@isomorph.ai/cli 0.10.10 → 0.11.0

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -120,7 +120,7 @@ Rules live beside this file: \`core.md\` before the first edit; \`integrations.m
 | "does it work?" (and before reporting anything as working) | open the dev link in your own browser, press the control you built or changed, read what the app shows; a green \`isomorph check\` is not that proof (fixtures answer AI and company systems). A Send in development is real: reuse explicit authorization or ask once. No browser: say the button is untested. |
 | "I need Slack / Gmail / the warehouse" | read \`integrations.md\` beside this skill first; then: catalog, write the call (literals only), \`isomorph check\`, then submit the request; say READY or PENDING in one line. |
 | "summarise", "draft", "AI" | read \`ai.md\` beside this skill first; then one call behind a control they press. |
-| "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). Give them \`result.deployment.protectedUrl\` and \`result.consoleUrl\` (its live checks). \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
+| "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). To give someone access later: add their email to \`audience\`, then \`isomorph share --app-root . --json\`, never \`deploy\`. Give them \`result.deployment.protectedUrl\` and \`result.consoleUrl\` (its live checks). \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
 | "make it live" | only after they have tried the preview: \`isomorph promote --operation <ref> --app-root . --confirm-tested --json\`. Report the production link, or that operator approval is pending. |
 | "stop it" | \`isomorph stop --app-root .\` (data kept); \`isomorph dev --app-root . --reset\` only when they ask to start over. |
 | "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first (follow its in-conversation owner approval steps); write the job, run it once with \`isomorph jobs run\`, and report what was verified. |

package/dist/packages/harbour-cli/src/auth.js

@@ -5,6 +5,15 @@ import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
 export const requestedOAuthScopes = "mcp";
+/**
+ * The loopback ports the company sign-in returns to. Cognito matches redirect
+ * URIs exactly and allows plain http only on loopback, so the port cannot be
+ * random: the platform registers exactly `http://127.0.0.1:<port>/callback`
+ * for these two on every company's client (the second is for a second
+ * `isomorph login` on the same machine). `ISOMORPH_LOGIN_PORT` names one other
+ * port, for an operator who registered it.
+ */
+export const CLI_LOGIN_PORTS = [47821, 47822];
 export function tokenStorePath(env = process.env) {
     return join(env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config"), "isomorph", "tokens.json");
 }
@@ -52,7 +61,10 @@ export async function clearStoredToken(mcpUrl, tenant, path = tokenStorePath())
         await rm(path, { force: true });
     return token;
 }
-export async function login(mcpUrl, tenant, output) {
+export async function login(mcpUrl, tenant, output, options = {}) {
+    if (options.login)
+        return cognitoLogin(mcpUrl, tenant, output, options.login, options);
+    const open = options.open ?? openBrowser;
     const metadata = await discover(mcpUrl);
     if (!metadata.registration_endpoint || !metadata.authorization_endpoint || !metadata.token_endpoint)
         throw new Error("Isomorph sign-in is not available on this endpoint yet.");
@@ -67,17 +79,52 @@ export async function login(mcpUrl, tenant, output) {
         const authorize = new URL(metadata.authorization_endpoint);
         authorize.search = new URLSearchParams({ response_type: "code", client_id: registered.client_id, redirect_uri: callback.redirectUri, scope: requestedOAuthScopes, state, resource: mcpUrl, code_challenge: challenge, code_challenge_method: "S256" }).toString();
         output("Isomorph is opening your browser to sign in.");
-        openBrowser(authorize.toString());
+        open(authorize.toString());
         output(`If it does not open, visit: ${authorize}`);
         const code = await callback.wait(state);
         const response = await token(metadata.token_endpoint, { grant_type: "authorization_code", client_id: registered.client_id, code, redirect_uri: callback.redirectUri, code_verifier: verifier });
-        await saveStoredToken(mcpUrl, tenant, { ...response, clientId: registered.client_id, tokenEndpoint: metadata.token_endpoint, ...(metadata.revocation_endpoint ? { revocationEndpoint: metadata.revocation_endpoint } : {}) });
+        await saveStoredToken(mcpUrl, tenant, { accessToken: response.accessToken, ...(response.refreshToken ? { refreshToken: response.refreshToken } : {}), ...(response.accessTokenExpiresAt ? { accessTokenExpiresAt: response.accessTokenExpiresAt } : {}), clientId: registered.client_id, tokenEndpoint: metadata.token_endpoint, ...(metadata.revocation_endpoint ? { revocationEndpoint: metadata.revocation_endpoint } : {}) }, options.path);
         output("Isomorph sign-in is complete.");
     }
     finally {
         callback.close();
     }
 }
+/**
+ * Sign-in to the company's own Cognito client, as the console does: the
+ * authorization-code + PKCE flow against the profile's endpoints, no dynamic
+ * registration, and the ID token kept as the bearer. Every governance route
+ * the CLI calls accepts it, including the maker routes the console uses
+ * (`share`), which the adapter's opaque token never reached.
+ */
+async function cognitoLogin(mcpUrl, tenant, output, login, options) {
+    const open = options.open ?? openBrowser;
+    const callback = await loopbackCallback(loginPorts(options.env ?? process.env));
+    try {
+        const verifier = randomBytes(32).toString("base64url");
+        const state = randomBytes(24).toString("base64url");
+        const challenge = createHash("sha256").update(verifier).digest("base64url");
+        const authorize = new URL(login.authorizationEndpoint);
+        authorize.search = new URLSearchParams({ response_type: "code", client_id: login.clientId, redirect_uri: callback.redirectUri, scope: login.scope, state, code_challenge: challenge, code_challenge_method: "S256" }).toString();
+        output("Isomorph is opening your browser to sign in.");
+        open(authorize.toString());
+        output(`If it does not open, visit: ${authorize}`);
+        const code = await callback.wait(state);
+        const response = await token(login.tokenEndpoint, { grant_type: "authorization_code", client_id: login.clientId, code, redirect_uri: callback.redirectUri, code_verifier: verifier });
+        if (!response.idToken)
+            throw new Error("Isomorph sign-in did not return an identity token.");
+        await saveStoredToken(mcpUrl, tenant, { kind: "cognito", accessToken: response.idToken, ...(response.refreshToken ? { refreshToken: response.refreshToken } : {}), ...(response.accessTokenExpiresAt ? { accessTokenExpiresAt: response.accessTokenExpiresAt } : {}), clientId: login.clientId, tokenEndpoint: login.tokenEndpoint, revocationEndpoint: `${new URL(login.tokenEndpoint).origin}/oauth2/revoke` }, options.path);
+        output("Isomorph sign-in is complete.");
+    }
+    finally {
+        callback.close();
+    }
+}
+/** The ports to try, in order: the operator's one, or the two the platform registers. */
+function loginPorts(env) {
+    const override = Number(env.ISOMORPH_LOGIN_PORT?.trim() || "");
+    return Number.isInteger(override) && override > 0 && override < 65_536 ? [override] : CLI_LOGIN_PORTS;
+}
 /**
  * The account this device is already signed in as, or undefined: a stored
  * token that still answers the userinfo endpoint. `login` stops here instead
@@ -107,8 +154,12 @@ export async function refreshStoredToken(mcpUrl, tenant, path = tokenStorePath()
         return stored.accessToken;
     try {
         const refreshed = await token(stored.tokenEndpoint, { grant_type: "refresh_token", client_id: stored.clientId, refresh_token: stored.refreshToken });
-        await saveStoredToken(mcpUrl, tenant, { ...stored, ...refreshed, refreshToken: refreshed.refreshToken ?? stored.refreshToken }, path);
-        return refreshed.accessToken;
+        // Cognito answers a refresh with a new ID token and access token and no refresh token: the stored one stays.
+        const bearer = stored.kind === "cognito" ? refreshed.idToken : refreshed.accessToken;
+        if (!bearer)
+            throw new Error("Isomorph sign-in did not return an identity token.");
+        await saveStoredToken(mcpUrl, tenant, { ...stored, accessToken: bearer, refreshToken: refreshed.refreshToken ?? stored.refreshToken, ...(refreshed.accessTokenExpiresAt ? { accessTokenExpiresAt: refreshed.accessTokenExpiresAt } : {}) }, path);
+        return bearer;
     }
     catch {
         const rotated = await loadStoredToken(mcpUrl, tenant, path);
@@ -126,6 +177,16 @@ export async function logout(mcpUrl, tenant, path = tokenStorePath()) {
     const stored = await clearStoredToken(mcpUrl, tenant, path);
     if (!stored?.revocationEndpoint)
         return;
+    if (stored.kind === "cognito") {
+        // Cognito's revoke takes the refresh token only (and revokes what was minted from it); the ID token expires on its own within the hour.
+        if (!stored.refreshToken)
+            return;
+        try {
+            await fetch(stored.revocationEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ token: stored.refreshToken, client_id: stored.clientId }), redirect: "error" });
+        }
+        catch { /* as below */ }
+        return;
+    }
     for (const [token, hint] of [[stored.refreshToken, "refresh_token"], [stored.accessToken, "access_token"]]) {
         if (!token)
             continue;
@@ -135,11 +196,21 @@ export async function logout(mcpUrl, tenant, path = tokenStorePath()) {
         catch { /* Local credentials are removed even if offline revocation cannot complete. */ }
     }
 }
-/** Email of the signed-in company account, from the OAuth userinfo endpoint beside the token endpoint; undefined when unavailable. */
+/**
+ * Email of the signed-in company account; undefined when unavailable. A Cognito
+ * record carries it in the ID token itself, read locally (Cognito's userinfo
+ * wants the access token, which is not kept; the server verifies the signature
+ * on every request, so the CLI only needs the label). An adapter record asks
+ * the OAuth userinfo endpoint beside the token endpoint.
+ */
 export async function connectedAccount(mcpUrl, tenant, accessToken, path = tokenStorePath()) {
     const stored = await loadStoredToken(mcpUrl, tenant, path);
     if (!stored)
         return undefined;
+    if (stored.kind === "cognito") {
+        const claims = idTokenClaims(accessToken);
+        return typeof claims?.email === "string" && typeof claims.exp === "number" && claims.exp * 1_000 > Date.now() ? claims.email : undefined;
+    }
     try {
         const response = await fetch(stored.tokenEndpoint.replace(/\/token$/, "/userinfo"), { headers: { authorization: `Bearer ${accessToken}` }, redirect: "error" });
         const body = response.ok ? await response.json() : {};
@@ -162,18 +233,48 @@ async function discover(mcpUrl) {
         throw new Error("Isomorph sign-in metadata is incomplete.");
     return { authorization_endpoint: metadata.authorization_endpoint, token_endpoint: metadata.token_endpoint, registration_endpoint: metadata.registration_endpoint, revocation_endpoint: metadata.revocation_endpoint ?? "" };
 }
+/** The payload of a JWT, decoded without verification; undefined for anything that is not one. */
+function idTokenClaims(token) {
+    try {
+        const payload = token.split(".")[1];
+        const claims = payload ? JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) : undefined;
+        return claims && typeof claims === "object" && !Array.isArray(claims) ? claims : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function token(endpoint, values) {
     const response = await json(endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(values), redirect: "error" });
     if (!response.access_token)
         throw new Error("Isomorph sign-in did not return an access token.");
-    return { accessToken: response.access_token, ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}), ...(typeof response.expires_in === "number" && response.expires_in > 0 ? { accessTokenExpiresAt: Date.now() + response.expires_in * 1_000 } : {}) };
+    return { accessToken: response.access_token, ...(response.id_token ? { idToken: response.id_token } : {}), ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}), ...(typeof response.expires_in === "number" && response.expires_in > 0 ? { accessTokenExpiresAt: Date.now() + response.expires_in * 1_000 } : {}) };
 }
 async function json(url, init) { const response = await fetch(url, { ...init, redirect: "error" }); if (!response.ok)
     throw new Error(`Isomorph sign-in request failed (${response.status}).`); return response.json(); }
 export function authorizationServerMetadataUrl(server) { return `${server.replace(/\/$/, "")}/.well-known/oauth-authorization-server`; }
-function validToken(value) { return Boolean(value && typeof value === "object" && typeof value.accessToken === "string" && typeof value.clientId === "string" && typeof value.tokenEndpoint === "string"); }
+function validToken(value) { return Boolean(value && typeof value === "object" && typeof value.accessToken === "string" && typeof value.clientId === "string" && typeof value.tokenEndpoint === "string" && (value.kind === undefined || value.kind === "cognito")); }
 function isMissing(error) { return Boolean(error && typeof error === "object" && error.code === "ENOENT"); }
-function loopbackCallback() {
+/**
+ * The local page the sign-in returns to. With `ports`, the first of them that is
+ * free is bound (the company client registers exactly those); with none, any
+ * free port (the adapter registers the CLI's redirect per sign-in).
+ */
+async function loopbackCallback(ports) {
+    if (!ports)
+        return listenCallback(0);
+    for (const port of ports) {
+        try {
+            return await listenCallback(port);
+        }
+        catch (error) {
+            if (error.code !== "EADDRINUSE")
+                throw error;
+        }
+    }
+    throw new Error(`Isomorph could not start local sign-in: ${ports.length > 1 ? `ports ${ports.join(" and ")} are both` : `port ${ports[0]} is`} in use. Another \`isomorph login\` may be running; finish or stop it, or set ISOMORPH_LOGIN_PORT to a port your Isomorph admin registered.`);
+}
+function listenCallback(port) {
     return new Promise((resolve, reject) => {
         const server = createServer();
         const timer = setTimeout(() => { server.close(); reject(new Error("Isomorph sign-in timed out. Run `isomorph login` again.")); }, 5 * 60_000);
@@ -186,7 +287,7 @@ function loopbackCallback() {
             if (code && state)
                 server.callback = { code, state };
         });
-        server.listen(0, "127.0.0.1", () => {
+        server.listen(port, "127.0.0.1", () => {
             const address = server.address();
             if (!address || typeof address === "string") {
                 reject(new Error("Isomorph could not start local sign-in."));
@@ -200,7 +301,7 @@ function loopbackCallback() {
                         done(callback.code); }, 25);
                 }), close: () => { clearTimeout(timer); server.close(); } });
         });
-        server.on("error", reject);
+        server.on("error", error => { clearTimeout(timer); reject(error); });
     });
 }
 export function openBrowser(url) { const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open"; const args = platform() === "win32" ? ["/c", "start", "", url] : [url]; const child = spawn(command, args, { detached: true, stdio: "ignore" }); child.unref(); child.on("error", () => { }); }

package/dist/packages/harbour-cli/src/cli.js

@@ -3,7 +3,7 @@ import { appCallsAi, deploy, readDeployNote } from "./deploy.js";
 import { continueCommand, follow, promoteToProduction, retryDeployment, statusFetch, summarize } from "./operations.js";
 import { CliError, failureEnvelope, operationEnvelope, renderFailure, renderSummary } from "./output.js";
 import { CLI_VERSION } from "./version.js";
-import { alreadySignedIn, connectedAccount, login, logout, openBrowser, refreshStoredToken } from "./auth.js";
+import { alreadySignedIn, connectedAccount, loadStoredToken, login, logout, openBrowser, refreshStoredToken } from "./auth.js";
 import { assertCliCurrent, CLI_INSTALL_COMMAND, cliStaleness, companyLabel, connect, loadConfig, resolveConfig } from "./config.js";
 import { EMBEDDED_KIT_BUNDLE } from "./kit-bundle.js";
 import { appRoot, assertLockCompany, readAppProfile, readKitLock, requestResourceName } from "./kit.js";
@@ -15,6 +15,7 @@ import { endProcess, installDependencies, LocalRuntime, readDevLock, releaseDevL
 import { CHECKS_FAILED_HINT, checksFailedMessage, runChecks } from "./check.js";
 import { connectIntegration, assertDeployReady, companySystemsLine, GovernanceClient, groupGrants, IDENTITY_WORDS, integrationsCatalog, integrationsStatus, renderGrantGroup, renderIntegrationsCatalog, requestIntegrations } from "./integrations.js";
 import { runJob } from "./jobs.js";
+import { renderShare, shareApp } from "./share.js";
 const args = process.argv.slice(2);
 // `productionise` (the command's name until 0.3.4) was an alias of `deploy` for one release; it is no longer a command and falls through to the usage error.
 const command = args[0];
@@ -62,6 +63,7 @@ const usage = [
     "  isomorph stop --app-root <path>                             stop this app's local services, keeping its database and files",
     "  isomorph check --app-root <path> [--integrations] [--json]  types, build, then the pipeline's kit gate in the local session: declaration, migrations + database gate, write probe with cross-user denial, journeys, operation coverage (+ authorised real reads)",
     "  isomorph deploy --app-root <path> [--session-notes <text>] [--no-wait] [--max-wait <seconds>] [--json]   deploy the private preview: name, description and audience come from .isomorph/app.json (--no-wait returns once Isomorph has the package, with the command that follows it)",
+    "  isomorph share --app-root <path> [--json]                   give the audience in .isomorph/app.json access to the deployed preview without a new release (deploy carries the audience too; share is for an audience-only change)",
     "  isomorph status [--app-root <path>] [--operation <reference>] [--wait] [--max-wait <seconds>] [--json]   (--app-root defaults to the current folder; --operation to the deployment last started from it)",
     "  isomorph retry [--app-root <path>] [--operation <reference>] [--no-wait] [--max-wait <seconds>] [--json]",
     "  isomorph promote [--app-root <path>] [--operation <reference>] [--confirm-tested] [--no-wait] [--max-wait <seconds>] [--json]   (--confirm-tested: the person has tried the preview; the company's AI setup is confirmed for production when the app calls governed AI)",
@@ -91,7 +93,7 @@ const emit = (value, line) => { process.stdout.write(json ? `${JSON.stringify(va
  */
 const exitAfterWriting = (code, out, err = "") => { process.stderr.write(err, () => process.stdout.write(out, () => process.exit(code))); };
 /** Exit 2, like a usage error: nothing started and the fix is a command the maker runs (or a file the maker edits). */
-const USAGE_REFUSALS = ["APP_EXISTS", "APP_UNSUPPORTED", "KIT_APP", "DEPLOY_BLOCKED", "INTEGRATIONS_NOT_READY", "AI_NOT_READY", "CLI_UPGRADE_REQUIRED", "KIT_BUNDLE_STALE", "NOT_A_MEMBER", "TENANT_AMBIGUOUS", "NOT_A_START_LINK", "PLATFORM_UNREACHABLE", "DEPLOY_IN_FLIGHT", "OPERATION_REQUIRED"];
+const USAGE_REFUSALS = ["APP_EXISTS", "APP_UNSUPPORTED", "KIT_APP", "DEPLOY_BLOCKED", "INTEGRATIONS_NOT_READY", "AI_NOT_READY", "CLI_UPGRADE_REQUIRED", "KIT_BUNDLE_STALE", "NOT_A_MEMBER", "TENANT_AMBIGUOUS", "NOT_A_START_LINK", "PLATFORM_UNREACHABLE", "DEPLOY_IN_FLIGHT", "OPERATION_REQUIRED", "INDIVIDUAL_SHARING_DISABLED", "EXTERNAL_EMAIL_NOT_ALLOWED", "INVALID_SHARE_EMAILS"];
 if (command === "--version" || command === "version") {
     process.stdout.write(`${CLI_VERSION}\n`);
     // `-h` was matched anywhere in argv while `--help` was only recognised as the
@@ -112,10 +114,10 @@ else if (command === "agent-setup") {
     progress("Claude Code and Codex: the `isomorph` skill is installed. Each agent uses it only for an Isomorph app (a folder with .isomorph/, or an app you ask it to build) and works as usual everywhere else. Say what you want to build; the agent installs and runs the kit itself.");
     emit(summaryEnvelope({ ...result, paths: agentPaths(process.env) }));
 }
-else if (!["connect", "login", "logout", "deploy", "integrations", ...LOCAL_COMMANDS, ...OPERATION_COMMANDS].includes(command)
+else if (!["connect", "login", "logout", "deploy", "share", "integrations", ...LOCAL_COMMANDS, ...OPERATION_COMMANDS].includes(command)
     || (command === "connect" && (!connectUrl || connectUrl.startsWith("--")))
     || (["deploy", "integrations", ...OPERATION_COMMANDS].includes(command) && optionError)
-    || (command === "deploy" && !root)
+    || ((command === "deploy" || command === "share") && !root)
     || (LOCAL_COMMANDS.includes(command) && !root)
     || (command === "jobs" && (subcommand !== "run" || !args[2] || args[2].startsWith("--")))
     || (command === "integrations" && (!root || !subcommand || !["request", "status", "catalog", "connect"].includes(subcommand) || (["request", "connect"].includes(subcommand) && (!args[2] || args[2].startsWith("--")))))) {
@@ -228,9 +230,14 @@ else {
                 // every unattended builder five minutes (auth.ts loopbackCallback), and
                 // when the sign-in could not complete, agents escalated to `logout`
                 // — which signs the whole machine out (bench, 2026-09-16).
-                const already = await alreadySignedIn(url, tenant);
+                // A device still holding the adapter's token for a company that now
+                // signs the CLI in through its own Cognito client (0.11.0) re-signs:
+                // that token cannot open the console's routes (`share`), and "already
+                // signed in" would send the agent to `logout` to switch.
+                const stale = Boolean(config.login) && (await loadStoredToken(url, tenant))?.kind !== "cognito";
+                const already = stale ? undefined : await alreadySignedIn(url, tenant);
                 if (!already)
-                    await login(url, tenant, progress);
+                    await login(url, tenant, progress, { ...(config.login ? { login: config.login } : {}) });
                 else
                     progress(`Already signed in to ${companyLabel(config)} as ${already}; nothing to do. Run \`isomorph logout\` first to sign in as someone else.`);
                 const signedIn = await signedInDetails(config);
@@ -248,7 +255,15 @@ else {
                 // The client re-resolves per request so a token rotated by a sibling process mid-poll is picked up.
                 const governance = new GovernanceClient(config.apiUrl, resolveToken, tenant);
                 let envelope;
-                if (command === "integrations") {
+                /** The human form, for a command whose result is a sentence rather than a summary. */
+                let line;
+                if (command === "share") {
+                    // An explicit ISOMORPH_TOKEN is the operator's to vouch for; a stored record must be the company sign-in.
+                    const shared = await shareApp(appRoot(root), governance, tenant, EMBEDDED_KIT_BUNDLE, explicitToken ? undefined : (await loadStoredToken(url, tenant)) ?? {});
+                    envelope = summaryEnvelope(shared.outcome);
+                    line = renderShare(shared.audience);
+                }
+                else if (command === "integrations") {
                     const target = appRoot(root);
                     const result = subcommand === "connect"
                         ? await connectIntegration(target, governance, args[2], optionValue("--return-url"))
@@ -295,7 +310,7 @@ else {
                     }
                     envelope = operationEnvelope(summary, ref, CLI_VERSION);
                 }
-                process.stdout.write(json ? `${JSON.stringify(envelope)}\n` : renderSummary(envelope));
+                emit(envelope, line);
             }
         }
     }

package/dist/packages/harbour-cli/src/config.js

@@ -121,6 +121,7 @@ export async function connect(startUrl, path = configPath(), fetchImpl = fetch)
     if (body.schema !== "harbour.tenant-start/1.0")
         throw new Error("This is not an Isomorph connection profile.");
     const minimum = minimumCliVersion(body);
+    const login = tenantLogin(body);
     const config = {
         schema: "isomorph.cli-config/1.0",
         tenantId: String(body.tenantId ?? ""),
@@ -128,7 +129,8 @@ export async function connect(startUrl, path = configPath(), fetchImpl = fetch)
         mcpUrl: String(body.mcpUrl ?? ""),
         ...(typeof body.uploadUrl === "string" ? { uploadUrl: body.uploadUrl } : {}),
         ...(typeof body.apiUrl === "string" ? { apiUrl: body.apiUrl } : {}),
-        ...(minimum ? { minimumCliVersion: minimum } : {})
+        ...(minimum ? { minimumCliVersion: minimum } : {}),
+        ...(login ? { login } : {})
     };
     if (!validConfig(config))
         throw new Error("This is not the expected Isomorph connection profile.");
@@ -140,6 +142,20 @@ function minimumCliVersion(body) {
     const kit = isRecord(body.kit) ? body.kit : undefined;
     return typeof kit?.minimumCliVersion === "string" && kit.minimumCliVersion.trim() ? kit.minimumCliVersion.trim() : undefined;
 }
+/** The `login` block of a tenant-start profile, verbatim; undefined when absent or incomplete (the adapter path stands then). */
+function tenantLogin(body) {
+    const login = body.login;
+    if (!validLogin(login))
+        return undefined;
+    return { clientId: login.clientId, authorizationEndpoint: login.authorizationEndpoint, tokenEndpoint: login.tokenEndpoint, ...(typeof login.issuer === "string" ? { issuer: login.issuer } : {}), scope: login.scope };
+}
+function validLogin(value) {
+    return isRecord(value) && typeof value.clientId === "string" && value.clientId.length > 0
+        && typeof value.authorizationEndpoint === "string" && /^https?:\/\//.test(value.authorizationEndpoint)
+        && typeof value.tokenEndpoint === "string" && /^https?:\/\//.test(value.tokenEndpoint)
+        && (value.issuer === undefined || typeof value.issuer === "string")
+        && typeof value.scope === "string" && value.scope.length > 0;
+}
 function platformOrigin() {
     return process.env.ISOMORPH_PLATFORM_URL?.trim() || "https://platform.isomorph.ai";
 }
@@ -179,7 +195,7 @@ export function resolveConfig(env, saved) {
     if (!mcpUrl || !tenantId)
         return undefined;
     // The saved name belongs to the saved tenant; an ISOMORPH_TENANT override names another company.
-    return { schema: "isomorph.cli-config/1.0", tenantId, ...(saved?.displayName && tenantId === saved.tenantId ? { displayName: saved.displayName } : {}), mcpUrl, ...(saved?.uploadUrl ? { uploadUrl: saved.uploadUrl } : {}), apiUrl: env.ISOMORPH_API_URL?.trim() || saved?.apiUrl || apiUrlFromMcpUrl(mcpUrl), ...(saved?.minimumCliVersion && tenantId === saved.tenantId ? { minimumCliVersion: saved.minimumCliVersion } : {}) };
+    return { schema: "isomorph.cli-config/1.0", tenantId, ...(saved?.displayName && tenantId === saved.tenantId ? { displayName: saved.displayName } : {}), mcpUrl, ...(saved?.uploadUrl ? { uploadUrl: saved.uploadUrl } : {}), apiUrl: env.ISOMORPH_API_URL?.trim() || saved?.apiUrl || apiUrlFromMcpUrl(mcpUrl), ...(saved?.minimumCliVersion && tenantId === saved.tenantId ? { minimumCliVersion: saved.minimumCliVersion } : {}), ...(saved?.login && tenantId === saved.tenantId ? { login: saved.login } : {}) };
 }
 /** The company as the CLI names it: `Fourier (fourier)`, or the id twice when the profile carried no name. */
 export function companyLabel(config) {
@@ -202,7 +218,8 @@ function validConfig(value) {
         && /^https?:\/\//.test(value.mcpUrl)
         && (value.uploadUrl === undefined || typeof value.uploadUrl === "string")
         && (value.apiUrl === undefined || (typeof value.apiUrl === "string" && /^https?:\/\//.test(value.apiUrl)))
-        && (value.minimumCliVersion === undefined || typeof value.minimumCliVersion === "string"));
+        && (value.minimumCliVersion === undefined || typeof value.minimumCliVersion === "string")
+        && (value.login === undefined || validLogin(value.login)));
 }
 function isRecord(value) {
     return Boolean(value && typeof value === "object" && !Array.isArray(value));

package/dist/packages/harbour-cli/src/integrations.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { basename } from "node:path";
 import { linkIdempotencyKey, readDeclaration, readKitLock, readReviewedAppProfile, requestResourceName, requestResources, writeKitLock, newKitLock } from "./kit.js";
 import { CliError } from "./output.js";
@@ -74,8 +75,18 @@ export class GovernanceClient {
     retryDeployment(appId, operationRef) {
         return this.call("POST", `${deployments(appId)}/${encodeURIComponent(operationRef)}/retry`, {});
     }
-    async call(method, path, body) {
-        return (await this.exchange(method, path, body)).data;
+    /**
+     * Who may open the app: the console's own audience route, called with the
+     * company sign-in (a Cognito ID token) this CLI holds since 0.11.0. It changes
+     * the access policy only — no release. The route's refusals are a bare
+     * `{ error: "<code>" }`, unlike the `/v1/development/*` envelope, and a
+     * 401 is the gateway refusing a token of the old adapter kind.
+     */
+    share(appId, emails) {
+        return this.call("PUT", `/v1/maker/${encodeURIComponent(this.tenantId)}/apps/${encodeURIComponent(appId)}/access`, { emails }, { headers: { "x-harbour-idempotency-key": randomUUID() }, refusals: SHARE_REFUSALS, unauthorized: SHARE_SIGN_IN });
+    }
+    async call(method, path, body, options) {
+        return (await this.exchange(method, path, body, options)).data;
     }
     /**
      * One request, with governance's refusal carried whole: its code (or category,
@@ -85,26 +96,40 @@ export class GovernanceClient {
      * 5xx are named as such (`GOVERNANCE_UNREACHABLE`, `HTTP_5xx`) so a long poll
      * can tell a transient fault from a refusal; see `waitForSettled`.
      */
-    async exchange(method, path, body) {
+    async exchange(method, path, body, options = {}) {
         const url = `${this.apiUrl.replace(/\/$/, "")}${path}`;
-        let response = await this.send(url, method, body);
+        let response = await this.send(url, method, body, options.headers);
         if (response.status === 401)
-            response = await this.send(url, method, body);
+            response = await this.send(url, method, body, options.headers);
         const parsed = await response.json().catch(() => ({}));
         if (response.status === 401)
-            throw new CliError("AUTH_REQUIRED", "Please sign in to Isomorph with `isomorph login`.", undefined, undefined, undefined, { layer: "governance" });
+            throw new CliError("AUTH_REQUIRED", options.unauthorized ?? "Please sign in to Isomorph with `isomorph login`.", undefined, undefined, undefined, { layer: "governance" });
+        // The maker routes (the console's) refuse with `{ error: "<code>" }` and no sentence: the CLI's own words for each code.
+        if (!response.ok && typeof parsed.error === "string")
+            throw new CliError(parsed.error.toUpperCase(), options.refusals?.[parsed.error] ?? "Isomorph governance rejected the request.", undefined, undefined, undefined, { layer: "governance" });
         if (!response.ok) {
-            const { code, remediationHint, ...details } = parsed.error?.details ?? {};
-            throw new CliError(code ?? parsed.error?.category ?? `HTTP_${response.status}`, parsed.error?.message || "Isomorph governance rejected the request.", undefined, typeof remediationHint === "string" && remediationHint.trim() ? remediationHint.trim() : undefined, undefined, { layer: "governance", ...(Object.keys(details).length ? { details } : {}) });
+            const failure = typeof parsed.error === "object" ? parsed.error : undefined;
+            const { code, remediationHint, ...details } = failure?.details ?? {};
+            throw new CliError(code ?? failure?.category ?? `HTTP_${response.status}`, failure?.message || "Isomorph governance rejected the request.", undefined, typeof remediationHint === "string" && remediationHint.trim() ? remediationHint.trim() : undefined, undefined, { layer: "governance", ...(Object.keys(details).length ? { details } : {}) });
         }
         return { status: response.status, data: (parsed.data ?? parsed) };
     }
-    async send(url, method, body) {
+    async send(url, method, body, headers = {}) {
         const token = await this.token();
-        return this.fetchImpl(url, { method, headers: { ...(token ? { authorization: `Bearer ${token}` } : {}), "x-harbour-tenant": this.tenantId, accept: "application/json", ...(body ? { "content-type": "application/json" } : {}) }, ...(body ? { body: JSON.stringify(body) } : {}), redirect: "error" })
+        return this.fetchImpl(url, { method, headers: { ...(token ? { authorization: `Bearer ${token}` } : {}), "x-harbour-tenant": this.tenantId, accept: "application/json", ...(body ? { "content-type": "application/json" } : {}), ...headers }, ...(body ? { body: JSON.stringify(body) } : {}), redirect: "error" })
             .catch((error) => { throw new CliError("GOVERNANCE_UNREACHABLE", `Isomorph governance at ${new URL(url).host} could not be reached: ${transportFailure(error)}.`); });
     }
 }
+/** The console's refusals of an audience change, in the words it shows (makerAppActionPlainEnglish). */
+export const SHARE_REFUSALS = {
+    app_access_not_owned: "Only the builder who registered this app can change it.",
+    individual_sharing_disabled: "This company has not enabled sharing apps with named colleagues. Confirm an empty audience, or ask an administrator.",
+    external_email_not_allowed: "Only email addresses on the company's approved domains can be given access.",
+    invalid_share_emails: "Audience must be a list of up to 100 company email addresses.",
+    app_not_found: "Isomorph has no registered app for this operation."
+};
+/** A 401 from the audience route, or a stored sign-in of the adapter kind: the maker routes take only the company sign-in. */
+export const SHARE_SIGN_IN = "Sign in again with `isomorph login`: sharing needs the company sign-in this CLI now uses.";
 const deployments = (appId) => `/v1/development/apps/${encodeURIComponent(appId)}/deployments`;
 /**
  * What actually failed under a `fetch` rejection. undici reports every transport

package/dist/packages/harbour-cli/src/share.js

@@ -0,0 +1,25 @@
+import { describeProfile } from "./deploy.js";
+import { ensureLinkedApp, SHARE_SIGN_IN } from "./integrations.js";
+import { assertLockCompany, readKitLock, readReviewedAppProfile } from "./kit.js";
+import { CliError } from "./output.js";
+/**
+ * `isomorph share`: the audience in `.isomorph/app.json`, sent as the app's
+ * access policy without a release. `deploy` carries the same audience with the
+ * package; this is the path for the builder who only changed who may open the
+ * app. The route is the console's, behind the company sign-in: a record of the
+ * adapter kind is refused here, before the network, rather than by a 401.
+ */
+export async function shareApp(root, governance, tenantId, bundle, signedIn) {
+    if (signedIn && signedIn.kind !== "cognito")
+        throw new CliError("AUTH_REQUIRED", SHARE_SIGN_IN, undefined, "Run `isomorph logout` then `isomorph login`.");
+    const profile = await readReviewedAppProfile(root);
+    assertLockCompany(await readKitLock(root), tenantId);
+    const appId = await ensureLinkedApp(root, governance, tenantId, bundle);
+    const outcome = await governance.share(appId, profile.audience);
+    return { audience: profile.audience, outcome };
+}
+/** The audience line `deploy` prints, then what did (and did not) happen. */
+export function renderShare(audience) {
+    const line = describeProfile({ schema: "isomorph.app/1.0", name: "", description: "", audience }).find(entry => entry.startsWith("Audience:"));
+    return `${line}\nIsomorph updated who can open the preview; no new release was made.\n`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.10.10",
+  "version": "0.11.0",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {