@isomorph.ai/cli 0.10.4 → 0.10.6

package/README.md

@@ -56,3 +56,17 @@ There are two ways onto Isomorph and `init` is where the folder decides. An empt
 Built from the [governance control plane](https://github.com/Fourier-Labs-AI/harbour-governance-control-plane) repository: `npm ci`, `npm run build --prefix packages/harbour-cli`, tests in `tests/cli-kit.test.ts` and `tests/cli-packaging-contract.test.ts`. Merge is release (`docs/adr/0021`): a PR that bumps the version in `packages/harbour-cli/package.json` — the one file that carries it; `src/version.ts` reads it at runtime — is tagged `cli-v<version>` by `CLI release automation` the moment it lands on `main`, and `Release Isomorph CLI` publishes that version under `latest` through npm trusted publishing. A version that already exists on npm is never republished. A prerelease (`X.Y.Z-rc.N`) publishes under `candidate` and is never required. When the release embeds a new kit bundle, bump `harbour.kitBundle.version` in the same PR and run `npm run kit-bundle:sync` there: it regenerates the embedded manifest and the server's `src/kit-bundle-expectation.generated.ts` from one fetch. 0.2.0 and 0.2.1 (the rename) were published by hand from their merge commits before the trusted publisher existed for `@isomorph.ai/cli`, which is why their `cli-v` release runs show red.
 
 Connect with `isomorph connect name@getlokal.com`: the CLI asks the platform which company admits the email's domain (`https://platform.isomorph.ai/start/getlokal.com.json` — the same policies that admit the person at sign-in) and saves that company's profile. Only the domain is sent, not the email. When no company admits the domain, or more than one does, the CLI prints the platform's sentence (ask IT, or run the printed `isomorph connect <link>`) and saves nothing; a company's console page (`platform.isomorph.ai/t/<company>`) is accepted as the link. `isomorph login` then prints the company it signed in to and what IT has set up there. Company sign-in and access checks still apply.
+
+### Owner-authorised background integrations
+
+Read `isomorph integrations status --app-root . --json` for `consents`: the caller's connected
+accounts and per-environment background flags. Include background use of the account by the app
+in the setup approval, naming the account and environment; reuse explicit approval already given.
+Then run `isomorph integrations request <connection> --app-root . --allow-background preview --json`
+and verify status. Omit the flag for ordinary requests. This records consent on the existing link;
+it neither approves IT access nor sends a message. The existing console control can revoke it.
+
+If the account needs connecting, use `integrations connect <connection> --app-root .
+--return-url <dev-origin>/_harbour/integrations/oauth/complete --json` and follow `nextStep`.
+Run `isomorph agent-setup` after updating the CLI to refresh the AI instructions; `init` also
+installs them. No new endpoint, login, runtime or SDK change is needed.

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -123,7 +123,7 @@ Rules live beside this file: \`core.md\` before the first edit; \`integrations.m
 | "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). Give them \`result.deployment.protectedUrl\`. \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
 | "make it live" | only after they have tried the preview: \`isomorph promote --operation <ref> --app-root . --confirm-tested --json\`. Report the production link, or that operator approval is pending. |
 | "stop it" | \`isomorph stop --app-root .\` (data kept); \`isomorph dev --app-root . --reset\` only when they ask to start over. |
-| "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first (the owner must enable background use of their account); write the job, run it once with \`isomorph jobs run\`, and say its sentence. |
+| "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first (follow its in-conversation owner approval steps); write the job, run it once with \`isomorph jobs run\`, and report what was verified. |
 | "call this API", "a key for it", "run it in the background" | read \`server.md\` beside this skill first; server code goes in \`actions/\` or \`jobs/\`, a key by its name only. |
 
 A refusal names its layer, its reason and its fix: change that one thing, then run it again. A wait timeout is not a failure — work is still running: run the command it prints (\`${continueCommand("<ref>")}\`); never start a second deploy while one is running.

package/dist/packages/harbour-cli/src/cli.js

@@ -13,7 +13,7 @@ import { agentPaths, agentSetup } from "./agent-setup.js";
 import { detachDev, startDev } from "./dev.js";
 import { endProcess, installDependencies, LocalRuntime, readDevLock, releaseDevLock, runCommand } from "./local-runtime.js";
 import { CHECKS_FAILED_HINT, checksFailedMessage, runChecks } from "./check.js";
-import { assertDeployReady, companySystemsLine, GovernanceClient, groupGrants, IDENTITY_WORDS, integrationsCatalog, integrationsStatus, renderGrantGroup, renderIntegrationsCatalog, requestIntegrations } from "./integrations.js";
+import { connectIntegration, assertDeployReady, companySystemsLine, GovernanceClient, groupGrants, IDENTITY_WORDS, integrationsCatalog, integrationsStatus, renderGrantGroup, renderIntegrationsCatalog, requestIntegrations } from "./integrations.js";
 import { runJob } from "./jobs.js";
 const args = process.argv.slice(2);
 // `productionise` (the command's name until 0.3.4) was an alias of `deploy` for one release; it is no longer a command and falls through to the usage error.
@@ -39,6 +39,7 @@ const out = optionValue("--out");
 const testIntegrations = args.includes("--integrations");
 const reason = optionValue("--reason");
 const operations = optionValue("--operations");
+const allowBackground = optionValue("--allow-background");
 const scheduledAt = optionValue("--scheduled-at");
 const realJob = args.includes("--real");
 /** Seconds `deploy`, `status --wait`, `retry` and `promote` follow the operation before reporting it as still running (default: 30 minutes). */
@@ -47,6 +48,8 @@ const waitOptions = maxWaitSeconds ? { maxWaitMs: maxWaitSeconds * 1000 } : {};
 let optionError;
 if (maxWaitSeconds !== undefined && !(Number.isInteger(maxWaitSeconds) && maxWaitSeconds > 0))
     optionError = "--max-wait takes a whole number of seconds.";
+if (args.includes("--allow-background") && !["development", "preview", "production"].includes(allowBackground ?? ""))
+    optionError = "--allow-background takes development, preview or production.";
 const explicitToken = process.env.ISOMORPH_TOKEN?.trim() ?? "";
 const usage = [
     "Usage:",
@@ -63,7 +66,8 @@ const usage = [
     "  isomorph retry [--app-root <path>] [--operation <reference>] [--no-wait] [--max-wait <seconds>] [--json]",
     "  isomorph promote [--app-root <path>] [--operation <reference>] [--confirm-tested] [--no-wait] [--max-wait <seconds>] [--json]   (--confirm-tested: the person has tried the preview; the company's AI setup is confirmed for production when the app calls governed AI)",
     "  isomorph jobs run <name> --app-root <path> [--scheduled-at <UTC>] [--real] [--json]  run one scheduled job now (local fixtures; --real uses approved company access)",
-    "  isomorph integrations request <connection> --app-root <path> [--reason <text>] [--operations a,b] [--json]   one request per connection, for every environment at once: IT approves it once (isomorph dev and deploy file it for you)",
+    "  isomorph integrations request <connection> --app-root <path> [--reason <text>] [--operations a,b] [--allow-background <development|preview|production>] [--json]   one request per connection, for every environment at once: IT approves it once (isomorph dev and deploy file it for you)",
+    "  isomorph integrations connect <connection> --app-root <path> [--return-url <local-app-url>] [--json]  connect the signed-in account; returns provider authorizationUrl when needed",
     "  isomorph integrations status --app-root <path> [--json]",
     "  isomorph integrations catalog --app-root <path> [--json]   the company's connections as .isomorph/integrations.json names them: identifiers, allowed operations, approved channels/tables/views/mailboxes per environment (no app needed)",
     "Run `isomorph connect <work-email>` once; sign in with `isomorph login` when Isomorph asks.",
@@ -110,11 +114,11 @@ else if (command === "agent-setup") {
 }
 else if (!["connect", "login", "logout", "deploy", "integrations", ...LOCAL_COMMANDS, ...OPERATION_COMMANDS].includes(command)
     || (command === "connect" && (!connectUrl || connectUrl.startsWith("--")))
-    || (["deploy", ...OPERATION_COMMANDS].includes(command) && optionError)
+    || (["deploy", "integrations", ...OPERATION_COMMANDS].includes(command) && optionError)
     || (command === "deploy" && !root)
     || (LOCAL_COMMANDS.includes(command) && !root)
     || (command === "jobs" && (subcommand !== "run" || !args[2] || args[2].startsWith("--")))
-    || (command === "integrations" && (!root || !subcommand || !["request", "status", "catalog"].includes(subcommand) || (subcommand === "request" && (!args[2] || args[2].startsWith("--")))))) {
+    || (command === "integrations" && (!root || !subcommand || !["request", "status", "catalog", "connect"].includes(subcommand) || (["request", "connect"].includes(subcommand) && (!args[2] || args[2].startsWith("--")))))) {
     exitAfterWriting(2, "", `${optionError ? `${optionError}\n` : ""}${usage}`);
 }
 else {
@@ -246,14 +250,20 @@ else {
                 let envelope;
                 if (command === "integrations") {
                     const target = appRoot(root);
-                    const result = subcommand === "status"
-                        ? await integrationsStatus(target, governance)
-                        : subcommand === "catalog"
-                            ? await integrationsCatalog(governance)
-                            : await requestIntegrations(target, governance, tenant, EMBEDDED_KIT_BUNDLE, { connection: args[2], ...(reason ? { reason } : {}), operations: operations?.split(",").map(value => value.trim()).filter(Boolean) });
+                    const result = subcommand === "connect"
+                        ? await connectIntegration(target, governance, args[2], optionValue("--return-url"))
+                        : subcommand === "status"
+                            ? await integrationsStatus(target, governance)
+                            : subcommand === "catalog"
+                                ? await integrationsCatalog(governance)
+                                : await requestIntegrations(target, governance, tenant, EMBEDDED_KIT_BUNDLE, { connection: args[2], ...(reason ? { reason } : {}), operations: operations?.split(",").map(value => value.trim()).filter(Boolean), allowBackground });
                     envelope = summaryEnvelope(result);
-                    if (!json)
-                        progress(subcommand === "status" ? renderIntegrationsStatus(result) : subcommand === "catalog" ? renderIntegrationsCatalog(result) : renderRequest(result));
+                    if (!json) {
+                        if ("nextStep" in result)
+                            progress([result.authorizationUrl, result.nextStep].filter(Boolean).join("\n"));
+                        else
+                            progress(subcommand === "status" ? renderIntegrationsStatus(result) : subcommand === "catalog" ? renderIntegrationsCatalog(result) : renderRequest(result));
+                    }
                 }
                 else if (command === "deploy") {
                     const result = await deploy(root, governance, progress, tenant, { waitForDeployment: !noWait, waitOptions, bundle: EMBEDDED_KIT_BUNDLE, ...(sessionNotes ? { sessionNotes } : {}) });
@@ -299,6 +309,8 @@ function renderIntegrationsStatus(status) {
     if (!status.linked)
         return "This app is not linked yet; `isomorph dev` (signed in) or `isomorph integrations request` links it.";
     const lines = [`App ${status.appId}`, ...groupGrants(status.grants).flatMap(group => renderGrantGroup(group).map(line => `  ${line}`))];
+    for (const consent of status.consents ?? [])
+        lines.push(`  ${consent.connection} (${consent.environment}): ${consent.accountLabel ?? "your account"}, ${consent.status}, background ${consent.backgroundAllowed ? "allowed" : "off"}`);
     for (const request of status.requests)
         lines.push(`  request ${request.requestId}: ${request.state}${request.reason ? ` (${request.reason})` : ""}`);
     if (!status.grants.length && !status.requests.length)
@@ -306,7 +318,7 @@ function renderIntegrationsStatus(status) {
     return lines.join("\n");
 }
 function renderRequest(result) {
-    return [`App ${result.appId}: ${result.connection}`, ...result.requests.map(item => `  ${IDENTITY_WORDS[item.identityMode]} — ${item.operations.join(", ")} on ${item.resources.map(requestResourceName).join(", ")}${item.presentation ? ` (posts as "${item.presentation.displayName}")` : ""}: ${item.state} — ${item.summary}`)].join("\n");
+    return [`App ${result.appId}: ${result.connection}`, ...result.requests.map(item => `  ${IDENTITY_WORDS[item.identityMode]} — ${item.operations.join(", ")} on ${item.resources.map(requestResourceName).join(", ")}${item.presentation ? ` (posts as "${item.presentation.displayName}")` : ""}: ${item.state} — ${item.summary}${item.backgroundConsent ? `; background allowed in ${item.backgroundConsent.environment}` : ""}`)].join("\n");
 }
 /**
  * Who signed in and what IT has set up, for the line after `login`; undefined

package/dist/packages/harbour-cli/src/guide.js

@@ -91,13 +91,16 @@ const reply = await isomorph.ai.chat({ messages: [{ role: "user", content: \`Sum
 The starter calls no AI; add the one call when the person asks. The check's generated ai journey makes a real governed call locally through the development route with your \`isomorph login\`; in the pipeline it is answered by a canned completion and reported as not tested.`,
     jobs: `# Scheduled jobs
 
-A job runs as the app. It may use Gmail or user-mode Slack after the app owner explicitly enables background use of their connected account for that app and environment. Without that permission, user-mode calls are refused.
+Jobs run as the app. Gmail and user-mode Slack require the current owner's connected account, an approved integration grant and explicit background permission in each environment. App-mode Slack needs no personal background consent.
 
-Scheduled work lives only in \`jobs/<name>.ts\`: export one literal UTC cron as \`schedule\` and one default async handler. Never use \`setInterval\`, an effect or a browser timer as a scheduler; Isomorph runs the same declaration automatically after deployment on the app's server process, which owns the real clock. A job may call \`isomorph.ai.chat\` and approved company operations. A job with no \`schedule\` runs only when enqueued (server.md). Test it immediately: start \`isomorph dev\`, then \`isomorph jobs run <name> --app-root . --scheduled-at <matching-UTC-time> --json\` — local data, canned AI, company systems refused, nothing sent. Use \`--real\` only when the person explicitly asks to test the company action now and the exact action has development approval.
+Write \`jobs/<name>.ts\` with one literal UTC cron as \`schedule\` and a default async handler. Never use \`setInterval\`, an effect or a browser timer: the deployed app server owns the clock. Jobs can call approved company operations and \`isomorph.ai.chat\`; without a schedule they run only when enqueued (server.md). Use a deterministic idempotency key per business period and destination.
 
-A real scheduled send requires the app owner to enable background use of their account, the operation and resource declared in \`.isomorph/integrations.json\`, and a grant for that environment; use one deterministic idempotency key for the business period and destination so a replay does not silently repost.
+For personal background access:
+1. Run \`isomorph integrations status --app-root . --json\`; inspect \`consents\` for the connected account and per-environment \`backgroundAllowed\`.
+2. If connection is missing or needs reconnecting, run \`isomorph dev\`, then \`isomorph integrations connect <connection> --app-root . --return-url <origin>/_harbour/integrations/oauth/complete --json\`. Follow \`nextStep\`; the person completes provider consent if required.
+3. Include use of this account by this app's background code in the setup approval, naming the account and environment. Reuse explicit approval already given; no separate approval step. Then run \`isomorph integrations request <connection> --app-root . --allow-background <development|preview|production> --json\` and verify status. Do not send the person to the Admin console. Omit the flag when background use was not authorised.
 
-Tell them: "Your scheduled task is ready. I can test the app on your computer now. Company messages will start after the app is online and access is approved."`,
+Test with \`isomorph jobs run <name> --app-root . --scheduled-at <matching-UTC-time> --json\`: local data, canned AI, company systems refused, nothing sent. Add \`--real\` only for an explicitly requested immediate test with development approval and background consent. Permission alone does not deploy the job; verify deployment and actual delivery before calling the schedule active.`,
     server: `# Server code: actions, queued runs, outside APIs
 
 Isomorph runs one server process for the app, started by \`isomorph dev\`, the check and the deployment. It serves \`actions/<name>.ts\` and \`jobs/<name>.ts\`; both use the same \`isomorph\` client and nothing else — no database driver, no \`process.env.DATABASE_URL\`, no HTTP framework.

package/dist/packages/harbour-cli/src/integrations.js

@@ -29,6 +29,9 @@ export class GovernanceClient {
     catalog() {
         return this.call("GET", `/v1/development/integrations/catalog?tenantId=${encodeURIComponent(this.tenantId)}`);
     }
+    connectIntegration(appId, connection, returnUrl) {
+        return this.call("POST", `/v1/development/apps/${encodeURIComponent(appId)}/integrations/connect`, { connection, ...(returnUrl ? { returnUrl } : {}) });
+    }
     execute(appId, body) {
         return this.call("POST", `/v1/development/apps/${encodeURIComponent(appId)}/integrations/execute`, body);
     }
@@ -141,11 +144,14 @@ export const IDENTITY_WORDS = { app: "as the company bot", user: "as the signed-
 /** A refusal about the leg rather than the ask — signed out, unreachable, an answer with no code — is nobody's ask and stops the run. */
 const legFailure = (code) => code === "AUTH_REQUIRED" || code === "GOVERNANCE_UNREACHABLE" || code.startsWith("HTTP_");
 /** One request per identity mode of the connection. A refusal of an ask is returned beside the others, not thrown, so a caller can report every connection at once. */
-async function submitRequests(client, appId, declaration, root, connection, app, reason, only) {
+async function submitRequests(client, appId, declaration, root, connection, app, reason, only, allowBackground) {
     return Promise.all(requestScope(declaration, connection, only).map(async (part) => {
         const ask = { connection, ...part };
         try {
-            return { ...ask, outcome: await client.request(appId, { connection, identityMode: part.identityMode, operations: part.operations, resources: part.resources, ...(part.presentation ? { presentation: part.presentation } : {}), ...(reason?.trim() ? { reason: reason.trim() } : {}), app }) };
+            const outcome = await client.request(appId, { connection, identityMode: part.identityMode, operations: part.operations, resources: part.resources, ...(part.presentation ? { presentation: part.presentation } : {}), ...(reason?.trim() ? { reason: reason.trim() } : {}), app, ...(allowBackground && part.identityMode === "user" ? { allowBackground } : {}) });
+            if (allowBackground && part.identityMode === "user" && (outcome.backgroundConsent?.environment !== allowBackground || outcome.backgroundConsent.backgroundAllowed !== true))
+                throw new CliError("BACKGROUND_NOT_CONFIRMED", "The server did not confirm background permission. Check integrations status before reporting it enabled.");
+            return { ...ask, outcome };
         }
         catch (error) {
             const refusal = unregisteredResourceGuidance(error, declaration, connection, root);
@@ -192,9 +198,11 @@ export async function fileDeclaredRequests(root, client, tenantId, bundle) {
  */
 export async function requestIntegrations(root, client, tenantId, bundle, options) {
     const declaration = await readDeclaration(root);
+    if (options.allowBackground !== undefined && (!ENVIRONMENTS.includes(options.allowBackground) || !requestScope(declaration, options.connection, options.operations).some(part => part.identityMode === "user")))
+        throw new CliError("INPUT_INVALID", "--allow-background requires user-mode access and one environment: development, preview or production.");
     const app = reviewedProfileBody(await readReviewedAppProfile(root));
     const appId = await ensureLinkedApp(root, client, tenantId, bundle);
-    const submitted = settled(await submitRequests(client, appId, declaration, root, options.connection, app, options.reason, options.operations)).map(item => ({ ...item, state: item.outcome.state }));
+    const submitted = settled(await submitRequests(client, appId, declaration, root, options.connection, app, options.reason, options.operations, options.allowBackground)).map(item => ({ ...item, state: item.outcome.state }));
     const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
     const pollMs = options.pollMs ?? 3_000;
     let grants = [];
@@ -216,6 +224,7 @@ export async function requestIntegrations(root, client, tenantId, bundle, option
     }
     const groups = groupGrants(grants);
     return { appId, connection: options.connection, requests: submitted.map(item => ({
+            ...(item.outcome.backgroundConsent ? { backgroundConsent: item.outcome.backgroundConsent } : {}),
             identityMode: item.identityMode, operations: item.operations, resources: item.resources, ...(item.presentation ? { presentation: item.presentation } : {}),
             ...(item.outcome.requestId ? { requestId: item.outcome.requestId } : {}), grantId: item.outcome.grantId, state: item.state,
             readiness: item.state === "PENDING" ? "pending" : grants.find(grant => grant.grantId === item.outcome.grantId)?.readiness ?? (item.state === "READY" ? "ready" : "denied"),
@@ -463,5 +472,24 @@ export async function integrationsStatus(root, client) {
     if (!lock?.appId)
         return { linked: false, grants: [], requests: [] };
     const listed = await client.list(lock.appId);
-    return { appId: lock.appId, linked: true, grants: listed.grants.map(grant => ({ connection: grant.connection, environment: grant.environment, identityMode: grant.identityMode, status: grant.status, operations: grant.operations, resources: grant.resources, expiresAt: grant.expiresAt, readiness: grant.readiness, provisioning: grant.provisioning, pendingRequestId: grant.pendingRequestId, failure: grant.failure })), requests: listed.requests };
+    return { appId: lock.appId, linked: true, grants: listed.grants.map(grant => ({ connection: grant.connection, environment: grant.environment, identityMode: grant.identityMode, status: grant.status, operations: grant.operations, resources: grant.resources, expiresAt: grant.expiresAt, readiness: grant.readiness, provisioning: grant.provisioning, pendingRequestId: grant.pendingRequestId, failure: grant.failure })), requests: listed.requests, consents: listed.consents ?? [] };
+}
+async function linkedApp(root) {
+    const lock = await readKitLock(root);
+    if (!lock?.appId)
+        throw new CliError("APP_NOT_LINKED", "Run isomorph dev or integrations request for this app first.");
+    return lock.appId;
+}
+export async function connectIntegration(root, client, connection, returnUrl) {
+    const appId = await linkedApp(root);
+    let result;
+    try {
+        result = await client.connectIntegration(appId, connection, returnUrl);
+    }
+    catch (error) {
+        if (!returnUrl && error instanceof CliError && error.code === "VALIDATION_FAILED")
+            throw new CliError(error.code, error.message, undefined, "Start isomorph dev, then repeat with --return-url <origin>/_harbour/integrations/oauth/complete using the returned local origin.");
+        throw error;
+    }
+    return { appId, connection, ...result, nextStep: result.status === "connected" ? "Account connected. Run integrations status, then integrations request with --allow-background for the approved environment; connecting never enables it." : "Open authorizationUrl in the browser and let the owner finish provider consent, then run this command again. Use --return-url with the running app's local URL if required." };
 }

package/dist/src/analyzer.js

@@ -3,7 +3,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { lstat, readFile, readdir, stat } from "node:fs/promises";
 import { basename, dirname, join, relative, sep } from "node:path";
-import { parseGitIgnore } from "./gitignore.js";
+import ignore from "ignore";
 import { sha256 } from "./digest.js";
 import { isEnvExamplePath, isKitCommittedPath, isSourceIntakeExcludedPath } from "./secret-paths.js";
 const ANALYZER_VERSION = "0.1.0";
@@ -91,18 +91,18 @@ function extension(path) {
  * Nested ignore files are not read. A missing file adds no rules.
  */
 async function loadGitIgnore(root) {
-    let content = "";
+    const filter = ignore();
     try {
-        content = await readFile(join(root, ".gitignore"), "utf8");
+        filter.add(await readFile(join(root, ".gitignore"), "utf8"));
     }
     catch { /* no .gitignore: nothing extra is ignored */ }
-    return parseGitIgnore(content);
+    return filter;
 }
 function isGitIgnored(filter, root, absolute, isDirectory) {
     const path = relative(root, absolute).split(sep).join("/");
     if (!path)
         return false;
-    return filter.ignores(path, isDirectory);
+    return filter.ignores(isDirectory ? `${path}/` : path);
 }
 /**
  * Which directories filled the boundary, for the error a builder reads when

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -18,7 +18,6 @@
     "dist/src/analyzer.js",
     "dist/src/contracts.js",
     "dist/src/digest.js",
-    "dist/src/gitignore.js",
     "dist/src/secret-paths.js",
     "dist/src/source-digest.js",
     "dist/src/source-intake.js",
@@ -28,7 +27,8 @@
     "node": ">=22.13.0"
   },
   "dependencies": {
-    "embedded-postgres": "18.4.0-beta.17"
+    "embedded-postgres": "18.4.0-beta.17",
+    "ignore": "^7.0.10"
   },
   "scripts": {
     "prebuild": "node scripts/kit-bundle.mjs verify",

package/dist/src/gitignore.js

@@ -1,81 +0,0 @@
-export function parseGitIgnore(content) {
-    const rules = [];
-    for (const raw of content.split(/\r?\n/)) {
-        let line = raw.replace(/\s+$/, "");
-        if (!line || line.startsWith("#"))
-            continue;
-        let negated = false;
-        if (line.startsWith("!")) {
-            negated = true;
-            line = line.slice(1);
-        }
-        else if (line.startsWith("\\!") || line.startsWith("\\#"))
-            line = line.slice(1);
-        let directoryOnly = false;
-        if (line.endsWith("/")) {
-            directoryOnly = true;
-            line = line.slice(0, -1);
-        }
-        if (!line)
-            continue;
-        let anchored = line.startsWith("/");
-        if (anchored)
-            line = line.slice(1);
-        if (line.includes("/"))
-            anchored = true;
-        const regex = new RegExp(`^${anchored ? "" : "(?:.*/)?"}${globToRegex(line)}(?:/.*)?$`);
-        rules.push({ regex, negated, directoryOnly });
-    }
-    return {
-        ignores(path, isDirectory) {
-            const normalized = path.replace(/^\/+|\/+$/g, "");
-            if (!normalized)
-                return false;
-            let ignored = false;
-            for (const rule of rules) {
-                if (rule.directoryOnly && !isDirectory && !parentMatches(rule.regex, normalized))
-                    continue;
-                if (rule.regex.test(normalized))
-                    ignored = !rule.negated;
-            }
-            return ignored;
-        }
-    };
-}
-/** A directory-only pattern still ignores a file beneath a matching directory. */
-function parentMatches(regex, path) {
-    const parts = path.split("/");
-    for (let depth = 1; depth < parts.length; depth += 1)
-        if (regex.test(parts.slice(0, depth).join("/")))
-            return true;
-    return false;
-}
-function globToRegex(glob) {
-    let out = "";
-    for (let index = 0; index < glob.length; index += 1) {
-        const char = glob[index];
-        if (char === "*") {
-            if (glob[index + 1] === "*") {
-                index += 1;
-                if (glob[index + 1] === "/") {
-                    index += 1;
-                    out += "(?:.*/)?";
-                }
-                else
-                    out += ".*";
-            }
-            else
-                out += "[^/]*";
-        }
-        else if (char === "?")
-            out += "[^/]";
-        else if (char === "\\" && index + 1 < glob.length) {
-            index += 1;
-            out += escape(glob[index]);
-        }
-        else
-            out += escape(char);
-    }
-    return out;
-}
-function escape(char) { return /[.*+?^${}()|[\]\\/]/.test(char) ? `\\${char}` : char; }