@isomorph.ai/cli 0.2.0

package/dist/packages/harbour-cli/src/kit-bundle.js

@@ -0,0 +1,41 @@
+import { PUBLISHED_KIT_BUNDLE } from "./kit-bundle.manifest.js";
+/**
+ * The local stack's supporting services. Not part of the published bundle: they run only under `isomorph dev`.
+ * MinIO is the exact image the pipeline's validation cell runs (data plane `transformbuild.validationMinIOImage`),
+ * from MinIO's own registry by digest: Docker Hub's `minio/minio` repository disappeared on 2026-09-11
+ * (404, "pull access denied"), and `isomorph dev`/`check` pull before every start, so a tag there took the
+ * whole local kit down. A digest cannot be moved or removed from under an app.
+ */
+export const LOCAL_SERVICE_IMAGES = {
+    postgres: "postgres:16-alpine",
+    minio: "quay.io/minio/minio@sha256:d249d1fb6966de4d8ad26c04754b545205ff15a62e4fd19ebd0f26fa5baacbc0"
+};
+/**
+ * The bundle this CLI was built with: `manifest.json` of the
+ * harbour-deployment-data-plane `publish-kit-bundle` artifact for the kit
+ * version pinned in package.json `harbour.kitBundle`, fetched at build time
+ * into `kit-bundle.manifest.ts` (the images and the tarball live in the kit's
+ * public registry, `public.ecr.aws/<alias>/`, pinned by digest so no login
+ * and no tag can substitute other bytes). `isomorph init` records it in the
+ * app's kit.lock; `isomorph init --upgrade` shows the digest diff against it;
+ * the hosted pipeline compares `sdk.tarballSha256` with the SDK it bakes.
+ */
+export const EMBEDDED_KIT_BUNDLE = { ...PUBLISHED_KIT_BUNDLE, images: { ...LOCAL_SERVICE_IMAGES, ...PUBLISHED_KIT_BUNDLE.images } };
+export function isKitBundle(value) {
+    const record = value;
+    return Boolean(record && typeof record === "object" && record.schema === "isomorph.kit-bundle/1.0" && typeof record.kitVersion === "string"
+        && record.sdk && typeof record.sdk.package === "string" && typeof record.sdk.tarballSha256 === "string"
+        && record.images && typeof record.images.appGateway === "string" && typeof record.images.sessionFixture === "string"
+        && record.brief && typeof record.brief.fingerprint === "string" && record.declarationSchema === "isomorph.app-integrations/2.0");
+}
+/** Lines naming every digest that differs between two manifests, for `init --upgrade`. */
+export function bundleDiff(before, after) {
+    const fields = [
+        ["kitVersion", before.kitVersion, after.kitVersion],
+        ["sdk.tarballSha256", before.sdk.tarballSha256, after.sdk.tarballSha256],
+        ["images.appGateway", before.images.appGateway, after.images.appGateway],
+        ["images.sessionFixture", before.images.sessionFixture, after.images.sessionFixture],
+        ["brief.fingerprint", before.brief.fingerprint, after.brief.fingerprint]
+    ];
+    return fields.filter(([, a, b]) => a !== b).map(([name, a, b]) => `${name}: ${a ?? "(none)"} -> ${b ?? "(none)"}`);
+}

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -0,0 +1,32 @@
+export const PUBLISHED_KIT_BUNDLE = {
+    "schema": "isomorph.kit-bundle/1.0",
+    "kitVersion": "0.2.0",
+    "sdk": {
+        "package": "@isomorph.ai/app-sdk",
+        "version": "1.2.0",
+        "tarballSha256": "6b41494883215527a73e05a1e07d022552dfe3402915e23950e357e5e9381c49",
+        "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:6b41494883215527a73e05a1e07d022552dfe3402915e23950e357e5e9381c49"
+    },
+    "images": {
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:13c51a2396d1af396e744b1f6f09abce9fd54267418b07122af89d6797fd5809",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:7c06fe3d14f902eef93240f33a6c39e20b01459c108dcaa7bdaa892109f6853d"
+    },
+    "nativeRuntime": {
+        "darwinArm64": {
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:217471d3f95de27f774da7765b6e01f814f770c531c4ae2e0f17474b2b909ada",
+            "sha256": "217471d3f95de27f774da7765b6e01f814f770c531c4ae2e0f17474b2b909ada"
+        },
+        "linuxX64": {
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:a55f40569ae51d6a4088b8025ea8f720ef6876a352fe3f17b32ff9571098ffd8",
+            "sha256": "a55f40569ae51d6a4088b8025ea8f720ef6876a352fe3f17b32ff9571098ffd8"
+        },
+        "windowsX64": {
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:3f637182209f6063b85d781bddcf9b437c4bca7f3361df37e209f874a377aaa1",
+            "sha256": "3f637182209f6063b85d781bddcf9b437c4bca7f3361df37e209f874a377aaa1"
+        }
+    },
+    "brief": {
+        "fingerprint": "dd6aca0163116c0c5b73ca447094aba67c5ca58a9d285722acb12eef5fde4e9e"
+    },
+    "declarationSchema": "isomorph.app-integrations/2.0"
+};

package/dist/packages/harbour-cli/src/kit.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, parse, resolve } from "node:path";
+import { scanWorkspace } from "../../../src/analyzer.js";
+import { isKitBundle } from "./kit-bundle.js";
+import { CliError } from "./output.js";
+/**
+ * Closed set: each operation has one connection kind and the identity modes it
+ * may run under — exactly one, except slack.message.post, which the app
+ * declares (`app` posts as the company's Slack app under its IT-approved name,
+ * `user` posts as the signed-in person after their consent). Gmail is
+ * user-mode only (two reads and one send as the signed-in person).
+ */
+export const OPERATIONS = {
+    "slack.channel.history": { identities: ["user"], kind: "saas" },
+    "slack.message.post": { identities: ["app", "user"], kind: "saas" },
+    "gmail.thread.list": { identities: ["user"], kind: "saas" },
+    "gmail.message.read": { identities: ["user"], kind: "saas" },
+    "gmail.message.send": { identities: ["user"], kind: "saas" },
+    "warehouse.view.read": { identities: ["app"], kind: "database" }
+};
+/** Explicit reads `isomorph check --integrations` may run; every other operation is a send and never runs during checks. */
+export const READ_OPERATIONS = ["slack.channel.history", "gmail.thread.list", "warehouse.view.read"];
+/** Reads whose input needs an identifier from a prior read (a message id): listed as reads, exercised only through the list. */
+export const DEPENDENT_READ_OPERATIONS = ["gmail.message.read"];
+/**
+ * Reads the committed declaration as JSON. The closed rules (schema, connection
+ * kinds, the operation set, identity modes, logical resource names) are the
+ * kit gate's `declaration` check — the pipeline's own — so a defect is named
+ * once, in the same words, by `isomorph check` and by CodeBuild.
+ */
+export function emptyDeclaration() { return { schema: "isomorph.app-integrations/2.0", connections: {} }; }
+export function resourceNames(operation) { return Array.isArray(operation.resources) ? operation.resources : Object.keys(operation.resources); }
+export const requestResourceName = (resource) => typeof resource === "string" ? resource : resource.name;
+export function requestResources(operation) {
+    return Array.isArray(operation.resources) ? operation.resources : Object.entries(operation.resources).map(([name, spec]) => ({ name, columns: [...spec.columns] }));
+}
+export async function readDeclaration(root) {
+    let raw;
+    try {
+        raw = await readFile(kitPaths(root).declaration, "utf8");
+    }
+    catch {
+        return { declaration: emptyDeclaration(), errors: [".isomorph/integrations.json is missing (run `isomorph init`)"] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { declaration: emptyDeclaration(), errors: [".isomorph/integrations.json is not valid JSON"] };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return { declaration: emptyDeclaration(), errors: [".isomorph/integrations.json must be a JSON object"] };
+    const record = parsed;
+    const connections = record.connections && typeof record.connections === "object" && !Array.isArray(record.connections) ? record.connections : {};
+    return { declaration: { schema: record.schema, connections }, errors: [] };
+}
+export function isKitLock(value) {
+    const record = value;
+    return Boolean(record && typeof record === "object" && record.schema === "isomorph.kit-lock/1.0" && typeof record.appId === "string" && typeof record.tenantId === "string" && isKitBundle(record.bundle) && typeof record.createdAt === "string" && typeof record.updatedAt === "string");
+}
+export async function readKitLock(root) {
+    let raw;
+    try {
+        raw = await readFile(kitPaths(root).lock, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CliError("KIT_LOCK_INVALID", ".isomorph/kit.lock.json is not valid JSON.");
+    }
+    if (!isKitLock(parsed))
+        throw new CliError("KIT_LOCK_INVALID", ".isomorph/kit.lock.json does not match isomorph.kit-lock/1.0.");
+    return parsed;
+}
+export async function writeKitLock(root, lock) {
+    const next = { ...lock, updatedAt: new Date().toISOString() };
+    await mkdir(dirname(kitPaths(root).lock), { recursive: true });
+    await writeFile(kitPaths(root).lock, `${JSON.stringify(next, null, 2)}\n`);
+    return next;
+}
+/** Records the app identity Isomorph settled on; a non-kit app (no kit.lock) is left alone. */
+export async function recordKitAppId(root, appId, tenantId) {
+    const lock = await readKitLock(root);
+    if (!lock || (lock.appId === appId && lock.tenantId === tenantId))
+        return;
+    await writeKitLock(root, { ...lock, appId, tenantId });
+}
+export function newKitLock(bundle, tenantId = "", appId = "") {
+    const now = new Date().toISOString();
+    return { schema: "isomorph.kit-lock/1.0", appId, tenantId, bundle, createdAt: now, updatedAt: now };
+}
+// ---- Paths and identity --------------------------------------------------------
+/** Where a kit app keeps its declaration, lock, retained checks, gate-written inventory and (ignored) local state. */
+export const KIT_DIRECTORY = ".isomorph";
+export function appRoot(rootArg) {
+    if (!rootArg)
+        throw new CliError("USAGE", "--app-root <path> is required.");
+    const root = resolve(rootArg);
+    if (root === parse(root).root || root === resolve(homedir()))
+        throw new CliError("PREFLIGHT_APP_ROOT", "The selected app root is unsafe.");
+    return root;
+}
+export function kitPaths(root) {
+    const kit = join(root, KIT_DIRECTORY);
+    const local = join(kit, "local");
+    return { kit, local, declaration: join(kit, "integrations.json"), lock: join(kit, "kit.lock.json"), checks: join(kit, "checks"), devLock: join(local, "dev.lock"), state: join(local, "state"), report: join(local, "check-report.json") };
+}
+/** The kit directory of an app set up by a CLI older than 0.2.0; `isomorph init --upgrade` moves it to `.isomorph/`. */
+export const LEGACY_KIT_DIRECTORY = ".harbour";
+/**
+ * Refuses an app that still carries the old kit directory and not the current
+ * one. Nothing reads the old layout — not `dev`, not `check`, not the
+ * deployment pipeline — so the one command that moves it is named here rather
+ * than discovered as a missing declaration, a missing lock and an app deployed
+ * without its kit.
+ */
+export async function assertKitCurrent(root) {
+    const [legacy, current] = await Promise.all([isDirectory(join(root, LEGACY_KIT_DIRECTORY)), isDirectory(kitPaths(root).kit)]);
+    if (legacy && !current)
+        throw new CliError("KIT_UPGRADE_REQUIRED", "This app was set up by an older CLI and has not been moved to the current kit yet. Run `isomorph init --upgrade --app-root .` once, then run this again.");
+}
+const isDirectory = (path) => stat(path).then(info => info.isDirectory(), () => false);
+/** Stable per-project identity for the kit-managed local state. */
+export function projectName(root, suffix = "") {
+    return `isomorph-${createHash("sha256").update(resolve(root)).digest("hex").slice(0, 12)}${suffix}`;
+}
+/** Governance link idempotency key: sha256(tenantId + absolute app root). */
+export function linkIdempotencyKey(tenantId, root) {
+    return createHash("sha256").update(`${tenantId}${resolve(root)}`).digest("hex");
+}
+/** sha256 over the tracked app files (same boundary as productionise), so any edit changes it. */
+export async function sourceDigest(root) {
+    const graph = await scanWorkspace(root, { sourceBoundary: "root" });
+    const files = [...graph.deploymentScope.includedFiles].sort();
+    const hash = createHash("sha256");
+    for (const path of files) {
+        hash.update(path).update("\0");
+        hash.update(await readFile(join(root, path))).update("\0");
+    }
+    return { digest: `sha256:${hash.digest("hex")}`, files };
+}