@isomorph.ai/cli 0.3.4-rc.1 → 0.4.0-rc.1

package/README.md

@@ -12,7 +12,7 @@ npx -y @isomorph.ai/cli agent-setup
 
 Paste that line into Claude Code or Codex (or a terminal). It teaches both agents the kit by installing the `isomorph` skill for each (`~/.claude/skills/isomorph/SKILL.md`, `~/.codex/skills/isomorph/SKILL.md`, with the kit's rules beside it as `core.md`, `integrations.md`, `ai.md` and `jobs.md`) and never touches your other skills or instructions. A skill is read only when the task matches it — a folder with `.isomorph/`, an app you ask for on Isomorph — so the agent works exactly as before on everything else. (Releases before 0.1.34 put the guide in your global Codex instructions, `~/.codex/AGENTS.md`, where every Codex session read it; running the line again takes that block out and leaves the rest of the file as it was.)
 
-That `npx` line runs the current release, but `isomorph init`, `dev` and `check` afterwards run whatever `isomorph` is installed on this machine. So `agent-setup` also compares the two and says, in its output and in `result.cli` of `--json` (`state`, `upgradeRequired`, `remediation`), when the installed CLI is missing or behind — a stale one carries an old kit bundle and builds an app the deployment pipeline refuses. The fix is always `npm i -g @isomorph.ai/cli`.
+That `npx` line runs the current release; `isomorph init`, `dev`, `check` and `deploy` afterwards run whatever `isomorph` is installed on this machine. A CLI older than what your company's Isomorph platform accepts is refused by every company command in under a second (`CLI_UPGRADE_REQUIRED`), with the fix: `npm i -g @isomorph.ai/cli`.
 
 Then, in an empty folder:
 
@@ -27,28 +27,26 @@ The only step you do yourself is the company sign-in: when the agent runs `isomo
 ## Commands
 
 ```
-isomorph agent-setup                                        install the `isomorph` skill for Claude Code and Codex; idempotent; reports a missing or stale installed CLI
-isomorph init --app-root <path> [--upgrade]                 starter app in an empty folder, or kit files in a Vite + React app (also runs agent-setup); --upgrade re-pins the kit bundle
-isomorph dev --app-root <path> [--reset]                    run the app locally on one loopback origin
+isomorph agent-setup                                        install the `isomorph` skill for Claude Code and Codex; idempotent
+isomorph init --app-root <path> [--upgrade]                 starter app in an empty folder, or kit files in a Vite + React app (also runs agent-setup); --upgrade re-pins the kit bundle and runs the checks
+isomorph dev --app-root <path> [--reset] [--detach] [--json]  run the app locally on one loopback origin; --detach starts it in the background and prints {origin, pid} once it answers
 isomorph stop --app-root <path>                             stop local services, keep data
-isomorph check --app-root <path> [--integrations] [--json]  declaration, types, build, migrations, journeys; report in .isomorph/local/check-report.json
+isomorph check --app-root <path> [--integrations] [--json]  types, build, migrations, database gate, write probe, journeys, coverage; --json prints the whole report
 isomorph integrations catalog --app-root <path> [--json]   the company's connections as .isomorph/integrations.json names them, with approved channels/views per environment
-isomorph integrations request <connection> --app-root <path> [--reason <text>]   one request per connection; IT approves it once for every environment (`isomorph dev` and `isomorph productionise` file it for you)
+isomorph integrations request <connection> --app-root <path> [--reason <text>]   one request per connection; IT approves it once for every environment (`isomorph dev` and `isomorph deploy` file it for you)
 isomorph integrations status --app-root <path> [--json]
 isomorph connect <work-email | company-start-url>                 once per company; then isomorph login | logout
-isomorph productionise --app-root <path> [--confirm-save] [--json]  save + preview deployment, prints the protected link
-isomorph status | retry | promote | setup | profile | audience | secrets … --operation <reference>   (promote: [--confirm-tested])
+isomorph deploy --app-root <path> [--json]                  checks (when not already passed for this code), one pre-flight, save + preview deployment; prints the protected link
+isomorph status | retry | promote --operation <reference>   (promote: [--app-root <path>] [--confirm-tested])
 ```
 
-`productionise`, `status --wait`, `retry` and `promote` follow the deployment for up to `--max-wait <seconds>` (default 30 minutes). Past that they exit 0 with `status: "RUNNING"` and the `isomorph status --operation <reference> --wait --max-wait 120 --json` that continues the same deployment — a bounded wait is not a failure, and never a reason to start another deploy.
+`deploy` reads the app's name, description and audience from `.isomorph/app.json` (written by `init`; edit it before shipping) and prints the three values before it starts. It then asks Isomorph once whether the app can deploy — the access request for every declared connection, the company's AI setup when the app calls governed AI, and this CLI's version — and refuses with exit 2 naming every blocker and its fix (`DEPLOY_BLOCKED`, or `INTEGRATIONS_NOT_READY` / `AI_NOT_READY` / `CLI_UPGRADE_REQUIRED` when the blockers are all of one kind).
 
-`productionise` and `promote` each stop for a typed reply — `Approved.` before the app files are copied to the company code system, `Tested.` before the preview is released. `--confirm-save` and `--confirm-tested` give that same reply on the command line when nobody can type it.
+`deploy`, `status --wait`, `retry` and `promote` follow the deployment for up to `--max-wait <seconds>` (default 30 minutes). Past that they exit 0 with `status: "RUNNING"` and the `isomorph status --operation <reference> --wait --max-wait 120 --json` that continues the same deployment — a bounded wait is not a failure, and never a reason to start another deploy.
 
-`isomorph --help` prints the full usage. Local commands need no company sign-in; integrations and shipping do.
-
-## Apps set up by the old `harbour` CLI
+`promote` never prompts: `--confirm-tested` is the one flag that means the person has opened the preview and it works. `productionise` is still accepted as an unlisted alias of `deploy` for one release.
 
-Before 0.2.0 the CLI was published as `@fourier-labs/harbour` with the command `harbour`, and it kept the kit's files under `.harbour/`. That layout is not read any more — not by this CLI and not by the deployment pipeline. Run `isomorph init --upgrade --app-root .` once in each such app: it renames `.harbour/` to `.isomorph/` (git records renames), moves the two committed schema ids with it, rewrites the managed block in CLAUDE.md / AGENTS.md, deletes the project skill older CLIs wrote (`.claude/skills/harbour-kit/SKILL.md` up to 0.1.x, `.claude/skills/isomorph-kit/SKILL.md` up to 0.2.2 — when it is the kit's, by the frontmatter name and the opening line every release wrote; one whose body you rewrote is kept, and reported as kept; the rules now live beside the user-level skill and no project skill replaces it), deletes the checks the old kit generated (the next `isomorph check` regenerates them) and rewrites the SDK package name, its exported type names and the retired `HARBOUR_*` environment names (`HARBOUR_APP_URL` → `ISOMORPH_APP_URL` and the rest) in `package.json`, `vite.config.*`, `src/`, `jobs/` and the checks you wrote yourself. Run it again after updating the CLI: an app already moved by 0.2.0 loses its old skill and old environment names the same way. Every other command refuses an un-upgraded app and names that command. The old CLI can stay installed; it no longer deploys.
+`isomorph --help` prints the full usage. Local commands need no company sign-in; integrations and shipping do.
 
 ## Development
 

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -1,21 +1,10 @@
-import { execFile } from "node:child_process";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
-import { CLI_VERSION } from "./version.js";
 import { GUIDE_MODULES } from "./guide.js";
 import { continueCommand } from "./operations.js";
-const execFileAsync = promisify(execFile);
 export const MANAGED_START = "<!-- isomorph:kit:start -->";
 export const MANAGED_END = "<!-- isomorph:kit:end -->";
-/**
- * The one command that installs or upgrades the CLI. It carries no dist-tag: npm resolves an
- * untagged name through `latest`, which is what a release publishes, so every instruction in
- * the kit names the package the same way a person typing it from memory would (LLD §15.5).
- */
-export const CLI_INSTALL_COMMAND = "npm i -g @isomorph.ai/cli";
 /**
  * Where the two agents read the user-level guide from; both honour the tools' own
  * override variables. Both are skills — a file each tool lists by name and description
@@ -40,13 +29,11 @@ export function agentPaths(env = process.env) {
  * workflow) and the four rule modules beside it, every file wholly owned by the kit —
  * and takes the guide back out of Codex's global AGENTS.md where an older release put
  * it, keeping everything else in that file. Idempotent:
- * unchanged files are reported as kept. Also reports which `isomorph` the agent's next
- * command will run (`result.cli`), because this command is routinely reached through
- * `npx` while everything after it is not.
+ * unchanged files are reported as kept.
  */
-export async function agentSetup(env = process.env, lookups = {}) {
+export async function agentSetup(env = process.env) {
     const paths = agentPaths(env);
-    const result = { created: [], updated: [], kept: [], removed: [], cli: await checkCliVersion(lookups) };
+    const result = { created: [], updated: [], kept: [], removed: [] };
     for (const skill of [paths.claudeSkill, paths.codexSkill])
         for (const file of skillFiles(skill))
             result[await upsertManagedBlock(file.path, file.text, {})].push(file.path);
@@ -58,94 +45,6 @@ export async function agentSetup(env = process.env, lookups = {}) {
 export function skillFiles(skill) {
     return [{ path: skill, text: `${SKILL_FRONTMATTER}\n${AGENT_GUIDE}` }, ...Object.entries(GUIDE_MODULES).map(([name, text]) => ({ path: join(dirname(skill), `${name}.md`), text }))];
 }
-/** Compares the globally resolvable `isomorph` with the package this process runs from. */
-export async function checkCliVersion(lookups = {}) {
-    const running = await (lookups.runningCliVersion ?? runningPackageVersion)();
-    // No `isomorph` on PATH, output with no version in it, a non-zero exit or a hang all
-    // mean the same thing: there is no installed CLI whose version can be trusted.
-    const installed = parseVersion(await (lookups.installedCliVersion ?? installedCliVersion)() ?? "");
-    const consequence = "carries an old kit bundle, so the app it creates passes every local check and is then refused by the deployment pipeline (kit_bundle_incompatible)";
-    if (!installed) {
-        // The CLI used to be published under another name with another command; a machine that still has it needs to know that it no longer deploys.
-        const legacy = await (lookups.legacyCliInstalled ?? legacyCliInstalled)() ? " The old `harbour` CLI is installed; it no longer deploys — install @isomorph.ai/cli." : "";
-        return { running, state: "missing", upgradeRequired: true, remediation: CLI_INSTALL_COMMAND, message: `No \`isomorph\` command is installed on this machine; this package is ${running}. \`isomorph init\`, \`dev\` and \`check\` run the installed CLI, not this one, and a missing or stale CLI ${consequence}.${legacy}` };
-    }
-    const order = compareCliVersions(installed, running);
-    if (order < 0)
-        return { running, installed, state: "stale", upgradeRequired: true, remediation: CLI_INSTALL_COMMAND, message: `The installed \`isomorph\` command is ${installed}, older than this package (${running}). \`isomorph init\`, \`dev\` and \`check\` run the installed CLI, not this one, and a stale CLI ${consequence}.` };
-    if (order > 0)
-        return { running, installed, state: "ahead", upgradeRequired: false, message: `The installed \`isomorph\` command is ${installed}, newer than this package (${running}); the installed one is what runs.` };
-    return { running, installed, state: "current", upgradeRequired: false, message: `The installed \`isomorph\` command is ${installed}, the same version as this package.` };
-}
-/** What `agent-setup` and `init` print about the installed CLI; an upgrade is impossible to miss in a scrolling log. */
-export function cliVersionLines(check) {
-    if (!check.upgradeRequired)
-        return [check.message];
-    return ["", "!!! UPGRADE THE ISOMORPH CLI BEFORE `isomorph init` OR ANY OTHER ISOMORPH COMMAND !!!", check.message, `Run: ${check.remediation}`, ""];
-}
-/** Numeric-core semver order; a prerelease sorts before its release. An unparseable version compares equal, so nothing is called stale on a guess. */
-export function compareCliVersions(left, right) {
-    const parse = (value) => {
-        const match = /^\s*v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(value);
-        return match ? { core: [Number(match[1]), Number(match[2]), Number(match[3])], pre: match[4] } : undefined;
-    };
-    const a = parse(left);
-    const b = parse(right);
-    if (!a || !b)
-        return 0;
-    for (let index = 0; index < 3; index += 1)
-        if (a.core[index] !== b.core[index])
-            return a.core[index] < b.core[index] ? -1 : 1;
-    if (a.pre === b.pre)
-        return 0;
-    if (a.pre === undefined)
-        return 1;
-    if (b.pre === undefined)
-        return -1;
-    return a.pre < b.pre ? -1 : 1;
-}
-/** Whatever the globally resolvable `isomorph` prints for `--version`; undefined when running it is not possible at all. */
-async function installedCliVersion() {
-    try {
-        const { stdout } = await execFileAsync("isomorph", ["--version"], { timeout: 20_000, windowsHide: true });
-        return stdout;
-    }
-    catch (error) {
-        return error.stdout;
-    }
-}
-/** Whether the CLI's previous command name is still on PATH (whatever it answers). */
-async function legacyCliInstalled() {
-    try {
-        await execFileAsync("harbour", ["--version"], { timeout: 20_000, windowsHide: true });
-        return true;
-    }
-    catch (error) {
-        return error.code !== "ENOENT";
-    }
-}
-function parseVersion(text) {
-    return /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(text.trim())?.[1];
-}
-/**
- * The version of the package this process runs from: the nearest package.json named
- * `@isomorph.ai/cli`, walking up from this file. That is `packages/harbour-cli/`
- * in the repository and the package root once published (the entry point is
- * `dist/packages/harbour-cli/src/cli.js`), so no environment variable is involved.
- */
-async function runningPackageVersion() {
-    let directory = dirname(fileURLToPath(import.meta.url));
-    for (let depth = 0; depth < 12; depth += 1) {
-        const manifest = await readFile(join(directory, "package.json"), "utf8").then(text => JSON.parse(text), () => undefined);
-        if (manifest?.name === "@isomorph.ai/cli" && typeof manifest.version === "string")
-            return manifest.version;
-        const parent = dirname(directory);
-        if (parent === directory)
-            break;
-        directory = parent;
-    }
-    return CLI_VERSION;
-}
 /**
  * Writes `block` to `file`: creates the file, replaces the text between the markers
  * when both are present, or appends the block after the existing content. Without
@@ -201,34 +100,35 @@ description: ${SKILL_DESCRIPTION}
 /** One guide, shared by the Claude Code and Codex skills: the workflow only, written for an agent working with a non-developer. Every rule lives in a module (`guide.ts`) beside it and is pointed at, not restated. */
 export const AGENT_GUIDE = `# Isomorph development kit
 
-This guide is for one job: an app that runs on Isomorph — a folder with \`.isomorph/\`, or a new app the person asks for on Isomorph. Anything else is not this job: ignore every rule below and work as you always do. Never turn an existing project into an Isomorph app unless the person asks for that by name.
+This guide is for one job: an app that runs on Isomorph (a folder with \`.isomorph/\`, or a new app asked for on Isomorph). Anything else: ignore every rule below and work as you always do. Never turn an existing project into an Isomorph app unless asked by name.
 
-The person may not be a developer. They say what they want in plain English; you build it and run every command yourself. Never ask them to type a terminal command (the one exception is sign-in, below). Prefer \`--json\` output and read it yourself; never paste JSON, logs, stack traces or file contents at them.
+The person may not be a developer: they say what they want in plain English; you build it and run every command (they type none but the sign-in below). Use \`--json\`; never paste JSON, logs or file contents at them.
 
-The kit's rules are the files beside this one: \`core.md\` before the first edit; \`integrations.md\`, \`ai.md\` and \`jobs.md\` before the work each names.
+Rules live beside this file: \`core.md\` before the first edit; \`integrations.md\`, \`ai.md\`, \`jobs.md\` before the work each names.
 
-## Getting ready (once per machine and folder)
+## Getting ready
 
-1. CLI, before \`isomorph init\` or anything else: the installed CLI must match the current release. \`isomorph agent-setup\` prints both versions and says when the installed one is missing or older (\`--json\`: \`cli.upgradeRequired\`, \`cli.remediation\`); otherwise compare \`isomorph --version\` with \`npx -y @isomorph.ai/cli --version\`. If it is missing or older, run \`npm i -g @isomorph.ai/cli\` and confirm \`isomorph --version\` now matches: every later command runs the installed CLI, and a stale one builds an app the deployment pipeline refuses (\`kit_bundle_incompatible\`). Node 22+, no Docker.
-2. Folder: if it has no \`.isomorph/\` directory, run \`isomorph init --app-root .\` — an empty folder gets a small starter app, an existing Vite + React app gets the kit files and nothing overwritten.
-3. Sign-in, needed only for company systems and shipping: run \`isomorph login\`. It opens the browser and the person finishes the sign-in there — the one step they do themselves; tell them so in one line. It then prints the company and what IT has set up. If it says the company is not connected yet, ask for their work email and run \`isomorph connect <work-email>\` — Isomorph looks the company up from the email's domain. Only if that fails use a link: if it answers that more than one company admits the domain, ask which one and run the command it printed; if it says no company admits the domain, their IT admin has to add it or give them a link (their Isomorph page \`https://platform.isomorph.ai/t/<company>\`, or the setup link), and then run \`isomorph connect <link>\`.
+- No \`.isomorph/\` yet: \`isomorph init --app-root .\` (empty folder → starter; Vite + React app → kit files only). Node 22+, no Docker.
+- Sign-in (company systems and shipping only): \`isomorph connect <work-email>\` (refused? run the command it prints), then \`isomorph login\` — the browser opens and the person finishes there (their one step; say so).
 
-## What they say → what you do
+## Intent → command
 
-- "run it", "show me", "let me try it" → start \`isomorph dev --app-root .\` in the background (the first start downloads the native runtime; a minute or two). Wait for \`Isomorph dev is running: http://127.0.0.1:<port>\` and give them that link — unasked as soon as the first check is green. Locally they are a fixture user; no company sign-in is needed.
-- "check it", "is it ok?", "is it ready?" → with dev running, \`isomorph check --app-root . --json\`, then read \`.isomorph/local/check-report.json\`. Failures in the app's code are yours: fix, then check again until it is clean — after every change and before every ship, without being asked and without offering them as a choice.
-- "does it work?", and before you report anything as working → open the dev link in your own browser, press the control you built or changed, and read what the app shows. A green \`isomorph check\` is not that proof: fixtures answer AI and company systems, so their refusals appear only when the control is really pressed. Test rendering, navigation, fixtures and approved reads automatically; a Send in development is real: reuse explicit authorization for that bounded test, or ask once if none exists (IT approval alone is not permission to send). If you have no browser, say that the button itself is untested.
-- "I need Slack / Gmail / the warehouse / company data" → read \`integrations.md\` beside this skill first; then, in the same turn, read the catalog, declare only what the app calls, submit the access request yourself, and say READY or PENDING in one line.
-- "summarise", "draft", "explain", "AI" → read \`ai.md\` beside this skill first; then one call behind a control they press.
-- "ship it", "put it online", "let my team try it" → \`isomorph check --app-root . --json\` first, unasked; fix everything it finds: the same gates rerun in the cloud, minutes per attempt. Before sharing or deploying the private preview, show the exact proposed app name, description and audience that will be passed to Isomorph (say "only you" when the audience is empty); ask for one confirmation or correction covering all three; do not run \`productionise\` until they confirm. \`isomorph productionise --app-root . --name "<app name>" --description "<description>" --emails "<comma-separated audience>" --confirm-save --json\` (omit \`--emails\` for "only you"; \`--confirm-save\` is the approval they just gave). It records the confirmed setup before uploading or deploying the app, files the access request for each declared connection itself and refuses with \`INTEGRATIONS_NOT_READY\` naming what IT still has to approve, or \`AI_NOT_READY\` and the one IT step: relay that line only; the app works without them until then. Pass \`--session-notes\`: what in Isomorph cost you time, what you believed, what was true; \`""\` if nothing did. \`result.deployment.protectedUrl\` is the private preview, for them and the confirmed audience after company sign-in. If your tool cuts it off, \`${continueCommand("<ref>")}\` continues the same deployment; never start another one to find out what happened; \`TRANSFORMING\` means building and checking.
-- "make it live for everyone", "go to production" → only after they have tried the preview, which \`--confirm-tested\` states. Before \`isomorph promote --operation <ref> --confirm-tested --json\`, show the exact app name, description and production audience again; ask for one confirmation or correction covering all three; never promote a profile or audience the person has not just seen and confirmed. Report the production link, or that operator approval is pending.
-- "stop it" → \`isomorph stop --app-root .\` (data kept); \`isomorph dev --reset --app-root .\` deletes local data, only when they ask to start over.
-- "every day at 2pm", "run this on a schedule", "send this automatically" → read \`jobs.md\` beside this skill first; then write the job, run it once with \`isomorph jobs run\`, and say the sentence it gives you.
+| They say | You do |
+|---|---|
+| "run it", "show me" | \`isomorph dev --app-root . --detach --json\`; give them \`result.origin\` (the first start takes a minute or two). Locally they are a fixture user. |
+| "check it", "is it ready?" | \`isomorph check --app-root . --json\` (the output is the report). Failures in the app's code are yours: fix and re-check until clean, after every change and before every ship, unasked and never offered as a choice. |
+| "does it work?" (and before reporting anything as working) | open the dev link in your own browser, press the control you built or changed, read what the app shows; a green \`isomorph check\` is not that proof (fixtures answer AI and company systems). A Send in development is real: reuse explicit authorization or ask once. No browser: say the button is untested. |
+| "I need Slack / Gmail / the warehouse" | read \`integrations.md\` beside this skill first; then, in the same turn: catalog, declare only what the app calls, submit the request yourself, say READY or PENDING in one line. |
+| "summarise", "draft", "AI" | read \`ai.md\` beside this skill first; then one call behind a control they press. |
+| "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). Give them \`result.deployment.protectedUrl\`. \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
+| "make it live" | only after they have tried the preview: \`isomorph promote --operation <ref> --app-root . --confirm-tested --json\`. Report the production link, or that operator approval is pending. |
+| "stop it" | \`isomorph stop --app-root .\` (data kept); \`isomorph dev --app-root . --reset\` only when they ask to start over. |
+| "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first; then write the job, run it once with \`isomorph jobs run\`, and say the sentence it gives you. |
 
-When a command refuses, the refusal names its own reason and its own fix: change that one thing, then run it again. A failed app needs its reported fix; a wait timeout means work is still running, so continue the saved operation — and never start a second deploy of an app while one is running, because concurrent deploys of one app cancel each other.
+A refusal names its layer, its reason and its fix: change that one thing, then run it again. A wait timeout is not a failure — work is still running: run the command it prints (\`${continueCommand("<ref>")}\`); never start a second deploy while one is running.
 
 ## Talking to the person
 
-- Plain words, short: "Your app is running at <link>.", "IT has to approve Slack; the app works without it until then." Say what happens next and roughly how long it takes; report only what you observed, and say when something is unknown.
-- Keep reports natural and brief: what you verified, any remaining blocker and who can resolve it, any material scope decision. No forced headings, no repeated status. A platform check is not proof that the main task worked in the browser.
-- End a turn with at most one question, and only when a decision is genuinely theirs and you cannot go on without it. Never offer to do something this guide already tells you to do unasked — do it and report what happened.`;
+- Plain words, short: "IT has to approve Slack; the app works meanwhile." Say what happens next and how long; report only what you observed; say when something is unknown.
+- Reports: brief and natural — what you verified, any remaining blocker and who resolves it, any material scope decision; no forced headings or repeated status.
+- End a turn with at most one question, only when a decision is genuinely theirs and you cannot go on without it. Never offer to do something this guide already tells you to do unasked — do it and report.`;

package/dist/packages/harbour-cli/src/auth.js

@@ -83,7 +83,7 @@ const REFRESH_MARGIN_MS = 5 * 60_000;
 /**
  * Returns a usable access token, refreshing only when the stored one is about
  * to expire. Refresh tokens are single-use, so every CLI process refreshing on
- * start meant two processes at once (a `productionise` still polling and a
+ * start meant two processes at once (a `deploy` still polling and a
  * `status` beside it) spent the same refresh token and one was told to sign in
  * again. A refresh that fails now re-reads the store once: if a sibling
  * process rotated the pair in the meantime, its newer token is used instead.

package/dist/packages/harbour-cli/src/check.js

@@ -5,16 +5,17 @@ import { readAppSchema } from "./app-schema.js";
 import { describeRetainedChecks, syncRetainedChecks } from "./retained-checks.js";
 import { CliError } from "./output.js";
 import { DEPENDENT_READ_OPERATIONS, READ_OPERATIONS, kitPaths, readDeclaration, readKitLock, resourceNames, sourceDigest } from "./kit.js";
-import { LocalRuntime, allocatePorts, ensureSdk, freePort, nodePackageCommand, readDevLock, runCommand, runningOrigin } from "./local-runtime.js";
+import { LocalRuntime, allocatePorts, ensureSdk, freePort, nodePackageCommand, readDevLock, runningOrigin } from "./local-runtime.js";
 import { CLI_VERSION } from "./version.js";
 /**
  * What actually failed, in the refusal itself.
  *
  * The report is already in hand at the call site, and a refusal that spends its
  * message on a file path costs the reader a whole turn to learn anything —
- * `productionise` already names the failing checks when it refuses to deploy
- * (`nameList(failed)`), and `check` did not. The detail of the first failure is
- * carried too, capped, because "which check" is a smaller answer than "why".
+ * `deploy` already names the failing checks when it refuses to deploy
+ * and `check` did not. Every failing check is named, in full — names are never
+ * elided — and the detail of the first failure is carried too, capped, because
+ * "which check" is a smaller answer than "why".
  */
 export function checksFailedMessage(report) {
     const failed = report.checks.filter(check => check.status === "fail");
@@ -93,7 +94,7 @@ export async function runChecks(root, options) {
     // After the gate, because `.isomorph/checks/*.mjs` is part of the deployed
     // tree (kit.ts `sourceDigest`) and the gate may have regenerated it: the
     // report has to pin the tree the journeys actually ran against, or
-    // `isomorph productionise` would refuse the very tree this check just passed
+    // `isomorph deploy` would refuse the very tree this check just passed
     // as CHECKS_STALE.
     const source = await sourceDigest(root);
     const report = {
@@ -101,7 +102,7 @@ export async function runChecks(root, options) {
         createdAt: new Date().toISOString(),
         sourceDigest: source.digest,
         sourceFiles: source.entries,
-        toolchain: { node: process.version, cliVersion: CLI_VERSION, bundle: { kitVersion: bundle.kitVersion, sdkTarballSha256: bundle.sdk.tarballSha256, appGateway: bundle.images.appGateway, sessionFixture: bundle.images.sessionFixture, briefFingerprint: bundle.brief.fingerprint } },
+        toolchain: { node: process.version, cliVersion: CLI_VERSION, bundle: { kitVersion: bundle.kitVersion, sdkTarballSha256: bundle.sdk.tarballSha256, briefFingerprint: bundle.brief.fingerprint } },
         checks,
         gate,
         integrations,
@@ -255,34 +256,6 @@ async function ensureSession(root, runtime, bundle, output) {
     await runtime.sessionEnv();
     return true;
 }
-/**
- * `productionise` pre-flight for a kit app: the same gate the pipeline runs,
- * here, before any operation exists. A failed check is refused with the
- * pipeline's own wording (kit.check-failed: <check>); a local runtime that
- * cannot start is reported and skipped — the pipeline's gate
- * still runs.
- */
-export async function preflightKitGate(root, bundle, output, run = runCommand, fetchImpl, runtime) {
-    const lock = await readKitLock(root).catch(() => undefined);
-    if (!lock)
-        return "skipped";
-    let report;
-    try {
-        report = await runKitGate(root, { run, bundle, output, ...(fetchImpl ? { fetch: fetchImpl } : {}), ...(runtime ? { runtime } : {}) });
-    }
-    catch (error) {
-        if (error instanceof CliError && ["LOCAL_RUNTIME_FAILED", "KIT_IMAGES_UNAVAILABLE", "KIT_RUNTIME_UNAVAILABLE"].includes(error.code)) {
-            output(`The kit gate was not run locally (${error.message}); the pipeline's gate will run in CodeBuild.`);
-            return "skipped";
-        }
-        throw error;
-    }
-    const failed = report.checks.filter(check => check.status === "fail");
-    if (failed.length)
-        throw new CliError("KIT_GATE_FAILED", `The kit gate refused this app (${failed.length} check(s) failed):\n${failed.map(check => `  - ${check.name}: ${check.detail ?? ""}`).join("\n")}\nFix the app and run \`isomorph check\`; the pipeline would refuse this deployment as kit.check-failed: ${failed[0].name}.`);
-    output(`The kit gate passed locally (${report.checks.length} checks; ${report.inventory.journeys.length} journey(s), ${report.inventory.migrations} migration(s)).`);
-    return "passed";
-}
 // ---- Real integrations ----------------------------------------------------------------
 /** Explicit read operations only (READ_OPERATIONS) against READY development grants; sends never run. A dependent read (gmail.message.read) is exercised through its list: the newest message of the first thread, when there is one. */
 async function testIntegrationReads(appId, client, declaration, output) {