@isomorph.ai/cli 0.3.4 → 0.4.0-rc.1

package/dist/packages/harbour-cli/src/operations.js

@@ -211,13 +211,13 @@ export function outcomeFor(status, operationRef) {
     if (status.deployment)
         return { ...summary, outcome: "running" };
     // No deployment yet has two very different causes. A save that stalled or
-    // failed (RETRYABLE_FAILURE, FAILED) is resumed by running `productionise`
+    // failed (RETRYABLE_FAILURE, FAILED) is resumed by running `deploy`
     // again — observed 2026-09-14 (fourier "Dad Jokes"): a builder read the
     // administrator sentence for a save that was simply resumable. Only a
     // SUCCEEDED save with no deployment behind it is the company-setup case.
     const save = status.sourceSave?.status;
     if (save && save !== "SUCCEEDED")
-        return { ...summary, outcome: "no_deployment", nextStep: summary.nextStep ?? `Isomorph has not finished saving the app (${save}). Run \`isomorph productionise\` again for this app: it resumes the same save and deploys; nothing is deployed twice.` };
+        return { ...summary, outcome: "no_deployment", nextStep: summary.nextStep ?? `Isomorph has not finished saving the app (${save}). Run \`isomorph deploy\` again for this app: it resumes the same save and deploys; nothing is deployed twice.` };
     return { ...summary, outcome: "no_deployment", nextStep: summary.nextStep ?? "Isomorph saved the app but has not started a deployment for this company yet. Ask your Isomorph administrator to connect deployment." };
 }
 /**
@@ -250,9 +250,11 @@ export async function retryDeployment(client, operationRef, output, options = {}
         return summarize(await fetchStatus(client, operationRef));
     return follow(client, operationRef, output, options.waitOptions);
 }
-/** What the maker types at the promote prompt. `--confirm-tested` supplies this same literal through
- * `readConfirmation`, so governance receives the attestation it receives today, byte for byte — the
- * claim is unchanged, only reachable where no terminal can answer the prompt. */
+/**
+ * What governance records as the promotion attestation. `--confirm-tested` is
+ * the one flag that means "the person tried the preview"; nothing is prompted
+ * for, because the CLI is run by an agent and the person is in the browser.
+ */
 export const PROMOTION_CONFIRMATION = "Tested.";
 /**
  * Promotion mirrors the console's "I tested this version" button: the maker
@@ -269,30 +271,18 @@ export async function promoteToProduction(client, operationRef, output, options
     const deployment = status.deployment;
     if (deployment?.state !== "LIVE" || !deployment.versionId || !deployment.protectedUrl)
         throw new CliError("LIVE_PREVIEW_REQUIRED", "The preview must be live before it can be promoted. Check `isomorph status` first.", operationRef);
-    output(`Open the protected preview and test it: ${deployment.protectedUrl}`);
-    output("When it works as expected, type Tested. then press Enter to promote it to production.");
-    const reply = await (options.readConfirmation ?? readLine)();
-    if (reply !== PROMOTION_CONFIRMATION)
-        throw new CliError("PROMOTION_NOT_CONFIRMED", "The production promotion was not confirmed. Confirm the tested preview with --confirm-tested instead.", operationRef);
+    if (!options.confirmedTested)
+        throw new CliError("PROMOTION_NOT_CONFIRMED", `The preview has not been confirmed as tested: ${deployment.protectedUrl}`, operationRef, "Once the person has opened the preview and it works, run this again with --confirm-tested.");
     const result = structured(await client.call("isomorph_promote_to_production", {
         operationId: operationRef,
         expectedPreviewVersionId: deployment.versionId,
-        confirmation: { schema: "isomorph.stage-approval/1.0", step: "confirm_preview_tested_and_promote", approved: true, approvedByUser: true, userApprovalText: reply }
+        confirmation: { schema: "isomorph.stage-approval/1.0", step: "confirm_preview_tested_and_promote", approved: true, approvedByUser: true, userApprovalText: PROMOTION_CONFIRMATION }
     }));
     output("Isomorph accepted the production promotion.");
     if (options.wait === false)
         return { ...summarize(status), ...(result.production ? { production: pickProduction(result.production) } : {}) };
     return follow(client, operationRef, output, options.waitOptions);
 }
-export async function readLine() {
-    if (!process.stdin.isTTY) {
-        const chunks = [];
-        for await (const chunk of process.stdin)
-            chunks.push(Buffer.from(chunk));
-        return Buffer.concat(chunks).toString("utf8").trim();
-    }
-    return new Promise(resolve => { process.stdin.setEncoding("utf8"); process.stdin.once("data", value => resolve(String(value).trim())); });
-}
 export async function getAppSetup(client, operationRef) {
     await client.initialize();
     return structured(await client.call("isomorph_get_app_setup", { operationId: operationRef }));
@@ -302,7 +292,7 @@ export async function confirmProfile(client, operationRef, input, output) {
     const displayName = input.displayName ?? setup.profile?.suggested?.displayName ?? setup.profile?.displayName;
     const description = input.description ?? setup.profile?.suggested?.description ?? setup.profile?.description;
     if (!displayName || !description)
-        throw new CliError("PROFILE_INCOMPLETE", "Give the app a name (--name) and a description (--description); Isomorph had no suggestion to fall back on.", operationRef);
+        throw new CliError("PROFILE_INCOMPLETE", "The app needs a name and a description in .isomorph/app.json; Isomorph had no suggestion to fall back on.", operationRef);
     if (!setup.profile?.profileVersion)
         throw new CliError("PROFILE_VERSION_MISSING", "Isomorph did not return the app details version.", operationRef);
     await client.call("isomorph_confirm_app_profile", { operationId: operationRef, displayName, description, expectedVersion: setup.profile.profileVersion });
@@ -315,72 +305,3 @@ export async function confirmAudience(client, operationRef, emails, output) {
     output(emails.length ? `Isomorph recorded the app's audience: ${emails.length} colleague${emails.length === 1 ? "" : "s"}.` : "Isomorph recorded that only you can open the app for now.");
     return getAppSetup(client, operationRef);
 }
-export async function listSecrets(client, operationRef) {
-    return (await getAppSetup(client, operationRef)).secrets;
-}
-/**
- * The value is read by the CLI itself — from the terminal with echo off, or
- * from stdin when the caller pipes it — and sent straight to Isomorph. It is
- * never printed, never placed in the result, and never seen by an AI tool that
- * merely launched this command.
- */
-export async function setSecret(client, operationRef, input, output) {
-    await client.initialize();
-    const value = (await input.readValue()).replace(/\r?\n$/, "");
-    if (!value)
-        throw new CliError("SECRET_VALUE_REQUIRED", "No value was entered.", operationRef);
-    const result = structured(await client.call("isomorph_set_app_secret", { operationId: operationRef, name: input.name, value, scope: input.personal ? "personal" : "app", ...(input.personal ? { acknowledgePersonal: true } : {}) }));
-    output(`Isomorph stored the value for ${input.name}.${result.resumedOperationIds?.length ? " The paused deployment is resuming." : ""}`);
-    return { ...(result.secret ? { secret: result.secret } : {}), resumedOperationIds: result.resumedOperationIds ?? [] };
-}
-export async function dismissSecret(client, operationRef, name, output) {
-    await client.initialize();
-    const result = structured(await client.call("isomorph_dismiss_app_secret", { operationId: operationRef, name }));
-    output(`Isomorph recorded that ${name} is not needed.`);
-    return { ...(result.secret ? { secret: result.secret } : {}), resumedOperationIds: result.resumedOperationIds ?? [] };
-}
-/** Read one line from the controlling terminal with echo off, so the value
- * never lands in shell history, scrollback, or a parent process's capture. */
-export async function readSecretFromTerminal(prompt) {
-    const { openSync, readSync, closeSync } = await import("node:fs");
-    let fd;
-    try {
-        fd = openSync("/dev/tty", "r+");
-    }
-    catch {
-        throw new CliError("NO_TERMINAL", "No terminal is available to enter the value. Pipe it on stdin with --value-stdin instead.");
-    }
-    const { writeSync } = await import("node:fs");
-    writeSync(fd, prompt);
-    const stty = await import("node:child_process");
-    try {
-        stty.execSync("stty -echo", { stdio: ["inherit", "ignore", "ignore"] });
-    }
-    catch { /* best effort: some terminals cannot toggle echo */ }
-    const chunks = [];
-    const buffer = Buffer.alloc(1);
-    try {
-        while (true) {
-            const read = readSync(fd, buffer, 0, 1, null);
-            if (read === 0 || buffer[0] === 0x0a)
-                break;
-            if (buffer[0] !== 0x0d)
-                chunks.push(Buffer.from(buffer));
-        }
-    }
-    finally {
-        try {
-            stty.execSync("stty echo", { stdio: ["inherit", "ignore", "ignore"] });
-        }
-        catch { /* ignore */ }
-        writeSync(fd, "\n");
-        closeSync(fd);
-    }
-    return Buffer.concat(chunks).toString("utf8");
-}
-export async function readSecretFromStdin() {
-    const chunks = [];
-    for await (const chunk of process.stdin)
-        chunks.push(Buffer.from(chunk));
-    return Buffer.concat(chunks).toString("utf8");
-}

package/dist/packages/harbour-cli/src/output.js

@@ -16,11 +16,15 @@ export const NO_DETAIL = "Isomorph could not complete the request.";
  */
 export function safeError(error) {
     const code = error instanceof CliError ? error.code : "CLI_FAILED";
+    const layer = error instanceof CliError ? error.layer : "cli";
     const raw = error instanceof Error ? error.message : typeof error === "string" ? error : "";
     // The hint is a separate field rather than more sentence: it is often as long
     // as the message, and appending it would push the reason itself past the cap.
     const hint = error instanceof CliError && error.remediationHint ? redact(error.remediationHint) : "";
-    return { code, message: redact(raw) || NO_DETAIL, ...(hint ? { remediationHint: hint } : {}) };
+    // Paths and identifiers are a list field, never prose: `redact` bounds prose and
+    // would elide the one token the reader needs. They are carried whole, always.
+    const paths = error instanceof CliError && error.paths?.length ? error.paths : undefined;
+    return { code, layer, message: redact(raw) || NO_DETAIL, ...(hint ? { remediationHint: hint } : {}), ...(paths ? { paths } : {}) };
 }
 /** Anything that must never reach a terminal, a log or an envelope. */
 const SECRETS = /https?:\/\/\S+|Bearer\s+\S+|(?:x-harbour|authorization|content-type)[^\n]*/gi;
@@ -121,7 +125,9 @@ export function renderFailure(envelope) {
     const error = envelope.error;
     const result = (envelope.result ?? {});
     const stages = ["production", "deployment"].filter(kind => result[kind]?.failure && result[kind]?.versionId).map(kind => `\n${stageLine(kind, result[kind])}`);
-    return `${error?.message ?? NO_DETAIL}${error?.remediationHint ? ` ${error.remediationHint}` : ""}${stages.join("")}\n`;
+    // One path per line, verbatim: never through `said`, which would bound them.
+    const paths = (error?.paths ?? []).map(path => `\n  ${path}`);
+    return `${error?.message ?? NO_DETAIL}${error?.remediationHint ? ` ${error.remediationHint}` : ""}${paths.join("")}${stages.join("")}\n`;
 }
 /**
  * Server-supplied text on its way to a terminal, given exactly the treatment
@@ -131,7 +137,7 @@ export function renderFailure(envelope) {
  * `safeError` was `redact`’s only caller. `renderSummary` printed the server’s
  * words straight from the payload, so on the success-shaped path — a deployment
  * that reports a failure inside an otherwise-successful envelope, which is what
- * `status` and `productionise` emit after a failed build — that text reached the
+ * `status` and `deploy` emit after a failed build — that text reached the
  * terminal both unredacted and unbounded. A presigned URL, a bearer token or a
  * forwarded header dump printed verbatim into whatever captured stdout, and a
  * pathological message printed whole.
@@ -161,17 +167,6 @@ function said(value) {
  *  - `deployment.versionId`, `production.versionId` — printed only on a failed
  *    stage, and for the same reason: it is the reference the console and the
  *    email carry for that attempt, and a bounded or reworded one names nothing.
- *  - `secrets.asks[].name` and `.prefilledFromPath` — identifiers, not prose. A
- *    secret named `AUTHORIZATION_TOKEN` matches the header pattern and would be
- *    erased whole, printing `Secret : needs a value`; the path is read off the
- *    local checkout rather than sent by the server.
- *  - `audience.emails` — the builder’s own confirmed list, echoed back. A
- *    240-character bound over a joined list silently drops members, which is
- *    the information loss the tail-keeping change was about.
- *  - `ask.status`, `ask.scope`, `secrets.available`, `audience.confirmed` and
- *    the three mapped `pending` steps — compared against fixed literals, so
- *    only Isomorph’s own words ever print. An unmapped `pending` step is the
- *    server’s own id, so that one does go through `said`.
  *
  * `deployment.message` and `production.message` are declared on the payload and
  * never printed here; nothing routes them, and a line that printed one would
@@ -208,32 +203,6 @@ export function renderSummary(envelope) {
         lines.push(`Action needed: ${waiting}`);
     else if (nextStep)
         lines.push(`Next: ${nextStep}`);
-    const setup = envelope.result?.setup;
-    const secrets = setup?.secrets ?? envelope.result?.secrets;
-    if (setup?.profile) {
-        lines.push(`App name: ${said(setup.profile.displayName) || "(none)"}${setup.profile?.confirmed ? " (confirmed)" : setup.profile?.suggested?.displayName ? ` — suggested: ${said(setup.profile.suggested.displayName)}` : " (not confirmed)"}`);
-        if (setup.profile?.description || setup.profile?.suggested?.description)
-            lines.push(`Description: ${said(setup.profile?.confirmed ? setup.profile.description : setup.profile?.suggested?.description ?? setup.profile?.description)}`);
-        if (setup.audience?.available === false)
-            lines.push(`Audience: ${said(setup.audience.plainEnglish) || "console only"}`);
-        else
-            lines.push(`Audience: ${setup.audience?.confirmed ? (setup.audience.emails?.length ? setup.audience.emails.join(", ") : "only you") + " (confirmed)" : "not confirmed"}`);
-    }
-    if (secrets) {
-        if (secrets.available === false)
-            lines.push(`Secrets: ${said(secrets.plainEnglish) || "console only"}`);
-        else if (!secrets.asks?.length)
-            lines.push("Secrets: none asked for");
-        else
-            for (const ask of secrets.asks)
-                lines.push(`Secret ${ask.name}: ${ask.status === "UNSET" ? "needs a value" : ask.status === "SET" ? "set" : "not needed"}${ask.scope === "personal" ? " (personal)" : ""}${ask.prefilledFromPath ? ` (from ${ask.prefilledFromPath})` : ""}`);
-    }
-    // productionise carries only the open steps; the setup commands carry the full view.
-    const openSteps = setup?.pending?.length ? setup.pending.map(step => step === "confirm_app_profile" ? "confirm the app's name and description" : step === "confirm_app_audience" ? "confirm who may open it" : step === "provide_secrets" ? "provide the secrets it asked for" : said(step)) : [];
-    if (openSteps.length)
-        lines.push(`Still needed: ${openSteps.join("; ")}${envelope.result.setup?.plainEnglish && !setup?.profile ? ` — run \`isomorph setup --operation ${envelope.operationRef ?? "<reference>"}\`` : ""}`);
-    else if (setup?.profile)
-        lines.push("Setup complete.");
     return `${lines.join("\n")}\n`;
 }
 /**
@@ -257,17 +226,31 @@ function failureText(failure) {
     const hint = said(failure.remediationHint);
     return `${said(failure.message) || NO_DETAIL}${hint ? ` ${hint}` : ""}`;
 }
+/** The layer a code implies when its producer named none: the gate's and the pipeline's codes are fixed sets. */
+function layerFor(code) {
+    if (/^CHECKS_/.test(code) || code === "KIT_GATE_FAILED")
+        return "gate";
+    if (code === "DEPLOYMENT_FAILED" || code === "DEPLOYMENT_RETRYABLE_FAILURE" || code === "PRODUCTION_PROMOTION_FAILED")
+        return "pipeline";
+    return "cli";
+}
 export class CliError extends Error {
     code;
     operationRef;
     remediationHint;
     result;
+    /** Which machine refused; `layerFor(code)` when the producer named none. */
+    layer;
+    /** Paths and identifiers the message refers to, carried whole: the envelope never bounds them. */
+    paths;
     /** `result` becomes the envelope's `result`: what the command knew about the operation when it failed. */
-    constructor(code, message, operationRef, remediationHint, result) {
+    constructor(code, message, operationRef, remediationHint, result, options = {}) {
         super(message);
         this.code = code;
         this.operationRef = operationRef;
         this.remediationHint = remediationHint;
         this.result = result;
+        this.layer = options.layer ?? layerFor(code);
+        this.paths = options.paths?.length ? [...options.paths] : undefined;
     }
 }

package/dist/packages/harbour-cli/src/remote-mcp-client.js

@@ -26,7 +26,7 @@ export function serverRefusal(result) {
     const declared = typeof detail?.code === "string" ? detail.code.trim() : "";
     const hint = typeof detail?.remediationHint === "string" && detail.remediationHint.trim() ? detail.remediationHint.trim() : undefined;
     const labelled = declared ? null : LABELLED.exec(text);
-    return new CliError(declared || labelled?.[1] || UNLABELLED_REFUSAL, (labelled?.[2] ?? text) || "Isomorph rejected the request.", undefined, hint);
+    return new CliError(declared || labelled?.[1] || UNLABELLED_REFUSAL, (labelled?.[2] ?? text) || "Isomorph rejected the request.", undefined, hint, undefined, { layer: "governance" });
 }
 /** A JSON-RPC error is Isomorph refusing the call itself (an unknown method, a
  * body it could not parse). Its numeric code is the only one it has, so it is
@@ -35,21 +35,21 @@ function rpcRefusal(error, status) {
     const text = error.message?.trim() ?? "";
     const labelled = LABELLED.exec(text);
     const code = labelled?.[1] ?? (typeof error.code === "number" ? `ISOMORPH_RPC_${error.code}` : `ISOMORPH_HTTP_${status}`);
-    return new CliError(code, (labelled?.[2] ?? text) || `Isomorph refused the request (HTTP ${status}).`);
+    return new CliError(code, (labelled?.[2] ?? text) || `Isomorph refused the request (HTTP ${status}).`, undefined, undefined, undefined, { layer: "governance" });
 }
 /**
  * A second 401 in a row: the sign-in itself is gone, or this company does not
  * admit the signed-in account. The server says which in `error_description`
  * (plain English, no URL or token); an older server sends only the code, and
  * the fixed sentence stands in. Both fixes are named because the builder cannot
- * tell the two causes apart: on 2026-09-14 a `productionise` 14 seconds after a
+ * tell the two causes apart: on 2026-09-14 a `deploy` 14 seconds after a
  * successful `isomorph login` was refused by a company the account was not a
  * member of, and "run login again" would only have repeated it.
  */
 async function signInRefused(response) {
     const body = await response.json().catch(() => undefined);
     const said = typeof body?.error_description === "string" ? body.error_description.trim() : "";
-    return new CliError("AUTH_REQUIRED", `${said || "Isomorph sign-in expired or was revoked."} Run \`isomorph login\` again, or \`isomorph connect <work-email-or-start-url>\` if this is the wrong company.`);
+    return new CliError("AUTH_REQUIRED", `${said || "Isomorph sign-in expired or was revoked."} Run \`isomorph login\` again, or \`isomorph connect <work-email-or-start-url>\` if this is the wrong company.`, undefined, undefined, undefined, { layer: "governance" });
 }
 async function readRpc(response) {
     try {

package/dist/packages/harbour-cli/src/starter.js

@@ -1,10 +1,9 @@
-import { mkdir, readdir, readFile, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { bundleDiff } from "./kit-bundle.js";
 import { agentSetup, MANAGED_END, MANAGED_START, upsertManagedBlock } from "./agent-setup.js";
-import { assertKitCurrent, emptyDeclaration, KIT_DIRECTORY, kitPaths, LEGACY_KIT_DIRECTORY, newKitLock, readKitLock, writeKitLock } from "./kit.js";
+import { defaultAppProfile, emptyDeclaration, newKitLock, readKitLock, renderAppProfile, writeKitLock } from "./kit.js";
 import { CliError } from "./output.js";
-import { isPristine } from "./retained-checks.js";
 export { MANAGED_END, MANAGED_START };
 /**
  * Creates the starter in an empty directory, or adds the missing kit files to
@@ -19,17 +18,7 @@ export async function initKit(root, bundle, options = {}) {
     const emptyDir = !existingPackage && !(await exists(join(root, "src")));
     if (existingPackage && !isSupportedApp(existingPackage))
         throw new CliError("APP_UNSUPPORTED", "isomorph init supports an empty directory or an existing Vite + React app (package.json must depend on vite and react).", undefined, "Run `isomorph init --app-root <new-empty-folder>` to start a Vite + React app, then move this app's code into it.");
-    // An app from a CLI older than 0.2.0 is moved to this layout by `--upgrade`
-    // and by nothing else: a plain `init` over it would write a second, empty kit
-    // beside the one it has. Refused before anything, the user-level skill included, is written.
-    if (!options.upgrade)
-        await assertKitCurrent(root);
     const result = { root, created: [], kept: [], updated: [], mode: options.upgrade ? "upgrade" : emptyDir ? "starter" : "existing", bundleChanges: [], agents: options.env ? await agentSetup(options.env) : { created: [], updated: [], kept: [], removed: [] } };
-    if (options.upgrade) {
-        await migrateLegacyKit(root, bundle, result);
-        await retireLegacySkill(root, result);
-        await rewriteLegacyReferences(root, bundle.sdk.package, result);
-    }
     const write = async (path, content) => {
         const absolute = join(root, path);
         if (await exists(absolute)) {
@@ -43,7 +32,7 @@ export async function initKit(root, bundle, options = {}) {
     // The starter (its source and schema) is created only when there is no app here
     // yet; kit infrastructure is written on every path, including `--upgrade`.
     const appFiles = emptyDir ? starterFiles(bundle) : {};
-    for (const [path, content] of Object.entries({ ...appFiles, ...kitFiles() }))
+    for (const [path, content] of Object.entries({ ...appFiles, ...kitFiles(root) }))
         await write(path, content);
     await appendManaged(root, ".gitignore", GITIGNORE_LINES, result, "\n");
     for (const file of ["CLAUDE.md", "AGENTS.md"])
@@ -54,7 +43,6 @@ export async function initKit(root, bundle, options = {}) {
         result.created.push(".isomorph/kit.lock.json");
     }
     else if (options.upgrade) {
-        // Already re-pinned when the migration moved the lock: then the diff is the migration's and the file is kept here.
         const changes = bundleDiff(previous.bundle, bundle);
         result.bundleChanges.push(...changes);
         if (changes.length) {
@@ -66,159 +54,8 @@ export async function initKit(root, bundle, options = {}) {
     }
     else
         result.kept.push(".isomorph/kit.lock.json");
-    // A file the migration rewrote is reported once, as updated, not again as kept by the pass after it.
-    result.kept = result.kept.filter(path => !result.updated.includes(path));
     return result;
 }
-/** The kit layout of CLI releases before 0.2.0, as `init --upgrade` finds it: everything here is what that layout wrote, nothing an app author chose. */
-const LEGACY = {
-    start: "<!-- harbour:kit:start -->",
-    end: "<!-- harbour:kit:end -->",
-    generatedPrefix: "// harbour:generated sha256:",
-    gitignoreLine: ".harbour/local/",
-    /**
-     * The project skills older CLIs wrote — `harbour-kit` up to 0.1.x, `isomorph-kit` up
-     * to 0.2.2 — each under one frontmatter name and one opening line, with a body that
-     * changed from release to release. Since 0.3.0 the rules live beside the user-level
-     * skill and no project skill is written.
-     */
-    skills: [
-        { path: ".claude/skills/harbour-kit/SKILL.md", frontmatter: "name: harbour-kit", opening: 'Follow the "Harbour development kit" block' },
-        { path: ".claude/skills/isomorph-kit/SKILL.md", frontmatter: "name: isomorph-kit", opening: 'Follow the "Isomorph development kit" block' }
-    ],
-    sdkPackage: "@harbour/app-sdk",
-    /** The SDK's exported type names, renamed with the package. */
-    typeNames: /\bHarbour(User|ErrorCategory|Error|Client|Result|CompatSource)\b/g,
-    /**
-     * The environment names the kit and the platform export to a check, a job and
-     * the Vite config, renamed with the CLI. Whole words: the session's
-     * `HARBOUR_LOCAL_USER_EMAIL` and the CLI↔gateway `HARBOUR_APP_GATEWAY_*` and
-     * `HARBOUR_GATE_*` names are not builder-visible and are not renamed.
-     */
-    envNames: /\bHARBOUR_(APP_URL|SDK_MODULE|IDENTITY_CONTEXT_SECOND_USER|IDENTITY_CONTEXT_HEADER|IDENTITY_CONTEXT|GATEWAY_URL|WORKLOAD_TOKEN|SCHEDULED_AT|LOCAL_ORIGIN|VITE_PORT)\b/g
-};
-/**
- * Moves an app set up by a CLI older than 0.2.0 to this kit, once, and only under
- * `init --upgrade`: the kit directory and its five entries are renamed (git records
- * renames), the two committed schema ids move with it, the `.gitignore` line and
- * the managed block in CLAUDE.md / AGENTS.md are rewritten, and the checks the old
- * kit generated are deleted for the next `check` to regenerate. A check the author
- * wrote or edited is kept, as everywhere else. Nothing happens when there is no old
- * layout, or when the current one already exists beside it. The old project skill
- * and the old names in the app's own files are handled after this, on every
- * `--upgrade`, so an app this pass already moved still loses them.
- */
-async function migrateLegacyKit(root, bundle, result) {
-    const legacy = join(root, LEGACY_KIT_DIRECTORY);
-    const paths = kitPaths(root);
-    if (!(await exists(legacy)) || await exists(paths.kit))
-        return;
-    const touched = (path) => result.updated.push(path);
-    await mkdir(paths.kit, { recursive: true });
-    for (const entry of ["kit.lock.json", "integrations.json", "checks", "ai-inventory.json", "local"]) {
-        if (!(await exists(join(legacy, entry))))
-            continue;
-        await rename(join(legacy, entry), join(paths.kit, entry));
-        touched(`${KIT_DIRECTORY}/${entry}`);
-    }
-    await rmdir(legacy).catch(() => undefined); // anything else in it was never the kit's
-    const declaration = await readJson(paths.declaration);
-    if (declaration)
-        await writeFile(paths.declaration, `${JSON.stringify({ ...declaration, schema: emptyDeclaration().schema }, null, 2)}\n`);
-    const lock = await readJson(paths.lock);
-    if (lock) {
-        result.bundleChanges = bundleDiff(lock.bundle, bundle);
-        await writeKitLock(root, { ...newKitLock(bundle, lock.tenantId, lock.appId), createdAt: lock.createdAt });
-    }
-    const ignore = join(root, ".gitignore");
-    const ignored = (await readFile(ignore, "utf8").catch(() => undefined))?.split("\n");
-    if (ignored?.includes(LEGACY.gitignoreLine)) {
-        await writeFile(ignore, ignored.map(line => line === LEGACY.gitignoreLine ? `${KIT_DIRECTORY}/local/` : line).join("\n"));
-        touched(".gitignore");
-    }
-    for (const file of ["CLAUDE.md", "AGENTS.md"]) {
-        const current = await readFile(join(root, file), "utf8").catch(() => "");
-        if (current.includes(LEGACY.start) && current.includes(LEGACY.end)) {
-            await upsertManagedBlock(join(root, file), managedBlock(), { start: LEGACY.start, end: LEGACY.end });
-            touched(file);
-        }
-    }
-    for (const name of await readdir(paths.checks).catch(() => [])) {
-        if (!isPristine(await readFile(join(paths.checks, name), "utf8").catch(() => ""), LEGACY.generatedPrefix))
-            continue;
-        await rm(join(paths.checks, name));
-        touched(`${KIT_DIRECTORY}/checks/${name}`);
-    }
-}
-/**
- * Deletes the project skills older CLIs wrote, on every `--upgrade` — an app the
- * layout migration moved under 0.2.0 still has the old one, and every app set up
- * before 0.3.0 has the `isomorph-kit` one. A file is the kit's by shape, not by
- * bytes: each release wrote a different body under the same frontmatter name and
- * the same opening line, so one whose body an author rewrote is kept, and
- * reported, as theirs.
- */
-async function retireLegacySkill(root, result) {
-    for (const skill of LEGACY.skills) {
-        const path = join(root, skill.path);
-        const text = await readFile(path, "utf8").catch(() => undefined);
-        if (text === undefined)
-            continue;
-        if (!isLegacyKitSkill(text, skill)) {
-            result.kept.push(skill.path);
-            continue;
-        }
-        await rm(path);
-        await rmdir(dirname(path)).catch(() => undefined);
-        result.updated.push(skill.path);
-    }
-}
-/** Frontmatter naming the kit's skill, and the opening every release wrote as the body's first line. */
-function isLegacyKitSkill(text, skill) {
-    const lines = text.split(/\r?\n/);
-    const close = lines.indexOf("---", 1);
-    if (lines[0] !== "---" || close < 0)
-        return false;
-    return lines.slice(1, close).includes(skill.frontmatter) && (lines.slice(close + 1).find(line => line.trim()) ?? "").startsWith(skill.opening);
-}
-/**
- * Rewrites what the old kit named in the app's own files — `package.json`,
- * `vite.config.*`, `src/`, `jobs/` and the retained checks — on every `--upgrade`:
- * the SDK's previous package name (and, in `package.json`, the tarball path the
- * old kit staged it under), its six exported type names, and the environment
- * names the kit and the platform export to a check, a job and the Vite config.
- * Whole words only, so an author's own `HarbourUserProfile` is theirs. Idempotent:
- * an app that names none of them is left untouched and unreported.
- */
-async function rewriteLegacyReferences(root, sdkPackage, result) {
-    const rewrite = (text) => text.replaceAll(`"${LEGACY.sdkPackage}"`, `"${sdkPackage}"`).replaceAll(`'${LEGACY.sdkPackage}'`, `'${sdkPackage}'`).replace(LEGACY.typeNames, "Isomorph$1").replace(LEGACY.envNames, "ISOMORPH_$1");
-    for (const path of ["package.json", "vite.config.ts", "vite.config.js", "vite.config.mjs", ...(await appSourceFiles(root))]) {
-        const current = await readFile(join(root, path), "utf8").catch(() => undefined);
-        if (current === undefined)
-            continue;
-        const next = path === "package.json" ? rewrite(current).replaceAll(`file:${LEGACY_KIT_DIRECTORY}/local/sdk/`, `file:${KIT_DIRECTORY}/local/sdk/`) : rewrite(current);
-        if (next !== current) {
-            await writeFile(join(root, path), next);
-            result.updated.push(path);
-        }
-    }
-}
-/** `src/**`, `jobs/**` and the retained checks, relative to the app root. */
-async function appSourceFiles(root) {
-    const files = [];
-    const walk = async (directory) => {
-        for (const entry of await readdir(join(root, directory), { withFileTypes: true }).catch(() => [])) {
-            const path = `${directory}/${entry.name}`;
-            if (entry.isDirectory())
-                await walk(path);
-            else if (/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(entry.name))
-                files.push(path);
-        }
-    };
-    for (const directory of ["src", "jobs", `${KIT_DIRECTORY}/checks`])
-        await walk(directory);
-    return files.sort();
-}
 function isSupportedApp(pkg) {
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     return Boolean(deps.vite && deps.react);
@@ -256,13 +93,9 @@ export function managedBlock() {
         MANAGED_START,
         "## Isomorph development kit",
         "",
-        "This app runs on Isomorph. Its rules live in the `isomorph` skill (Claude Code: `~/.claude/skills/isomorph/`, Codex: `~/.codex/skills/isomorph/`); if that skill is not installed, run `npx -y @isomorph.ai/cli agent-setup`.",
-        "",
-        "1. Read `core.md` beside the skill's `SKILL.md` before the first edit.",
-        "2. Before you add a key under `\"connections\"` in `.isomorph/integrations.json`, read `integrations.md` there.",
-        "3. Before you call `isomorph.ai.*`, read `ai.md`; before you create `jobs/`, read `jobs.md`.",
+        "This app runs on Isomorph: use the `isomorph` skill (Claude Code `~/.claude/skills/isomorph/`, Codex `~/.codex/skills/isomorph/`; if it is missing, run `npx -y @isomorph.ai/cli agent-setup`). Read `core.md` there before the first edit.",
         "",
-        "Commands: `isomorph dev --app-root .` runs the app locally; `isomorph check --app-root . --json` runs the gates the deployment pipeline runs, before every hand-off; `isomorph productionise --app-root .` deploys the private preview.",
+        "Commands: `isomorph dev --app-root . --detach --json`, `isomorph check --app-root . --json`, `isomorph deploy --app-root . --json`.",
         MANAGED_END
     ].join("\n");
 }
@@ -272,10 +105,13 @@ export function managedBlock() {
  * `--upgrade`. Nothing here is example content, because `write` only fills a
  * gap: an app that deleted a file it does not want must not have it recreated.
  */
-function kitFiles() {
+function kitFiles(root) {
     return {
+        // Name, description and audience: what `isomorph deploy` prints before it starts and records
+        // with the deployment. The folder name and an empty audience are only a starting point.
+        ".isomorph/app.json": renderAppProfile(defaultAppProfile(root)),
         // No connection. The starter calls no company system, and a connection the
-        // app does not call is a deploy that never happens: `isomorph productionise`
+        // app does not call is a deploy that never happens: `isomorph deploy`
         // files the access request for every declared connection and refuses to
         // start until IT has approved it. One is added when the app really calls it —
         // the steps and the worked Slack and warehouse examples are in integrations.md
@@ -330,30 +166,26 @@ Created by \`isomorph init\`: a Vite + React app that runs on Isomorph. Sign-in,
 
 ## Three commands
 
-- \`isomorph dev --app-root .\` — starts the app on this machine with a local database, file store and gateway; open the printed link.
-- \`isomorph check --app-root . --json\` — the same gates the deployment pipeline runs (types, build, schema, retained checks); read \`.isomorph/local/check-report.json\` afterwards.
-- \`isomorph productionise --app-root .\` — deploys a private preview for the people you name; \`isomorph promote\` makes it live for everyone once they have tried it.
+- \`isomorph dev --app-root . --detach --json\` — starts the app on this machine with a local database, file store and gateway; open the printed link.
+- \`isomorph check --app-root . --json\` — the same gates the deployment pipeline runs (types, build, schema, retained checks); the output is the report.
+- \`isomorph deploy --app-root . --json\` — deploys a private preview for the people named in \`.isomorph/app.json\`; \`isomorph promote\` makes it live for everyone once they have tried it.
 
 ## Where the rules are
 
-The kit's rules are in the \`isomorph\` skill that \`isomorph agent-setup\` installs for Claude Code (\`~/.claude/skills/isomorph/\`) and Codex (\`~/.codex/skills/isomorph/\`): \`core.md\` (identity, data, files, realtime, retained checks, commands, error codes), \`integrations.md\` (Slack, Gmail, warehouse), \`ai.md\` and \`jobs.md\`. The managed block in CLAUDE.md / AGENTS.md says when to read each, and \`init --upgrade\` keeps that block current.
+The kit's rules are in the \`isomorph\` skill that \`isomorph agent-setup\` installs for Claude Code (\`~/.claude/skills/isomorph/\`) and Codex (\`~/.codex/skills/isomorph/\`): \`core.md\` (identity, data, files, realtime, commands, error codes), \`integrations.md\` (Slack, Gmail, warehouse), \`ai.md\` and \`jobs.md\`. The managed block in CLAUDE.md / AGENTS.md points there.
 
-\`.isomorph/checks/\` is generated by \`isomorph check\` from \`migrations/\` and \`src/\` — do not write it by hand. \`.isomorph/integrations.json\` declares the company systems the app calls: none, to start.
+\`.isomorph/checks/\` is generated by \`isomorph check\` from \`migrations/\` and \`src/\` — do not write it by hand. \`.isomorph/integrations.json\` declares the company systems the app calls: none, to start. \`.isomorph/app.json\` holds the app's name, description and audience.
 `;
 const VITE_CONFIG = `import { defineConfig } from "vite";
 import react from "@vitejs/plugin-react";
 
-// \`isomorph dev\` fronts Vite with one loopback origin and sets ISOMORPH_LOCAL_ORIGIN;
-// the proxy below keeps SDK calls working if Vite is opened directly.
-const isomorphOrigin = process.env.ISOMORPH_LOCAL_ORIGIN ?? "http://127.0.0.1:4180";
-
+// \`isomorph dev\` fronts Vite with one loopback origin (the printed link) and sets ISOMORPH_VITE_PORT.
 export default defineConfig({
   plugins: [react()],
   server: {
     host: "127.0.0.1",
     port: Number(process.env.ISOMORPH_VITE_PORT ?? 5173),
-    strictPort: true,
-    proxy: { "/_harbour": { target: isomorphOrigin, changeOrigin: false } }
+    strictPort: true
   }
 });
 `;
@@ -390,7 +222,6 @@ export function App() {
     const { data } = await isomorph.data.from<Note>("notes").select("*").order("created_at", { ascending: false });
     setNotes(data);
   }, []);
-  // files capability — this call and \`upload\` below are what .isomorph/checks/files-journey.mjs exercises.
   const loadFiles = useCallback(async () => { setFiles((await isomorph.files.list("private/")) as StoredFile[]); }, []);
 
   useEffect(() => {
@@ -408,10 +239,9 @@ export function App() {
   };
   const toggle = async (note: Note) => { await isomorph.data.from("notes").update({ done: !note.done }).eq("id", note.id); await loadNotes(); };
   const remove = async (note: Note) => { await isomorph.data.from("notes").delete().eq("id", note.id); await loadNotes(); };
-  const upload = async (file: File) => { await isomorph.files.upload(\`private/\${file.name}\`, file); await loadFiles(); }; // .isomorph/checks/files-journey.mjs
+  const upload = async (file: File) => { await isomorph.files.upload(\`private/\${file.name}\`, file); await loadFiles(); };
 
-  // Company systems and AI are not part of the starter: .isomorph/integrations.json declares
-  // nothing and no isomorph.ai call exists, so nothing here waits on IT. Rules for adding
+  // Company systems and AI are not part of the starter. Rules for adding
   // either: integrations.md and ai.md in the isomorph skill.
 
   return (
@@ -420,12 +250,7 @@ export function App() {
       <p>Signed in as <strong>{user ? user.email : "…"}</strong> (identity from Isomorph; locally the fixture user).</p>
       {error && <p role="alert" style={{ color: "crimson" }}>{error}</p>}
 
-      {/* Notes — paired with .isomorph/checks/notes-journey.mjs and notes-cross-user.mjs, generated
-          from this section and migrations/0001_notes.sql; \`isomorph check\` rewrites both whenever
-          either one changes. Edit 0001_notes.sql in place only until this app's first deploy: an
-          applied migration is frozen, so after that the schema changes by adding the next
-          migrations/000N_*.sql — never by editing or deleting an applied file, and never by
-          dropping a deployed table. Rules: core.md in the isomorph skill (data). */}
+      {/* Notes — schema in migrations/0001_notes.sql. Rules: core.md in the isomorph skill (data). */}
       <section>
         <h2>Notes</h2>
         <form onSubmit={event => { event.preventDefault(); void addNote(); }}>
@@ -442,10 +267,7 @@ export function App() {
         </ul>
       </section>
 
-      {/* Private files — the only code here that calls isomorph.files.*, and so the only reason
-          .isomorph/checks/files-journey.mjs exists: delete this section and \`isomorph check\` deletes
-          that check too (one you have edited is yours to delete, in the same edit). Rules: core.md
-          in the isomorph skill (retained checks). */}
+      {/* Private files: the app's own file store (isomorph.files.*). */}
       <section>
         <h2>Private files</h2>
         <input type="file" aria-label="Upload file" onChange={event => { const file = event.target.files?.[0]; if (file) void upload(file); }} />
@@ -469,6 +291,4 @@ DROP POLICY IF EXISTS notes_owner ON notes;
 CREATE POLICY notes_owner ON notes
   USING (owner_subject = current_setting('harbour.user_id', true))
   WITH CHECK (owner_subject = current_setting('harbour.user_id', true));
-GRANT SELECT, INSERT, UPDATE, DELETE ON notes TO harbour_app_gateway;
-GRANT USAGE, SELECT ON SEQUENCE notes_id_seq TO harbour_app_gateway;
 `;