@isomorph.ai/cli 0.3.1-rc.1 → 0.3.1-rc.2

package/dist/packages/harbour-cli/src/app-schema.js

@@ -144,3 +144,7 @@ export function numericMinimum(checks, column) {
     }
     return minimum;
 }
+/** Whether `col <= n` / `col < n` caps the column: the mirror of `numericMinimum`, asked so no invented value is written into a range the app's own CHECK does not admit. */
+export function hasNumericMaximum(checks, column) {
+    return checks.some(check => new RegExp(String.raw `\b${column}\b[^<>=]*(?:<=|<)\s*-?\d+(?:\.\d+)?`, "i").test(check));
+}

package/dist/packages/harbour-cli/src/check.js

@@ -1,5 +1,6 @@
 import { readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { readAppSchema } from "./app-schema.js";
 import { describeRetainedChecks, syncRetainedChecks } from "./retained-checks.js";
 import { CliError } from "./output.js";
@@ -158,7 +159,7 @@ export async function runKitGate(root, options) {
                     output("Running the retained journeys against the gate's App Gateway.");
                 }
                 const name = state.current;
-                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { ...state.environment, ISOMORPH_SDK_MODULE: join(root, "node_modules", ...bundle.sdk.package.split("/"), "dist", "index.js"), NODE_NO_WARNINGS: "1" } });
+                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { ...state.environment, ISOMORPH_SDK_MODULE: sdkModuleSpecifier(root, bundle), NODE_NO_WARNINGS: "1" } });
                 const posted = await post(`/_gate/journeys/${encodeURIComponent(name)}`, { code: result.code, output: `${result.stdout}${result.stderr}`.slice(-4000) });
                 if (posted?.status !== 200)
                     throw new CliError("LOCAL_RUNTIME_FAILED", `The kit gate did not accept the result of ${name}.`);
@@ -175,6 +176,21 @@ export async function runKitGate(root, options) {
             await runtime.down();
     }
 }
+/**
+ * The SDK a generated journey imports, as a `file://` URL rather than a path.
+ *
+ * The journey does `await import(process.env.ISOMORPH_SDK_MODULE)`, and on
+ * Windows a bare absolute path is not a specifier `import()` accepts: Node
+ * reads the drive letter in `D:\\app\\node_modules\\…` as a URL scheme and
+ * refuses it with ERR_UNSUPPORTED_ESM_URL_SCHEME. Every journey on Windows
+ * therefore failed before it reached its first assertion. It went unseen
+ * because `isomorph check` reported those failures and still exited 0 (a
+ * dependency's `beforeExit` hook overwrote `process.exitCode`, fixed in
+ * 0.3.1-rc.1), so the Windows lane read the run as a pass.
+ */
+export function sdkModuleSpecifier(root, bundle) {
+    return pathToFileURL(join(root, "node_modules", ...bundle.sdk.package.split("/"), "dist", "index.js")).href;
+}
 /**
  * `.isomorph/checks/` is generated from what the app declares — the tables the
  * gate's replayed database holds, the capabilities the gate derived from the

package/dist/packages/harbour-cli/src/guide.js

@@ -13,21 +13,23 @@ export const GUIDE_MODULES = {
 
 ## The SDK is the only door
 
-\`@isomorph.ai/app-sdk\`, on the client exported by \`src/isomorph.client.ts\`, is the whole path: \`isomorph.identity.current()\`, \`isomorph.data.from(table)\`, \`isomorph.files.*\`, \`isomorph.realtime.*\`, \`isomorph.integrations.execute\` (integrations.md) and \`isomorph.ai.chat\` (ai.md). Never open a database, bucket or company URL from browser code; never add another backend, auth library, deployment config, provider key or SDK. No secrets, tokens, \`.env\` values or fetched company content in source. Commit \`.isomorph/integrations.json\` and \`.isomorph/kit.lock.json\`, never \`.isomorph/local/\`.
+\`@isomorph.ai/app-sdk\`, on the client \`src/isomorph.client.ts\` exports, is the whole path: \`isomorph.identity.current()\`, \`isomorph.data.from(table)\`, \`isomorph.files.*\`, \`isomorph.realtime.*\`, \`isomorph.integrations.execute\` (integrations.md), \`isomorph.ai.chat\` (ai.md). Never open a database, bucket or company URL from browser code; never add a backend, auth library, deployment config, provider key or SDK. No secrets, tokens, \`.env\` values or fetched company content in source. Commit \`.isomorph/integrations.json\` and \`.isomorph/kit.lock.json\`, never \`.isomorph/local/\`.
 
 ## Identity
 
-Isomorph SSO signs everyone in: no login forms, no roles or ids trusted from the browser, no public routes or wildcard exceptions. \`isomorph.identity.current()\` answers \`{ id, email }\` only — no display name; derive one from the email.
+Isomorph SSO signs everyone in: no login forms, no browser-trusted roles or ids, no public routes. \`isomorph.identity.current()\` answers \`{ id, email }\` only; derive a display name from the address.
 
 ## Data (\`core.rls-owner-scoped\`)
 
-Schema changes are SQL files in \`migrations/\`, applied by \`isomorph dev\` and \`isomorph check\`. Every table: \`ENABLE ROW LEVEL SECURITY\`, a policy, and \`GRANT\` of every verb a policy allows to \`harbour_app_gateway\` and no other role; the database gate names whatever breaks this. Row ownership is decided in SQL through \`current_setting('harbour.user_id', true)\` (set by the gateway per request, with \`harbour.user_email\`), never in the browser. Two patterns:
+Schema changes are SQL files in \`migrations/\`. Every table: \`ENABLE ROW LEVEL SECURITY\`, a policy, and \`GRANT\` of every verb it allows to \`harbour_app_gateway\` and no other role. Row ownership is decided in SQL through \`current_setting('harbour.user_id', true)\` (set by the gateway per request, with \`harbour.user_email\`), never in the browser. Two patterns:
 
-- **Private table** — every policy scoped to \`current_setting('harbour.user_id', true)\`; the gate then asserts a second signed-in person cannot read, update or delete another person's row.
-- **Shared-read, owner-write** — \`USING (true)\` for SELECT; INSERT, UPDATE and DELETE scoped to the identity setting.
+- **Private table** — every policy scoped to that setting; the gate asserts another signed-in person cannot read, update or delete the row.
+- **Shared-read, owner-write** — \`USING (true)\` for SELECT; INSERT, UPDATE and DELETE scoped to that setting.
 
 The gate treats a table as private when any of its policies mentions \`harbour.user_id\` (or \`harbour.user_email\`), so a shared-read table must keep that setting out of its SELECT policy, or its cross-user read check fails.
 
+Iterating on the schema needs no restart: every \`isomorph check\` replays \`migrations/*.sql\` into a fresh, empty scratch database. \`isomorph dev --reset\` only refreshes the running app's own data, so its UI shows the new schema; stopping, resetting and waiting before each check costs minutes and changes nothing.
+
 ## Files
 
 \`isomorph.files.upload(path, file)\`, \`list(prefix)\` and \`remove([path])\`.
@@ -38,45 +40,47 @@ The gate treats a table as private when any of its policies mentions \`harbour.u
 
 ## Retained checks (\`core.journey-fk\`)
 
-\`.isomorph/checks/\` holds one journey per capability the app's code uses plus a cross-user denial per private table. \`isomorph check\` generates them from \`migrations/\` and \`src/\` and deletes the ones the app no longer needs, so run it in the same edit that changes the app; never write or remove these files by hand. A generated check starts with \`// isomorph:generated\` and a digest of its body; edit one and it is yours — kept, no longer updated, never deleted — so delete it yourself in the same edit that removes the feature it covers. The pairing is two-way: the \`flow\` gate refuses a capability no check exercises and a check exercising something the code no longer does (\`flow.check-failed\`) — the most common reason a first deploy is refused. What cannot be generated (\`actions\`, \`realtime\`, a table with no migration) is named for you to write. No journey is generated for a table whose row needs a parent (a foreign key): write that table's journey yourself.
+\`.isomorph/checks/\` holds one journey per capability the app uses, plus a cross-user denial per private table. \`isomorph check\` generates them from \`migrations/\` and \`src/\` and deletes what the app dropped, so run it in the edit that changes the app; never write or remove them by hand. A generated check starts with \`// isomorph:generated\` and a digest of its body; edit one and it is yours: kept, never updated or deleted, so delete it in the same edit that drops the feature. Two-way (\`flow.check-failed\`): the \`flow\` gate refuses a capability no check exercises, and a check exercising what the code dropped — the most common first-deploy refusal. What cannot be generated (\`actions\`, \`realtime\`, a table with no migration) is named for you to write. No journey is generated for a table whose row needs a parent (a foreign key): write that table's journey yourself.
+
+A journey failing on a CHECK constraint: generation marks the row by the first free text or number column with no foreign key, no allowed-values CHECK and no ceiling on a number, so that column's other CHECKs must admit an arbitrary unique value. Only the generated file names the column.
 
 ## Commands
 
-- \`isomorph dev --app-root .\` — local Postgres, storage, gateway and Vite behind one loopback origin; company calls use the \`isomorph login\` account.
-- \`isomorph check --app-root . --json\` — types, build, then the pipeline's own kit gate locally (declaration, database gate, write probe with cross-user denial, journeys, operation coverage); report in \`.isomorph/local/check-report.json\`.
-- \`isomorph productionise --app-root . …\` — saves and deploys the private preview; \`isomorph promote\` after the person has tried it.
+- \`isomorph dev --app-root .\` — local Postgres, storage, gateway and Vite on one origin; company calls use the \`isomorph login\` account.
+- \`isomorph check --app-root . --json\` — types, build, then the pipeline's kit gate locally (declaration, database, write probe, journeys, coverage).
+- \`isomorph productionise --app-root . …\` — private preview; \`isomorph promote\` makes it live.
 
 ## Error codes
 
-- \`CONFIG_REQUIRED\`: no company connected — \`isomorph connect <work-email>\`.
-- \`AUTH_REQUIRED\`: sign in — \`isomorph login\`.
-- \`NOT_A_MEMBER\` / \`TENANT_AMBIGUOUS\`: no company, or more than one, admits that email domain — use the command it printed or IT's link.
-- \`CHECKS_FAILED\` / \`CHECKS_STALE\`: fix what \`isomorph check\` reports and run it again on this exact code.
+- \`CONFIG_REQUIRED\`: \`isomorph connect <work-email>\`; \`AUTH_REQUIRED\`: \`isomorph login\`.
+- \`NOT_A_MEMBER\` / \`TENANT_AMBIGUOUS\`: use the command it printed or IT's link.
+- \`CHECKS_FAILED\` / \`CHECKS_STALE\`: fix what \`isomorph check\` reports, then rerun on this code.
 - \`APP_NOT_FOUND\`: the app is linked to another company — connect back to it with its start link, or clear \`appId\` and \`tenantId\` in \`.isomorph/kit.lock.json\` to relink.
-- \`INTEGRATIONS_NOT_READY\`: IT has not approved a declared connection yet (integrations.md).
-- \`AI_NOT_READY\`: IT has not enabled the company's AI setup yet (ai.md).`,
+- \`INTEGRATIONS_NOT_READY\` / \`AI_NOT_READY\`: IT has not approved the connection (integrations.md) or enabled AI (ai.md).`,
     integrations: `# Company systems (Slack, Gmail, warehouse)
 
 ## Declare
 
-Reach company systems only through \`isomorph.integrations.execute(connection, { operation, resource, input })\`, declared in \`.isomorph/integrations.json\`. Operations, a closed set: \`slack.channel.history\` (user identity), \`slack.message.post\` (app or user identity, declared per app), \`gmail.thread.list\`, \`gmail.message.read\` and \`gmail.message.send\` (user identity, resource \`inbox\`, plain-text send), \`warehouse.view.read\` (app identity). Resources are logical names, never IDs, URLs or tokens. The file starts as \`"connections": {}\`: declare a connection only when the app really calls it, by the identifier the catalog lists, with only the operations it calls — each declared connection blocks the deploy until IT grants it, and an undeclared one cannot be requested (\`CONNECTION_NOT_DECLARED\`). Strict JSON, no comments.
+Reach company systems only through \`isomorph.integrations.execute(connection, { operation, resource, input })\`, declared in \`.isomorph/integrations.json\`. Operations, a closed set: \`slack.channel.history\` (user identity), \`slack.message.post\` (app or user identity, declared per app), \`gmail.thread.list\`, \`gmail.message.read\` and \`gmail.message.send\` (user identity, resource \`inbox\`, plain-text send), \`warehouse.view.read\` (app identity). Resources are logical names, never IDs, URLs or tokens. The file starts as \`"connections": {}\`: declare one only when the app calls it, by the catalog's identifier, with only the operations it calls — each declared connection blocks the deploy until IT grants it; an undeclared one cannot be requested (\`CONNECTION_NOT_DECLARED\`). Strict JSON, no comments.
 
 \`\`\`json
 "company-slack": { "kind": "saas", "operations": { "slack.message.post": { "identity": "app", "resources": ["team-updates"] } } },
 "sales-warehouse": { "kind": "database", "operations": { "warehouse.view.read": { "identity": "app", "resources": { "weekly_sales": { "columns": ["week", "total"] } } } } }
 \`\`\`
 
+A connection that was READY reporting PENDING again: widening an approved declaration (another column on a declared resource, or another operation) re-files the request, and a database connection's development lane re-enters provisioning while access is re-minted, so the widened read fails until it republishes. Nothing is revoked: the record stays GRANTED with the resources it had, and the window closes on its own — re-check the status rather than treat it as a blocker.
+
 ## Catalog
 
-Never guess a connection, channel, table, view, mailbox or warehouse column — a guessed name is refused before IT's queue ever sees it. Before writing a warehouse query or mapping response fields, run \`isomorph integrations catalog --app-root . --json\`, select a listed table or view, and copy its listed column names exactly; if the object or column is absent, report that catalog gap instead of substituting a plausible name. A resource whose catalog columns are \`["*"]\` is declared and read with \`["*"]\`: inspect the returned row keys; do not invent a schema or ask IT for one.
+Never guess a connection, channel, table, view, mailbox or warehouse column — a guessed name is refused before IT's queue ever sees it. Before writing a warehouse query or mapping response fields, run \`isomorph integrations catalog --app-root . --json\`, select a listed table or view, and copy its listed column names exactly; if either is absent, report that catalog gap instead of substituting a plausible name. A resource whose catalog columns are \`["*"]\` is declared and read with \`["*"]\`: inspect the returned row keys; never invent a schema.
 
 ## Request
 
-One request per connection; IT approves it once for every environment. \`isomorph dev\` and \`isomorph productionise\` file it for you; \`isomorph integrations request <connection> --reason "<what the app does with it>" --app-root . --json\` files it now — submit the request yourself in the same turn, and never tell the person to ask IT before you have submitted the request.
+One request per connection; IT approves it once for every environment. \`isomorph dev\` and \`isomorph productionise\` file it for you; \`isomorph integrations request <connection> --reason "<why the app needs it>" --app-root . --json\` files it now — submit the request yourself in the same turn, and never tell the person to ask IT before you have submitted the request.
 
 ## Status
 
-READY: use it now. PENDING: say "IT has to approve this; the app works without it until then" and check later with \`isomorph integrations status --app-root . --json\`. Before a real integration test, read that status; show pending IT approval and missing consent separately, and test ready destinations independently. Retained checks that call \`isomorph.integrations.execute\` get the gate's fixture, locally and in the pipeline alike (nothing sent or read; the report says so); only \`isomorph check --integrations\` (reads) exercises real access.
+READY: use it now. PENDING: say "IT has to approve this; the app works without it until then" and check later with \`isomorph integrations status --app-root . --json\`. Before a real integration test read that status: show pending approval and missing consent separately. Retained checks calling \`isomorph.integrations.execute\` get the gate's fixture, locally and in the pipeline (nothing sent or read); only \`isomorph check --integrations\` (reads) exercises real access.
 
 ## Call shape
 
@@ -92,11 +96,11 @@ Input bounds: \`slack.channel.history\` \`input.limit\` 1..15, \`gmail.thread.li
 
 ## Slack modes
 
-\`"identity": "app"\` posts as the company's Slack bot, Isomorph AI, under the connection's \`presentation.displayName\` (optional \`iconEmoji\`), which IT approves — leave it out to post as Isomorph AI itself; every app-mode post ends "Posted by <app> on Isomorph". \`"identity": "user"\` posts as the person after their consent; an older consent answers \`USER_RECONNECT_REQUIRED\` — offer Connect again. Never pretend one is the other. The declaration is the mode requested; the call names the approved mode it runs under (\`mode: "app"\` or \`"user"\`): optional with one approved mode, required with both (\`MODE_REQUIRED\`), and an unapproved mode is \`MODE_NOT_GRANTED\`, never swapped. \`RESOURCE_NOT_APPROVED\` on a post: the bot is not in the channel — say "IT (or anyone in the channel) has to run \`/invite @Isomorph AI\` in #<channel> first". On a request: the resource is not on the connection yet — IT adds it in the console under Controls & integrations, then you run the same request again.
+\`"identity": "app"\` posts as the company's Slack bot, Isomorph AI, under the connection's IT-approved \`presentation.displayName\` (optional \`iconEmoji\`); omit it to post as Isomorph AI itself. \`"identity": "user"\` posts as the person after their consent; an older consent answers \`USER_RECONNECT_REQUIRED\`: offer Connect again. Never pretend one is the other. The call names the approved mode it runs under (\`mode: "app"\` or \`"user"\`): optional with one approved mode, required with both (\`MODE_REQUIRED\`); an unapproved mode is \`MODE_NOT_GRANTED\`, never swapped. \`RESOURCE_NOT_APPROVED\` on a post: the bot is not in the channel — say "IT (or anyone in the channel) runs \`/invite @Isomorph AI\` in #<channel>". On a request: the resource is not on the connection yet — IT adds it in the console under Controls & integrations, then run the same request again.
 
 ## Consent
 
-Only user-identity operations (\`slack.channel.history\`, \`gmail.thread.list\`, \`gmail.message.read\`, \`gmail.message.send\`, and \`slack.message.post\` declared \`"identity": "user"\`) need it; build the flow in unasked, during the original implementation: the operation's control calls \`isomorph.integrations.connect(connection)\`, follows \`authorizationUrl\` when the result is \`consent_required\`, returns to a clear connected state and lets the person continue. Consent starts only from that person's control, never on page load; missing consent never falls back to another account. App-identity operations (\`slack.message.post\` declared \`"identity": "app"\`, \`warehouse.view.read\`) never call connect — it is refused as unapproved user access and puts nothing in IT's queue.
+Only user-identity operations (\`slack.channel.history\`, \`gmail.thread.list\`, \`gmail.message.read\`, \`gmail.message.send\`, and \`slack.message.post\` declared \`"identity": "user"\`) need it; build the flow in unasked, during the original implementation: the operation's control calls \`isomorph.integrations.connect(connection)\`, follows \`authorizationUrl\` when the result is \`consent_required\`, returns to a clear connected state and lets the person continue. Consent starts from that control, never on page load; missing consent never falls back to another account. App-identity operations (\`slack.message.post\` declared \`"identity": "app"\`, \`warehouse.view.read\`) never call connect — it is refused and puts nothing in IT's queue.
 
 ## Sends
 

package/dist/packages/harbour-cli/src/integrations.js

@@ -205,8 +205,24 @@ export function openRequestId(lanes) {
 }
 /** A granted lane past IT's expiry (the server reads it as failed; the sentence says why). */
 const expired = (grant, nowMs) => grant.status === "GRANTED" && Boolean(grant.expiresAt && Date.parse(grant.expiresAt) <= nowMs);
-/** A lane a deploy can run on: granted, unexpired, not still provisioning or failed (a person's consent is asked in the app, at runtime). */
-const laneReady = (grant, nowMs) => grant.status === "GRANTED" && !expired(grant, nowMs) && grant.readiness !== "pending" && grant.readiness !== "failed";
+/**
+ * The worker is minting this lane's credentials right now. `readiness` cannot say so on its own —
+ * the server folds both waits into `pending` — but the grant summary has always carried the
+ * provisioning status beside it, and the two together separate seconds from days: `REQUESTED` waits
+ * on a person at IT, while `PENDING` provisioning follows a decision already taken (IT's, the anchor
+ * rule's, or the connection's development preapproval) and clears itself. Observed 2026-09-14: one
+ * added column re-files an approved warehouse request, the still-GRANTED lanes are re-minted, and
+ * reading that as IT's sent a builder off to report a permanently broken development lane.
+ */
+const minting = (grant) => grant.readiness === "pending" && grant.provisioning === "PENDING";
+/**
+ * Which readiness values can carry a deploy, as a total map so `npm run check` refuses a new
+ * readiness value until this question has been answered for it. A person's consent is asked
+ * inside the running app, so a consent lane deploys.
+ */
+const DEPLOYABLE = { ready: true, consent_required: true, reconnect_required: true, pending: false, failed: false };
+/** A lane a deploy can run on: granted, unexpired, on a readiness that can carry one, and not still being minted — implied by `pending` today, and asked anyway so the gate fails closed if that map ever changes. */
+const laneReady = (grant, nowMs) => grant.status === "GRANTED" && !expired(grant, nowMs) && DEPLOYABLE[grant.readiness] && !minting(grant);
 /** Builder-safe failure guidance as one sentence: what failed, then what to do. */
 export const failureSentence = (failure) => `${failure.message} ${failure.remediation}`;
 const failureError = (failure) => new CliError(failure.code, failureSentence(failure));
@@ -218,12 +234,17 @@ const failureError = (failure) => new CliError(failure.code, failureSentence(fai
  * read right after filing may not carry the anchor yet, so the filing's own
  * request id is the fallback). Development ready while another lane waits is
  * the connection's development preapproval: the server writes that lane at
- * filing time and keeps the request open for IT.
+ * filing time and keeps the request open for IT. A lane the worker is still
+ * minting reads `being set up`: it carries the request it was re-filed under,
+ * but nobody has to decide anything and it clears itself in seconds.
  */
 export function laneSummary(group, requestHint, nowMs = Date.now()) {
     const { lanes } = group;
     const open = openRequestId(lanes) ?? requestHint;
-    const waitingOn = (lane) => { const grant = lanes[lane]; return grant ? (grant.readiness === "pending" ? grant.pendingRequestId ?? requestHint : undefined) : open; };
+    // Only a lane a person still has to decide is named as IT's. A lane being minted is `pending` too and always
+    // carries the request id it was re-filed under, so naming it here was the whole bug — and it also turned a
+    // sibling `ready` development lane into a "(preapproved)" one, as if something were being held back from it.
+    const waitingOn = (lane) => { const grant = lanes[lane]; return grant ? (grant.readiness === "pending" && !minting(grant) ? grant.pendingRequestId ?? requestHint : undefined) : open; };
     const word = (lane) => {
         const grant = lanes[lane];
         const request = waitingOn(lane);
@@ -236,6 +257,8 @@ export function laneSummary(group, requestHint, nowMs = Date.now()) {
             case "ready": return { base: "ready", suffix: lane === "development" && ENVIRONMENTS.some(other => other !== lane && waitingOn(other)) ? ` (preapproved${until})` : until };
             case "consent_required": return { base: "approved", suffix: " (connect your account in the app)" };
             case "reconnect_required": return { base: "approved", suffix: " (reconnect your account in the app)" };
+            // `being set up` is reachable at last: a minting lane is `pending` here too, and `waitingOn` no longer hands
+            // it a request id, so it falls through to the words that were always the right ones for it.
             case "pending": return { base: request ? `waiting for IT (request ${request})` : "being set up", suffix: "" };
             case "failed": return { base: grant.status === "DENIED" ? "denied" : grant.status === "REVOKED" ? "revoked" : "failed", suffix: "" };
         }
@@ -277,6 +300,9 @@ export async function assertPreviewIntegrationsReady(root, client, tenantId, bun
     if (!filed)
         return (await readKitLock(root))?.appId || undefined;
     const nowMs = Date.now();
+    // `awaitsDecision` separates the refusals a person has to act on from a preview lane the worker is
+    // simply still minting: that one refuses too (there are no credentials to deploy against yet), but
+    // saying "Waiting for IT" over it is the same false blocker the minting predicate exists to end.
     const waiting = [];
     for (const item of settled(filed.requests)) {
         const group = findGroup(filed.groups, item.connection, item.identityMode);
@@ -286,17 +312,24 @@ export async function assertPreviewIntegrationsReady(root, client, tenantId, bun
             throw failureError(preview.failure);
         if (preview && laneReady(preview, nowMs))
             continue;
+        if (preview && minting(preview)) {
+            waiting.push({ awaitsDecision: false, line: `${item.connection} ${IDENTITY_WORDS[item.identityMode]} is being set up for the preview; nobody has to approve anything and it finishes on its own.` });
+            continue;
+        }
         const requestId = item.outcome.requestId ?? openRequestId(group.lanes);
-        waiting.push(requestId
-            ? `Waiting for IT: ${item.connection} ${IDENTITY_WORDS[item.identityMode]} (request ${requestId}).`
-            : `${item.connection} ${IDENTITY_WORDS[item.identityMode]} is not ready for the preview (${laneSummary(group, undefined, nowMs)}); ask IT to review this app's access in the Isomorph console.`);
+        waiting.push({ awaitsDecision: true, line: requestId
+                ? `Waiting for IT: ${item.connection} ${IDENTITY_WORDS[item.identityMode]} (request ${requestId}).`
+                : `${item.connection} ${IDENTITY_WORDS[item.identityMode]} is not ready for the preview (${laneSummary(group, undefined, nowMs)}); ask IT to review this app's access in the Isomorph console.` });
     }
     if (!waiting.length)
         return filed.appId;
     output("Isomorph cannot deploy the preview yet:");
-    for (const line of waiting)
+    for (const { line } of waiting)
         output(`  ${line}`);
-    throw new CliError("INTEGRATIONS_NOT_READY", `${waiting.join(" ")} IT approves a request once, for every environment; rerun productionise when it is approved.`);
+    const next = waiting.some(item => item.awaitsDecision)
+        ? "IT approves a request once, for every environment; rerun productionise when it is approved."
+        : "Run productionise again in a minute.";
+    throw new CliError("INTEGRATIONS_NOT_READY", `${waiting.map(item => item.line).join(" ")} ${next}`);
 }
 /**
  * `productionise` / `promote` pre-check for an app that calls governed AI
@@ -386,5 +419,5 @@ export async function integrationsStatus(root, client) {
     if (!lock?.appId)
         return { linked: false, grants: [], requests: [] };
     const listed = await client.list(lock.appId);
-    return { appId: lock.appId, linked: true, grants: listed.grants.map(grant => ({ connection: grant.connection, environment: grant.environment, identityMode: grant.identityMode, status: grant.status, operations: grant.operations, resources: grant.resources, expiresAt: grant.expiresAt, readiness: grant.readiness, pendingRequestId: grant.pendingRequestId, failure: grant.failure })), requests: listed.requests };
+    return { appId: lock.appId, linked: true, grants: listed.grants.map(grant => ({ connection: grant.connection, environment: grant.environment, identityMode: grant.identityMode, status: grant.status, operations: grant.operations, resources: grant.resources, expiresAt: grant.expiresAt, readiness: grant.readiness, provisioning: grant.provisioning, pendingRequestId: grant.pendingRequestId, failure: grant.failure })), requests: listed.requests };
 }

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "isomorph.kit-bundle/1.0",
-    "kitVersion": "0.3.0",
+    "kitVersion": "0.3.1",
     "sdk": {
         "package": "@isomorph.ai/app-sdk",
         "version": "1.2.0",
@@ -8,21 +8,21 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:6b41494883215527a73e05a1e07d022552dfe3402915e23950e357e5e9381c49"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:cdb494a98ddcab21a42b9cb8089d077007da1d4f178458cef94b3aa9ad6e1a11",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:34d5e175a6346636a25fe8c6f9b730e93d67ef1e3361b0349c31f2a2da3322a8"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:af841461de984099c202b5d0c86321c5e5f51713f3bcd487f0fc904b17a30d3a",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:fe94fb879357520bc9b34db590a64b6c82cb63e59b97ca76d1cde470e84f7df3"
     },
     "nativeRuntime": {
         "darwinArm64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:a07e18b61ca9b5db8077fd37ced21ca29bc4e37049f10724c61cea5a68d46077",
-            "sha256": "a07e18b61ca9b5db8077fd37ced21ca29bc4e37049f10724c61cea5a68d46077"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:56db6d0080e0f38401d8a4a6cba0dfd44fd66878d574e88df8b6ffe63551fa4e",
+            "sha256": "56db6d0080e0f38401d8a4a6cba0dfd44fd66878d574e88df8b6ffe63551fa4e"
         },
         "linuxX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:43b80fbe2153c79ccca6b663d79e32e100f56b6ada896f0bb192cfd23bbfc1cc",
-            "sha256": "43b80fbe2153c79ccca6b663d79e32e100f56b6ada896f0bb192cfd23bbfc1cc"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:082272dd1823d51e05d5f9497c5644dd62dd3996ffe83ae69f357471d7d492a0",
+            "sha256": "082272dd1823d51e05d5f9497c5644dd62dd3996ffe83ae69f357471d7d492a0"
         },
         "windowsX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:540020f44f874d20c28fbd19b8879aab9f3e41aa2d228f9b5b7bc301ac428afd",
-            "sha256": "540020f44f874d20c28fbd19b8879aab9f3e41aa2d228f9b5b7bc301ac428afd"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:5341eab77337713255fa3175f14038d702b07332bb0073b5bba333ba5adf5bf1",
+            "sha256": "5341eab77337713255fa3175f14038d702b07332bb0073b5bba333ba5adf5bf1"
         }
     },
     "brief": {

package/dist/packages/harbour-cli/src/retained-checks.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { allowedLiterals, numericMinimum, textLengthBounds } from "./app-schema.js";
+import { allowedLiterals, hasNumericMaximum, numericMinimum, textLengthBounds } from "./app-schema.js";
 import { COVERED_CAPABILITIES, capabilitiesCalled, capabilityCallSurface, capabilityUsage, sourceTableUsage } from "./source-inventory.js";
 import { kitPaths } from "./kit.js";
 /**
@@ -334,7 +334,7 @@ function rowShape(schema, needsUpdate) {
         return { blocked: `its \`${unwritable.name} ${unwritable.declaredType}\` column ${unwritable.references ? "references another table, so a row cannot be written without inventing its parent — rule core.journey-fk (core.md in the isomorph skill)" : "has a type Isomorph cannot invent a value for"}` };
     const marker = writable.find(column => isMarker(column) && column.notNull && !column.hasDefault) ?? writable.find(isMarker);
     if (!marker)
-        return { blocked: "it has no free text or number column a check could write a unique value into and find the row by" };
+        return { blocked: markerless(writable) };
     const markerExpression = marker.type === "text" ? textMarker(marker) : "Date.now() % 2000000000";
     if (!markerExpression)
         return { blocked: `\`${marker.name}\` is the only column a check could find a row by, and its CHECK constraint leaves no room for a unique value` };
@@ -345,6 +345,12 @@ function rowShape(schema, needsUpdate) {
         return { blocked: "the app updates it, but every column Isomorph could change is the one the check finds the row by" };
     return { values: [`${marker.name}: markerValue`, ...fill], marker, markerExpression, locator, uuid: fill.some(value => value.includes("randomUUID(")), update };
 }
+/** Why nothing on the table can carry the unique value a journey finds its row by — naming the capped number when that is what ruled the last candidate out, so the answer is a column to add rather than a CHECK to weaken. */
+function markerless(writable) {
+    const none = "it has no free text or number column a check could write a unique value into and find the row by";
+    const capped = writable.find(cappedNumber);
+    return capped ? `${none}: \`${capped.name} ${capped.declaredType}\` is a number its own CHECK caps, and the unique value a journey writes is a timestamp` : none;
+}
 /** What a journey writes into a free-text column it updates, when the column's length bounds admit it. */
 const UPDATED_TEXT = "isomorph check updated";
 /** The column a journey changes, and what it changes it to: a boolean is flipped, a closed set moves to its other value, free text gets a fixed one. */
@@ -366,8 +372,10 @@ function updateStep(writable, marker, locator) {
     }
     return undefined;
 }
+/** A number the app's own CHECK caps from above: the unique value a journey marks a row with is a timestamp, which no ordinary ceiling admits, so such a column is never the marker. */
+const cappedNumber = (column) => (column.type === "integer" || column.type === "number") && hasNumericMaximum(column.checks, column.name);
 /** A column a check can write a unique value into and then filter on. */
-const isMarker = (column) => (column.type === "text" || column.type === "integer" || column.type === "number") && !column.references && !allowedLiterals(column.checks, column.name).length;
+const isMarker = (column) => (column.type === "text" || column.type === "integer" || column.type === "number") && !column.references && !cappedNumber(column) && !allowedLiterals(column.checks, column.name).length;
 /** A unique marker satisfying the column's own length constraints, or `undefined` when they leave no room for one. */
 function textMarker(column) {
     const { min, max } = textLengthBounds(column.checks, column.name);

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.3.1-rc.1";
+export const CLI_VERSION = "0.3.1-rc.2";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.3.1-rc.1",
+  "version": "0.3.1-rc.2",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.3.0"
+      "version": "0.3.1"
     }
   }
 }