@isomorph.ai/cli 0.4.2 → 0.5.1

package/dist/packages/harbour-cli/src/retained-checks.js

@@ -1,443 +0,0 @@
-import { createHash } from "node:crypto";
-import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { allowedLiterals, hasNumericMaximum, numericMinimum, textLengthBounds } from "./app-schema.js";
-import { COVERED_CAPABILITIES, capabilitiesCalled, capabilityCallSurface, capabilityUsage, sourceTableUsage } from "./source-inventory.js";
-import { kitPaths } from "./kit.js";
-/**
- * Retained checks, generated from what the app declares.
- *
- * `.isomorph/checks/` used to be shipped by `isomorph init` as three fixed files
- * written for the starter's own notes/files example. The first thing a builder
- * does is replace that example, and the checks stayed — exercising tables and a
- * capability the app no longer had, which is exactly what the pipeline's `flow`
- * gate refuses (`flow.check-failed`). It cost two real builder runs on one day:
- * a todo app that dropped the files UI and renamed notes to todos failed on
- * `files-journey.mjs` ("application capability is not enabled") and on
- * `notes-cross-user.mjs` ("relation … does not exist").
- *
- * So there are no templates. The two readings the `flow` gate already makes of
- * the app's own code — `sourceTableUsage` (every `<table> <verb>` the browser
- * code performs) and `capabilityUsage` (every SDK namespace it calls) — decide
- * which checks exist, and the app's own database, the one `isomorph check` has
- * just replayed `migrations/*.sql` into, supplies the row a journey writes. A
- * check exists for each capability the app actually has and for none it does
- * not, by construction rather than by guidance.
- *
- * Three rules keep that safe:
- *
- *   - **Isomorph only manages what Isomorph wrote.** A generated file carries a
- *     digest of its own body on its first line. `isomorph check` rewrites and
- *     deletes a file whose digest still matches; the moment a builder edits one
- *     — or writes their own — it is theirs, and Isomorph reports it instead of
- *     touching it. That was #456's lesson: the remediation we hand out must
- *     never overwrite the app.
- *   - **Isomorph never writes a check its own gate would refuse.** The `flow`
- *     gate refuses a retained check exercising a capability no code in the app
- *     calls (#469), reading that surface with `capabilityCallSurface`; nothing
- *     is generated for a capability outside it.
- *   - **The `flow` gate is untouched.** Generation removes the drift; the gate
- *     still decides. Surface Isomorph cannot write a journey for is named with
- *     the reason, and `flow` fails exactly as it did before.
- */
-/** First line of every file Isomorph wrote, carrying the digest of the body below it. */
-const GENERATED_PREFIX = "// isomorph:generated sha256:";
-/** Capability names that own a fixed file name, so a table of the same name does not shadow one. */
-const RESERVED_NAMES = new Set(["files", "telemetry", "actions", "realtime", "ai"]);
-/** The data verbs a generated journey performs, in the order it performs them — the set `source-inventory.ts` inventories. */
-const VERB_ORDER = ["insert", "upsert", "select", "update", "delete"];
-/**
- * Regenerates `.isomorph/checks/` in place from the app's code and its own
- * database, and reports every decision. `declared`, when given, is the
- * capability set the kit gate derived from the source — the set its coverage
- * gate will demand evidence for — and it is the authority: the kit lane and
- * this reading agree on the one call shape the starter teaches
- * (`isomorph.<namespace>.<method>(`), for which the lane's derivation is exact.
- * Without it (tests, no gate) the source reading decides.
- */
-export async function syncRetainedChecks(root, schema, declared) {
-    const plan = await planRetainedChecks(root, schema, declared);
-    const created = [];
-    const updated = [];
-    for (const check of plan.write) {
-        const absolute = join(root, check.path);
-        const current = await readFile(absolute, "utf8").catch(() => undefined);
-        if (current === check.content)
-            continue;
-        await mkdir(kitPaths(root).checks, { recursive: true });
-        await writeFile(absolute, check.content);
-        (current === undefined ? created : updated).push(check.path);
-    }
-    for (const path of plan.remove)
-        await rm(join(root, path), { force: true });
-    return { created, updated, removed: [...plan.remove], adopted: plan.adopted, blocked: plan.blocked, orphaned: plan.orphaned };
-}
-/** One line per decision, for `isomorph check`'s output. */
-export function describeRetainedChecks(result) {
-    return [
-        ...result.created.map(path => `generated ${path}`),
-        ...result.updated.map(path => `regenerated ${path}`),
-        ...result.removed.map(path => `removed ${path} — the app's code no longer does what it exercised, and the pipeline's flow gate refuses a check that does`),
-        ...result.orphaned.map(detail => `keeping ${detail}`),
-        ...result.blocked.map(detail => `no check generated for ${detail}`)
-    ];
-}
-/** Reads the app and decides what `.isomorph/checks/` should hold, writing nothing. */
-export async function planRetainedChecks(root, schema, declared) {
-    const [tables, used, surface, existing] = await Promise.all([sourceTableUsage(root), capabilityUsage(root), capabilityCallSurface(root), readChecks(root)]);
-    // The gate's derivation, when it spoke, names the capabilities; the source
-    // reading keeps the file attribution where it has one.
-    const capabilities = declared ? new Map(declared.map(capability => [capability, used.get(capability) ?? ["the app's source, as the kit lane derives it"]])) : used;
-    const gateDeclared = (capability) => declared !== undefined && declared.includes(capability);
-    const adopted = existing.filter(check => !check.pristine);
-    const plan = { write: [], remove: [], adopted: adopted.map(check => check.path), blocked: [], orphaned: [] };
-    const planned = new Set();
-    /**
-     * A planned check, named by the one capability it exercises: outside the
-     * `flow` gate's own surface, Isomorph writes nothing. And never over a file
-     * the builder owns: an adopted check under the name Isomorph would use is
-     * theirs, however little of the table it still exercises — the gate says
-     * what it misses, and only its author decides.
-     */
-    const add = (capability, name, content) => {
-        if (!surface.has(capability) && !gateDeclared(capability))
-            return;
-        if (adopted.some(check => check.name === name))
-            return;
-        planned.add(name);
-        plan.write.push({ path: `.isomorph/checks/${name}`, content });
-    };
-    for (const [table, usage] of [...tables].sort(([first], [second]) => first.localeCompare(second))) {
-        const verbs = VERB_ORDER.filter(verb => usage.verbs.has(verb));
-        const declared = schema.get(table);
-        // A check the builder owns covering every verb is the coverage, and one acting as the
-        // second person is the cross-user coverage. The two are decided separately: editing a
-        // journey must not take its table's cross-user denial down with it.
-        const journeyCovered = verbs.length > 0 && verbs.every(verb => adopted.some(check => coversTableVerb(check.text, table, verb)));
-        const crossUserCovered = adopted.some(check => actsAsSecondUser(check.text) && coversTableVerb(check.text, table, "select"));
-        if (journeyCovered && (crossUserCovered || !declared?.ownerScoped))
-            continue;
-        const reason = (detail) => plan.blocked.push(`\`${table}\` (${verbs.join(", ")}), which ${usage.files.join(", ")} queries: ${detail}`);
-        if (!declared) {
-            reason("no table of that name exists once the app's migrations have replayed, so Isomorph cannot know what a row of it looks like");
-            continue;
-        }
-        const shape = verbs.some(verb => verb !== "select") ? rowShape(declared, verbs.includes("update")) : undefined;
-        if (shape && "blocked" in shape) {
-            reason(shape.blocked);
-            continue;
-        }
-        if (!journeyCovered)
-            add("data", fileName(table, "journey"), dataJourney(table, verbs, declared, usage.files, shape));
-        if (declared.ownerScoped && shape && !crossUserCovered)
-            add("data", fileName(table, "cross-user"), crossUserCheck(table, declared, shape, usage.files));
-    }
-    for (const capability of COVERED_CAPABILITIES) {
-        const files = capabilities.get(capability);
-        if (!files || capability === "data")
-            continue;
-        if (adopted.some(check => capabilitiesCalled(check.text).has(capability)))
-            continue;
-        const generic = capability === "files" ? filesJourney(files) : capability === "telemetry" ? telemetryJourney(files) : capability === "ai" ? aiJourney(files) : undefined;
-        if (!generic) {
-            plan.blocked.push(`the \`${capability}\` capability ${files.join(", ")} uses: Isomorph writes journeys for data, files, telemetry and ai only — write \`.isomorph/checks/${capability}-journey.mjs\` yourself${capability === "realtime" ? " (the filter and payload shape: core.md in the isomorph skill)" : ""}`);
-            continue;
-        }
-        add(capability, `${capability}-journey.mjs`, generic);
-    }
-    for (const check of existing) {
-        if (check.pristine) {
-            if (!planned.has(check.name))
-                plan.remove.push(check.path);
-            continue;
-        }
-        const stale = staleSurface(check.text, tables, capabilities);
-        if (stale)
-            plan.orphaned.push(`${check.path} — Isomorph did not write this file, so it is left alone, but it exercises ${stale}; delete it or restore the feature, or the pipeline's flow gate refuses the app`);
-    }
-    plan.write.sort((first, second) => first.path.localeCompare(second.path));
-    plan.remove.sort();
-    return plan;
-}
-// ---- Generated files ------------------------------------------------------------
-/** The paragraph every generated check carries: what wrote it, what maintains it, and what an edit means. */
-function stewardship(sources, uuid = false) {
-    return [
-        "//",
-        `// Generated by Isomorph from ${sources.join(" and ")}, and kept in step by`,
-        "// `isomorph check`: rewritten when the app's schema or the operations it performs",
-        "// change, and deleted when the app stops performing them. Edit this file and",
-        "// Isomorph stops managing it — your version is kept from then on, and keeping it",
-        "// honest becomes yours: the deployment pipeline replays `.isomorph/checks/` against",
-        "// a real App Gateway and refuses the app (`flow.check-failed`) when a check",
-        "// exercises something the code no longer does, so DELETE THIS FILE in the same",
-        "// edit that removes the feature it covers.",
-        "",
-        ...(uuid ? ["import { randomUUID } from \"node:crypto\";"] : []),
-        "import assert from \"node:assert/strict\";",
-        "",
-        "const appUrl = process.env.ISOMORPH_APP_URL;",
-        "assert.ok(appUrl, \"ISOMORPH_APP_URL is required\");",
-        "const sdk = await import(process.env.ISOMORPH_SDK_MODULE ?? \"@isomorph.ai/app-sdk\");"
-    ];
-}
-/** The single signed-in identity every journey but the cross-user one runs as. */
-const SIGNED_IN = [
-    "// The signed-in identity is attached by the SDK itself, from the kit gate's",
-    "// runner (the same under `isomorph check` and in the pipeline): one injector per request.",
-    "const isomorph = sdk.createClient({ baseUrl: appUrl });",
-    "",
-    "const user = await isomorph.identity.current();",
-    "assert.ok(user && user.email, \"identity/current must return the signed-in user\");"
-];
-/** A table's journey: the write steps when the app writes to it, a plain read when it only reads. */
-function dataJourney(table, verbs, schema, sources, row) {
-    const body = [
-        `// Retained journey for the \`${table}\` table: the signed-in identity can`,
-        `// ${sentence(verbs)} a row through the running app (ISOMORPH_APP_URL) — the operations`,
-        `// ${sources.join(", ")} performs on this table. Runs under \`isomorph check\` while`,
-        "// `isomorph dev` is up, and in the deployment pipeline's retained-check container.",
-        ...stewardship([schema.file, ...sources], row?.uuid ?? false),
-        ...SIGNED_IN,
-        ...(row ? writeSteps(table, verbs, row) : [
-            "",
-            `const { data: rows } = await isomorph.data.from("${table}").select("*").limit(1);`,
-            `assert.ok(Array.isArray(rows), "${table}: the signed-in identity can read the table this app reads");`
-        ])
-    ];
-    return sign(`${body.join("\n")}\n`);
-}
-function writeSteps(table, verbs, row) {
-    const from = `isomorph.data.from("${table}")`;
-    const at = `.eq("${row.locator}", row.${row.locator})`;
-    const steps = [
-        "",
-        `const markerValue = ${row.markerExpression};`,
-        `await ${from}.insert({ ${row.values.join(", ")} });`,
-        `const { data: rows } = await ${from}.select("*").eq("${row.marker.name}", markerValue);`,
-        `assert.equal(rows.length, 1, "the inserted ${table} row is readable by its owner");`,
-        "const row = rows[0];"
-    ];
-    if (verbs.includes("upsert"))
-        steps.push("", `await ${from}.upsert({ ...row, ${row.marker.name}: markerValue });`, `const { data: upserted } = await ${from}.select("*").eq("${row.marker.name}", markerValue);`, `assert.ok(upserted.length >= 1, "the upserted ${table} row is readable by its owner");`);
-    if (verbs.includes("update") && row.update)
-        steps.push("", `await ${from}.update({ ${row.update.column.name}: ${row.update.expression} })${at};`, `const { data: updated } = await ${from}.select("*")${at};`, `assert.deepEqual(updated[0].${row.update.column.name}, ${row.update.expression}, "the ${table} row is updated for its owner");`);
-    if (verbs.includes("delete"))
-        steps.push("", `await ${from}.delete()${at};`, `const { data: remaining } = await ${from}.select("*")${at};`, `assert.equal(remaining.length, 0, "the ${table} row is deleted");`);
-    return steps;
-}
-function crossUserCheck(table, schema, row, sources) {
-    const mutated = row.update ? { column: row.update.column.name, value: row.update.expression } : { column: row.marker.name, value: row.markerExpression };
-    const body = [
-        "// Cross-user check: a second signed-in person cannot read, update or delete the first",
-        `// person's \`${table}\` row through the running app (ISOMORPH_APP_URL). The deployment`,
-        "// pipeline's write probe makes exactly these three assertions, with a second identity,",
-        `// against every owner-scoped table, and \`${table}\` is one: ${schema.file} scopes its rows`,
-        `// with current_setting('harbour.user_id')${schema.ownerColumn ? ` on \`${schema.ownerColumn}\`` : ""}. Running it here means user isolation can`,
-        "// no longer be green under `isomorph check` and red in CodeBuild.",
-        ...stewardship([schema.file, ...sources], row.uuid),
-        "// Both people come from the SDK itself: the kit gate's runner signs two",
-        "// identities and the SDK attaches the first to every request by default and",
-        "// the second when asked. A check never reads a token name.",
-        "const owner = sdk.createClient({ baseUrl: appUrl });",
-        "const other = sdk.createClient({ baseUrl: appUrl, identity: \"second-user\" });",
-        "",
-        "const me = await owner.identity.current();",
-        "const them = await other.identity.current();",
-        "assert.ok(me && them && me.id !== them.id, \"the two signed-in identities must be different people\");",
-        "",
-        `const markerValue = ${row.markerExpression};`,
-        `await owner.data.from("${table}").insert({ ${row.values.join(", ")} });`,
-        `const { data: mine } = await owner.data.from("${table}").select("*").eq("${row.marker.name}", markerValue);`,
-        `assert.equal(mine.length, 1, "the owner reads the ${table} row back");`,
-        "const row = mine[0];",
-        "",
-        "// 1. SELECT by key as the second person: no row.",
-        `const { data: seen } = await other.data.from("${table}").select("*").eq("${row.locator}", row.${row.locator});`,
-        `assert.equal(seen.length, 0, "${table}: a second signed-in user can read another user's row — the owner policy does not isolate users — rule core.rls-owner-scoped (core.md in the isomorph skill)");`,
-        "",
-        "// 2. UPDATE and 3. DELETE by key as the second person: refused (403) or no row affected.",
-        "const denied = async (verb, operation) => {",
-        "  let affected;",
-        "  try { affected = (await operation()).data ?? []; }",
-        "  catch (error) { if (error?.category === \"FORBIDDEN\") return; throw error; }",
-        `  assert.equal(affected.length, 0, \`${table} \${verb}: a second user mutated another user's row despite an owner-scoped source policy\`);`,
-        "};",
-        `await denied("UPDATE", () => other.data.from("${table}").update({ ${mutated.column}: ${mutated.value} }).eq("${row.locator}", row.${row.locator}));`,
-        `await denied("DELETE", () => other.data.from("${table}").delete().eq("${row.locator}", row.${row.locator}));`,
-        `const { data: after } = await owner.data.from("${table}").select("*").eq("${row.locator}", row.${row.locator});`,
-        `assert.equal(after.length, 1, "the owner's ${table} row still exists after the second user's attempts");`,
-        `assert.deepEqual(after[0].${mutated.column}, row.${mutated.column}, "the owner's ${table} row is unchanged after the second user's attempts");`,
-        `await owner.data.from("${table}").delete().eq("${row.locator}", row.${row.locator});`
-    ];
-    return sign(`${body.join("\n")}\n`);
-}
-function filesJourney(sources) {
-    const body = [
-        "// Retained journey for the app's private files: the signed-in identity can upload a",
-        "// file and list it back through the running app (ISOMORPH_APP_URL) — the operations",
-        `// ${sources.join(", ")} performs through \`isomorph.files.*\`. The deployment pipeline`,
-        "// refuses an app whose checks never exercise a capability its own code uses, so this",
-        "// runs under `isomorph check` while `isomorph dev` is up, and in the pipeline's container.",
-        ...stewardship(sources),
-        ...SIGNED_IN,
-        "",
-        "const name = `isomorph-journey-${Date.now()}.txt`;",
-        "await isomorph.files.upload(`private/${name}`, new Blob([\"isomorph journey check\\n\"], { type: \"text/plain\" }));",
-        "const listed = await isomorph.files.list(\"private/\");",
-        "assert.ok(Array.isArray(listed), \"files.list must return a list\");",
-        "const found = listed.some(entry => String(typeof entry === \"string\" ? entry : entry?.path ?? entry?.name ?? \"\").endsWith(name));",
-        "assert.ok(found, `the uploaded file is listed back to its owner (looking for ${name})`);"
-    ];
-    return sign(`${body.join("\n")}\n`);
-}
-function telemetryJourney(sources) {
-    const body = [
-        "// Retained journey for the app's telemetry: one event reaches the gateway through the",
-        `// running app (ISOMORPH_APP_URL) — the capability ${sources.join(", ")} uses through`,
-        "// `isomorph.telemetry.*`. The deployment pipeline refuses an app whose checks never",
-        "// exercise a capability its own code uses, so this runs under `isomorph check` while",
-        "// `isomorph dev` is up, and in the pipeline's retained-check container.",
-        ...stewardship(sources),
-        ...SIGNED_IN,
-        "",
-        "// `track` resolves with nothing and throws on a refusal, so reaching the next line is the assertion.",
-        "await isomorph.telemetry.track(\"isomorph_retained_check\", { source: \"telemetry-journey\" });"
-    ];
-    return sign(`${body.join("\n")}\n`);
-}
-function aiJourney(sources) {
-    const body = [
-        "// Retained journey for the app's governed AI: one chat completion reaches the gateway",
-        `// through the running app (ISOMORPH_APP_URL) — the capability ${sources.join(", ")} uses`,
-        "// through `isomorph.ai.chat`. Locally this is a real governed call through the Isomorph",
-        "// development route (your `isomorph login`; IT must have enabled an AI provider). In the",
-        "// deployment pipeline it is answered by a canned completion and reported as not tested.",
-        "// The pipeline refuses an app whose checks never exercise a capability its code uses.",
-        ...stewardship(sources),
-        ...SIGNED_IN,
-        "",
-        "const reply = await isomorph.ai.chat({ messages: [{ role: \"user\", content: \"Reply with one word: ready\" }], maxTokens: 16 });",
-        "assert.equal(typeof reply.content, \"string\", \"ai.chat must answer with content\");",
-        "assert.ok(reply.content.length > 0, \"the governed completion is not empty\");",
-        "assert.equal(typeof reply.model, \"string\", \"the answer names the governed model alias\");"
-    ];
-    return sign(`${body.join("\n")}\n`);
-}
-// ---- Reading the app ------------------------------------------------------------
-/** How a generated journey writes one row: the values to insert, the column it finds the row by, and the column it changes. */
-function rowShape(schema, needsUpdate) {
-    const writable = schema.columns.filter(column => !column.generated && !column.identityDefault);
-    const required = writable.filter(column => column.notNull && !column.hasDefault);
-    const unwritable = required.find(column => column.references) ?? required.find(column => !fillExpression(column));
-    if (unwritable)
-        return { blocked: `its \`${unwritable.name} ${unwritable.declaredType}\` column ${unwritable.references ? "references another table, so a row cannot be written without inventing its parent — rule core.journey-fk (core.md in the isomorph skill)" : "has a type Isomorph cannot invent a value for"}` };
-    const marker = writable.find(column => isMarker(column) && column.notNull && !column.hasDefault) ?? writable.find(isMarker);
-    if (!marker)
-        return { blocked: markerless(writable) };
-    const markerExpression = marker.type === "text" ? textMarker(marker) : "Date.now() % 2000000000";
-    if (!markerExpression)
-        return { blocked: `\`${marker.name}\` is the only column a check could find a row by, and its CHECK constraint leaves no room for a unique value` };
-    const locator = schema.primaryKey.length === 1 && schema.primaryKey[0] !== marker.name ? schema.primaryKey[0] : marker.name;
-    const fill = required.filter(column => column.name !== marker.name).map(column => `${column.name}: ${fillExpression(column)}`);
-    const update = needsUpdate ? updateStep(writable, marker, locator) : undefined;
-    if (needsUpdate && !update)
-        return { blocked: "the app updates it, but every column Isomorph could change is the one the check finds the row by" };
-    return { values: [`${marker.name}: markerValue`, ...fill], marker, markerExpression, locator, uuid: fill.some(value => value.includes("randomUUID(")), update };
-}
-/** Why nothing on the table can carry the unique value a journey finds its row by — naming the capped number when that is what ruled the last candidate out, so the answer is a column to add rather than a CHECK to weaken. */
-function markerless(writable) {
-    const none = "it has no free text or number column a check could write a unique value into and find the row by";
-    const capped = writable.find(cappedNumber);
-    return capped ? `${none}: \`${capped.name} ${capped.declaredType}\` is a number its own CHECK caps, and the unique value a journey writes is a timestamp` : none;
-}
-/** What a journey writes into a free-text column it updates, when the column's length bounds admit it. */
-const UPDATED_TEXT = "isomorph check updated";
-/** The column a journey changes, and what it changes it to: a boolean is flipped, a closed set moves to its other value, free text gets a fixed one. */
-function updateStep(writable, marker, locator) {
-    const candidates = writable.filter(column => column.name !== locator && column.name !== marker.name);
-    const flag = candidates.find(column => column.type === "boolean");
-    if (flag)
-        return { column: flag, expression: `!row.${flag.name}` };
-    for (const column of candidates) {
-        const literals = allowedLiterals(column.checks, column.name);
-        if (literals.length >= 2)
-            return { column, expression: JSON.stringify(literals[1]) };
-        if (column.type !== "text" || literals.length)
-            continue;
-        const { min, max } = textLengthBounds(column.checks, column.name);
-        if (max < UPDATED_TEXT.length || min > UPDATED_TEXT.length)
-            continue;
-        return { column, expression: JSON.stringify(UPDATED_TEXT) };
-    }
-    return undefined;
-}
-/** A number the app's own CHECK caps from above: the unique value a journey marks a row with is a timestamp, which no ordinary ceiling admits, so such a column is never the marker. */
-const cappedNumber = (column) => (column.type === "integer" || column.type === "number") && hasNumericMaximum(column.checks, column.name);
-/** A column a check can write a unique value into and then filter on. */
-const isMarker = (column) => (column.type === "text" || column.type === "integer" || column.type === "number") && !column.references && !cappedNumber(column) && !allowedLiterals(column.checks, column.name).length;
-/** A unique marker satisfying the column's own length constraints, or `undefined` when they leave no room for one. */
-function textMarker(column) {
-    const { min, max } = textLengthBounds(column.checks, column.name);
-    const [expression, length] = max >= 28 ? ["`isomorph check ${Date.now()}`", 28] : max >= 13 ? ["String(Date.now())", 13] : max >= 6 ? [`String(Date.now()).slice(-${max})`, max] : [undefined, 0];
-    if (!expression)
-        return undefined;
-    return min > length ? `${expression}.padEnd(${min}, "x")` : expression;
-}
-/** A value for a column a write must supply, or `undefined` when nothing can be invented for its type. */
-function fillExpression(column) {
-    const literals = allowedLiterals(column.checks, column.name);
-    if (literals.length)
-        return JSON.stringify(literals[0]);
-    switch (column.type) {
-        case "text": {
-            const { min, max } = textLengthBounds(column.checks, column.name);
-            return JSON.stringify("isomorph check".slice(0, max).padEnd(Math.min(min, max), "x"));
-        }
-        case "uuid": return "randomUUID()";
-        case "integer": return String(Math.ceil(numericMinimum(column.checks, column.name)));
-        case "number": return String(numericMinimum(column.checks, column.name));
-        case "boolean": return "false";
-        case "timestamptz": return "new Date().toISOString()";
-        case "date": return "new Date().toISOString().slice(0, 10)";
-        case "time": return "\"12:00:00\"";
-        case "json": return "{}";
-        case "array": return "[]";
-        default: return undefined;
-    }
-}
-async function readChecks(root) {
-    const directory = kitPaths(root).checks;
-    const names = (await readdir(directory).catch(() => [])).filter(name => /\.(mjs|js|cjs)$/.test(name)).sort();
-    return Promise.all(names.map(async (name) => {
-        const text = await readFile(join(directory, name), "utf8").catch(() => "");
-        return { name, path: `.isomorph/checks/${name}`, text, pristine: isPristine(text) };
-    }));
-}
-/** What an adopted check exercises that the app's own code no longer does, in the `flow` gate's terms. */
-function staleSurface(text, tables, capabilities) {
-    for (const match of text.matchAll(/\.from\(\s*["'`]([A-Za-z0-9_]+)["'`]\s*\)/g))
-        if (!tables.has(match[1]))
-            return `the \`${match[1]}\` table, which no source file queries`;
-    for (const capability of capabilitiesCalled(text))
-        if (!capabilities.has(capability))
-            return `the \`${capability}\` capability, which no source file uses`;
-    return undefined;
-}
-/** `insert, update and delete`, for a generated check's opening line. */
-const sentence = (verbs) => verbs.length > 1 ? `${verbs.slice(0, -1).join(", ")} and ${verbs.at(-1)}` : verbs.join("");
-/** A check that acts as the runner's second person, in the SDK's form. */
-const actsAsSecondUser = (text) => /identity:\s*["'`]second-user["'`]/.test(text);
-const coversTableVerb = (text, table, verb) => new RegExp(`\\.from\\(\\s*["'\`]${table}["'\`]\\s*\\)`).test(text) && new RegExp(`\\.${verb}\\s*\\(`).test(text);
-/** `notes` gets `notes-journey.mjs`; a table sharing a capability's name does not shadow it. */
-const fileName = (table, kind) => `${table}${RESERVED_NAMES.has(table) ? "-table" : ""}-${kind}.mjs`;
-// ---- Ownership ------------------------------------------------------------------
-const digest = (body) => createHash("sha256").update(body).digest("hex").slice(0, 16);
-const sign = (body) => `${GENERATED_PREFIX}${digest(body)}\n${body}`;
-/** True only for a file Isomorph wrote and nobody has edited since. `prefix` is only ever an older release's marker, passed by `init --upgrade`. */
-export function isPristine(text, prefix = GENERATED_PREFIX) {
-    if (!text.startsWith(prefix))
-        return false;
-    const end = text.indexOf("\n");
-    return end > 0 && text.slice(0, end).trim() === `${prefix}${digest(text.slice(end + 1))}`;
-}