@pithy-sh/core 0.10.0 → 0.11.0

package/dist/cli/commandCatalog.generated.js

@@ -148,6 +148,34 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"completion": {
+		"positionals": [{
+			"name": "shell",
+			"required": false,
+			"variadic": false
+		}],
+		"flags": {
+			"--remove": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--status": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": [{
+			"kind": "atMostOne",
+			"flags": ["--remove", "--status"]
+		}]
+	},
 	"contract": {
 		"positionals": [],
 		"flags": {
@@ -238,6 +266,16 @@ const COMMANDS = {
 				"type": "string",
 				"required": false,
 				"repeatable": false
+			},
+			"--purpose": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--kind": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
 			}
 		},
 		"groups": [
@@ -259,13 +297,20 @@ const COMMANDS = {
 				"needs": ["--public-key"],
 				"any": false
 			},
+			{
+				"kind": "requires",
+				"flag": "--kind",
+				"needs": ["--public-key"],
+				"any": false
+			},
 			{
 				"kind": "requires",
 				"flag": "--update",
 				"needs": [
 					"--worker-url",
 					"--scope",
-					"--public-key"
+					"--public-key",
+					"--purpose"
 				],
 				"any": true
 			}
@@ -980,11 +1025,6 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
-			"--api-token": {
-				"type": "string",
-				"required": false,
-				"repeatable": false
-			},
 			"--r2-access-key-id": {
 				"type": "string",
 				"required": false,
@@ -995,11 +1035,6 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
-			"--r2-api-token": {
-				"type": "string",
-				"required": false,
-				"repeatable": false
-			},
 			"--json": {
 				"type": "boolean",
 				"required": false,
@@ -1354,6 +1389,28 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"secrets tables": {
+		"positionals": [],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"default": "dev"
+			},
+			"--worker": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"secrets update": {
 		"positionals": [{
 			"name": "name",
@@ -1452,6 +1509,27 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"setup": {
+		"positionals": [],
+		"flags": {
+			"--skip-install": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--dry-run": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"storage deprovision": {
 		"positionals": [],
 		"flags": {
@@ -1491,11 +1569,6 @@ const COMMANDS = {
 				"required": false,
 				"repeatable": false
 			},
-			"--api-token": {
-				"type": "string",
-				"required": false,
-				"repeatable": false
-			},
 			"--r2-access-key-id": {
 				"type": "string",
 				"required": false,
@@ -1872,6 +1945,32 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"token forget": {
+		"positionals": [{
+			"name": "profile",
+			"required": true,
+			"variadic": false
+		}],
+		"flags": {
+			"--env": {
+				"type": "string",
+				"required": false,
+				"repeatable": false,
+				"default": "dev"
+			},
+			"--force": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"token list": {
 		"positionals": [],
 		"flags": {
@@ -1930,7 +2029,12 @@ const COMMANDS = {
 					"vectorize:write",
 					"ai:read",
 					"zone:read",
-					"routes:write"
+					"routes:write",
+					"analytics:read",
+					"images:write",
+					"stream:write",
+					"queues:write",
+					"artifacts:write"
 				]
 			},
 			"--json": {
@@ -2003,7 +2107,12 @@ const COMMANDS = {
 					"vectorize:write",
 					"ai:read",
 					"zone:read",
-					"routes:write"
+					"routes:write",
+					"analytics:read",
+					"images:write",
+					"stream:write",
+					"queues:write",
+					"artifacts:write"
 				]
 			},
 			"--keep-previous": {
@@ -2282,6 +2391,32 @@ const COMMANDS = {
 		},
 		"groups": []
 	},
+	"worker bind": {
+		"positionals": [],
+		"flags": {
+			"--from": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--to": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--binding": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": []
+	},
 	"worker list": {
 		"positionals": [],
 		"flags": { "--json": {
@@ -2306,15 +2441,25 @@ const COMMANDS = {
 	},
 	"worker rename": {
 		"positionals": [{
-			"name": "from",
-			"required": true,
+			"name": "old",
+			"required": false,
 			"variadic": false
 		}, {
-			"name": "to",
-			"required": true,
+			"name": "new",
+			"required": false,
 			"variadic": false
 		}],
 		"flags": {
+			"--from": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--to": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
 			"--force": {
 				"type": "boolean",
 				"required": false,
@@ -2353,6 +2498,35 @@ const COMMANDS = {
 			}
 		},
 		"groups": []
+	},
+	"worker unbind": {
+		"positionals": [],
+		"flags": {
+			"--from": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--to": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--binding": {
+				"type": "string",
+				"required": false,
+				"repeatable": false
+			},
+			"--json": {
+				"type": "boolean",
+				"required": false,
+				"repeatable": false
+			}
+		},
+		"groups": [{
+			"kind": "exactlyOne",
+			"flags": ["--to", "--binding"]
+		}]
 	}
 };
 /** The flags every command takes, answered before any command runs. */

package/dist/cli/commandFacts.d.ts

@@ -31,7 +31,7 @@ export type WorkerScopedPath = (typeof WORKER_SCOPED)[number];
  * The commands that take `--worker` and do not need it: each fans out over every Worker, or falls back to the
  * first that answers, and the flag narrows.
  */
-export declare const WORKER_NARROWS: readonly ["contract", "dashboard disconnect", "dashboard revoke-key", "dashboard rotate", "dashboard status", "doctor", "env", "init", "migrate", "seed", "support deprovision", "upgrade"];
+export declare const WORKER_NARROWS: readonly ["contract", "dashboard disconnect", "dashboard revoke-key", "dashboard rotate", "dashboard status", "doctor", "env", "init", "migrate", "secrets tables", "seed", "support deprovision", "upgrade"];
 /**
  * A command only a person runs, at a terminal, where the Worker is asked for. `pithy remove` refuses every run
  * that cannot ask (`core/person_required`).

package/dist/cli/commandFacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commandFacts.d.ts","sourceRoot":"","sources":["../../src/cli/commandFacts.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,YACxB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,CACL,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc,YACzB,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,MAAM,EACN,qBAAqB,EACrB,SAAS,CACD,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,QAAQ,CAAU,CAAC;AAE/C,uHAAuH;AACvH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAuB,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAAI,OAAO,CAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;aAAK,MAAM,EAAE,QAAQ;aAAE,OAAO,EAAE,WAAW;CAAW,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;aAC/B,sBAAsB,EAAE,kEAAkE;aAC1F,sBAAsB,EAAE,mCAAmC;aAC3D,mBAAmB,EAAE,oEAAoE;aACzF,iBAAiB,EAAE,sEAAsE;aACzF,mBAAmB,EAAE,iDAAiD;aACtE,MAAM,EAAE,uBAAuB;aAC/B,qBAAqB,EAAE,uDAAuD;aAC9E,YAAY,EAAE,iBAAiB;aAC/B,qBAAqB,EAAE,mDAAmD;aAC1E,qBAAqB,EAAE,yDAAyD;aAChF,qBAAqB,EAAE,oBAAoB;aAC3C,cAAc,EAAE,cAAc;aAC9B,uBAAuB,EAAE,yDAAyD;aAClF,cAAc,EAAE,2BAA2B;aAC3C,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aAC5B,oBAAoB,EAAE,8BAA8B;aACpD,QAAQ,EAAE,uBAAuB;aACjC,QAAQ,EAAE,uBAAuB;aACjC,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAI,WAAW,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAC;AAErH;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAIhH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,CAChB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,uBAAuB,YAAI,MAAM,EAAE,YAAY,CAAU,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;wBACnB,WAAW;mBAChB,sBAAsB;;;;CAI8B,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gCAAqE,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gCAAqE,CAAC;AAE3G;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAEnG,CAAC"}
+{"version":3,"file":"commandFacts.d.ts","sourceRoot":"","sources":["../../src/cli/commandFacts.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,YACxB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,CACL,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc,YACzB,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,MAAM,EACN,qBAAqB,EACrB,SAAS,CACD,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,QAAQ,CAAU,CAAC;AAE/C,uHAAuH;AACvH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAuB,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAAI,OAAO,CAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;aAAK,MAAM,EAAE,QAAQ;aAAE,OAAO,EAAE,WAAW;CAAW,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;aAC/B,sBAAsB,EAAE,kEAAkE;aAC1F,sBAAsB,EAAE,mCAAmC;aAC3D,mBAAmB,EAAE,oEAAoE;aACzF,iBAAiB,EAAE,sEAAsE;aACzF,mBAAmB,EAAE,iDAAiD;aACtE,MAAM,EAAE,uBAAuB;aAC/B,qBAAqB,EAAE,uDAAuD;aAC9E,YAAY,EAAE,iBAAiB;aAC/B,qBAAqB,EAAE,mDAAmD;aAC1E,qBAAqB,EAAE,yDAAyD;aAChF,qBAAqB,EAAE,oBAAoB;aAC3C,cAAc,EAAE,cAAc;aAC9B,uBAAuB,EAAE,yDAAyD;aAClF,cAAc,EAAE,2BAA2B;aAC3C,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aAC5B,oBAAoB,EAAE,8BAA8B;aACpD,QAAQ,EAAE,uBAAuB;aACjC,QAAQ,EAAE,uBAAuB;aACjC,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAI,WAAW,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAC;AAErH;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAIhH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,CAChB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,uBAAuB,YAAI,MAAM,EAAE,YAAY,CAAU,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;wBACnB,WAAW;mBAChB,sBAAsB;;;;CAI8B,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gCAAqE,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gCAAqE,CAAC;AAE3G;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAEnG,CAAC"}

package/dist/cli/commandFacts.js

@@ -57,6 +57,7 @@ const WORKER_NARROWS = [
 	"env",
 	"init",
 	"migrate",
+	"secrets tables",
 	"seed",
 	"support deprovision",
 	"upgrade"

package/dist/controlPlane/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAWnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAmKtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAkBnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAoLtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/controlPlane/capability.js

@@ -6,11 +6,13 @@ import "../worker/identity.js";
 import { ControlPlaneConfig } from "./config/config.js";
 import { ControlPlaneConnection } from "./data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, controlPlaneTables } from "./data/tables.js";
-import { capabilityHealthSources } from "./discovery/health.js";
+import { capabilityHealthSources, defineCapabilityHealth } from "./discovery/health.js";
 import { createControlPlaneVerifier } from "./http/guard.js";
+import { MIGRATION_HEALTH_KEYS, composeMigrationDatabases, readMigrationHealth } from "./migrationState/migrationState.js";
 import { controlPlaneRouteDescriptors, registerControlPlaneRoutes } from "./http/routes.js";
 import { controlplane_0001_init } from "./migrations/0001_init.js";
 import { controlplane_0002_management_origin } from "./migrations/0002_management_origin.js";
+import { controlplane_0003_connection_principal } from "./migrations/0003_connection_principal.js";
 import { d1ReplayGuard } from "./replay/d1Guard.js";
 import { CONTROL_PLANE_KV_BINDING, controlPlaneKvNamespaces, kvReplayGuard } from "./replay/kvGuard.js";
 //#region src/controlPlane/capability.ts
@@ -52,7 +54,8 @@ function controlplane(options = {}) {
 	const config = ControlPlaneConfig.parse(options);
 	const migrations = {
 		"0001_init": controlplane_0001_init,
-		"0002_management_origin": controlplane_0002_management_origin
+		"0002_management_origin": controlplane_0002_management_origin,
+		"0003_connection_principal": controlplane_0003_connection_principal
 	};
 	const requiredBindings = [{
 		type: "d1",
@@ -83,6 +86,7 @@ function controlplane(options = {}) {
 	});
 	let composed = [];
 	let health = /* @__PURE__ */ new Map();
+	let migrationDatabases = [];
 	return {
 		...defineCapability({
 			name: "controlplane",
@@ -98,6 +102,10 @@ function controlplane(options = {}) {
 			} },
 			kvNamespaces: usesKvReplay ? controlPlaneKvNamespaces(config.jtiTtlSeconds) : {},
 			adminRoutes: controlPlaneRouteDescriptors(config.basePath),
+			health: defineCapabilityHealth({
+				keys: MIGRATION_HEALTH_KEYS,
+				read: (c) => readMigrationHealth(c.env, migrationDatabases)
+			}),
 			compose: ({ capabilities }) => {
 				composed = capabilities.map((cap) => ({
 					name: cap.name,
@@ -109,6 +117,7 @@ function controlplane(options = {}) {
 					config: { ...cap.manifestConfig?.values ?? {} }
 				}));
 				health = capabilityHealthSources(capabilities);
+				migrationDatabases = composeMigrationDatabases(capabilities);
 			},
 			middleware: [(app) => {
 				app.use("*", async (c, next) => {
@@ -135,6 +144,7 @@ function controlplane(options = {}) {
 					database,
 					composedCapabilities: () => composed,
 					composedHealth: () => health,
+					composedMigrations: () => migrationDatabases,
 					now
 				});
 			}

package/dist/controlPlane/context.d.ts

@@ -24,6 +24,11 @@ export declare const ControlPlaneContext: z.ZodObject<{
     grantedScopes: z.ZodArray<z.ZodString>;
     keyId: z.ZodString;
     tokenId: z.ZodString;
+    actorKind: z.ZodNullable<z.ZodEnum<{
+        agent: "agent";
+        dashboard: "dashboard";
+        script: "script";
+    }>>;
 }, z.core.$strip>;
 export type ControlPlaneContext = z.output<typeof ControlPlaneContext>;
 //# sourceMappingURL=context.d.ts.map

package/dist/controlPlane/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/controlPlane/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;iBAyC7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/controlPlane/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBA4C7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/controlPlane/context.js

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { ControlPlaneScope } from "./scope/scope.js";
+import { ControlPlaneActorKind } from "./data/connection.js";
 import { z } from "zod";
 //#region src/controlPlane/context.ts
 /**
@@ -25,7 +26,8 @@ const ControlPlaneContext = z.object({
 	scope: ControlPlaneScope.describe("The single scope this token was minted for. One call, one operation — a token carrying the whole grant would make every call as dangerous as the most dangerous one."),
 	grantedScopes: z.array(ControlPlaneScope).describe("Every scope the adopter granted this connection, read from their own row. The authority: a scope absent here is denied however the token is written."),
 	keyId: z.string().describe("Which registered key verified this call. Recorded so a rotation can be traced through the trail, and so a key still in use is visible before it is expired."),
-	tokenId: z.string().describe("The token's `jti`, already claimed in the replay set. Recorded to tie one audit event to one call.")
+	tokenId: z.string().describe("The token's `jti`, already claimed in the replay set. Recorded to tie one audit event to one call."),
+	actorKind: ControlPlaneActorKind.nullable().describe("What kind of client the connection is for — `agent`, `dashboard` or `script` — read from the adopter's own row, never from the token. The gate stamps it onto every control-plane audit row this call writes. Null for a connection registered before the kind was recorded (#721).")
 }).describe("The verified control-plane caller for one request. Never an AuthContext: a management client is not a user of the adopter's app.");
 //#endregion
 export { ControlPlaneContext };

package/dist/controlPlane/data/connection.d.ts

@@ -37,6 +37,46 @@ export declare const RegisteredKey: z.ZodObject<{
     revokedAt: z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>>;
 }, z.core.$strip>;
 export type RegisteredKey = z.output<typeof RegisteredKey>;
+/**
+ * What kind of client a connection is for (#721): `agent`, `dashboard` or `script`.
+ *
+ * The audit trail's `actorType: "control-plane"` names all three identically, and the questions asked
+ * after an incident are exactly the ones that tell them apart — was it a person at the dashboard, a
+ * script somebody wrote, or an agent running unattended. So the kind is recorded on the connection when
+ * it is registered and stamped from there onto every row its calls write.
+ *
+ * It follows the path, never a guess: the device-code flow is a dashboard, always, and a key the
+ * operator registered themselves is whichever of the other two they say, out loud, with `--kind`.
+ */
+export declare const ControlPlaneActorKind: z.ZodEnum<{
+    agent: "agent";
+    dashboard: "dashboard";
+    script: "script";
+}>;
+export type ControlPlaneActorKind = z.output<typeof ControlPlaneActorKind>;
+/**
+ * Who sanctioned a connection: the email address of the signed-in Cloudflare session that registered it.
+ *
+ * **A plain string, deliberately not a reference.** An adopter's `pithy_auth_users` are their customers,
+ * and the operator who registers a connection is their staff, so a join into the organization model would
+ * be empty for most of them. A string is readable by anybody, and matchable against a directory where the
+ * operator is in one.
+ *
+ * **Derived, never asserted.** No flag supplies it; the CLI reads it from `GET /user` under the session.
+ */
+export declare const ConnectionPrincipal: z.ZodEmail;
+export type ConnectionPrincipal = z.output<typeof ConnectionPrincipal>;
+/** The longest purpose a connection may carry. One line on a review screen, with room to say what it does. */
+export declare const MAX_CONNECTION_PURPOSE = 200;
+/**
+ * What a connection is for, in the words of whoever registered it (#721).
+ *
+ * **Required at registration, and refused when absent**, because a review listing credentials by key id
+ * cannot support the decision it exists for. **Untrusted input**: a customer writes it and something else
+ * renders it, so it is validated on the way in, and again on every read of the row.
+ */
+export declare const ConnectionPurpose: z.ZodString;
+export type ConnectionPurpose = z.output<typeof ConnectionPurpose>;
 /**
  * One management-client connection — the row in `pithy_controlplane_connections`.
  *
@@ -52,6 +92,13 @@ export declare const ControlPlaneConnection: z.ZodObject<{
     workerUrl: z.ZodURL;
     basePath: z.ZodDefault<z.ZodString>;
     managementOrigin: z.ZodDefault<z.ZodNullable<z.ZodURL>>;
+    authorizedBy: z.ZodDefault<z.ZodNullable<z.ZodEmail>>;
+    actorKind: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        agent: "agent";
+        dashboard: "dashboard";
+        script: "script";
+    }>>>;
+    purpose: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     scopes: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodString>>;
     keys: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodObject<{
         keyId: z.ZodString;

package/dist/controlPlane/data/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;EAI/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,YAK7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,8GAA8G;AAC9G,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAiB1C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAW3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkEhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/controlPlane/data/connection.js

@@ -35,6 +35,57 @@ const RegisteredKey = z.object({
 	revokedAt: JsonDate.nullable().describe("When this key was revoked outright, or null. Revocation ignores `validUntil` and takes effect immediately — it is the adopter's unilateral control, and it must not wait for a window to close.")
 }).describe("One registered public key with its validity window. Two live at once during a rotation overlap.");
 /**
+* What kind of client a connection is for (#721): `agent`, `dashboard` or `script`.
+*
+* The audit trail's `actorType: "control-plane"` names all three identically, and the questions asked
+* after an incident are exactly the ones that tell them apart — was it a person at the dashboard, a
+* script somebody wrote, or an agent running unattended. So the kind is recorded on the connection when
+* it is registered and stamped from there onto every row its calls write.
+*
+* It follows the path, never a guess: the device-code flow is a dashboard, always, and a key the
+* operator registered themselves is whichever of the other two they say, out loud, with `--kind`.
+*/
+const ControlPlaneActorKind = z.enum([
+	"agent",
+	"dashboard",
+	"script"
+]).describe("What kind of client a connection is for: `agent` (an automated client acting on its own judgment, often unattended), `dashboard` (a management dashboard a person drives, registered through the device-code flow), or `script` (an operator's own automation, doing one fixed thing).");
+/**
+* Who sanctioned a connection: the email address of the signed-in Cloudflare session that registered it.
+*
+* **A plain string, deliberately not a reference.** An adopter's `pithy_auth_users` are their customers,
+* and the operator who registers a connection is their staff, so a join into the organization model would
+* be empty for most of them. A string is readable by anybody, and matchable against a directory where the
+* operator is in one.
+*
+* **Derived, never asserted.** No flag supplies it; the CLI reads it from `GET /user` under the session.
+*/
+const ConnectionPrincipal = z.email().max(254).describe("The email address of the person who sanctioned this connection, read from their signed-in Cloudflare session at registration. Never typed, so never asserted.");
+/** The longest purpose a connection may carry. One line on a review screen, with room to say what it does. */
+const MAX_CONNECTION_PURPOSE = 200;
+/**
+* Characters a purpose may not carry: every C0 and C1 control (so no terminal escape, no newline and no
+* carriage return), the Unicode line and paragraph separators, every `Bidi_Control` character — the
+* embeddings, overrides and isolates, and the LRM, RLM and ALM marks — that lets text render in a
+* different order from the one it is stored in, and the invisible zero-width space, word joiner and
+* byte-order mark that split a word without showing it. The zero-width joiner and non-joiner stay: Persian
+* and the Indic scripts cannot be written without them.
+*
+* Each of those is a way for a sentence to look like something else once it reaches a renderer: a line
+* in `pithy dashboard status` forged beneath the real one, a screen cleared, a scope name read backwards.
+* Escaping them at every renderer is a promise each renderer has to keep. Refusing them at the boundary
+* is one promise, kept here.
+*/
+const UNRENDERABLE = /[\p{Cc}\p{Bidi_Control}\u2028\u2029\u200B\u2060\uFEFF]/u;
+/**
+* What a connection is for, in the words of whoever registered it (#721).
+*
+* **Required at registration, and refused when absent**, because a review listing credentials by key id
+* cannot support the decision it exists for. **Untrusted input**: a customer writes it and something else
+* renders it, so it is validated on the way in, and again on every read of the row.
+*/
+const ConnectionPurpose = z.string().trim().min(1, "Say what this client is for.").max(200, `A purpose is 200 characters at most.`).refine((purpose) => !UNRENDERABLE.test(purpose), "A purpose is one line of plain text: no control, bidi or invisible characters.").describe(`What this connection's client is for, in the registering operator's words — one line of plain text, 200 characters at most, with no control, bidi or invisible characters. Written by a customer and rendered elsewhere, so validated at the boundary.`);
+/**
 * One management-client connection — the row in `pithy_controlplane_connections`.
 *
 * Keys are a versioned JSON column rather than a child table for two reasons. **Rotation becomes one
@@ -49,10 +100,13 @@ const ControlPlaneConnection = z.object({
 	workerUrl: z.url().describe("This environment's deployed Worker URL, captured at connect. The address the management client calls; re-pointed by `pithy dashboard connect --update` when a custom domain or a rename moves it."),
 	basePath: z.string().min(1).default("/control-plane").describe("Where this Worker mounts the control-plane seam, captured at connect from its resolved config. Stored beside `workerUrl` because the two together fully determine the manifest address — and this is the one part of it a client cannot discover, since it *is* the manifest's own address. Defaulted rather than required so a connection registered before the column existed still parses, reading as the default it was necessarily using."),
 	managementOrigin: z.url().nullable().default(null).describe("Where the management client that registered this connection answers — the origin the CLI calls for a verify, a rotation or a disconnect. Stored because it is not derivable: `issuer` is what that client *signs as*, and nothing says a dashboard's API answers at its own `iss`. Null for a connection registered before this column, which reads as the issuer rather than as the hosted dashboard — an older row is still a row about somebody's own deployment. Nothing on the Worker's side reads it; verification cares about `issuer` alone."),
+	authorizedBy: ConnectionPrincipal.nullable().default(null).describe("Who sanctioned this connection: the email of the signed-in Cloudflare session that registered it, never a flag. Null for a connection registered before principals were recorded (#721), which keeps working and reads as exactly that; registering again is the only way to set it."),
+	actorKind: ControlPlaneActorKind.nullable().default(null).describe("What kind of client this connection is for — `agent`, `dashboard` or `script` — stamped onto every audit row its calls write so the trail can tell them apart. Null for a connection registered before it was recorded."),
+	purpose: ConnectionPurpose.nullable().default(null).describe("What this connection's client is for, in the registering operator's words. Required at registration and editable with `pithy dashboard connect --update --purpose`; null only for a connection registered before it was recorded."),
 	scopes: sqliteJson(z.array(ControlPlaneScope)).describe("The operations this connection was granted, stored and enforced on the adopter's side. Enforced only by the caller, a scope would not be a limit at all."),
 	keys: sqliteJson(z.array(RegisteredKey)).describe("Every key this connection may sign with, current and superseded. One JSON column rather than a child table, so a rotation is one atomic UPDATE and verification is one read."),
 	createdAt: SQLiteDate.describe("When the connection was registered. Ms-epoch in SQLite, a Date in TypeScript."),
 	updatedAt: SQLiteDate.describe("When the row last changed — a key registered or expired, or the Worker URL re-pointed.")
 }).describe("One management-client connection: its identity, the environment and URL it is bound to, the operations it was granted, and its versioned public keys.");
 //#endregion
-export { ControlPlaneConnection, Ed25519PublicJwk, RegisteredKey };
+export { ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, ControlPlaneConnection, Ed25519PublicJwk, MAX_CONNECTION_PURPOSE, RegisteredKey };

package/dist/controlPlane/http/cors.d.ts

@@ -93,10 +93,10 @@ export declare function corsMiddleware(entry: CorsSurfaceEntry, origins: Readonl
 /**
  * Mount one `app.use(path, …)` per entry.
  *
- * **Called from the capability's `middleware` hook, never its `routes` hook, and that is load-bearing.**
- * `createBackend` runs every capability's `middleware` hook before **any** capability's `routes` hook
- * (`createBackend.ts:262-267`), which is what makes this independent of the order an adopter happens to
- * list their capabilities in.
+ * **Called from `createBackend` ahead of every capability's `middleware`, never from a `routes` hook,
+ * and that is load-bearing.** Registered there, it is independent of the order an adopter happens to
+ * list their capabilities in, and it can put a header on whatever a capability's middleware or a
+ * readiness guard short-circuits.
  *
  * From `routes` it looks like it works and does not. The preflight still answers — an `OPTIONS` has no
  * route handler to lose to, so this `use` is the only thing that matches it — but a capability composed

package/dist/controlPlane/http/cors.js

@@ -170,10 +170,10 @@ function corsMiddleware(entry, origins, maxAgeSeconds) {
 /**
 * Mount one `app.use(path, …)` per entry.
 *
-* **Called from the capability's `middleware` hook, never its `routes` hook, and that is load-bearing.**
-* `createBackend` runs every capability's `middleware` hook before **any** capability's `routes` hook
-* (`createBackend.ts:262-267`), which is what makes this independent of the order an adopter happens to
-* list their capabilities in.
+* **Called from `createBackend` ahead of every capability's `middleware`, never from a `routes` hook,
+* and that is load-bearing.** Registered there, it is independent of the order an adopter happens to
+* list their capabilities in, and it can put a header on whatever a capability's middleware or a
+* readiness guard short-circuits.
 *
 * From `routes` it looks like it works and does not. The preflight still answers — an `OPTIONS` has no
 * route handler to lose to, so this `use` is the only thing that matches it — but a capability composed