@pithy-sh/core 0.13.0 → 0.14.0

package/dist/test-utils/connectionFixtures.js

@@ -0,0 +1,58 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/test-utils/connectionFixtures.ts
+/** The instant the connection fixtures are read at. */
+const FIXTURE_NOW = /* @__PURE__ */ new Date("2026-10-27T12:00:00.000Z");
+const REGISTERED = /* @__PURE__ */ new Date("2026-10-01T00:00:00.000Z");
+/** A registered key, live at {@link FIXTURE_NOW} unless overridden. */
+function fixtureKey(keyId, overrides = {}) {
+	return {
+		keyId,
+		publicKey: {
+			kty: "OKP",
+			crv: "Ed25519",
+			x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
+		},
+		validFrom: REGISTERED,
+		validUntil: null,
+		revokedAt: null,
+		...overrides
+	};
+}
+/** An OIDC trust, live at {@link FIXTURE_NOW} unless overridden. */
+function fixtureTrust(trustId, overrides = {}) {
+	return {
+		trustId,
+		issuer: "https://token.actions.githubusercontent.com",
+		jwksUrl: "https://token.actions.githubusercontent.com/.well-known/jwks",
+		audience: "https://api.example.com",
+		claims: { repository_id: "1262274726" },
+		authorizedBy: "ada@example.com",
+		validFrom: REGISTERED,
+		revokedAt: null,
+		firstCallAt: null,
+		...overrides
+	};
+}
+/** A connection authorized by ada@example.com, holding one live key, unless overridden. */
+function fixtureConnection(overrides = {}) {
+	return {
+		id: "3f2504e0-4f89-41d3-9a0c-0305e82c3301",
+		environment: "prod",
+		issuer: "https://app.pithy.sh",
+		workerUrl: "https://api.example.com",
+		basePath: "/control-plane",
+		managementOrigin: null,
+		authorizedBy: "ada@example.com",
+		actorKind: "agent",
+		purpose: "Nightly audit summarizer.",
+		scopes: ["manifest:read"],
+		keys: [fixtureKey("k1")],
+		trusts: [],
+		createdAt: REGISTERED,
+		updatedAt: REGISTERED,
+		...overrides
+	};
+}
+//#endregion
+export { FIXTURE_NOW, fixtureConnection, fixtureKey, fixtureTrust };

package/dist/test-utils/interleave.d.ts

@@ -0,0 +1,12 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Kysely } from "kysely";
+/**
+ * The same database, with `between` run after each of its first `times` reads and before the caller sees the rows: a
+ * write that lands between a read and the write made from it.
+ *
+ * `between` receives the count of reads it has followed so far, from 0. It must write through another handle, since a
+ * read it made through this one would be followed in turn.
+ */
+export declare function writeAfterRead<DB>(db: Kysely<DB>, between: (count: number) => Promise<void>, times?: number): Kysely<DB>;
+//# sourceMappingURL=interleave.d.ts.map

package/dist/test-utils/interleave.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interleave.d.ts","sourceRoot":"","sources":["../../src/test-utils/interleave.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAyB,MAAM,QAAQ,CAAC;AAE5D;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAC/B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EACd,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EACzC,KAAK,SAA2B,GAC/B,MAAM,CAAC,EAAE,CAAC,CAcZ"}

package/dist/test-utils/interleave.js

@@ -0,0 +1,26 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/test-utils/interleave.ts
+/**
+* The same database, with `between` run after each of its first `times` reads and before the caller sees the rows: a
+* write that lands between a read and the write made from it.
+*
+* `between` receives the count of reads it has followed so far, from 0. It must write through another handle, since a
+* read it made through this one would be followed in turn.
+*/
+function writeAfterRead(db, between, times = Number.POSITIVE_INFINITY) {
+	const reads = /* @__PURE__ */ new WeakSet();
+	let count = 0;
+	return db.withPlugin({
+		transformQuery({ queryId, node }) {
+			if (node.kind === "SelectQueryNode") reads.add(queryId);
+			return node;
+		},
+		async transformResult({ queryId, result }) {
+			if (reads.has(queryId) && count < times) await between(count++);
+			return result;
+		}
+	});
+}
+//#endregion
+export { writeAfterRead };

package/dist/testWorker.d.ts

@@ -0,0 +1,8 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+export { PresenceRoom } from "./presence/durableObject";
+declare const _default: {
+    fetch(): Response;
+};
+export default _default;
+//# sourceMappingURL=testWorker.d.ts.map

package/dist/testWorker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testWorker.d.ts","sourceRoot":"","sources":["../src/testWorker.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;;IAGtD,KAAK,IAAI,QAAQ"}

package/dist/testWorker.js

@@ -0,0 +1,9 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { PresenceRoom } from "./presence/durableObject.js";
+//#region src/testWorker.ts
+var testWorker_default = { fetch() {
+	return new Response("core test worker", { status: 200 });
+} };
+//#endregion
+export { PresenceRoom, testWorker_default as default };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.13.0";
+export declare const PACKAGE_VERSION = "0.14.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.13.0";
+const PACKAGE_VERSION = "0.14.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/workflow/dispatchRoute.js

@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: MIT
 import { ForbiddenError, PithyError } from "../error/pithyError.js";
 import { commandName } from "../cli/command.js";
-import { ambientEnv, compositionEnvironment } from "../env/ambient.js";
 import { describeRoute } from "../http/routeSpec.js";
 import { validate } from "../http/validation.js";
+import { ambientEnv, compositionEnvironment } from "../env/ambient.js";
 import { WORKFLOW_DISPATCH_ROUTE, WorkflowDispatchParams, WorkflowDispatchRequest, WorkflowDispatchResponse } from "./schemas.js";
 import { workflowBindingFor } from "./dispatch.js";
 //#region src/workflow/dispatchRoute.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/audit/auditEvent.ts

@@ -97,7 +97,7 @@ export const AuditEvent = z
       .nullish()
       .describe("The acting principal's stable id (user id, service/token name); null for `system`/`anonymous`."),
     actorKind: ControlPlaneActorKind.nullish().describe(
-      "For a `control-plane` actor, what kind of management client acted — `agent`, `dashboard` or `script` — from the connection it called through (#721). `actorType` names all three alike; this is what tells them apart. Stamped by `requireControlPlane`, so an emit site does not set it; null for every other actor type, and for a connection registered before the kind was recorded.",
+      "What kind of client acted — `agent`, `dashboard` or `script`. On a `control-plane` row it is the connection's kind, which `actorType` cannot tell apart, stamped by `requireControlPlane` so an emit site does not set it; null for a connection registered before the kind was recorded. On a `user` row it is `agent` when an MCP client acted as that user, so one filter finds every agent row on both paths. Null otherwise.",
     ),
     sessionId: z
       .string()