@pithy-sh/core 0.16.0 → 0.16.1

package/dist/controlPlane/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAWvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAqBnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB;aAClC,GAAG,EAAE,aAAa;aAClB,IAAI,EAAE,OAAO;aACb,MAAM;aACN,KAAK;aACL,IAAI,EAAE,SAAS;aACf,OAAO,EAAE,qGAAqG;aAC9G,OAAO;CACC,CAAC;AAEX,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAsPtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAWvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAsBnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB;aAClC,GAAG,EAAE,aAAa;aAClB,IAAI,EAAE,OAAO;aACb,MAAM;aACN,KAAK;aACL,IAAI,EAAE,SAAS;aACf,OAAO,EAAE,qGAAqG;aAC9G,OAAO;CACC,CAAC;AAEX,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAuPtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/controlPlane/capability.js

@@ -8,7 +8,7 @@ import { describePresenceRooms } from "../presence/http/routes.js";
 import { readRetirement } from "../privacy/fieldRotation.js";
 import { lazyPrivacyInventory } from "../privacy/inventory.js";
 import { composedRetention } from "../retention/composed.js";
-import { ControlPlaneConnection } from "./data/connection.js";
+import { parseConnectionRow } from "./data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, controlPlaneTables } from "./data/tables.js";
 import { standingHolds } from "../retention/holds.js";
 import { holdsUserPurge } from "../retention/holdsPurge.js";
@@ -25,6 +25,7 @@ import { controlplane_0002_management_origin } from "./migrations/0002_managemen
 import { controlplane_0003_connection_principal } from "./migrations/0003_connection_principal.js";
 import { controlplane_0004_connection_trusts } from "./migrations/0004_connection_trusts.js";
 import { controlplane_0005_holds } from "./migrations/0005_holds.js";
+import { controlplane_0006_connection_nulls } from "./migrations/0006_connection_nulls.js";
 import { d1ReplayGuard } from "./replay/d1Guard.js";
 import { CONTROL_PLANE_KV_BINDING, controlPlaneKvNamespaces, kvReplayGuard } from "./replay/kvGuard.js";
 //#region src/controlPlane/capability.ts
@@ -79,7 +80,8 @@ function controlplane(options = {}) {
 		"0002_management_origin": controlplane_0002_management_origin,
 		"0003_connection_principal": controlplane_0003_connection_principal,
 		"0004_connection_trusts": controlplane_0004_connection_trusts,
-		"0005_holds": controlplane_0005_holds
+		"0005_holds": controlplane_0005_holds,
+		"0006_connection_nulls": controlplane_0006_connection_nulls
 	};
 	const requiredBindings = [{
 		type: "d1",
@@ -165,7 +167,7 @@ function controlplane(options = {}) {
 					c.set("controlPlaneVerifier", createControlPlaneVerifier({
 						loadConnection: async (connectionId) => {
 							const row = await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().where("id", "=", connectionId).executeTakeFirst();
-							return row ? ControlPlaneConnection.parse(row) : null;
+							return row ? parseConnectionRow(row) : null;
 						},
 						countConnections: async () => {
 							return (await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).select("id").limit(1).execute()).length;
@@ -177,7 +179,7 @@ function controlplane(options = {}) {
 					}, {
 						loadEnvironmentConnection: async () => {
 							const row = await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().where("environment", "=", environment).executeTakeFirst();
-							return row ? ControlPlaneConnection.parse(row) : null;
+							return row ? parseConnectionRow(row) : null;
 						},
 						environment,
 						now,

package/dist/controlPlane/data/connection.d.ts

@@ -135,4 +135,14 @@ export declare const ControlPlaneConnection: z.ZodObject<{
 }, z.core.$strip>;
 export type ControlPlaneConnection = z.output<typeof ControlPlaneConnection>;
 export type ControlPlaneConnectionRow = z.input<typeof ControlPlaneConnection>;
+/** The nullable columns a NULL in which means "not recorded", and which `pithy migrate` repairs when they hold `''`. */
+export declare const CONNECTION_NULLABLE_COLUMNS: readonly ["managementOrigin", "authorizedBy", "actorKind", "purpose"];
+/**
+ * Decode one stored connection row, or refuse it with the columns that would not parse.
+ *
+ * Every reader of the table goes through this, the Worker's verifier and the CLI's registry alike, so a row
+ * nobody can read is named the same way wherever it is met, never surfaced as a bare `ZodError`. The message is
+ * the default, because the verifier answers before a caller is authenticated.
+ */
+export declare function parseConnectionRow(row: unknown): ControlPlaneConnection;
 //# sourceMappingURL=connection.d.ts.map

package/dist/controlPlane/data/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;EAI/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,YAK7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,8GAA8G;AAC9G,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAiB1C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAW3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB;;;;;EAIlC,CAAC;AACJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;EAI/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,YAK7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,8GAA8G;AAC9G,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAiB1C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAW3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB;;;;;EAIlC,CAAC;AACJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAQ/E,wHAAwH;AACxH,eAAO,MAAM,2BAA2B,YAAI,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAEjH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAgBvE"}

package/dist/controlPlane/data/connection.js

@@ -1,5 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { InternalError } from "../../error/pithyError.js";
+import { commandName } from "../../cli/command.js";
 import { ControlPlaneScope } from "../scope/scope.js";
 import { JsonDate, SQLiteDate, sqliteJson } from "../../data/codecs.js";
 import { OidcTrust } from "./oidcTrust.js";
@@ -117,5 +119,36 @@ const ControlPlaneConnection = z.object({
 	createdAt: SQLiteDate.describe("When the connection was registered. Ms-epoch in SQLite, a Date in TypeScript."),
 	updatedAt: SQLiteDate.describe("When the row last changed — a key registered or expired, or the Worker URL re-pointed.")
 }).describe("One management-client connection: its identity, the environment and URL it is bound to, the operations it was granted, and its versioned public keys.");
+/** The SQLite column a schema path names: `authorizedBy` → `authorized_by`, or `row` for the row itself. */
+function columnOf(path) {
+	const field = path[0];
+	return field === void 0 ? "row" : String(field).replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+}
+/** The nullable columns a NULL in which means "not recorded", and which `pithy migrate` repairs when they hold `''`. */
+const CONNECTION_NULLABLE_COLUMNS = [
+	"managementOrigin",
+	"authorizedBy",
+	"actorKind",
+	"purpose"
+];
+/**
+* Decode one stored connection row, or refuse it with the columns that would not parse.
+*
+* Every reader of the table goes through this, the Worker's verifier and the CLI's registry alike, so a row
+* nobody can read is named the same way wherever it is met, never surfaced as a bare `ZodError`. The message is
+* the default, because the verifier answers before a caller is authenticated.
+*/
+function parseConnectionRow(row) {
+	const parsed = ControlPlaneConnection.safeParse(row);
+	if (parsed.success) return parsed.data;
+	const columns = [...new Set(parsed.error.issues.map((issue) => columnOf(issue.path)))];
+	const repairable = CONNECTION_NULLABLE_COLUMNS.map((column) => columnOf([column]));
+	const id = typeof row === "object" && row !== null && "id" in row ? String(row.id) : "unknown";
+	const repair = columns.some((column) => repairable.includes(column)) ? ` ${repairable.join(", ")} read NULL as not recorded, and an empty string in one is not NULL. Run ${commandName("migrate")} for its environment, which puts it back.` : "";
+	throw new InternalError({
+		action: `${columns.join(", ")} in pithy_controlplane_connections ${columns.length === 1 ? "holds a value" : "hold values"} this release cannot read.${repair}`,
+		detail: `Connection ${id}: ${parsed.error.issues.map((issue) => `${columnOf(issue.path)}: ${issue.message}`).join("; ")}`
+	}, { cause: parsed.error });
+}
 //#endregion
-export { ConnectionCredentialKind, ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, ControlPlaneConnection, Ed25519PublicJwk, MAX_CONNECTION_PURPOSE, RegisteredKey };
+export { CONNECTION_NULLABLE_COLUMNS, ConnectionCredentialKind, ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, ControlPlaneConnection, Ed25519PublicJwk, MAX_CONNECTION_PURPOSE, RegisteredKey, parseConnectionRow };

package/dist/controlPlane/data/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connections.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,wBAAwB,EAAE,sBAAsB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzG,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEtF;;;;;GAKG;AAEH,8DAA8D;AAC9D,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,sBAAsB,GAAG,wBAAwB,CAOrG;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAErF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAU9F;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,GAAG,kBAAkB,CAenG;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpG;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACxD,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC1D;AAED,sGAAsG;AACtG,wBAAsB,eAAe,CACnC,EAAE,EAAE,oBAAoB,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED,0CAA0C;AAC1C,wBAAsB,cAAc,CAAC,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAGjH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,kHAAkH;AAClH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,oBAAoB,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC1D,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMpC;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,oBAAoB,EACxB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,SAAS,aAAa,EAAE,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CAelB;AAKD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,IAAI,EACT,OAAO,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC1D,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAcpC"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connections.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,EAEtB,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEtF;;;;;GAKG;AAEH,8DAA8D;AAC9D,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,sBAAsB,GAAG,wBAAwB,CAOrG;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAErF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAU9F;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,EAAE,IAAI,GAAG,kBAAkB,CAenG;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpG;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACxD,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC1D;AAED,sGAAsG;AACtG,wBAAsB,eAAe,CACnC,EAAE,EAAE,oBAAoB,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED,0CAA0C;AAC1C,wBAAsB,cAAc,CAAC,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAGjH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,kHAAkH;AAClH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,oBAAoB,EACxB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC1D,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAMpC;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,oBAAoB,EACxB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,SAAS,aAAa,EAAE,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CAelB;AAKD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,oBAAoB,EACxB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,IAAI,EACT,OAAO,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC1D,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAcpC"}

package/dist/controlPlane/data/connections.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { ConflictError } from "../../error/pithyError.js";
 import { activeTrusts } from "./oidcTrust.js";
-import { ControlPlaneConnection } from "./connection.js";
+import { ControlPlaneConnection, parseConnectionRow } from "./connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE } from "./tables.js";
 import { activeKeys } from "./keyLifecycle.js";
 import { sql } from "kysely";
@@ -74,7 +74,7 @@ function authorizedByPrincipal(connection, principal) {
 async function listConnections(db, filter = {}) {
 	let query = db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().orderBy("createdAt").orderBy("id");
 	if (filter.environment !== void 0) query = query.where("environment", "=", filter.environment);
-	const rows = (await query.execute()).map((row) => ControlPlaneConnection.parse(row));
+	const rows = (await query.execute()).map((row) => parseConnectionRow(row));
 	const { principal } = filter;
 	return {
 		connections: rows.filter((row) => row.authorizedBy !== null && (principal === void 0 || authorizedByPrincipal(row, principal))),
@@ -84,7 +84,7 @@ async function listConnections(db, filter = {}) {
 /** Read one connection by id, or null. */
 async function readConnection(db, id) {
 	const row = await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().where("id", "=", id).executeTakeFirst();
-	return row ? ControlPlaneConnection.parse(row) : null;
+	return row ? parseConnectionRow(row) : null;
 }
 /** Read one connection by id for a write, or null. With `environment`, null for a connection bound to another. */
 async function readConnectionForWrite(db, id, options = {}) {
@@ -93,7 +93,7 @@ async function readConnectionForWrite(db, id, options = {}) {
 	const row = await query.executeTakeFirst();
 	if (!row) return null;
 	return {
-		connection: ControlPlaneConnection.parse(row),
+		connection: parseConnectionRow(row),
 		storedKeys: row.keys,
 		storedTrusts: row.trusts
 	};

package/dist/controlPlane/evidence/pack.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { noopEmit } from "../../audit/recorder.js";
 import { MIGRATIONS_READ_SCOPE } from "../scope/scope.js";
-import { ControlPlaneConnection } from "../data/connection.js";
+import { parseConnectionRow } from "../data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE } from "../data/tables.js";
 import { workerVersionMetadata } from "../../worker/identity.js";
 import { readCapabilityHealth } from "../discovery/health.js";
@@ -17,7 +17,7 @@ import { deriveAuditLogging, deriveChangeHistory, deriveCsrf, deriveDataProtecti
 async function readConnections(c, sources, environment) {
 	try {
 		return (await sources.database(c).selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().where("environment", "=", environment).orderBy("createdAt").execute()).map((row) => {
-			const connection = ControlPlaneConnection.parse(row);
+			const connection = parseConnectionRow(row);
 			return {
 				id: connection.id,
 				authorizedBy: connection.authorizedBy,

package/dist/controlPlane/migrations/0006_connection_nulls.d.ts

@@ -0,0 +1,14 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Migration } from "kysely/migration";
+/**
+ * An empty nullable column reads as NULL again.
+ *
+ * `''` is not a value any of them accepts: not a URL, not an email, not an actor kind, shorter than a purpose.
+ * A connection holding one cannot be read, so every call on it is refused, and the only writer of one bound NULL
+ * as an empty string. So `''` in any of them is NULL, put back.
+ *
+ * `down` writes nothing. An empty string is not a state to return to: it is the one that refuses every call.
+ */
+export declare const controlplane_0006_connection_nulls: Migration;
+//# sourceMappingURL=0006_connection_nulls.d.ts.map

package/dist/controlPlane/migrations/0006_connection_nulls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0006_connection_nulls.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrations/0006_connection_nulls.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKlD;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAahD,CAAC"}

package/dist/controlPlane/migrations/0006_connection_nulls.js

@@ -0,0 +1,28 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/controlPlane/migrations/0006_connection_nulls.ts
+/** The nullable columns `''` cannot satisfy, as they stood when this migration was written. */
+const NULLABLE_COLUMNS = [
+	"managementOrigin",
+	"authorizedBy",
+	"actorKind",
+	"purpose"
+];
+/**
+* An empty nullable column reads as NULL again.
+*
+* `''` is not a value any of them accepts: not a URL, not an email, not an actor kind, shorter than a purpose.
+* A connection holding one cannot be read, so every call on it is refused, and the only writer of one bound NULL
+* as an empty string. So `''` in any of them is NULL, put back.
+*
+* `down` writes nothing. An empty string is not a state to return to: it is the one that refuses every call.
+*/
+const controlplane_0006_connection_nulls = {
+	up: async (db) => {
+		const table = db;
+		for (const column of NULLABLE_COLUMNS) await table.updateTable("pithyControlplaneConnections").set({ [column]: null }).where(column, "=", "").execute();
+	},
+	down: async () => {}
+};
+//#endregion
+export { controlplane_0006_connection_nulls };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.16.0";
+export declare const PACKAGE_VERSION = "0.16.1";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.16.0";
+const PACKAGE_VERSION = "0.16.1";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/controlPlane/capability.ts

@@ -19,7 +19,7 @@ import { holdsUserPurge } from "../retention/holdsPurge";
 import { PACKAGE_NAME, PACKAGE_VERSION } from "../version.generated";
 import { ENVIRONMENT_VAR } from "../worker/identity";
 import { ControlPlaneConfig, type ControlPlaneConfigInput } from "./config/config";
-import { ControlPlaneConnection } from "./data/connection";
+import { parseConnectionRow } from "./data/connection";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, type ControlPlaneDatabase, controlPlaneTables } from "./data/tables";
 import { recordTrustFirstCall } from "./data/trustFirstCall";
 import type { CapabilityDeclaration } from "./discovery/adminRoute";
@@ -37,6 +37,7 @@ import { controlplane_0002_management_origin } from "./migrations/0002_managemen
 import { controlplane_0003_connection_principal } from "./migrations/0003_connection_principal";
 import { controlplane_0004_connection_trusts } from "./migrations/0004_connection_trusts";
 import { controlplane_0005_holds } from "./migrations/0005_holds";
+import { controlplane_0006_connection_nulls } from "./migrations/0006_connection_nulls";
 import { d1ReplayGuard } from "./replay/d1Guard";
 import type { ReplayGuard } from "./replay/guard";
 import {
@@ -113,6 +114,7 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
     "0003_connection_principal": controlplane_0003_connection_principal,
     "0004_connection_trusts": controlplane_0004_connection_trusts,
     "0005_holds": controlplane_0005_holds,
+    "0006_connection_nulls": controlplane_0006_connection_nulls,
   };
   const requiredBindings: BindingSpecInput[] = [
     // The app database — the connections table lives here, beside auth's and audit's. Not the secrets
@@ -291,7 +293,7 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
                     .selectAll()
                     .where("id", "=", connectionId)
                     .executeTakeFirst();
-                  return row ? ControlPlaneConnection.parse(row) : null;
+                  return row ? parseConnectionRow(row) : null;
                 },
                 countConnections: async () => {
                   const rows = await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).select("id").limit(1).execute();
@@ -313,7 +315,7 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
                     .selectAll()
                     .where("environment", "=", environment)
                     .executeTakeFirst();
-                  return row ? ControlPlaneConnection.parse(row) : null;
+                  return row ? parseConnectionRow(row) : null;
                 },
                 environment,
                 now,

package/src/controlPlane/data/connection.ts

@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: MIT
 
 import { z } from "zod";
+import { commandName } from "../../cli/command";
 import { JsonDate, SQLiteDate, sqliteJson } from "../../data/codecs";
+import { InternalError } from "../../error/pithyError";
 import { ControlPlaneScope } from "../scope/scope";
 import { OidcTrust } from "./oidcTrust";
 
@@ -232,3 +234,37 @@ export const ControlPlaneConnection = z
   );
 export type ControlPlaneConnection = z.output<typeof ControlPlaneConnection>;
 export type ControlPlaneConnectionRow = z.input<typeof ControlPlaneConnection>;
+
+/** The SQLite column a schema path names: `authorizedBy` → `authorized_by`, or `row` for the row itself. */
+function columnOf(path: readonly PropertyKey[]): string {
+  const field = path[0];
+  return field === undefined ? "row" : String(field).replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+}
+
+/** The nullable columns a NULL in which means "not recorded", and which `pithy migrate` repairs when they hold `''`. */
+export const CONNECTION_NULLABLE_COLUMNS = ["managementOrigin", "authorizedBy", "actorKind", "purpose"] as const;
+
+/**
+ * Decode one stored connection row, or refuse it with the columns that would not parse.
+ *
+ * Every reader of the table goes through this, the Worker's verifier and the CLI's registry alike, so a row
+ * nobody can read is named the same way wherever it is met, never surfaced as a bare `ZodError`. The message is
+ * the default, because the verifier answers before a caller is authenticated.
+ */
+export function parseConnectionRow(row: unknown): ControlPlaneConnection {
+  const parsed = ControlPlaneConnection.safeParse(row);
+  if (parsed.success) return parsed.data;
+  const columns = [...new Set(parsed.error.issues.map((issue) => columnOf(issue.path)))];
+  const repairable = CONNECTION_NULLABLE_COLUMNS.map((column) => columnOf([column]));
+  const id = typeof row === "object" && row !== null && "id" in row ? String(row.id) : "unknown";
+  const repair = columns.some((column) => repairable.includes(column))
+    ? ` ${repairable.join(", ")} read NULL as not recorded, and an empty string in one is not NULL. Run ${commandName("migrate")} for its environment, which puts it back.`
+    : "";
+  throw new InternalError(
+    {
+      action: `${columns.join(", ")} in pithy_controlplane_connections ${columns.length === 1 ? "holds a value" : "hold values"} this release cannot read.${repair}`,
+      detail: `Connection ${id}: ${parsed.error.issues.map((issue) => `${columnOf(issue.path)}: ${issue.message}`).join("; ")}`,
+    },
+    { cause: parsed.error },
+  );
+}

package/src/controlPlane/data/connections.ts

@@ -3,7 +3,12 @@
 
 import { sql } from "kysely";
 import { ConflictError } from "../../error/pithyError";
-import { type ConnectionCredentialKind, ControlPlaneConnection, type RegisteredKey } from "./connection";
+import {
+  type ConnectionCredentialKind,
+  ControlPlaneConnection,
+  parseConnectionRow,
+  type RegisteredKey,
+} from "./connection";
 import { activeKeys } from "./keyLifecycle";
 import { activeTrusts, type OidcTrust } from "./oidcTrust";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, type ControlPlaneDatabase } from "./tables";
@@ -104,7 +109,7 @@ export async function listConnections(
 ): Promise<ConnectionListing> {
   let query = db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().orderBy("createdAt").orderBy("id");
   if (filter.environment !== undefined) query = query.where("environment", "=", filter.environment);
-  const rows = (await query.execute()).map((row) => ControlPlaneConnection.parse(row));
+  const rows = (await query.execute()).map((row) => parseConnectionRow(row));
   const { principal } = filter;
   return {
     connections: rows.filter(
@@ -117,7 +122,7 @@ export async function listConnections(
 /** Read one connection by id, or null. */
 export async function readConnection(db: ControlPlaneDatabase, id: string): Promise<ControlPlaneConnection | null> {
   const row = await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().where("id", "=", id).executeTakeFirst();
-  return row ? ControlPlaneConnection.parse(row) : null;
+  return row ? parseConnectionRow(row) : null;
 }
 
 /**
@@ -142,7 +147,7 @@ export async function readConnectionForWrite(
   if (options.environment !== undefined) query = query.where("environment", "=", options.environment);
   const row = await query.executeTakeFirst();
   if (!row) return null;
-  return { connection: ControlPlaneConnection.parse(row), storedKeys: row.keys, storedTrusts: row.trusts };
+  return { connection: parseConnectionRow(row), storedKeys: row.keys, storedTrusts: row.trusts };
 }
 
 /**

package/src/controlPlane/evidence/pack.ts

@@ -12,7 +12,7 @@ import type { PrivacyInventory } from "../../privacy/report";
 import type { RetirementVerdict } from "../../privacy/retirement";
 import { workerVersionMetadata } from "../../worker/identity";
 import type { ControlPlaneContext } from "../context";
-import { ControlPlaneConnection } from "../data/connection";
+import { parseConnectionRow } from "../data/connection";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, type ControlPlaneDatabase } from "../data/tables";
 import { type CapabilityHealthSource, readCapabilityHealth } from "../discovery/health";
 import type { ControlPlaneEvidenceResponse } from "../http/responses";
@@ -82,7 +82,7 @@ async function readConnections(
       .execute();
     return rows.map((row) => {
       // Only the fields the pack reports and the key windows it ages. The public halves stay in the row.
-      const connection = ControlPlaneConnection.parse(row);
+      const connection = parseConnectionRow(row);
       return {
         id: connection.id,
         authorizedBy: connection.authorizedBy,

package/src/controlPlane/migrations/0006_connection_nulls.ts

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { Kysely } from "kysely";
+import type { Migration } from "kysely/migration";
+
+/** The nullable columns `''` cannot satisfy, as they stood when this migration was written. */
+const NULLABLE_COLUMNS = ["managementOrigin", "authorizedBy", "actorKind", "purpose"] as const;
+
+/**
+ * An empty nullable column reads as NULL again.
+ *
+ * `''` is not a value any of them accepts: not a URL, not an email, not an actor kind, shorter than a purpose.
+ * A connection holding one cannot be read, so every call on it is refused, and the only writer of one bound NULL
+ * as an empty string. So `''` in any of them is NULL, put back.
+ *
+ * `down` writes nothing. An empty string is not a state to return to: it is the one that refuses every call.
+ */
+export const controlplane_0006_connection_nulls: Migration = {
+  up: async (db: Kysely<unknown>): Promise<void> => {
+    const table = db as unknown as Kysely<{ pithyControlplaneConnections: Record<string, string | null> }>;
+    for (const column of NULLABLE_COLUMNS) {
+      await table
+        .updateTable("pithyControlplaneConnections")
+        .set({ [column]: null })
+        .where(column, "=", "")
+        .execute();
+    }
+  },
+
+  down: async (): Promise<void> => {},
+};

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.16.0";
+export const PACKAGE_VERSION = "0.16.1";