@pithy-sh/core 0.6.1 → 0.7.0

package/dist/capability/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/capability/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,EAAE,UAAU,CAAC;IACd;;;;;;;;;OASG;IACH,YAAY,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;;;;;;;;OASG;IACH,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,iHAAiH;AACjH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,uGAAuG;IACvG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,qGAAqG;IACrG,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,gBAAgB,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU,CACzB,SAAS,SAAS,eAAe,GAAG,eAAe,EACnD,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAC1D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,eAAe;IAEnD;;;;OAIG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACtD;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACnD,gCAAgC;IAChC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;IAC3C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,gBAAgB,CAAC;IAChE;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,yFAAyF;IACzF,gBAAgB,EAAE,WAAW,EAAE,CAAC;CACjC;AAED,mGAAmG;AACnG,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EACxD,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC5D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IACtD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,kBAAkB,CAAC,GAAG;IACjF,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,CAAC,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAClE,KAAK,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAClC,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,EAAE,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAKpH;AAED,sGAAsG;AACtG,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;AAEpH,kFAAkF;AAClF,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE7G,sFAAsF;AACtF,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3G;;;;;GAKG;AACH,KAAK,gBAAgB,CAAC,CAAC,IACrB,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC,GAC1E;KAAG,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;CAAE,GAC5E,KAAK,CAAC;AAEZ;;;;GAIG;AACH,KAAK,YAAY,CAAC,MAAM,EAAE,KAAK,IAC7B,mBAAmB,CAAC,MAAM,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC;AAEpH,sFAAsF;AACtF,MAAM,MAAM,eAAe,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC5E,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACzB,eAAe,CAChB,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC/E,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC1B,kBAAkB,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CACjF,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/capability/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,EAAE,UAAU,CAAC;IACd;;;;;;;;;OASG;IACH,YAAY,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;;;;;;;;OASG;IACH,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,iHAAiH;AACjH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,uGAAuG;IACvG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,qGAAqG;IACrG,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,gBAAgB,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU,CACzB,SAAS,SAAS,eAAe,GAAG,eAAe,EACnD,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAC1D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,eAAe;IAEnD;;;;OAIG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACtD;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACnD,gCAAgC;IAChC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;IAC3C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,gBAAgB,CAAC;IAChE;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,yFAAyF;IACzF,gBAAgB,EAAE,WAAW,EAAE,CAAC;CACjC;AAED,mGAAmG;AACnG,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EACxD,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC5D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IACtD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,kBAAkB,CAAC,GAAG;IACjF,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,CAAC,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAClE,KAAK,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAClC,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,EAAE,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAUpH;AAED,sGAAsG;AACtG,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;AAEpH,kFAAkF;AAClF,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE7G,sFAAsF;AACtF,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3G;;;;;GAKG;AACH,KAAK,gBAAgB,CAAC,CAAC,IACrB,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC,GAC1E;KAAG,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;CAAE,GAC5E,KAAK,CAAC;AAEZ;;;;GAIG;AACH,KAAK,YAAY,CAAC,MAAM,EAAE,KAAK,IAC7B,mBAAmB,CAAC,MAAM,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC;AAEpH,sFAAsF;AACtF,MAAM,MAAM,eAAe,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC5E,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACzB,eAAe,CAChB,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC/E,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC1B,kBAAkB,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CACjF,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC"}

package/dist/capability/capability.js

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { BindingSpec } from "./bindings.js";
+import { declareRetained } from "../migrations/retainedDeclaration.js";
 //#region src/capability/capability.ts
 /**
 * Author a capability. Parses each binding through `BindingSpec` — normalizing `optional`
@@ -9,6 +10,7 @@ import { BindingSpec } from "./bindings.js";
 * `databases`/`kvNamespaces` literals so `createBackend` can infer the merged registries.
 */
 function defineCapability(input) {
+	for (const spec of Object.values(input.databases ?? {})) if (spec.migrations && spec.retained) declareRetained(spec.migrations, spec.retained);
 	return {
 		...input,
 		requiredBindings: input.requiredBindings.map((binding) => BindingSpec.parse(binding))

package/dist/capability/settings.d.ts

@@ -84,11 +84,24 @@ export interface SettingsAccountReader {
     d1Databases(): Promise<readonly string[]>;
     /** Whether this account holds a Cloudflare zone covering the hostname — the prerequisite for onboarding it. */
     zone(hostname: string): Promise<boolean>;
-    /** Whether a declared secret has a value in that environment. The name is the registry's, not a binding's. */
-    secret(request: {
+    /**
+     * Whether that environment's **D1 vault** holds a value under this registry name — asked of its manager
+     * Worker, the only thing that can open it.
+     *
+     * Named for the store it asks, because it used to be `secret()` — "does this secret have a value" — and
+     * that question has two stores behind it (#596). A check asking it about a `cf-secrets-store` secret got a
+     * confident `false` from a vault the secret never lives in. Ask {@link storeEntry} about one of those.
+     */
+    vaultSecret(request: {
         name: string;
         environment: string;
     }): Promise<boolean>;
+    /**
+     * Whether the account's **Secrets Store** holds an entry of exactly this name. The name is the entry's, not
+     * the registry's: compose it with `environmentScope(project, env).secretEntry(...)`, the namer provisioning
+     * created it with, so the check looks where the value went.
+     */
+    storeEntry(name: string): Promise<boolean>;
 }
 /** What the account tier is told: everything the local tier gets, plus the account it may ask. */
 export interface SettingsAccountContext extends SettingsCheckContext {

package/dist/capability/settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/capability/settings.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,eAAe;;;;;iBA0B+D,CAAC;AAC5F,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,4GAA4G;AAC5G,MAAM,WAAW,oBAAoB;IACnC,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,WAAW,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,8GAA8G;IAC9G,MAAM,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E;AAED,kGAAkG;AAClG,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,yDAAyD;IACzD,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACrF,wGAAwG;IACxG,OAAO,CAAC,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CACvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,eAAe,EAAE,CAO7G"}
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/capability/settings.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,mFAAmF;AACnF,eAAO,MAAM,eAAe;;;;;iBA0B+D,CAAC;AAC5F,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,4GAA4G;AAC5G,MAAM,WAAW,oBAAoB;IACnC,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,WAAW,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAED,kGAAkG;AAClG,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,yDAAyD;IACzD,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,KAAK,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACrF,wGAAwG;IACxG,OAAO,CAAC,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CACvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,eAAe,EAAE,CAO7G"}

package/dist/data/databases.d.ts

@@ -26,6 +26,17 @@ export interface DatabaseSpec<Tables extends SchemaMap = SchemaMap> {
     migrations?: Record<string, Migration>;
     /** Sort order within this database relative to other capabilities (core low, app high). Required with `migrations`. */
     migrationOrder?: number;
+    /**
+     * The tables in this slice whose rows **exist nowhere else** — a vault's sealed credentials, a
+     * suppression list of people who asked not to be mailed. Keys of `tables`, declared beside the
+     * `migrations` that create them (required with them).
+     *
+     * A schema `down` is right to drop a table; for these it destroys the only copy. So while one of them
+     * holds rows, no `down` runs against this database — a rollback, a `seed --redo` reset, a
+     * `remove --drop` — unless the operator passes the exact row count (`--destroy-retained <n>`). The
+     * refusal lives in the migration runner, so a new command that reverses migrations inherits it (#588).
+     */
+    retained?: readonly (keyof Tables & string)[];
 }
 /** A capability's databases: database name → {@link DatabaseSpec}. */
 export type DatabaseSpecMap = Record<string, DatabaseSpec>;

package/dist/data/databases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"databases.d.ts","sourceRoot":"","sources":["../../src/data/databases.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,KAAK,YAAY,EAA2C,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,SAAS,GAAG,SAAS;IAChE,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,uHAAuH;IACvH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,UAAU,CAAC,GAAG,SAAS,eAAe,IAAI;KACnD,IAAI,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,YAAY,CAAC,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK;CAC3G,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEtE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,eAAe,CAO5E;AAED,uGAAuG;AACvG,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,eAAe,GAAG,cAAc,CAaxG"}
+{"version":3,"file":"databases.d.ts","sourceRoot":"","sources":["../../src/data/databases.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,KAAK,YAAY,EAA2C,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,SAAS,GAAG,SAAS;IAChE,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,uHAAuH;IACvH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,UAAU,CAAC,GAAG,SAAS,eAAe,IAAI;KACnD,IAAI,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,YAAY,CAAC,MAAM,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK;CAC3G,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEtE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,eAAe,CAO5E;AAED,uGAAuG;AACvG,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,eAAe,GAAG,cAAc,CAaxG"}

package/dist/migrations/registry.d.ts

@@ -18,6 +18,12 @@ export interface NamespacedMigrations {
     order: number;
     /** Stable, per-namespace keys, each `^\d{4}_[a-z0-9_]+$` (e.g. "0001_init"). */
     migrations: Record<string, Migration>;
+    /**
+     * The table keys (camelCase, as the capability's `tables` declares them) this set's capability retains
+     * in this database — rows that exist nowhere else. Recorded on this set's `down`s, and the runner refuses
+     * any `down` against the database while one of them holds rows. See `./retained`.
+     */
+    retained?: readonly string[];
 }
 /**
  * Merge namespaced migration sets into one ordered `MigrationProvider` **per database** — matching

package/dist/migrations/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/migrations/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMrE,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,QAAyB,CAAC;AAE1D,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,QAAqB,CAAC;AAKpD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACvC;AA6DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAavG"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/migrations/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAOrE,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,QAAyB,CAAC;AAE1D,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,QAAqB,CAAC;AAKpD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAgED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAavG"}

package/dist/migrations/registry.js

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
+import { declareRetained } from "./retainedDeclaration.js";
 //#region src/migrations/registry.ts
 /** Width of the zero-padded `order` prefix in a composed key — the stable anchor. */
 const ORDER_DIGITS = 4;
@@ -40,6 +41,7 @@ function composeDatabase(database, sets) {
 			if (migration) composed[`${prefix}_${set.namespace}_${localKey}`] = migration;
 		}
 	}
+	for (const set of sets) declareRetained(set.migrations, set.retained ?? []);
 	return { getMigrations: async () => composed };
 }
 /**

package/dist/migrations/retained.d.ts

@@ -0,0 +1,101 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { D1Database } from "@cloudflare/workers-types";
+import type { Migration, MigrationProvider } from "kysely/migration";
+import { ValidationError } from "../error/pithyError";
+/** The SQL name of a declared table key — `pithySecretsSystemSecrets` → `pithy_secrets_system_secrets`. */
+export declare function retainedTableName(key: string): string;
+/** One retained table that holds rows, on the binding it was counted through. */
+export interface RetainedRows {
+    /** The D1 binding the table lives behind — the name an adopter recognizes. */
+    binding: string;
+    /** The SQL table name. */
+    table: string;
+    /** How many rows it holds. Always positive: an empty or absent table is not at risk. */
+    rows: number;
+}
+/** The SQL names of the retained tables a provider's migrations declare. Reads no database. */
+export declare function retainedTableNames(provider: MigrationProvider): Promise<string[]>;
+/**
+ * Count the rows in every retained table these migrations declare that is present in the database.
+ * Read-only. Returns only the tables holding rows, so an empty result means nothing retained is at risk.
+ */
+export declare function countRetainedRows(database: D1Database, migrations: Readonly<Record<string, Migration>>, binding: string): Promise<RetainedRows[]>;
+/**
+ * Mark an error as a refusal to run a `down`, so it reaches the operator as itself rather than as a failed
+ * migration. For a guard written outside this module — the CLI's shared-database floor is one.
+ */
+export declare function downRefusal<E extends ValidationError>(error: E): E;
+/** Whether `error` refused a `down` before it ran — as opposed to a migration that failed. */
+export declare function isDownRefusal(error: unknown): error is ValidationError;
+/**
+ * What a refusal was raised ahead of, as the sentence ends: `Refused before <this>.` A `down` for the
+ * runner and the migration fan-out; a database deletion for a teardown that removes the database whole
+ * (#591), where "any down ran" would name an operation that was never going to happen.
+ */
+export type RefusedBefore = "any down against them ran" | "anything was deleted";
+/**
+ * The refusal, in one wording for every place that raises it — the fan-out's preflight, which names every
+ * database before any of them moves, {@link guardRetained}, which is the floor under it, and a teardown
+ * that deletes a database holding retained tables (`pithy secrets deprovision`, #591).
+ *
+ * `consent` is what the caller passed. The action always prints the number that would work, because that
+ * number is the one fact the operator has to read before typing it.
+ */
+export declare function retainedRefusal(atRisk: readonly RetainedRows[], consent: number | undefined, before?: RefusedBefore): ValidationError;
+/**
+ * **The preflight: refuse unless the operator counted exactly the retained rows in scope.**
+ *
+ * Absent a count, only an empty scope passes; given one, only the same number does — a count that is too
+ * high is a count of something else, and agreeing to it would let a stale number from shell history through
+ * the day the rows it described are joined by more. Call it with every database the operation will touch,
+ * counted before the first of them moves, so the refusal names them all with nothing changed.
+ *
+ * The floor under it is {@link RetainedBudget}, fed the operator's number and never this function's
+ * count.
+ */
+export declare function assertRetainedAgreed(atRisk: readonly RetainedRows[], consent: number | undefined, before?: RefusedBefore): void;
+/**
+ * **How many retained rows a run has agreed to destroy, spent as each database is reached.**
+ *
+ * One per run, shared by every database in it. Absent an agreement it holds nothing, so any retained row
+ * refuses. A database whose rows exceed what is left is refused whole — nothing is spent on a refusal.
+ */
+export declare class RetainedBudget {
+    #private;
+    /** What the caller agreed to, as they typed it — the number a refusal quotes back. */
+    readonly agreed: number | undefined;
+    constructor(agreed: number | undefined);
+    /** Spend `rows` if the budget covers them. False, and nothing spent, when it does not. */
+    spend(rows: number): boolean;
+}
+/**
+ * Wrap a provider so no `down` it yields runs while the database holds retained rows the budget does not
+ * cover. The check runs once, at the first `down`, and its answer stands for the rest of the run: a reset
+ * whose first `down` dropped the vault must not refuse its second for finding it empty.
+ *
+ * Counted at the `down`, not before: a row written after somebody else counted is a row this refuses.
+ */
+export declare function guardRetained(provider: MigrationProvider, database: D1Database, options: {
+    binding: string;
+    budget: RetainedBudget;
+}): MigrationProvider;
+/** Which way one migration is about to move — Kysely's own spelling, as a `MigrationResult` carries it. */
+export type MigrationDirection = "Up" | "Down";
+/** Called ahead of one migration's body, with its composed name and the direction it is about to move. */
+export type BeforeMigration = (name: string, direction: MigrationDirection) => Promise<void>;
+/**
+ * Wrap a provider so `before` runs ahead of every `down` it yields — and a throw from `before` means the
+ * `down` never runs. Ups pass through untouched. A declared `down` stays declared: see {@link wrapEach}.
+ */
+export declare function beforeEachDown(provider: MigrationProvider, before: () => Promise<void>): MigrationProvider;
+/**
+ * Wrap a provider so `before` hears each migration's name and direction ahead of its body, up or down (#583).
+ *
+ * The seam a caller uses to say which migration it is on while it is on it: the CLI raises a `▸` step here,
+ * because a remote migration is a D1 round trip per statement and an operator watching nothing happen
+ * cannot tell a slow schema change from a hung one. Core carries no terminal concern — it hands over the
+ * name and the direction, and what is done with them is the caller's. A declared `down` stays declared.
+ */
+export declare function beforeEachMigration(provider: MigrationProvider, before: BeforeMigration): MigrationProvider;
+//# sourceMappingURL=retained.d.ts.map

package/dist/migrations/retained.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retained.d.ts","sourceRoot":"","sources":["../../src/migrations/retained.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA6DtD,2GAA2G;AAC3G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+FAA+F;AAC/F,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEvF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,UAAU,EACpB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAC/C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,EAAE,CAAC,CAgBzB;AAUD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAGlE;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAEtE;AAOD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,2BAA2B,GAAG,sBAAsB,CAAC;AAEjF;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,aAA2C,GAClD,eAAe,CAEjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,aAA2C,GAClD,IAAI,CAIN;AAyBD;;;;;GAKG;AACH,qBAAa,cAAc;;IACzB,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAGpC,YAAY,MAAM,EAAE,MAAM,GAAG,SAAS,EAGrC;IAED,0FAA0F;IAC1F,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI3B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACnD,iBAAiB,CAWnB;AAED,2GAA2G;AAC3G,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,MAAM,CAAC;AAE/C,0GAA0G;AAC1G,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAyC7F;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAE1G;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAE3G"}

package/dist/migrations/retained.js

@@ -0,0 +1,243 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { ValidationError } from "../error/pithyError.js";
+import { declareRetainedDown, retainedTablesOf, retainedTablesOfDown } from "./retainedDeclaration.js";
+import { CamelCasePlugin } from "kysely";
+//#region src/migrations/retained.ts
+/**
+* **A retained table holds rows that exist nowhere else (#588).**
+*
+* A migration's `down` is the tested inverse of its `up`, and for schema that is exactly right. For a
+* vault it is a `drop table` on the only copy of a credential Google issued. `0100_secrets_0001_init` is
+* the whole history of the secrets database, so one `pithy migrate --rollback` — which steps back one
+* migration in every composed database — emptied it in place, on staging, with nothing said first.
+*
+* So a capability **declares** a table retained, beside the migrations that create it
+* (`DatabaseSpec.retained`), and the declaration is recorded on those migrations' own `down` functions
+* (`./retainedDeclaration`) — by `defineCapability`, and again by `createMigrationRegistry` for a set that
+* carries it. The refusal is on the operation that runs a `down`, not on a list of commands:
+* {@link guardRetained} wraps every `down` a provider yields, and the runner applies it to every provider
+* it is handed.
+*
+* ## What is TRUE
+*
+* **No `down` runs against a database while a table declared retained in that database holds rows**,
+* beyond what the caller's {@link RetainedBudget} agreed to destroy. A count, not a boolean, so a flag
+* somebody has in their shell history for another database does not also authorize this one — and one
+* budget spent across a whole run, so an agreement to five rows cannot destroy five in every database.
+*
+* The budget is the operator's number and nothing else. The CLI's preflight also demands it *equal* the
+* rows in scope; this floor demands only that no more are spent, and it is deliberately not handed the
+* preflight's count — a guard fed the answer by the check above it is not a second guard.
+*
+* ## Its reach, stated so it can be checked
+*
+* - **Database-wide, deliberately.** A `down` cannot be inspected for which tables it drops without running
+*   it, so any `down` against a database holding retained rows is refused — including a migration of a
+*   different capability that never touches them. Over-refusing costs an override; under-refusing costs a
+*   vault.
+* - **Every `down` through `runner.ts`** — `rollbackMigration`, `resetMigrations`, `dropMigrations` — whose
+*   function was declared: the registry's providers, the fan-out's merged ones, and a provider written by
+*   hand, so long as it yields the capability's own migration objects (or spreads of them).
+* - **Counted over the set the runner is handed as the database.** Rollback and reset are handed one
+*   provider, and Kysely refuses one that does not span the ledger, so it is the database's. A drop reverses a
+*   part, and is handed the part and the database separately (`DropSelection`): it counts the database's,
+*   and refuses to reverse a migration the database's set does not carry. The CLI's `remove --drop` builds
+*   that set from the Worker's whole composition and every Worker discovered beside it — a capability sharing
+*   `SECRETS` and declaring nothing is refused while the vault holds rows.
+* - **Not seen:** a drop whose caller hands the part as the database too (`{ database: part, reverse: part }`
+*   counts only the part); for `remove --drop`, a table declared only by a Worker whose config does not load;
+*   a Kysely `Migrator` constructed outside `runner.ts`; a `down` whose capability was never constructed in
+*   this process and whose set never passed through the registry; a `down` re-wrapped in a new function by
+*   anything but {@link beforeEachDown} or {@link beforeEachMigration}; and a table no capability declares — a
+*   capability removed from the config takes its declaration with it.
+*/
+/** The snake_case the `CamelCasePlugin` writes, read from the plugin itself so there is one definition. */
+var TableNames = class extends CamelCasePlugin {
+	sqlName(key) {
+		return this.snakeCase(key);
+	}
+};
+const NAMES = new TableNames();
+/** The SQL name of a declared table key — `pithySecretsSystemSecrets` → `pithy_secrets_system_secrets`. */
+function retainedTableName(key) {
+	return NAMES.sqlName(key);
+}
+/** The SQL names of the retained tables a provider's migrations declare. Reads no database. */
+async function retainedTableNames(provider) {
+	return retainedTablesOf(await provider.getMigrations()).map(retainedTableName);
+}
+/**
+* Count the rows in every retained table these migrations declare that is present in the database.
+* Read-only. Returns only the tables holding rows, so an empty result means nothing retained is at risk.
+*/
+async function countRetainedRows(database, migrations, binding) {
+	const counted = [];
+	for (const key of retainedTablesOf(migrations)) {
+		const table = retainedTableName(key);
+		if (!await database.prepare("select name from sqlite_master where type = 'table' and name = ?").bind(table).first()) continue;
+		const rows = (await database.prepare(`select count(*) as n from "${table}"`).first())?.n ?? 0;
+		if (rows > 0) counted.push({
+			binding,
+			table,
+			rows
+		});
+	}
+	return counted;
+}
+/**
+* The refusals raised ahead of a `down`. A `Migrator` catches whatever a `down` throws and hands it back as
+* a result, and the runner turns that into "Couldn't roll back" with a remedy to fix the migration — which
+* is wrong for a refusal, where no migration is broken. So the runner asks {@link isDownRefusal} and
+* rethrows one unchanged.
+*/
+const REFUSALS = /* @__PURE__ */ new WeakSet();
+/**
+* Mark an error as a refusal to run a `down`, so it reaches the operator as itself rather than as a failed
+* migration. For a guard written outside this module — the CLI's shared-database floor is one.
+*/
+function downRefusal(error) {
+	REFUSALS.add(error);
+	return error;
+}
+/** Whether `error` refused a `down` before it ran — as opposed to a migration that failed. */
+function isDownRefusal(error) {
+	return typeof error === "object" && error !== null && REFUSALS.has(error);
+}
+/** `5 rows`, `1 row`. */
+function rowsLabel(count) {
+	return `${count} row${count === 1 ? "" : "s"}`;
+}
+/**
+* The refusal, in one wording for every place that raises it — the fan-out's preflight, which names every
+* database before any of them moves, {@link guardRetained}, which is the floor under it, and a teardown
+* that deletes a database holding retained tables (`pithy secrets deprovision`, #591).
+*
+* `consent` is what the caller passed. The action always prints the number that would work, because that
+* number is the one fact the operator has to read before typing it.
+*/
+function retainedRefusal(atRisk, consent, before = "any down against them ran") {
+	return downRefusal(refusalFor(atRisk, consent, before));
+}
+/**
+* **The preflight: refuse unless the operator counted exactly the retained rows in scope.**
+*
+* Absent a count, only an empty scope passes; given one, only the same number does — a count that is too
+* high is a count of something else, and agreeing to it would let a stale number from shell history through
+* the day the rows it described are joined by more. Call it with every database the operation will touch,
+* counted before the first of them moves, so the refusal names them all with nothing changed.
+*
+* The floor under it is {@link RetainedBudget}, fed the operator's number and never this function's
+* count.
+*/
+function assertRetainedAgreed(atRisk, consent, before = "any down against them ran") {
+	const total = atRisk.reduce((sum, entry) => sum + entry.rows, 0);
+	if (!(consent === void 0 ? total === 0 : consent === total)) throw retainedRefusal(atRisk, consent, before);
+}
+function refusalFor(atRisk, consent, before) {
+	const total = atRisk.reduce((sum, entry) => sum + entry.rows, 0);
+	const named = atRisk.map((entry) => `${entry.table} on ${entry.binding} (${rowsLabel(entry.rows)})`).join(", ");
+	const mismatch = consent === void 0 ? "" : `--destroy-retained ${consent} does not match the ${rowsLabel(total)} at risk. `;
+	if (total === 0) return new ValidationError({
+		message: `${mismatch}Nothing retained is at risk. Refused before ${before === "anything was deleted" ? before : "any down ran"}.`,
+		action: "Run it again without --destroy-retained."
+	});
+	return new ValidationError({
+		message: `${mismatch}Retained ${rowsLabel(total)} would be dropped: ${named}. Refused before ${before}.`,
+		action: `They exist nowhere else. Back them up, or pass --destroy-retained ${total} to drop them.`,
+		detail: "A retained table is declared by its capability. Any down against its database, and any deletion of the database, is refused while it holds rows."
+	});
+}
+/**
+* **How many retained rows a run has agreed to destroy, spent as each database is reached.**
+*
+* One per run, shared by every database in it. Absent an agreement it holds nothing, so any retained row
+* refuses. A database whose rows exceed what is left is refused whole — nothing is spent on a refusal.
+*/
+var RetainedBudget = class {
+	/** What the caller agreed to, as they typed it — the number a refusal quotes back. */
+	agreed;
+	#remaining;
+	constructor(agreed) {
+		this.agreed = agreed;
+		this.#remaining = agreed ?? 0;
+	}
+	/** Spend `rows` if the budget covers them. False, and nothing spent, when it does not. */
+	spend(rows) {
+		if (rows > this.#remaining) return false;
+		this.#remaining -= rows;
+		return true;
+	}
+};
+/**
+* Wrap a provider so no `down` it yields runs while the database holds retained rows the budget does not
+* cover. The check runs once, at the first `down`, and its answer stands for the rest of the run: a reset
+* whose first `down` dropped the vault must not refuse its second for finding it empty.
+*
+* Counted at the `down`, not before: a row written after somebody else counted is a row this refuses.
+*/
+function guardRetained(provider, database, options) {
+	let cleared;
+	const check = async () => {
+		const atRisk = await countRetainedRows(database, await provider.getMigrations(), options.binding);
+		const total = atRisk.reduce((sum, entry) => sum + entry.rows, 0);
+		if (!options.budget.spend(total)) throw retainedRefusal(atRisk, options.budget.agreed);
+	};
+	return beforeEachDown(provider, async () => {
+		cleared ??= check();
+		await cleared;
+	});
+}
+/**
+* Wrap a provider so `before` runs ahead of every migration body it yields, in each of `directions` — and a
+* throw from `before` means that body never runs. A direction not listed passes through untouched.
+*
+* **Each new `down` keeps the declaration of the one it wraps.** That is the reason this is the one way to
+* wrap a provider's migrations: a hand-rolled wrapper is a new function the declaration has never heard of,
+* and {@link guardRetained} handed it would find nothing declared and let every `down` through.
+*/
+function wrapEach(provider, before, directions) {
+	return { getMigrations: async () => {
+		const migrations = await provider.getMigrations();
+		return Object.fromEntries(Object.entries(migrations).map(([name, migration]) => {
+			const { up, down } = migration;
+			const wrappedUp = directions.includes("Up") ? async (db) => {
+				await before(name, "Up");
+				await up(db);
+			} : up;
+			if (!down || !directions.includes("Down")) return [name, {
+				...migration,
+				up: wrappedUp
+			}];
+			const wrappedDown = async (db) => {
+				await before(name, "Down");
+				await down(db);
+			};
+			declareRetainedDown(wrappedDown, retainedTablesOfDown(down));
+			return [name, {
+				up: wrappedUp,
+				down: wrappedDown
+			}];
+		}));
+	} };
+}
+/**
+* Wrap a provider so `before` runs ahead of every `down` it yields — and a throw from `before` means the
+* `down` never runs. Ups pass through untouched. A declared `down` stays declared: see {@link wrapEach}.
+*/
+function beforeEachDown(provider, before) {
+	return wrapEach(provider, () => before(), ["Down"]);
+}
+/**
+* Wrap a provider so `before` hears each migration's name and direction ahead of its body, up or down (#583).
+*
+* The seam a caller uses to say which migration it is on while it is on it: the CLI raises a `▸` step here,
+* because a remote migration is a D1 round trip per statement and an operator watching nothing happen
+* cannot tell a slow schema change from a hung one. Core carries no terminal concern — it hands over the
+* name and the direction, and what is done with them is the caller's. A declared `down` stays declared.
+*/
+function beforeEachMigration(provider, before) {
+	return wrapEach(provider, before, ["Up", "Down"]);
+}
+//#endregion
+export { RetainedBudget, assertRetainedAgreed, beforeEachDown, beforeEachMigration, countRetainedRows, downRefusal, guardRetained, isDownRefusal, retainedRefusal, retainedTableName, retainedTableNames };

package/dist/migrations/retainedDeclaration.d.ts

@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Migration } from "kysely/migration";
+/** Record that every `down` in `migrations` runs against a database holding these retained tables. */
+export declare function declareRetained(migrations: Readonly<Record<string, Migration>>, tables: readonly string[]): void;
+/** Record one `down` — for a wrapper that replaces a declared `down` with its own function. */
+export declare function declareRetainedDown(down: object, tables: readonly string[]): void;
+/** The retained table keys declared on one `down`. */
+export declare function retainedTablesOfDown(down: object): readonly string[];
+/**
+ * The retained table keys any migration in a set declares — the database-wide answer, since a `down` is
+ * refused for rows in *any* retained table of the database it runs against.
+ */
+export declare function retainedTablesOf(migrations: Readonly<Record<string, Migration>>): string[];
+//# sourceMappingURL=retainedDeclaration.d.ts.map

package/dist/migrations/retainedDeclaration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retainedDeclaration.d.ts","sourceRoot":"","sources":["../../src/migrations/retainedDeclaration.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAsBlD,sGAAsG;AACtG,wBAAgB,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAKhH;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAGjF;AAED,sDAAsD;AACtD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEpE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,MAAM,EAAE,CAO1F"}

package/dist/migrations/retainedDeclaration.js

@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/migrations/retainedDeclaration.ts
+/**
+* **Where a retained declaration is kept: on the `down` that would destroy the table (#588).**
+*
+* A capability says which of its tables are retained (`DatabaseSpec.retained`). The runner has to know it
+* at the moment a `down` is about to run, and by then all it holds is a `MigrationProvider` — Kysely's
+* interface, rebuilt by the registry, merged by the fan-out, wrapped by `batchedProvider`, and written by
+* hand in every capability's own migration tests. A declaration kept on any of those objects is lost the
+* first time somebody builds a new one.
+*
+* The `down` function survives all of that. A registry keeps the capability's migration object; a spread
+* that rebuilds the record keeps the same `down`; a hand-built provider in a test names the very
+* `secrets_0001_init` the capability ships. So the declaration is keyed on the function itself, and any
+* provider that yields it carries it.
+*
+* Kept apart from `./retained` so `defineCapability` can declare without importing Kysely's runtime.
+*/
+/** The destructive function → the retained table keys (camelCase, as `tables` declares them) it can drop. */
+const DECLARED = /* @__PURE__ */ new WeakMap();
+/** Record that every `down` in `migrations` runs against a database holding these retained tables. */
+function declareRetained(migrations, tables) {
+	if (tables.length === 0) return;
+	for (const migration of Object.values(migrations)) if (migration.down) declareRetainedDown(migration.down, tables);
+}
+/** Record one `down` — for a wrapper that replaces a declared `down` with its own function. */
+function declareRetainedDown(down, tables) {
+	if (tables.length === 0) return;
+	DECLARED.set(down, [.../* @__PURE__ */ new Set([...DECLARED.get(down) ?? [], ...tables])]);
+}
+/** The retained table keys declared on one `down`. */
+function retainedTablesOfDown(down) {
+	return DECLARED.get(down) ?? [];
+}
+/**
+* The retained table keys any migration in a set declares — the database-wide answer, since a `down` is
+* refused for rows in *any* retained table of the database it runs against.
+*/
+function retainedTablesOf(migrations) {
+	const tables = /* @__PURE__ */ new Set();
+	for (const migration of Object.values(migrations)) {
+		if (!migration.down) continue;
+		for (const table of retainedTablesOfDown(migration.down)) tables.add(table);
+	}
+	return [...tables].sort();
+}
+//#endregion
+export { declareRetained, declareRetainedDown, retainedTablesOf, retainedTablesOfDown };