@pithy-sh/core 0.7.0 → 0.7.1

package/dist/controlPlane/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAUnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAwJtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAWnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAyJtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/controlPlane/capability.js

@@ -10,6 +10,7 @@ import { capabilityHealthSources } from "./discovery/health.js";
 import { createControlPlaneVerifier } from "./http/guard.js";
 import { controlPlaneRouteDescriptors, registerControlPlaneRoutes } from "./http/routes.js";
 import { controlplane_0001_init } from "./migrations/0001_init.js";
+import { controlplane_0002_management_origin } from "./migrations/0002_management_origin.js";
 import { d1ReplayGuard } from "./replay/d1Guard.js";
 import { CONTROL_PLANE_KV_BINDING, controlPlaneKvNamespaces, kvReplayGuard } from "./replay/kvGuard.js";
 //#region src/controlPlane/capability.ts
@@ -49,7 +50,10 @@ function isControlPlaneCapability(capability) {
 */
 function controlplane(options = {}) {
 	const config = ControlPlaneConfig.parse(options);
-	const migrations = { "0001_init": controlplane_0001_init };
+	const migrations = {
+		"0001_init": controlplane_0001_init,
+		"0002_management_origin": controlplane_0002_management_origin
+	};
 	const requiredBindings = [{
 		type: "d1",
 		name: "DB"

package/dist/controlPlane/data/connection.d.ts

@@ -51,6 +51,7 @@ export declare const ControlPlaneConnection: z.ZodObject<{
     issuer: z.ZodURL;
     workerUrl: z.ZodURL;
     basePath: z.ZodDefault<z.ZodString>;
+    managementOrigin: z.ZodDefault<z.ZodNullable<z.ZodURL>>;
     scopes: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodString>>;
     keys: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodObject<{
         keyId: z.ZodString;

package/dist/controlPlane/data/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4ChC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/controlPlane/data/connection.js

@@ -48,6 +48,7 @@ const ControlPlaneConnection = z.object({
 	issuer: z.url().describe("The exact `iss` this connection accepts. Verified on every call, and effectively permanent — changing the management client's origin is a migration across every registered connection, not a DNS change."),
 	workerUrl: z.url().describe("This environment's deployed Worker URL, captured at connect. The address the management client calls; re-pointed by `pithy dashboard connect --update` when a custom domain or a rename moves it."),
 	basePath: z.string().min(1).default("/control-plane").describe("Where this Worker mounts the control-plane seam, captured at connect from its resolved config. Stored beside `workerUrl` because the two together fully determine the manifest address — and this is the one part of it a client cannot discover, since it *is* the manifest's own address. Defaulted rather than required so a connection registered before the column existed still parses, reading as the default it was necessarily using."),
+	managementOrigin: z.url().nullable().default(null).describe("Where the management client that registered this connection answers — the origin the CLI calls for a verify, a rotation or a disconnect. Stored because it is not derivable: `issuer` is what that client *signs as*, and nothing says a dashboard's API answers at its own `iss`. Null for a connection registered before this column, which reads as the issuer rather than as the hosted dashboard — an older row is still a row about somebody's own deployment. Nothing on the Worker's side reads it; verification cares about `issuer` alone."),
 	scopes: sqliteJson(z.array(ControlPlaneScope)).describe("The operations this connection was granted, stored and enforced on the adopter's side. Enforced only by the caller, a scope would not be a limit at all."),
 	keys: sqliteJson(z.array(RegisteredKey)).describe("Every key this connection may sign with, current and superseded. One JSON column rather than a child table, so a rotation is one atomic UPDATE and verification is one read."),
 	createdAt: SQLiteDate.describe("When the connection was registered. Ms-epoch in SQLite, a Date in TypeScript."),

package/dist/controlPlane/migrations/0002_management_origin.d.ts

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Migration } from "kysely/migration";
+/**
+ * Where the management client that registered a connection answers — `#614`.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written
+ * by it; a column added to the initial migration is history rewritten under a ledger that already
+ * records `0001_init` as applied. So this is a second migration, and `0001` stays what it was.
+ *
+ * **Nullable, with no default.** Every other address on the row has an obvious value when it is absent
+ * — a seam is mounted somewhere, so `basePath` defaults. An origin does not: a row written before this
+ * column knows only what its dashboard *signs* as, and defaulting it to the hosted origin would assert
+ * that every existing self-hosted connection belongs to `app.pithy.sh`. That is the assertion that
+ * caused #614 in the first place. Null means "not recorded", the CLI falls back to the issuer, and the
+ * next `connect` writes the real answer.
+ *
+ * **The Worker never reads it.** Verification matches a token's `iss` against `issuer`; this column
+ * exists for the operator's side, so that `status --verify`, `rotate` and `disconnect` call the
+ * dashboard the connection was registered against rather than whichever one a flag's default names.
+ */
+export declare const controlplane_0002_management_origin: Migration;
+//# sourceMappingURL=0002_management_origin.d.ts.map

package/dist/controlPlane/migrations/0002_management_origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0002_management_origin.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrations/0002_management_origin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mCAAmC,EAAE,SAWjD,CAAC"}

package/dist/controlPlane/migrations/0002_management_origin.js

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/controlPlane/migrations/0002_management_origin.ts
+/**
+* Where the management client that registered a connection answers — `#614`.
+*
+* **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written
+* by it; a column added to the initial migration is history rewritten under a ledger that already
+* records `0001_init` as applied. So this is a second migration, and `0001` stays what it was.
+*
+* **Nullable, with no default.** Every other address on the row has an obvious value when it is absent
+* — a seam is mounted somewhere, so `basePath` defaults. An origin does not: a row written before this
+* column knows only what its dashboard *signs* as, and defaulting it to the hosted origin would assert
+* that every existing self-hosted connection belongs to `app.pithy.sh`. That is the assertion that
+* caused #614 in the first place. Null means "not recorded", the CLI falls back to the issuer, and the
+* next `connect` writes the real answer.
+*
+* **The Worker never reads it.** Verification matches a token's `iss` against `issuer`; this column
+* exists for the operator's side, so that `status --verify`, `rotate` and `disconnect` call the
+* dashboard the connection was registered against rather than whichever one a flag's default names.
+*/
+const controlplane_0002_management_origin = {
+	up: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").addColumn("managementOrigin", "text").execute();
+	},
+	down: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").dropColumn("managementOrigin").execute();
+	}
+};
+//#endregion
+export { controlplane_0002_management_origin };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.7.0";
+export declare const PACKAGE_VERSION = "0.7.1";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.7.0";
+const PACKAGE_VERSION = "0.7.1";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/controlPlane/capability.ts

@@ -17,6 +17,7 @@ import { type CapabilityHealthSource, capabilityHealthSources } from "./discover
 import { createControlPlaneVerifier } from "./http/guard";
 import { controlPlaneRouteDescriptors, registerControlPlaneRoutes } from "./http/routes";
 import { controlplane_0001_init } from "./migrations/0001_init";
+import { controlplane_0002_management_origin } from "./migrations/0002_management_origin";
 import { d1ReplayGuard } from "./replay/d1Guard";
 import type { ReplayGuard } from "./replay/guard";
 import {
@@ -77,6 +78,7 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
 
   const migrations: Record<string, Migration> = {
     "0001_init": controlplane_0001_init,
+    "0002_management_origin": controlplane_0002_management_origin,
   };
   const requiredBindings: BindingSpecInput[] = [
     // The app database — the connections table lives here, beside auth's and audit's. Not the secrets

package/src/controlPlane/data/connection.ts

@@ -105,6 +105,13 @@ export const ControlPlaneConnection = z
       .describe(
         "Where this Worker mounts the control-plane seam, captured at connect from its resolved config. Stored beside `workerUrl` because the two together fully determine the manifest address — and this is the one part of it a client cannot discover, since it *is* the manifest's own address. Defaulted rather than required so a connection registered before the column existed still parses, reading as the default it was necessarily using.",
       ),
+    managementOrigin: z
+      .url()
+      .nullable()
+      .default(null)
+      .describe(
+        "Where the management client that registered this connection answers — the origin the CLI calls for a verify, a rotation or a disconnect. Stored because it is not derivable: `issuer` is what that client *signs as*, and nothing says a dashboard's API answers at its own `iss`. Null for a connection registered before this column, which reads as the issuer rather than as the hosted dashboard — an older row is still a row about somebody's own deployment. Nothing on the Worker's side reads it; verification cares about `issuer` alone.",
+      ),
     scopes: sqliteJson(z.array(ControlPlaneScope)).describe(
       "The operations this connection was granted, stored and enforced on the adopter's side. Enforced only by the caller, a scope would not be a limit at all.",
     ),

package/src/controlPlane/migrations/0002_management_origin.ts

@@ -0,0 +1,36 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { Kysely } from "kysely";
+import type { Migration } from "kysely/migration";
+
+/**
+ * Where the management client that registered a connection answers — `#614`.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written
+ * by it; a column added to the initial migration is history rewritten under a ledger that already
+ * records `0001_init` as applied. So this is a second migration, and `0001` stays what it was.
+ *
+ * **Nullable, with no default.** Every other address on the row has an obvious value when it is absent
+ * — a seam is mounted somewhere, so `basePath` defaults. An origin does not: a row written before this
+ * column knows only what its dashboard *signs* as, and defaulting it to the hosted origin would assert
+ * that every existing self-hosted connection belongs to `app.pithy.sh`. That is the assertion that
+ * caused #614 in the first place. Null means "not recorded", the CLI falls back to the issuer, and the
+ * next `connect` writes the real answer.
+ *
+ * **The Worker never reads it.** Verification matches a token's `iss` against `issuer`; this column
+ * exists for the operator's side, so that `status --verify`, `rotate` and `disconnect` call the
+ * dashboard the connection was registered against rather than whichever one a flag's default names.
+ */
+export const controlplane_0002_management_origin: Migration = {
+  up: async (db: Kysely<unknown>): Promise<void> => {
+    await db.schema.alterTable("pithyControlplaneConnections").addColumn("managementOrigin", "text").execute();
+  },
+
+  down: async (db: Kysely<unknown>): Promise<void> => {
+    // SQLite has dropped columns since 3.35 and D1 carries a newer engine, so the twelve-step rebuild is
+    // not needed here — and a rebuild would be the riskier `down`, since it rewrites every row of a table
+    // holding live credentials to remove a column nothing reads.
+    await db.schema.alterTable("pithyControlplaneConnections").dropColumn("managementOrigin").execute();
+  },
+};

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.7.0";
+export const PACKAGE_VERSION = "0.7.1";