@pithy-sh/core 0.7.0 → 0.7.2

package/dist/controlPlane/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAUnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAwJtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAWnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAyJtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/controlPlane/capability.js

@@ -10,6 +10,7 @@ import { capabilityHealthSources } from "./discovery/health.js";
 import { createControlPlaneVerifier } from "./http/guard.js";
 import { controlPlaneRouteDescriptors, registerControlPlaneRoutes } from "./http/routes.js";
 import { controlplane_0001_init } from "./migrations/0001_init.js";
+import { controlplane_0002_management_origin } from "./migrations/0002_management_origin.js";
 import { d1ReplayGuard } from "./replay/d1Guard.js";
 import { CONTROL_PLANE_KV_BINDING, controlPlaneKvNamespaces, kvReplayGuard } from "./replay/kvGuard.js";
 //#region src/controlPlane/capability.ts
@@ -49,7 +50,10 @@ function isControlPlaneCapability(capability) {
 */
 function controlplane(options = {}) {
 	const config = ControlPlaneConfig.parse(options);
-	const migrations = { "0001_init": controlplane_0001_init };
+	const migrations = {
+		"0001_init": controlplane_0001_init,
+		"0002_management_origin": controlplane_0002_management_origin
+	};
 	const requiredBindings = [{
 		type: "d1",
 		name: "DB"

package/dist/controlPlane/data/connection.d.ts

@@ -51,6 +51,7 @@ export declare const ControlPlaneConnection: z.ZodObject<{
     issuer: z.ZodURL;
     workerUrl: z.ZodURL;
     basePath: z.ZodDefault<z.ZodString>;
+    managementOrigin: z.ZodDefault<z.ZodNullable<z.ZodURL>>;
     scopes: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodString>>;
     keys: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodObject<{
         keyId: z.ZodString;

package/dist/controlPlane/data/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4ChC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/controlPlane/data/connection.js

@@ -48,6 +48,7 @@ const ControlPlaneConnection = z.object({
 	issuer: z.url().describe("The exact `iss` this connection accepts. Verified on every call, and effectively permanent — changing the management client's origin is a migration across every registered connection, not a DNS change."),
 	workerUrl: z.url().describe("This environment's deployed Worker URL, captured at connect. The address the management client calls; re-pointed by `pithy dashboard connect --update` when a custom domain or a rename moves it."),
 	basePath: z.string().min(1).default("/control-plane").describe("Where this Worker mounts the control-plane seam, captured at connect from its resolved config. Stored beside `workerUrl` because the two together fully determine the manifest address — and this is the one part of it a client cannot discover, since it *is* the manifest's own address. Defaulted rather than required so a connection registered before the column existed still parses, reading as the default it was necessarily using."),
+	managementOrigin: z.url().nullable().default(null).describe("Where the management client that registered this connection answers — the origin the CLI calls for a verify, a rotation or a disconnect. Stored because it is not derivable: `issuer` is what that client *signs as*, and nothing says a dashboard's API answers at its own `iss`. Null for a connection registered before this column, which reads as the issuer rather than as the hosted dashboard — an older row is still a row about somebody's own deployment. Nothing on the Worker's side reads it; verification cares about `issuer` alone."),
 	scopes: sqliteJson(z.array(ControlPlaneScope)).describe("The operations this connection was granted, stored and enforced on the adopter's side. Enforced only by the caller, a scope would not be a limit at all."),
 	keys: sqliteJson(z.array(RegisteredKey)).describe("Every key this connection may sign with, current and superseded. One JSON column rather than a child table, so a rotation is one atomic UPDATE and verification is one read."),
 	createdAt: SQLiteDate.describe("When the connection was registered. Ms-epoch in SQLite, a Date in TypeScript."),

package/dist/controlPlane/migrations/0002_management_origin.d.ts

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Migration } from "kysely/migration";
+/**
+ * Where the management client that registered a connection answers — `#614`.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written
+ * by it; a column added to the initial migration is history rewritten under a ledger that already
+ * records `0001_init` as applied. So this is a second migration, and `0001` stays what it was.
+ *
+ * **Nullable, with no default.** Every other address on the row has an obvious value when it is absent
+ * — a seam is mounted somewhere, so `basePath` defaults. An origin does not: a row written before this
+ * column knows only what its dashboard *signs* as, and defaulting it to the hosted origin would assert
+ * that every existing self-hosted connection belongs to `app.pithy.sh`. That is the assertion that
+ * caused #614 in the first place. Null means "not recorded", the CLI falls back to the issuer, and the
+ * next `connect` writes the real answer.
+ *
+ * **The Worker never reads it.** Verification matches a token's `iss` against `issuer`; this column
+ * exists for the operator's side, so that `status --verify`, `rotate` and `disconnect` call the
+ * dashboard the connection was registered against rather than whichever one a flag's default names.
+ */
+export declare const controlplane_0002_management_origin: Migration;
+//# sourceMappingURL=0002_management_origin.d.ts.map

package/dist/controlPlane/migrations/0002_management_origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0002_management_origin.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrations/0002_management_origin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mCAAmC,EAAE,SAWjD,CAAC"}

package/dist/controlPlane/migrations/0002_management_origin.js

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/controlPlane/migrations/0002_management_origin.ts
+/**
+* Where the management client that registered a connection answers — `#614`.
+*
+* **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written
+* by it; a column added to the initial migration is history rewritten under a ledger that already
+* records `0001_init` as applied. So this is a second migration, and `0001` stays what it was.
+*
+* **Nullable, with no default.** Every other address on the row has an obvious value when it is absent
+* — a seam is mounted somewhere, so `basePath` defaults. An origin does not: a row written before this
+* column knows only what its dashboard *signs* as, and defaulting it to the hosted origin would assert
+* that every existing self-hosted connection belongs to `app.pithy.sh`. That is the assertion that
+* caused #614 in the first place. Null means "not recorded", the CLI falls back to the issuer, and the
+* next `connect` writes the real answer.
+*
+* **The Worker never reads it.** Verification matches a token's `iss` against `issuer`; this column
+* exists for the operator's side, so that `status --verify`, `rotate` and `disconnect` call the
+* dashboard the connection was registered against rather than whichever one a flag's default names.
+*/
+const controlplane_0002_management_origin = {
+	up: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").addColumn("managementOrigin", "text").execute();
+	},
+	down: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").dropColumn("managementOrigin").execute();
+	}
+};
+//#endregion
+export { controlplane_0002_management_origin };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.7.0";
+export declare const PACKAGE_VERSION = "0.7.2";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.7.0";
+const PACKAGE_VERSION = "0.7.2";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/worker/identity.d.ts

@@ -65,6 +65,20 @@ export declare const WORKER_VAR = "WORKER";
  * silently absent in every scaffolded project.
  */
 export declare const VERSION_METADATA_BINDING = "CF_VERSION_METADATA";
+/**
+ * The service binding a Worker reaches **itself** through (#616).
+ *
+ * **A Worker cannot fetch its own hostname.** The subrequest leaves the isolate, loops back through the
+ * edge into the Worker it came from, and hangs until Cloudflare answers 522 — on a deployment where the
+ * same route answers `401` in 1.4s from outside. So a project that administers itself dispatches inside
+ * the runtime instead: `env.SELF.fetch(request)` reaches the same script with no edge hop.
+ *
+ * Like the three vars above, it is a name that has to be agreed rather than derived — the binding
+ * `pithy provision` writes into every stanza it generates for a project that declares
+ * `administersItself`, and the one an app reads off `env`. It lives here so neither side, in this
+ * repository or in a management client built on it, spells it a second way.
+ */
+export declare const SELF_BINDING = "SELF";
 /** Where a Worker is running, as it can state about itself. Every field is `null` when unstamped. */
 export interface WorkerIdentity {
     /** The owning project, or `null` when the Worker carries no `PROJECT` var. */

package/dist/worker/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/worker/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qFAAqF;AACrF,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,2FAA2F;AAC3F,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAW3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAazE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEzD"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/worker/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qFAAqF;AACrF,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,2FAA2F;AAC3F,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAW3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAazE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEzD"}

package/dist/worker/identity.js

@@ -66,6 +66,20 @@ const WORKER_VAR = "WORKER";
 * silently absent in every scaffolded project.
 */
 const VERSION_METADATA_BINDING = "CF_VERSION_METADATA";
+/**
+* The service binding a Worker reaches **itself** through (#616).
+*
+* **A Worker cannot fetch its own hostname.** The subrequest leaves the isolate, loops back through the
+* edge into the Worker it came from, and hangs until Cloudflare answers 522 — on a deployment where the
+* same route answers `401` in 1.4s from outside. So a project that administers itself dispatches inside
+* the runtime instead: `env.SELF.fetch(request)` reaches the same script with no edge hop.
+*
+* Like the three vars above, it is a name that has to be agreed rather than derived — the binding
+* `pithy provision` writes into every stanza it generates for a project that declares
+* `administersItself`, and the one an app reads off `env`. It lives here so neither side, in this
+* repository or in a management client built on it, spells it a second way.
+*/
+const SELF_BINDING = "SELF";
 /** One binding field, or `null` for anything that is not a non-empty string. */
 function carried(meta, field) {
 	const value = meta[field];
@@ -161,4 +175,4 @@ function workerVersion(env) {
 	return workerVersionMetadata(env).id;
 }
 //#endregion
-export { ENVIRONMENT_VAR, PROJECT_VAR, VERSION_METADATA_BINDING, WORKER_ORIGIN_VAR, WORKER_VAR, workerIdentity, workerVersion, workerVersionMetadata };
+export { ENVIRONMENT_VAR, PROJECT_VAR, SELF_BINDING, VERSION_METADATA_BINDING, WORKER_ORIGIN_VAR, WORKER_VAR, workerIdentity, workerVersion, workerVersionMetadata };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/controlPlane/capability.ts

@@ -17,6 +17,7 @@ import { type CapabilityHealthSource, capabilityHealthSources } from "./discover
 import { createControlPlaneVerifier } from "./http/guard";
 import { controlPlaneRouteDescriptors, registerControlPlaneRoutes } from "./http/routes";
 import { controlplane_0001_init } from "./migrations/0001_init";
+import { controlplane_0002_management_origin } from "./migrations/0002_management_origin";
 import { d1ReplayGuard } from "./replay/d1Guard";
 import type { ReplayGuard } from "./replay/guard";
 import {
@@ -77,6 +78,7 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
 
   const migrations: Record<string, Migration> = {
     "0001_init": controlplane_0001_init,
+    "0002_management_origin": controlplane_0002_management_origin,
   };
   const requiredBindings: BindingSpecInput[] = [
     // The app database — the connections table lives here, beside auth's and audit's. Not the secrets

package/src/controlPlane/data/connection.ts

@@ -105,6 +105,13 @@ export const ControlPlaneConnection = z
       .describe(
         "Where this Worker mounts the control-plane seam, captured at connect from its resolved config. Stored beside `workerUrl` because the two together fully determine the manifest address — and this is the one part of it a client cannot discover, since it *is* the manifest's own address. Defaulted rather than required so a connection registered before the column existed still parses, reading as the default it was necessarily using.",
       ),
+    managementOrigin: z
+      .url()
+      .nullable()
+      .default(null)
+      .describe(
+        "Where the management client that registered this connection answers — the origin the CLI calls for a verify, a rotation or a disconnect. Stored because it is not derivable: `issuer` is what that client *signs as*, and nothing says a dashboard's API answers at its own `iss`. Null for a connection registered before this column, which reads as the issuer rather than as the hosted dashboard — an older row is still a row about somebody's own deployment. Nothing on the Worker's side reads it; verification cares about `issuer` alone.",
+      ),
     scopes: sqliteJson(z.array(ControlPlaneScope)).describe(
       "The operations this connection was granted, stored and enforced on the adopter's side. Enforced only by the caller, a scope would not be a limit at all.",
     ),

package/src/controlPlane/migrations/0002_management_origin.ts

@@ -0,0 +1,36 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { Kysely } from "kysely";
+import type { Migration } from "kysely/migration";
+
+/**
+ * Where the management client that registered a connection answers — `#614`.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written
+ * by it; a column added to the initial migration is history rewritten under a ledger that already
+ * records `0001_init` as applied. So this is a second migration, and `0001` stays what it was.
+ *
+ * **Nullable, with no default.** Every other address on the row has an obvious value when it is absent
+ * — a seam is mounted somewhere, so `basePath` defaults. An origin does not: a row written before this
+ * column knows only what its dashboard *signs* as, and defaulting it to the hosted origin would assert
+ * that every existing self-hosted connection belongs to `app.pithy.sh`. That is the assertion that
+ * caused #614 in the first place. Null means "not recorded", the CLI falls back to the issuer, and the
+ * next `connect` writes the real answer.
+ *
+ * **The Worker never reads it.** Verification matches a token's `iss` against `issuer`; this column
+ * exists for the operator's side, so that `status --verify`, `rotate` and `disconnect` call the
+ * dashboard the connection was registered against rather than whichever one a flag's default names.
+ */
+export const controlplane_0002_management_origin: Migration = {
+  up: async (db: Kysely<unknown>): Promise<void> => {
+    await db.schema.alterTable("pithyControlplaneConnections").addColumn("managementOrigin", "text").execute();
+  },
+
+  down: async (db: Kysely<unknown>): Promise<void> => {
+    // SQLite has dropped columns since 3.35 and D1 carries a newer engine, so the twelve-step rebuild is
+    // not needed here — and a rebuild would be the riskier `down`, since it rewrites every row of a table
+    // holding live credentials to remove a column nothing reads.
+    await db.schema.alterTable("pithyControlplaneConnections").dropColumn("managementOrigin").execute();
+  },
+};

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.7.0";
+export const PACKAGE_VERSION = "0.7.2";

package/src/worker/identity.ts

@@ -72,6 +72,21 @@ export const WORKER_VAR = "WORKER";
  */
 export const VERSION_METADATA_BINDING = "CF_VERSION_METADATA";
 
+/**
+ * The service binding a Worker reaches **itself** through (#616).
+ *
+ * **A Worker cannot fetch its own hostname.** The subrequest leaves the isolate, loops back through the
+ * edge into the Worker it came from, and hangs until Cloudflare answers 522 — on a deployment where the
+ * same route answers `401` in 1.4s from outside. So a project that administers itself dispatches inside
+ * the runtime instead: `env.SELF.fetch(request)` reaches the same script with no edge hop.
+ *
+ * Like the three vars above, it is a name that has to be agreed rather than derived — the binding
+ * `pithy provision` writes into every stanza it generates for a project that declares
+ * `administersItself`, and the one an app reads off `env`. It lives here so neither side, in this
+ * repository or in a management client built on it, spells it a second way.
+ */
+export const SELF_BINDING = "SELF";
+
 /** Where a Worker is running, as it can state about itself. Every field is `null` when unstamped. */
 export interface WorkerIdentity {
   /** The owning project, or `null` when the Worker carries no `PROJECT` var. */