@pithy-sh/core 0.9.0 → 0.11.0

package/dist/controlPlane/http/responses.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { Ed25519PublicJwk } from "../data/connection.js";
+import { ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, Ed25519PublicJwk } from "../data/connection.js";
 import { z } from "zod";
 //#region src/controlPlane/http/responses.ts
 /**
@@ -47,8 +47,11 @@ const ControlPlanePingResponse = z.object({
 const ControlPlaneKeysResponse = z.object({
 	connectionId: z.string().describe("The connection these keys belong to."),
 	environment: z.string().describe("The environment that connection is bound to."),
-	keys: z.array(PublicKeyView).describe("Every registered key, expired and revoked ones included.")
-}).describe("Every key registered against this connection, with its window.");
+	keys: z.array(PublicKeyView).describe("Every registered key, expired and revoked ones included."),
+	authorizedBy: ConnectionPrincipal.nullable().optional().describe("Who sanctioned this connection — the signed-in session's email at registration. Null for a connection registered before principals were recorded; absent from a Worker older than the field."),
+	actorKind: ControlPlaneActorKind.nullable().optional().describe("What kind of client this connection is for: `agent`, `dashboard` or `script`. Null for a connection registered before it was recorded; absent from an older Worker."),
+	purpose: ConnectionPurpose.nullable().optional().describe("What the client is for, in the registering operator's words. Untrusted text: render it escaped. Null for a connection registered before it was recorded; absent from an older Worker.")
+}).describe("Every key registered against this connection, with its window, and who authorized it for what.");
 /** `POST /control-plane/keys` — the appended key, and the set as it now stands. */
 const RegisterKeyResponse = z.object({
 	keyId: z.string().describe("The key just registered."),
@@ -61,5 +64,59 @@ const ExpireKeyResponse = z.object({
 	validUntil: z.iso.datetime().describe("When its window closed, ISO-8601 — now, by construction."),
 	keys: z.array(PublicKeyView).describe("The connection's keys after the expiry.")
 }).describe("The expired key, and the set it left behind.");
+/**
+* One migration as `GET {basePath}/migrations` reports it: its composed name, and whose it is.
+*
+* The namespace is a capability's name, which the manifest already reports in `capabilities[]`. So a
+* client tells an adopter's own migrations from a composed capability's by comparing the two — no
+* convention, and no list kept anywhere.
+*/
+const MigrationView = z.object({
+	name: z.string().describe("The composed migration name, exactly as the ledger records it: `0250_audit_0001_init`."),
+	namespace: z.string().nullable().describe("The capability this migration belongs to — its name, as `capabilities[]` in the manifest reports it. Null only for an undeclared migration whose name no Pithy registry could have composed.")
+}).describe("One migration, and the capability namespace it belongs to.");
+/** Whether the last group is still reversible by name, or what is in its way. */
+const MigrationGroupPositionView = z.discriminatedUnion("state", [z.object({ state: z.literal("top").describe("The group's migrations are the contiguous tip of this database's chain. Not a promise that `pithy migrate --rollback --group <value>` runs: the CLI also refuses an undeclared migration in the ledger, and keeps back or refuses a database another environment binds.") }).describe("A group nothing on this database's ledger sits over."), z.object({
+	state: z.literal("buried").describe("Something sits over the group or inside it, so reversing it by name is refused."),
+	above: z.array(z.string()).describe("The groups in the way, newest first."),
+	ungrouped: z.array(MigrationView).describe("The migrations in the way that no group claims, newest first. Nothing can be reversed by group while one of them is at the tip.")
+}).describe("A group with something in its way, and what that is.")]).describe("Where the last group sits in this database's chain: the top, or buried under named things.");
+/** The run that last moved a database, and whether it can still be taken back. */
+const MigrationGroupView = z.object({
+	group: z.string().describe("The group's value: the `--group` the run was given, or the ISO-8601 timestamp it generated."),
+	appliedAt: z.iso.datetime().describe("When this group last applied something here, ISO-8601."),
+	migrations: z.array(MigrationView).describe("What this group applied in this database and is still applied, in application order."),
+	position: MigrationGroupPositionView.describe("Whether the group is the top of the chain, or what is in its way.")
+}).describe("The newest group with anything still applied in this database.");
+/**
+* One database this Worker binds, read or not.
+*
+* **An unreadable database carries no list at all**, never empty ones. `pending: []` reads as up to date,
+* and a database nobody read is not that. The state is on the value, so a client reaches a list only by
+* narrowing.
+*/
+const MigrationDatabaseView = z.discriminatedUnion("state", [z.object({
+	state: z.literal("readable").describe("This database's ledger was read."),
+	database: z.string().describe("The database name, as capabilities declare it in `databases`."),
+	binding: z.string().describe("The D1 binding it is read through, as `wrangler.jsonc` declares it."),
+	applied: z.array(MigrationView).describe("Every applied migration, in the order the ledger applied them."),
+	pending: z.array(MigrationView).describe("Declared by this build and not applied here, in the order they would run."),
+	undeclared: z.array(MigrationView).describe("Applied here and not declared by this Worker, sorted. Relative to this Worker: a database shared with another Worker lists that Worker's migrations here. Otherwise Kysely reads one as a corrupted chain and applies nothing."),
+	lastGroup: MigrationGroupView.nullable().describe("The newest group with anything applied here, or null when nothing applied here was ever grouped.")
+}).describe("A database whose ledger was read."), z.object({
+	state: z.literal("unreadable").describe("This database's ledger could not be read on this call."),
+	database: z.string().describe("The database name, as capabilities declare it in `databases`."),
+	binding: z.string().describe("The D1 binding it would be read through.")
+}).describe("A database that could not be read. No lists, so nothing about it reads as zero. The other databases still answer.")]).describe("One database this Worker binds: its migration state, or the fact that it could not be read.");
+/**
+* `GET /control-plane/migrations` — where every database this Worker binds stands.
+*
+* Asked of the Worker because the Worker *is* the deployed build. `pithy doctor` reads the project on disk,
+* which is what the operator has and not necessarily what is deployed.
+*/
+const ControlPlaneMigrationsResponse = z.object({
+	environment: z.string().describe("The environment this Worker answers for."),
+	databases: z.array(MigrationDatabaseView).describe("One entry per database this Worker binds, sorted by database name. One unreadable costs only itself.")
+}).describe("What is applied, pending and undeclared in each bound database, and which run put it there.");
 //#endregion
-export { ControlPlaneKeysResponse, ControlPlanePingResponse, ExpireKeyResponse, PublicKeyView, RegisterKeyResponse };
+export { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ExpireKeyResponse, MigrationDatabaseView, MigrationGroupPositionView, MigrationGroupView, MigrationView, PublicKeyView, RegisterKeyResponse };

package/dist/controlPlane/http/routes.d.ts

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 import type { Hono } from "hono";
 import type { PithyHonoEnv } from "../../capability/capability";
-import type { AdminRoute } from "../discovery/adminRoute";
+import { type AdminRoute } from "../discovery/adminRoute";
 import { type ControlPlaneHandlerDeps } from "./handlers";
 /**
  * The seam's own routes, distinct from the admin routes capabilities contribute.
@@ -12,6 +12,7 @@ import { type ControlPlaneHandlerDeps } from "./handlers";
  *   GET  /control-plane/keys                  → the registration state       (keys:rotate)
  *   POST /control-plane/keys                  → register a key               (keys:rotate)
  *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
+ *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
  *
  * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
  * and that is the shipped state of a Worker nobody has connected.

package/dist/controlPlane/http/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,EACL,KAAK,uBAAuB,EAM7B,MAAM,YAAY,CAAC;AAGpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAiC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CAqBN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAGhF,OAAO,EACL,KAAK,uBAAuB,EAO7B,MAAM,YAAY,CAAC;AAUpB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAwC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA6EN"}

package/dist/controlPlane/http/routes.js

@@ -1,11 +1,13 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE } from "../scope/scope.js";
+import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE } from "../scope/scope.js";
 import { requireControlPlane } from "./guard.js";
-import { validationHook } from "../../http/validation.js";
-import { expireKeyHandler, listKeysHandler, manifestHandler, pingHandler, registerKeyHandler } from "./handlers.js";
+import { describeRoute } from "../../http/routeSpec.js";
+import { validate } from "../../http/validation.js";
+import { ControlPlaneManifest } from "../discovery/adminRoute.js";
+import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, registerKeyHandler } from "./handlers.js";
+import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
 import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas.js";
-import { zValidator } from "@hono/zod-validator";
 //#region src/controlPlane/http/routes.ts
 /**
 * The seam's own routes, distinct from the admin routes capabilities contribute.
@@ -15,6 +17,7 @@ import { zValidator } from "@hono/zod-validator";
 *   GET  /control-plane/keys                  → the registration state       (keys:rotate)
 *   POST /control-plane/keys                  → register a key               (keys:rotate)
 *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
+*   GET  /control-plane/migrations            → where each database stands   (migrations:read)
 *
 * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
 * and that is the shipped state of a Worker nobody has connected.
@@ -71,15 +74,53 @@ function controlPlaneRouteDescriptors(basePath) {
 			path: `${basePath}/keys/:keyId/expire`,
 			scope: KEYS_ROTATE_SCOPE,
 			summary: "Retire a superseded key. Must be signed with the successor it names as proven."
+		},
+		{
+			method: "GET",
+			path: `${basePath}/migrations`,
+			scope: MIGRATIONS_READ_SCOPE,
+			summary: "What each bound database has applied, what is pending, what is undeclared, and which run put it there. Undeclared is relative to this Worker."
 		}
 	];
 }
 function registerControlPlaneRoutes(app, basePath, deps) {
-	app.get(`${basePath}/ping`, requireControlPlane(ANY_VERIFIED_CALLER), pingHandler(deps));
-	app.get(`${basePath}/manifest`, requireControlPlane(MANIFEST_READ_SCOPE), manifestHandler(deps));
-	app.get(`${basePath}/keys`, requireControlPlane(KEYS_ROTATE_SCOPE), listKeysHandler(deps));
-	app.post(`${basePath}/keys`, requireControlPlane(KEYS_ROTATE_SCOPE), zValidator("json", RegisterKeyRequest, validationHook), (c) => registerKeyHandler(deps)(c, c.req.valid("json")));
-	app.post(`${basePath}/keys/:keyId/expire`, requireControlPlane(KEYS_ROTATE_SCOPE), zValidator("param", ExpireKeyParams, validationHook), zValidator("json", ExpireKeyRequest, validationHook), (c) => expireKeyHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
+	app.get(`${basePath}/ping`, describeRoute({
+		summary: "Prove the connection and the key it signs with.",
+		verification: "control-plane",
+		responses: { 200: ControlPlanePingResponse }
+	}), requireControlPlane(ANY_VERIFIED_CALLER), pingHandler(deps));
+	app.get(`${basePath}/manifest`, describeRoute({
+		summary: "Describe what this Worker composes and how to call its admin surface.",
+		verification: "control-plane",
+		scopes: [MANIFEST_READ_SCOPE],
+		responses: { 200: ControlPlaneManifest }
+	}), requireControlPlane(MANIFEST_READ_SCOPE), manifestHandler(deps));
+	app.get(`${basePath}/keys`, describeRoute({
+		summary: "Read the connection's key registration state.",
+		verification: "control-plane",
+		scopes: [KEYS_ROTATE_SCOPE],
+		responses: { 200: ControlPlaneKeysResponse }
+	}), requireControlPlane(KEYS_ROTATE_SCOPE), listKeysHandler(deps));
+	app.post(`${basePath}/keys`, describeRoute({
+		summary: "Register a key for the connection.",
+		verification: "control-plane",
+		scopes: [KEYS_ROTATE_SCOPE],
+		responses: { 201: RegisterKeyResponse }
+	}), requireControlPlane(KEYS_ROTATE_SCOPE), validate("json", RegisterKeyRequest), (c) => registerKeyHandler(deps)(c, c.req.valid("json")));
+	app.post(`${basePath}/keys/:keyId/expire`, describeRoute({
+		summary: "Retire a superseded key.",
+		description: "Must be signed with the successor it names as proven.",
+		verification: "control-plane",
+		scopes: [KEYS_ROTATE_SCOPE],
+		responses: { 200: ExpireKeyResponse }
+	}), requireControlPlane(KEYS_ROTATE_SCOPE), validate("param", ExpireKeyParams), validate("json", ExpireKeyRequest), (c) => expireKeyHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
+	app.get(`${basePath}/migrations`, describeRoute({
+		summary: "Report where each database this Worker binds stands.",
+		description: "Applied, pending and undeclared migrations per database, each naming its namespace, and the last group with whether it is still reversible. Undeclared is relative to this Worker: a database shared with another Worker lists that Worker's migrations there. Read-only.",
+		verification: "control-plane",
+		scopes: [MIGRATIONS_READ_SCOPE],
+		responses: { 200: ControlPlaneMigrationsResponse }
+	}), requireControlPlane(MIGRATIONS_READ_SCOPE), migrationsHandler(deps));
 }
 //#endregion
 export { controlPlaneRouteDescriptors, registerControlPlaneRoutes };

package/dist/controlPlane/http/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,gBAAgB,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA2E9B"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,gBAAgB,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA6E9B"}

package/dist/controlPlane/http/verify.js

@@ -47,7 +47,8 @@ async function verifyControlPlaneCall(call, deps) {
 		scope: claims.scope,
 		grantedScopes: connection.scopes,
 		keyId: key.keyId,
-		tokenId: claims.jti
+		tokenId: claims.jti,
+		actorKind: connection.actorKind
 	});
 }
 /**

package/dist/controlPlane/migrationState/migrationState.d.ts

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { MigrationProvider } from "kysely/migration";
+import type { Capability } from "../../capability/capability";
+import type { HealthSummary } from "../discovery/healthSummary";
+import type { MigrationDatabaseView, MigrationView } from "../http/responses";
+/**
+ * **Migration state over the control plane (#729).**
+ *
+ * A management client could not answer what is applied where, or whether a deploy left something behind:
+ * the seam registered a ping, the manifest and key rotation, and not one field of it was about a database.
+ * The read already existed — {@link readMigrationLedger} answers both directions — and it needs a D1
+ * binding and the composed provider in one process. **The Worker is the only thing holding both**, and it
+ * is the deployed build, so asked from its side the answer cannot be stale the way the project on disk is.
+ *
+ * Two halves. At assembly, {@link composeMigrationDatabases} builds what this Worker declares per bound
+ * database, through `collectMigrationSets` — the function `pithy migrate` composes with, so the route and
+ * `pithy doctor` compose the same way. Not always from the same inputs: on a D1 two Workers share, the CLI
+ * merges both Workers' sets and the route holds only its own, so `pending` and `undeclared` can differ
+ * there. On a database one Worker binds alone they agree. Per request, {@link readDatabaseMigrations} reads
+ * one database for the route and {@link readMigrationHealth} totals all of them for the manifest.
+ *
+ * **Read-only.** Nothing here runs, reverses or resets a migration. A screen somebody opened to ask must
+ * not hand them the thing that changes the schema.
+ *
+ * **`undeclared` is relative to this Worker.** Two Workers can be bound to one physical D1, and the CLI
+ * composes across all of them. A Worker composes only its own capabilities and cannot learn a co-bound
+ * Worker's, so from inside one, every migration the other shipped to the shared database reads as
+ * undeclared. That is why `undeclaredMigrations` grades nothing.
+ */
+/** One database this Worker binds, with what this build declares for it. Built once, at assembly. */
+export interface ComposedMigrationDatabase {
+    /** The database name, as capabilities declare it in `databases`. */
+    database: string;
+    /** The D1 binding it is read through. */
+    binding: string;
+    /** Every migration this build declares for it — empty for a database bound with none. */
+    provider: MigrationProvider;
+    /** Each declared migration's namespace, known from the set it came from. */
+    namespaces: ReadonlyMap<string, string>;
+}
+/**
+ * Every database this Worker binds, with the provider this build composes for it, sorted by name.
+ *
+ * One entry per database `composeDatabases` maps to a binding — the same map the request registry is built
+ * from — so a database bound with no migrations is still reported. Leaving it out would read as not bound.
+ */
+export declare function composeMigrationDatabases(capabilities: readonly Capability[]): ComposedMigrationDatabase[];
+/**
+ * One migration as the route reports it.
+ *
+ * A declared migration's namespace comes from the set it was declared in. An undeclared one has only its
+ * key, so it is decomposed — and a key no registry composed answers null rather than a guess.
+ */
+export declare function migrationView(name: string, namespaces: ReadonlyMap<string, string>): MigrationView;
+/**
+ * Read one database's migration state for the route.
+ *
+ * **A database that cannot be read is `unreadable`, and costs only itself.** The cause goes to
+ * `onUnreadable` — the route logs it, where the operator's context stays the operator's — and never into
+ * the view: a D1 error can name a table or a query, and the view crosses to a management client.
+ */
+export declare function readDatabaseMigrations(env: Record<string, unknown>, entry: ComposedMigrationDatabase, onUnreadable?: (entry: ComposedMigrationDatabase, cause: unknown) => void): Promise<MigrationDatabaseView>;
+/**
+ * The two health keys the seam contributes to its own manifest entry.
+ *
+ * Both `indexed`: one small select per bound database, bounded by the declared migration count rather
+ * than by the adopter's data. Both behind {@link MIGRATIONS_READ_SCOPE}, which the seam's own route
+ * requires, so a connection without it gets no value rather than a zero.
+ *
+ * **`undeclaredMigrations` declares no nominal, on purpose.** From inside one Worker, a database shared
+ * with another lists the other's migrations as undeclared, so `atMost: 0` would report a corrupted chain
+ * on a database that is entirely fine. Null is what a client reads as unknowable, never as healthy (#471).
+ */
+export declare const MIGRATION_HEALTH_KEYS: readonly [{
+    readonly key: "pendingMigrations";
+    readonly kind: "count";
+    readonly states: null;
+    readonly scope: string;
+    readonly cost: "indexed";
+    readonly summary: "Migrations this build declares that a bound database has not applied.";
+    readonly nominal: {
+        readonly atMost: 0;
+    };
+}, {
+    readonly key: "undeclaredMigrations";
+    readonly kind: "count";
+    readonly states: null;
+    readonly scope: string;
+    readonly cost: "indexed";
+    readonly summary: "Migrations a bound database holds that this Worker does not declare. Relative to this Worker: a database shared with another lists that Worker's migrations here.";
+    readonly nominal: null;
+}];
+/**
+ * Total pending and undeclared across every bound database, for the manifest.
+ *
+ * **Throws rather than total a database it could not read.** A partial total is a zero for the database
+ * nobody read. The seam catches the throw and reports the summary `unavailable`, which a client reads as
+ * unknown — null is never zero.
+ */
+export declare function readMigrationHealth(env: Record<string, unknown>, databases: readonly ComposedMigrationDatabase[]): Promise<HealthSummary>;
+//# sourceMappingURL=migrationState.d.ts.map

package/dist/controlPlane/migrationState/migrationState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrationState.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrationState/migrationState.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAQ9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAsB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,qGAAqG;AACrG,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAKD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,yBAAyB,EAAE,CAe1G;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,aAAa,CAElG;AA8BD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,yBAAyB,EAChC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GACxE,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;kBAEzB,mBAAmB;mBAClB,OAAO;;;mBAGP,SAAS;sBACN,uEAAuE;;iBACrE,MAAM,EAAE,CAAC;;;kBAGf,sBAAsB;mBACrB,OAAO;;;mBAGP,SAAS;sBAEb,mKAAmK;;EAGvH,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,SAAS,EAAE,SAAS,yBAAyB,EAAE,GAC9C,OAAO,CAAC,aAAa,CAAC,CAQxB"}

package/dist/controlPlane/migrationState/migrationState.js

@@ -0,0 +1,142 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { InternalError } from "../../error/pithyError.js";
+import { MIGRATIONS_READ_SCOPE } from "../scope/scope.js";
+import { composeDatabases } from "../../data/databases.js";
+import { composedMigrationKey, createMigrationRegistry, decomposeMigrationKey } from "../../migrations/registry.js";
+import { collectMigrationSets } from "../../migrations/capabilitySets.js";
+import { readMigrationLedger } from "../../migrations/runner.js";
+import { readMigrationState } from "../../migrations/state.js";
+//#region src/controlPlane/migrationState/migrationState.ts
+/** A provider declaring nothing, for a database bound with no migrations: everything applied is undeclared. */
+const NOTHING_DECLARED = { getMigrations: async () => ({}) };
+/**
+* Every database this Worker binds, with the provider this build composes for it, sorted by name.
+*
+* One entry per database `composeDatabases` maps to a binding — the same map the request registry is built
+* from — so a database bound with no migrations is still reported. Leaving it out would read as not bound.
+*/
+function composeMigrationDatabases(capabilities) {
+	const sets = collectMigrationSets([...capabilities]);
+	const registry = createMigrationRegistry(sets);
+	const bound = composeDatabases([...capabilities]);
+	return Object.entries(bound).sort(([left], [right]) => left.localeCompare(right)).map(([database, group]) => {
+		const namespaces = /* @__PURE__ */ new Map();
+		for (const set of sets) {
+			if (set.database !== database) continue;
+			for (const localKey of Object.keys(set.migrations)) namespaces.set(composedMigrationKey(set, localKey), set.namespace);
+		}
+		return {
+			database,
+			binding: group.binding,
+			provider: registry[database] ?? NOTHING_DECLARED,
+			namespaces
+		};
+	});
+}
+/**
+* One migration as the route reports it.
+*
+* A declared migration's namespace comes from the set it was declared in. An undeclared one has only its
+* key, so it is decomposed — and a key no registry composed answers null rather than a guess.
+*/
+function migrationView(name, namespaces) {
+	return {
+		name,
+		namespace: namespaces.get(name) ?? decomposeMigrationKey(name)?.namespace ?? null
+	};
+}
+/** The D1 binding for `entry`, or a refusal naming it — a Worker missing the binding cannot read it. */
+function bindingOf(env, entry) {
+	const database = env[entry.binding];
+	if (database == null) throw new InternalError({
+		message: `The ${entry.binding} binding is missing, so database "${entry.database}" cannot be read.`,
+		action: `Declare ${entry.binding} in this Worker's wrangler.jsonc, then deploy again.`
+	});
+	return database;
+}
+function groupView(group, namespaces) {
+	return {
+		group: group.group,
+		appliedAt: group.appliedAt.toISOString(),
+		migrations: group.migrations.map((name) => migrationView(name, namespaces)),
+		position: group.position.state === "top" ? { state: "top" } : {
+			state: "buried",
+			above: group.position.above,
+			ungrouped: group.position.ungrouped.map((name) => migrationView(name, namespaces))
+		}
+	};
+}
+/**
+* Read one database's migration state for the route.
+*
+* **A database that cannot be read is `unreadable`, and costs only itself.** The cause goes to
+* `onUnreadable` — the route logs it, where the operator's context stays the operator's — and never into
+* the view: a D1 error can name a table or a query, and the view crosses to a management client.
+*/
+async function readDatabaseMigrations(env, entry, onUnreadable) {
+	try {
+		const state = await readMigrationState(bindingOf(env, entry), entry.provider);
+		const view = (name) => migrationView(name, entry.namespaces);
+		return {
+			state: "readable",
+			database: entry.database,
+			binding: entry.binding,
+			applied: state.applied.map(view),
+			pending: state.pending.map(view),
+			undeclared: state.undeclared.map(view),
+			lastGroup: state.lastGroup ? groupView(state.lastGroup, entry.namespaces) : null
+		};
+	} catch (cause) {
+		onUnreadable?.(entry, cause);
+		return {
+			state: "unreadable",
+			database: entry.database,
+			binding: entry.binding
+		};
+	}
+}
+/**
+* The two health keys the seam contributes to its own manifest entry.
+*
+* Both `indexed`: one small select per bound database, bounded by the declared migration count rather
+* than by the adopter's data. Both behind {@link MIGRATIONS_READ_SCOPE}, which the seam's own route
+* requires, so a connection without it gets no value rather than a zero.
+*
+* **`undeclaredMigrations` declares no nominal, on purpose.** From inside one Worker, a database shared
+* with another lists the other's migrations as undeclared, so `atMost: 0` would report a corrupted chain
+* on a database that is entirely fine. Null is what a client reads as unknowable, never as healthy (#471).
+*/
+const MIGRATION_HEALTH_KEYS = [{
+	key: "pendingMigrations",
+	kind: "count",
+	states: null,
+	scope: MIGRATIONS_READ_SCOPE,
+	cost: "indexed",
+	summary: "Migrations this build declares that a bound database has not applied.",
+	nominal: { atMost: 0 }
+}, {
+	key: "undeclaredMigrations",
+	kind: "count",
+	states: null,
+	scope: MIGRATIONS_READ_SCOPE,
+	cost: "indexed",
+	summary: "Migrations a bound database holds that this Worker does not declare. Relative to this Worker: a database shared with another lists that Worker's migrations here.",
+	nominal: null
+}];
+/**
+* Total pending and undeclared across every bound database, for the manifest.
+*
+* **Throws rather than total a database it could not read.** A partial total is a zero for the database
+* nobody read. The seam catches the throw and reports the summary `unavailable`, which a client reads as
+* unknown — null is never zero.
+*/
+async function readMigrationHealth(env, databases) {
+	const ledgers = await Promise.all(databases.map((entry) => readMigrationLedger(bindingOf(env, entry), entry.provider)));
+	return {
+		pendingMigrations: ledgers.reduce((total, ledger) => total + ledger.pending.length, 0),
+		undeclaredMigrations: ledgers.reduce((total, ledger) => total + ledger.undeclared.length, 0)
+	};
+}
+//#endregion
+export { MIGRATION_HEALTH_KEYS, composeMigrationDatabases, migrationView, readDatabaseMigrations, readMigrationHealth };

package/dist/controlPlane/migrations/0003_connection_principal.d.ts

@@ -0,0 +1,21 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Migration } from "kysely/migration";
+/**
+ * Who sanctioned a connection, what kind of client it is, and what it is for — `#721`.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written by
+ * it, so the three columns arrive in a migration of their own, as `0002`'s origin did.
+ *
+ * **Nullable, with no default, and nothing backfilled.** A row registered before this carries no
+ * principal, and none can be recovered: most of the trail that might be mined for one names a token
+ * rather than a person, and a principal read off a token name is the self-assertion this issue exists to
+ * end. So null means *registered before principals were recorded*, the connection keeps working exactly
+ * as it did, its purpose may be set with `pithy dashboard connect --update --purpose`, and its principal
+ * is set only by registering again, under a signed-in session.
+ *
+ * **The Worker reads only `actorKind`**, to stamp it onto the audit rows a connection's calls write. The
+ * other two exist for the adopter's own review, on their own side.
+ */
+export declare const controlplane_0003_connection_principal: Migration;
+//# sourceMappingURL=0003_connection_principal.d.ts.map

package/dist/controlPlane/migrations/0003_connection_principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0003_connection_principal.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrations/0003_connection_principal.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sCAAsC,EAAE,SAcpD,CAAC"}

package/dist/controlPlane/migrations/0003_connection_principal.js

@@ -0,0 +1,33 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/controlPlane/migrations/0003_connection_principal.ts
+/**
+* Who sanctioned a connection, what kind of client it is, and what it is for — `#721`.
+*
+* **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written by
+* it, so the three columns arrive in a migration of their own, as `0002`'s origin did.
+*
+* **Nullable, with no default, and nothing backfilled.** A row registered before this carries no
+* principal, and none can be recovered: most of the trail that might be mined for one names a token
+* rather than a person, and a principal read off a token name is the self-assertion this issue exists to
+* end. So null means *registered before principals were recorded*, the connection keeps working exactly
+* as it did, its purpose may be set with `pithy dashboard connect --update --purpose`, and its principal
+* is set only by registering again, under a signed-in session.
+*
+* **The Worker reads only `actorKind`**, to stamp it onto the audit rows a connection's calls write. The
+* other two exist for the adopter's own review, on their own side.
+*/
+const controlplane_0003_connection_principal = {
+	up: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").addColumn("authorizedBy", "text").execute();
+		await db.schema.alterTable("pithyControlplaneConnections").addColumn("actorKind", "text").execute();
+		await db.schema.alterTable("pithyControlplaneConnections").addColumn("purpose", "text").execute();
+	},
+	down: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").dropColumn("purpose").execute();
+		await db.schema.alterTable("pithyControlplaneConnections").dropColumn("actorKind").execute();
+		await db.schema.alterTable("pithyControlplaneConnections").dropColumn("authorizedBy").execute();
+	}
+};
+//#endregion
+export { controlplane_0003_connection_principal };

package/dist/controlPlane/scope/scope.d.ts

@@ -50,8 +50,19 @@ export declare const MANIFEST_READ_SCOPE: ControlPlaneScope;
  */
 export declare const KEYS_ROTATE_SCOPE: ControlPlaneScope;
 /**
- * Every grantable scope the seam's own routes use — what `pithy dashboard connect` offers by default.
- * Ping is absent because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
+ * Read where each database this Worker binds stands: what is applied, what is pending, what is undeclared,
+ * and which run put it there (#729). Read-only by construction — every route behind it is a `GET`, and
+ * nothing over the seam runs, reverses or resets a migration. The two migration health keys on the seam's
+ * manifest entry sit behind it too, so a connection without it gets no number rather than a zero.
+ */
+export declare const MIGRATIONS_READ_SCOPE: ControlPlaneScope;
+/**
+ * The seam's base grant — what `pithy dashboard connect` grants whatever the Worker composes. Ping is absent
+ * because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
+ *
+ * **{@link MIGRATIONS_READ_SCOPE} is absent on purpose.** It is a read — every route requiring it is a `GET`
+ * — so `connect` derives it from the seam's `adminRoutes` the way it derives every capability's reads. The
+ * base exists for `keys:rotate`, which is not a read and would otherwise drop out.
  */
 export declare const SEAM_SCOPES: readonly ControlPlaneScope[];
 /**

package/dist/controlPlane/scope/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/scope/scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAQ3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA2D,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAmC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,iBAAiB,EAA6C,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIrH"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/scope/scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAQ3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA2D,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAmC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAAqC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,iBAAiB,EAA6C,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIrH"}

package/dist/controlPlane/scope/scope.js

@@ -40,8 +40,19 @@ const MANIFEST_READ_SCOPE = "manifest:read";
 */
 const KEYS_ROTATE_SCOPE = "keys:rotate";
 /**
-* Every grantable scope the seam's own routes use — what `pithy dashboard connect` offers by default.
-* Ping is absent because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
+* Read where each database this Worker binds stands: what is applied, what is pending, what is undeclared,
+* and which run put it there (#729). Read-only by construction — every route behind it is a `GET`, and
+* nothing over the seam runs, reverses or resets a migration. The two migration health keys on the seam's
+* manifest entry sit behind it too, so a connection without it gets no number rather than a zero.
+*/
+const MIGRATIONS_READ_SCOPE = "migrations:read";
+/**
+* The seam's base grant — what `pithy dashboard connect` grants whatever the Worker composes. Ping is absent
+* because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
+*
+* **{@link MIGRATIONS_READ_SCOPE} is absent on purpose.** It is a read — every route requiring it is a `GET`
+* — so `connect` derives it from the seam's `adminRoutes` the way it derives every capability's reads. The
+* base exists for `keys:rotate`, which is not a read and would otherwise drop out.
 */
 const SEAM_SCOPES = [MANIFEST_READ_SCOPE, KEYS_ROTATE_SCOPE];
 /**
@@ -62,4 +73,4 @@ function scopeCovers(required, presented, granted) {
 	return granted.includes(required);
 }
 //#endregion
-export { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, SEAM_SCOPES, scopeCovers };
+export { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, SEAM_SCOPES, scopeCovers };

package/dist/createBackend.d.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { Hono } from "hono";
+import { z } from "zod";
 import type { Capability, MergedDatabases, MergedKvNamespaces, MergedWorkflowParams, PithyVars } from "./capability/capability";
 import { type DbRegistry } from "./data/databases";
 import { type KvRegistry } from "./kv/namespaces";
@@ -39,6 +40,12 @@ type BackendEnv<Caps extends readonly Capability[]> = {
         workflows: WorkflowDispatcher<MergedWorkflowParams<Caps>>;
     };
 };
+/** What `GET /health` answers. */
+export declare const HealthBody: z.ZodObject<{
+    status: z.ZodLiteral<"ok">;
+    version: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type HealthBody = z.infer<typeof HealthBody>;
 /**
  * Assemble capabilities into a deployable Hono app — a valid Worker `fetch` handler.
  *

package/dist/createBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA0KrF"}
+{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAO9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF,kCAAkC;AAClC,eAAO,MAAM,UAAU;;;iBAQ+B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA0MrF"}