@pithy-sh/core 0.9.0 → 0.11.0

package/dist/logger/record.d.ts

@@ -56,6 +56,29 @@ export declare const LogRecord: z.ZodObject<{
             message: z.ZodString;
             code: z.ZodString;
         }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"input/required">;
+        status: z.ZodLiteral<400>;
+        flag: z.ZodNullable<z.ZodString>;
+        choices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"core/precondition_failed">;
+        status: z.ZodLiteral<412>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"core/person_required">;
+        status: z.ZodLiteral<403>;
     }, z.core.$strip>, z.ZodObject<{
         message: z.ZodString;
         params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -287,6 +310,20 @@ export declare const LogRecord: z.ZodObject<{
         detail: z.ZodOptional<z.ZodString>;
         code: z.ZodLiteral<"turnstile/config">;
         status: z.ZodLiteral<500>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"turnstile/analytics_window">;
+        status: z.ZodLiteral<400>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"turnstile/analytics_unavailable">;
+        status: z.ZodLiteral<409>;
     }, z.core.$strip>, z.ZodObject<{
         message: z.ZodString;
         params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -308,6 +345,13 @@ export declare const LogRecord: z.ZodObject<{
         detail: z.ZodOptional<z.ZodString>;
         code: z.ZodLiteral<"media/not_found">;
         status: z.ZodLiteral<404>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"media/forbidden">;
+        status: z.ZodLiteral<403>;
     }, z.core.$strip>, z.ZodObject<{
         message: z.ZodString;
         params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -329,6 +373,20 @@ export declare const LogRecord: z.ZodObject<{
         detail: z.ZodOptional<z.ZodString>;
         code: z.ZodLiteral<"media/enrichment_failed">;
         status: z.ZodLiteral<500>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"media/analytics_window">;
+        status: z.ZodLiteral<400>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"media/analytics_unavailable">;
+        status: z.ZodLiteral<409>;
     }, z.core.$strip>, z.ZodObject<{
         message: z.ZodString;
         params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -763,6 +821,20 @@ export declare const LogRecord: z.ZodObject<{
         detail: z.ZodOptional<z.ZodString>;
         code: z.ZodLiteral<"payments/subscription_change_refused">;
         status: z.ZodLiteral<409>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"payments/override_stale">;
+        status: z.ZodLiteral<409>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"payments/quota_exceeded">;
+        status: z.ZodLiteral<402>;
     }, z.core.$strip>, z.ZodObject<{
         message: z.ZodString;
         params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
@@ -847,6 +919,41 @@ export declare const LogRecord: z.ZodObject<{
         detail: z.ZodOptional<z.ZodString>;
         code: z.ZodLiteral<"organization/nomination_invalid">;
         status: z.ZodLiteral<400>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"artifacts/not_found">;
+        status: z.ZodLiteral<404>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"artifacts/forbidden">;
+        status: z.ZodLiteral<403>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"artifacts/invalid_name">;
+        status: z.ZodLiteral<400>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"artifacts/name_taken">;
+        status: z.ZodLiteral<409>;
+    }, z.core.$strip>, z.ZodObject<{
+        message: z.ZodString;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        action: z.ZodOptional<z.ZodString>;
+        detail: z.ZodOptional<z.ZodString>;
+        code: z.ZodLiteral<"artifacts/invalid_config">;
+        status: z.ZodLiteral<400>;
     }, z.core.$strip>, z.ZodObject<{
         message: z.ZodString;
         params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;

package/dist/logger/record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/logger/record.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;GAKG;AAEH,4GAA4G;AAC5G,eAAO,MAAM,QAAQ;;;;;EAE4F,CAAC;AAClH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAgD,CAAC;AAEtG;;;;GAIG;AACH,eAAO,MAAM,SAAS,wCAEsF,CAAC;AAC7G,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW+E,CAAC;AACtG,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAmBnD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAMzD"}
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/logger/record.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;GAKG;AAEH,4GAA4G;AAC5G,eAAO,MAAM,QAAQ;;;;;EAE4F,CAAC;AAClH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAgD,CAAC;AAEtG;;;;GAIG;AACH,eAAO,MAAM,SAAS,wCAEsF,CAAC;AAC7G,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW+E,CAAC;AACtG,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC;AAmBnD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAMzD"}

package/dist/migrations/bookkeeping.d.ts

@@ -17,10 +17,31 @@ export declare const MIGRATION_LOCK_TABLE = "pithy_migrations_lock";
  * migration, so a rollback or a full reset must not remove it, and no capability has to ship it.
  */
 export declare const MIGRATION_OWNER_TABLE = "pithy_migrations_owner";
+/**
+ * Which run applied each migration — one row per applied migration, written by the runner from the
+ * `MigrationResult[]` Kysely hands back (`./groups`). Beside the ledger for the same reason the owner
+ * stamp is: Kysely creates `pithy_migrations` and its insert sets `name` and `timestamp` only, so there
+ * is nowhere in it to put a group — and a group is not a migration, so a rollback or a full reset must
+ * not remove the table. A reversed group's own rows go; the table stays.
+ */
+export declare const MIGRATION_GROUP_TABLE = "pithy_migrations_groups";
 /** The D1 dialect Pithy migrates through: stock kysely-d1, with the `sqlite_master`-only introspector. */
 export declare class D1MigrationDialect extends D1Dialect {
     createIntrospector(db: Kysely<unknown>): DatabaseIntrospector;
 }
 /** A Kysely over one D1 binding, with Pithy's dialect and `CamelCasePlugin` — the one way in. */
 export declare function migrationKysely<DB = unknown>(database: D1Database): Kysely<DB>;
+/**
+ * The applied migrations, **in the order Kysely steps down from them** — oldest first, tip last.
+ *
+ * Kysely's `Migrator` sorts the ledger by `timestamp`, breaks a tie on the name, and reverses that list to
+ * decide what the next `migrateDown()` reverses. So anything that asks *is this the top of the chain* has
+ * to read the same order: concluding it from the order some other table was written in answers a different
+ * question, and the answer only differs in the cases that matter (`./groups`, #694).
+ *
+ * Empty when the ledger table does not exist — a database nothing has migrated. Existence is checked
+ * against `sqlite_master`, a plain select D1 permits, rather than by catching the read's error, so a
+ * genuine read failure surfaces instead of being read as "nothing applied".
+ */
+export declare function appliedMigrationChain<DB>(db: Kysely<DB>): Promise<string[]>;
 //# sourceMappingURL=bookkeeping.d.ts.map

package/dist/migrations/bookkeeping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bookkeeping.d.ts","sourceRoot":"","sources":["../../src/migrations/bookkeeping.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAA0D,MAAM,QAAQ,CAAC;AAC3G,OAAO,EAAmB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAsBtC;;;GAGG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAgC9D,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,SAAS;IACtC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,oBAAoB,CAErE;CACF;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAE9E"}
+{"version":3,"file":"bookkeeping.d.ts","sourceRoot":"","sources":["../../src/migrations/bookkeeping.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAA0D,MAAM,QAAQ,CAAC;AAC3G,OAAO,EAAmB,MAAM,EAAO,MAAM,QAAQ,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAsBtC;;;GAGG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAgC/D,0GAA0G;AAC1G,qBAAa,kBAAmB,SAAQ,SAAS;IACtC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,oBAAoB,CAErE;CACF;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAE9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAcjF"}

package/dist/migrations/bookkeeping.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { CamelCasePlugin, Kysely } from "kysely";
+import { CamelCasePlugin, Kysely, sql } from "kysely";
 import { D1Dialect } from "kysely-d1";
 //#region src/migrations/bookkeeping.ts
 /**
@@ -16,11 +16,20 @@ const MIGRATION_LOCK_TABLE = "pithy_migrations_lock";
 * migration, so a rollback or a full reset must not remove it, and no capability has to ship it.
 */
 const MIGRATION_OWNER_TABLE = "pithy_migrations_owner";
+/**
+* Which run applied each migration — one row per applied migration, written by the runner from the
+* `MigrationResult[]` Kysely hands back (`./groups`). Beside the ledger for the same reason the owner
+* stamp is: Kysely creates `pithy_migrations` and its insert sets `name` and `timestamp` only, so there
+* is nowhere in it to put a group — and a group is not a migration, so a rollback or a full reset must
+* not remove the table. A reversed group's own rows go; the table stays.
+*/
+const MIGRATION_GROUP_TABLE = "pithy_migrations_groups";
 /** Pithy's bookkeeping tables — hidden by the introspector the way Kysely hides its own defaults. */
 const INTERNAL_TABLES = [
 	MIGRATION_TABLE,
 	MIGRATION_LOCK_TABLE,
-	MIGRATION_OWNER_TABLE
+	MIGRATION_OWNER_TABLE,
+	MIGRATION_GROUP_TABLE
 ];
 /** Table names from `sqlite_master` only — no pragma joins, no column metadata. */
 var D1Introspector = class {
@@ -55,5 +64,25 @@ function migrationKysely(database) {
 		plugins: [new CamelCasePlugin()]
 	});
 }
+/**
+* The applied migrations, **in the order Kysely steps down from them** — oldest first, tip last.
+*
+* Kysely's `Migrator` sorts the ledger by `timestamp`, breaks a tie on the name, and reverses that list to
+* decide what the next `migrateDown()` reverses. So anything that asks *is this the top of the chain* has
+* to read the same order: concluding it from the order some other table was written in answers a different
+* question, and the answer only differs in the cases that matter (`./groups`, #694).
+*
+* Empty when the ledger table does not exist — a database nothing has migrated. Existence is checked
+* against `sqlite_master`, a plain select D1 permits, rather than by catching the read's error, so a
+* genuine read failure surfaces instead of being read as "nothing applied".
+*/
+async function appliedMigrationChain(db) {
+	if ((await sql`select name from sqlite_master where type = 'table' and name = ${"pithy_migrations"}`.execute(db)).rows.length === 0) return [];
+	const { rows } = await sql`select name, timestamp from ${sql.table(MIGRATION_TABLE)}`.execute(db);
+	return [...rows].sort((left, right) => {
+		const elapsed = new Date(left.timestamp).getTime() - new Date(right.timestamp).getTime();
+		return elapsed === 0 ? left.name.localeCompare(right.name) : elapsed;
+	}).map((row) => row.name);
+}
 //#endregion
-export { D1MigrationDialect, MIGRATION_LOCK_TABLE, MIGRATION_OWNER_TABLE, MIGRATION_TABLE, migrationKysely };
+export { D1MigrationDialect, MIGRATION_GROUP_TABLE, MIGRATION_LOCK_TABLE, MIGRATION_OWNER_TABLE, MIGRATION_TABLE, appliedMigrationChain, migrationKysely };

package/dist/migrations/capabilitySets.d.ts

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { MigrationProvider } from "kysely/migration";
+import type { Capability } from "../capability/capability";
+import { type NamespacedMigrations } from "./registry";
+/**
+ * Every capability's per-database migration set (`DatabaseSpec.migrations`, namespaced by capability
+ * name), in composition order — the raw material {@link buildRegistryFromCapabilities}, the CLI's
+ * fan-out runner and the control-plane seam all build on. The runner needs the sets rather than a
+ * finished provider because two Workers can be bound to one physical D1: their sets merge into a single
+ * ordered provider so that database migrates once, with every Worker's capabilities in it. A Worker
+ * composes only its own, which is why the seam's `undeclared` is relative to that Worker. Migrations
+ * without a `migrationOrder` fail here, attributed to their capability.
+ */
+export declare function collectMigrationSets(capabilities: Capability[]): NamespacedMigrations[];
+/**
+ * Compose every capability's per-database migration sets (`DatabaseSpec.migrations`,
+ * namespaced by capability name) into one ordered provider per database. A database
+ * nobody migrates gets no provider; migrations without a `migrationOrder` fail here,
+ * attributed to their capability.
+ */
+export declare function buildRegistryFromCapabilities(capabilities: Capability[]): Record<string, MigrationProvider>;
+//# sourceMappingURL=capabilitySets.d.ts.map

package/dist/migrations/capabilitySets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilitySets.d.ts","sourceRoot":"","sources":["../../src/migrations/capabilitySets.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG3D,OAAO,EAA2B,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAsChF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,oBAAoB,EAAE,CAsBvF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAE3G"}

package/dist/migrations/capabilitySets.js

@@ -0,0 +1,74 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { InternalError } from "../error/pithyError.js";
+import { createMigrationRegistry } from "./registry.js";
+//#region src/migrations/capabilitySets.ts
+/**
+* **Where a capability's migrations become a registry's sets — one function, composed twice (#729).**
+*
+* `pithy migrate` and `pithy doctor` compose these sets from the project on disk; the Worker composes them
+* from the capabilities it was built with, to answer `GET {basePath}/migrations`. It lived in the CLI until
+* the Worker needed it too. It reads nothing but `Capability.databases`, so it belongs in core — and if
+* the two sides composed with two functions, `pithy doctor` and the route could disagree about one
+* environment with nothing to say which was wrong.
+*/
+/**
+* A retained declaration must name a table this slice declares, beside the migrations that create it.
+*
+* A misspelled key would count a table that does not exist, find no rows, and let the `down` through —
+* the refusal quietly off for the one table it was written for. And retention on a slice with no
+* migrations has no `down` to be recorded on, so nothing would ever enforce it. Both are an author's mistake,
+* caught where the declaration is read rather than discovered when a vault is empty (#588).
+*/
+function assertRetainedDeclared(capability, database, spec) {
+	const retained = spec.retained ?? [];
+	if (retained.length === 0) return;
+	const unknown = retained.filter((table) => !(table in spec.tables));
+	if (unknown.length > 0) throw new InternalError({
+		message: `Capability "${capability}" retains ${unknown.map((table) => `"${table}"`).join(", ")} in database "${database}", which its tables do not declare.`,
+		action: "Name tables from that database spec's tables in retained."
+	});
+	if (!spec.migrations || Object.keys(spec.migrations).length === 0) throw new InternalError({
+		message: `Capability "${capability}" retains tables in database "${database}" but ships no migrations for it.`,
+		action: "Declare retained beside the migrations that create those tables."
+	});
+}
+/**
+* Every capability's per-database migration set (`DatabaseSpec.migrations`, namespaced by capability
+* name), in composition order — the raw material {@link buildRegistryFromCapabilities}, the CLI's
+* fan-out runner and the control-plane seam all build on. The runner needs the sets rather than a
+* finished provider because two Workers can be bound to one physical D1: their sets merge into a single
+* ordered provider so that database migrates once, with every Worker's capabilities in it. A Worker
+* composes only its own, which is why the seam's `undeclared` is relative to that Worker. Migrations
+* without a `migrationOrder` fail here, attributed to their capability.
+*/
+function collectMigrationSets(capabilities) {
+	const sets = [];
+	for (const capability of capabilities) for (const [database, spec] of Object.entries(capability.databases ?? {})) {
+		assertRetainedDeclared(capability.name, database, spec);
+		if (!spec.migrations) continue;
+		if (spec.migrationOrder === void 0) throw new InternalError({
+			message: `Capability "${capability.name}" has migrations for database "${database}" but no migrationOrder.`,
+			action: "Set migrationOrder on that database spec (core low, app high)."
+		});
+		sets.push({
+			database,
+			namespace: capability.name,
+			order: spec.migrationOrder,
+			migrations: spec.migrations,
+			...spec.retained && spec.retained.length > 0 ? { retained: spec.retained } : {}
+		});
+	}
+	return sets;
+}
+/**
+* Compose every capability's per-database migration sets (`DatabaseSpec.migrations`,
+* namespaced by capability name) into one ordered provider per database. A database
+* nobody migrates gets no provider; migrations without a `migrationOrder` fail here,
+* attributed to their capability.
+*/
+function buildRegistryFromCapabilities(capabilities) {
+	return createMigrationRegistry(collectMigrationSets(capabilities));
+}
+//#endregion
+export { buildRegistryFromCapabilities, collectMigrationSets };

package/dist/migrations/groups.d.ts

@@ -0,0 +1,140 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { D1Database } from "@cloudflare/workers-types";
+import { z } from "zod";
+/**
+ * **Which run applied each migration — the group a rollback names (#694).**
+ *
+ * `pithy migrate --rollback` used to step back one migration in every database the environment binds, and
+ * nothing recorded what a single run had applied. So reversing a deploy that moved three migrations was
+ * three invocations and the count came from outside the tool — a human's memory, or a CI log read under
+ * pressure. Every run belongs to a group now: the caller's own `--group <value>`, or a generated ISO-8601
+ * timestamp, recorded here against every migration the run applies, in every database it touches.
+ *
+ * **It cannot live in the ledger.** `pithy_migrations` is Kysely's own table, renamed off its default
+ * (`./bookkeeping`); Kysely creates it and its insert sets `name` and `timestamp` only. So the group sits
+ * in a table *beside* it, written by the runner from the `MigrationResult[]` Kysely hands back — the same
+ * placement, and the same reasoning, as `pithy_migrations_owner`: it is not a migration, so no capability
+ * ships it, `--rollback` cannot step it back, and `pithy seed --redo`'s full reset cannot wipe it. What a
+ * reversal removes is the reversed migrations' own rows, which is bookkeeping catching up with the ledger.
+ *
+ * **The rows say which run; the ledger says which order.** Every applied migration is recorded here as it
+ * applies and forgotten as it is reversed, so these rows are the membership. Where a group *sits* is a
+ * question about the ledger, though, because the ledger is what Kysely steps down from — so {@link
+ * readGroupPosition} reads both (`appliedMigrationChain`) and compares the group against the chain's tail.
+ * Reading the group table alone would answer from the order this table happened to be written in, and the
+ * two differ in exactly the cases that matter: a migration applied with no group row at all.
+ *
+ * **What it cannot see, it names.** A migration applied before this table existed carries no row, and so
+ * does one a `seed --redo` reset reapplied or one whose group write failed. Such a migration over a group
+ * buries it — reversing the group would reverse a migration nobody recorded — and the position says so by
+ * name rather than calling the group reversible. Reading is cheap and additive: one group row per applied
+ * migration, and the table is created on the first run that applies anything.
+ */
+/** One applied migration and the run that applied it. The three columns are the whole table. */
+export declare const MigrationGroupRecord: z.ZodObject<{
+    groupKey: z.ZodString;
+    migration: z.ZodString;
+    appliedAt: z.ZodCodec<z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodDate]>, z.ZodDate>;
+}, z.core.$strip>;
+export type MigrationGroupRecord = z.output<typeof MigrationGroupRecord>;
+/** One group as it stands in one database: what it applied here, and when it last did. */
+export interface MigrationGroup {
+    /** The group's value — what `--rollback --group` takes back. */
+    group: string;
+    /**
+     * When this group last applied something here. A group extended by a retry carries the later moment,
+     * because that is the one that decides which group is newest.
+     */
+    appliedAt: Date;
+    /** The migrations this group applied in this database, in the order they were applied. */
+    migrations: string[];
+}
+/**
+ * Where a group sits in one database's chain — the question a rollback asks before it reverses anything.
+ *
+ * Three states, kept apart because they are three different answers. `absent` is *this database applied
+ * nothing under that group*, which for a group spanning two databases is ordinary and not a refusal.
+ * `buried` is the refusal: Kysely steps down from the tip, so reversing it would mean reversing the
+ * migrations over it, from groups nobody named.
+ */
+export type GroupPosition = {
+    state: "absent";
+} | {
+    /** The group's migrations are the top of this database's chain. */
+    state: "top";
+    /** Them, in the order they will be reversed — newest first. */
+    migrations: string[];
+} | {
+    /** Something else sits over the group, or inside it. */
+    state: "buried";
+    /**
+     * The groups in the way, newest first: applied over its newest migration, or inside it by a run that
+     * came between two of its own. A group extended after another ran names that one.
+     */
+    above: string[];
+    /**
+     * The migrations in the way that no group claims, newest first — an older kit's, a reset's re-apply, or
+     * a run whose group write failed. They bury the group as surely as another group does, and nothing can
+     * be reversed by group while one of them is at the tip.
+     */
+    ungrouped: string[];
+    /**
+     * The group whose own migrations *are* the contiguous tip here, when there is one — the only group a
+     * refusal may name as reversible. Absent when the tip is interleaved or ungrouped, which is the state
+     * where naming anything would print a command that refuses in its turn.
+     */
+    top?: string;
+};
+/** What {@link recordMigrationGroup} writes: the group, what it applied, and when. */
+export interface RecordGroupOptions {
+    /** The group every migration in this call was applied under. */
+    group: string;
+    /** The migrations applied, in application order. Empty writes nothing at all. */
+    migrations: readonly string[];
+    /** When they applied. Defaults to now; passed explicitly by tests and by a caller that stamps a run. */
+    at?: Date;
+}
+/**
+ * The group a run with no `--group` belongs to: an **ISO-8601 timestamp**, `2026-10-03T19:52:47.611Z`.
+ *
+ * A timestamp rather than a date, because one run is one group. Date-only would silently merge two
+ * unrelated runs on a busy day into one group, and reversing it would then undo more than the caller did.
+ * The precision costs nothing, it sorts lexicographically into chronological order, and it tells an
+ * operator *when* without their having named anything.
+ */
+export declare function generatedMigrationGroup(now?: Date): string;
+/**
+ * Record a group against the migrations a run just applied, creating the table on demand. Idempotent in
+ * the only sense that matters: a migration applies once, so a name arrives here once — and a second call
+ * under the same group **extends** it, which is the retry case a release whose migrate half-failed needs.
+ */
+export declare function recordMigrationGroup(database: D1Database, options: RecordGroupOptions): Promise<void>;
+/**
+ * Every group this database records, oldest first by when each last applied something — and so the last
+ * entry is the newest group, which is what a rollback with no `--group` names. Empty for a database
+ * nothing has grouped, and reading creates nothing.
+ */
+export declare function readMigrationGroups(database: D1Database): Promise<MigrationGroup[]>;
+/**
+ * Where `group` sits in this database's chain — see {@link GroupPosition}.
+ *
+ * The test is *is this group the tail of the **ledger***, not *is it the newest by timestamp*: a group
+ * extended after another run has the later timestamp and still has that run's migration inside it, so
+ * reversing it would reverse the other group's work. Hence the two halves of one rule — nothing applied
+ * over the group's newest migration, and nothing applied inside it between two of its own.
+ *
+ * **Against the ledger, because the ledger is what comes down.** `migrateDown()` steps the ledger's tip,
+ * so a group whose rows are the tail of the *group table* is still buried when an ungrouped migration sits
+ * over it in the ledger — and that state is reachable from the ordinary dev loop, where `seed --redo`'s
+ * reset reapplies a pending migration under no group at all. Asked of the group table alone, this returned
+ * `top`, the `down` reversed a migration nobody asked about, and the refusal arrived after the damage.
+ */
+export declare function readGroupPosition(database: D1Database, group: string): Promise<GroupPosition>;
+/**
+ * Forget the group rows of migrations that are no longer applied — what a reversal writes once the `down`
+ * has run. By migration name alone, because the ledger's name is unique: one applied migration, one row.
+ * A database with no group table has nothing to forget.
+ */
+export declare function forgetMigrationGroups(database: D1Database, migrations: readonly string[]): Promise<void>;
+//# sourceMappingURL=groups.d.ts.map

package/dist/migrations/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/migrations/groups.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,gGAAgG;AAChG,eAAO,MAAM,oBAAoB;;;;iBAUkE,CAAC;AACpG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAWzE,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC;IAChB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IACE,mEAAmE;IACnE,KAAK,EAAE,KAAK,CAAC;IACb,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,GACD;IACE,wDAAwD;IACxD,KAAK,EAAE,QAAQ,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wGAAwG;IACxG,EAAE,CAAC,EAAE,IAAI,CAAC;CACX;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAEtE;AA2BD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB3G;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAqBzF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwBnG;AAwBD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9G"}