@pithy-sh/core 0.10.0 → 0.12.0

package/dist/error/payload.js

@@ -97,6 +97,16 @@ const AuthSessionNotFreshPublic = z.object({
 	status: z.literal(403).describe("Forbidden — a real, current credential was presented and is not sufficient for this particular decision. Not 401, which is what a caller with no credential gets: a client that cannot tell the two apart does not know whether to re-authenticate or to retry."),
 	...publicFields
 }).describe("The session is authentic but the holder authenticated too long ago to attach a provider (403).");
+const AuthAccountSuspendedPublic = z.object({
+	code: z.literal("auth/account_suspended").describe("The account this credential belongs to is suspended, so the request is refused whatever it carries. An operator suspended it on purpose, with a reason, and the reason is the `message`. When the suspension has an end, `params.suspendedUntil` names it as ISO-8601; a suspension past its end is no longer one, and nothing has to clear it. A separate code from `auth/forbidden` so a client can render the screen that says what happened rather than a generic refusal."),
+	status: z.literal(403).describe("Forbidden — the credential is genuine and the account behind it may not act. Not 401: signing in again cannot help, and a client that read it as an expired token would loop."),
+	...publicFields
+}).describe("The account is suspended (403).");
+const AuthAccountDeletedPublic = z.object({
+	code: z.literal("auth/account_deleted").describe("The account this credential belongs to is deleted and inside its purge window: it cannot sign in or act, and it can still be restored until the window closes. After the purge there is no account, and the credential is simply invalid."),
+	status: z.literal(403).describe("Forbidden — the account exists and may not act. Not 404, because until the purge runs it can come back, and not 401, because signing in again cannot help."),
+	...publicFields
+}).describe("The account is deleted and awaiting its purge (403).");
 const NotFoundPublic = z.object({
 	code: z.literal("core/not_found").describe("The requested resource does not exist."),
 	status: z.literal(404).describe("Not Found."),
@@ -242,6 +252,16 @@ const TurnstileConfigPublic = z.object({
 	status: z.literal(500).describe("Internal Server Error — a configuration fault, not a client request."),
 	...publicFields
 }).describe("The Turnstile middleware is misconfigured (500).");
+const TurnstileAnalyticsWindowPublic = z.object({
+	code: z.literal("turnstile/analytics_window").describe("The requested challenge window reaches past what Cloudflare keeps, or is wider than one read may ask for."),
+	status: z.literal(400).describe("Bad Request — narrow the window or move it later."),
+	...publicFields
+}).describe("A Turnstile-analytics window outside Cloudflare's retention or range (400).");
+const TurnstileAnalyticsUnavailablePublic = z.object({
+	code: z.literal("turnstile/analytics_unavailable").describe("Cloudflare does not serve Turnstile analytics to this account, so no outcome can be read."),
+	status: z.literal(409).describe("Conflict — the account's configuration rules the read out."),
+	...publicFields
+}).describe("Turnstile analytics are not served to this account (409).");
 const AuditInvalidEventPublic = z.object({
 	code: z.literal("audit/invalid_event").describe("An audit event failed validation against the AuditEvent schema (bad action, outcome, or actor)."),
 	status: z.literal(400).describe("Bad Request — the event did not match its schema."),
@@ -257,6 +277,11 @@ const MediaNotFoundPublic = z.object({
 	status: z.literal(404).describe("Not Found."),
 	...publicFields
 }).describe("A requested media record does not exist (404).");
+const MediaForbiddenPublic = z.object({
+	code: z.literal("media/forbidden").describe("The caller may read the media record but not change it: only its owner, acting for the record's organization, or a role holding `media:manage` there may edit, delete or re-scope it."),
+	status: z.literal(403).describe("Forbidden."),
+	...publicFields
+}).describe("The caller may read the record but not change it (403).");
 const MediaUnsupportedPublic = z.object({
 	code: z.literal("media/unsupported").describe("The media type, extension, or backend is not supported for the requested operation."),
 	status: z.literal(400).describe("Bad Request — the operation does not apply to this media."),
@@ -272,6 +297,16 @@ const MediaEnrichmentFailedPublic = z.object({
 	status: z.literal(500).describe("Internal Server Error — an enrichment step could not complete."),
 	...publicFields
 }).describe("A media AI-enrichment step failed (500).");
+const MediaAnalyticsWindowPublic = z.object({
+	code: z.literal("media/analytics_window").describe("The requested delivery window reaches past what Cloudflare keeps, or is wider than one read may ask for."),
+	status: z.literal(400).describe("Bad Request — narrow the window or move it later."),
+	...publicFields
+}).describe("A delivery-analytics window outside Cloudflare's retention or range (400).");
+const MediaAnalyticsUnavailablePublic = z.object({
+	code: z.literal("media/analytics_unavailable").describe("Cloudflare does not serve the delivery analytics this read needs to this account — a Customer Metadata Boundary outside the US carries none of them."),
+	status: z.literal(409).describe("Conflict — the account's configuration rules the read out."),
+	...publicFields
+}).describe("Delivery analytics are not served to this account (409).");
 const LeaderboardBoardNotFoundPublic = z.object({
 	code: z.literal("leaderboard/board_not_found").describe("No board with that key is configured. Board keys come from `pithy.config.ts`, not from the database."),
 	status: z.literal(404).describe("Not Found."),
@@ -438,17 +473,17 @@ const MatchmakingNotQueuedPublic = z.object({
 	...publicFields
 }).describe("The player is not in the queue (404).");
 const StorageNotFoundPublic = z.object({
-	code: z.literal("storage/not_found").describe("No object row matches, or the object exists but is not visible to this caller."),
+	code: z.literal("storage/not_found").describe("No object row matches, or the object exists but this caller may not read it."),
 	status: z.literal(404).describe("Not Found."),
 	...publicFields
 }).describe("The object does not exist, or is not visible to the caller (404).");
 const StorageForbiddenPublic = z.object({
-	code: z.literal("storage/forbidden").describe("The caller does not own the object and the object is not public."),
+	code: z.literal("storage/forbidden").describe("The caller may read the object but not change it: only its owner, acting for the object's organization, or a role holding `storage:manage` there may."),
 	status: z.literal(403).describe("Forbidden."),
 	...publicFields
-}).describe("The caller is not the owner and the object is not public (403).");
+}).describe("The caller may read the object but not change it (403).");
 const StorageQuotaExceededPublic = z.object({
-	code: z.literal("storage/quota_exceeded").describe("The declared upload size would push the owner past their byte quota. Checked at init against pending and stored rows together, so concurrent inits cannot race past the limit."),
+	code: z.literal("storage/quota_exceeded").describe("The declared upload size would push the owner past the configured `bytesPerOwner` quota. Checked at init against pending and stored rows together, so concurrent inits cannot race past the limit. Where the `storageBytes` meter is enforced, the same refusal is `payments/quota_exceeded` (402)."),
 	status: z.literal(413).describe("Content Too Large."),
 	...publicFields
 }).describe("The upload would exceed the owner's byte quota (413).");
@@ -582,6 +617,16 @@ const PaymentsSubscriptionChangeRefusedPublic = z.object({
 	status: z.literal(409).describe("Conflict — the subscription's present state forbids the change asked of it."),
 	...publicFields
 }).describe("A subscription's state forbids the change asked of it (409).");
+const PaymentsOverrideStalePublic = z.object({
+	code: z.literal("payments/override_stale").describe("A control-plane override write named a version behind the subject's override row. Two operators share one customer: both opened the same allowance, and the second would silently overwrite the first while the first believed they had succeeded. So the write is refused and nothing is written. 409, because the request is well-formed and the same request against the version it now holds would be accepted — the caller re-reads, and tries again."),
+	status: z.literal(409).describe("Conflict — the override changed since the caller read it."),
+	...publicFields
+}).describe("An override write named a stale version (409).");
+const PaymentsQuotaExceededPublic = z.object({
+	code: z.literal("payments/quota_exceeded").describe("An enforced kit meter — emails enqueued, bytes stored, media items held — would pass the subject's effective quota for the period. Nothing was written. 402 Payment Required, because it is the honest status: the plan does not allow more and the remedy is a purchase, a bigger tier, or a number pinned for this subject from the control plane. A meter refuses and never bills — the kit does not sell overage."),
+	status: z.literal(402).describe("Payment Required — the plan's allowance for this period is used up."),
+	...publicFields
+}).describe("An enforced meter is at its quota for this period (402).");
 const ControlPlaneNotConnectedPublic = z.object({
 	code: z.literal("controlplane/not_connected").describe("No management-client connection is registered for this environment. The shipped default: the seam is present and denies everything until the adopter provisions a credential. There is no backdoor."),
 	status: z.literal(403).describe("Forbidden."),
@@ -642,6 +687,31 @@ const OrganizationNominationInvalidPublic = z.object({
 	status: z.literal(400).describe("Bad Request — no offer this caller may accept."),
 	...publicFields
 }).describe("No standing ownership offer this caller may accept (400).");
+const ArtifactsNotFoundPublic = z.object({
+	code: z.literal("artifacts/not_found").describe("No such repository, **or** one the caller holds no grant on and does not own. One code for both, byte for byte: a repository's name is in its clone URL, and a refusal that told the two apart would hand it over. Also what the credential route answers for a repository with remote access off. Which it was survives in `detail`, which the HTTP codec strips."),
+	status: z.literal(404).describe("Not Found."),
+	...publicFields
+}).describe("No such repository, or none this caller may see — the same answer for both (404).");
+const ArtifactsForbiddenPublic = z.object({
+	code: z.literal("artifacts/forbidden").describe("The caller can see the repository and may not do this to it: a grant holder asking for what only an owner may do, or a member of an organization whose role lacks the configured `managePower`. A 403 rather than the 404 above, because by then the caller already knows the repository exists."),
+	status: z.literal(403).describe("Forbidden."),
+	...publicFields
+}).describe("The caller may see this repository and may not do this (403).");
+const ArtifactsInvalidNamePublic = z.object({
+	code: z.literal("artifacts/invalid_name").describe("A supplied repository name is outside Cloudflare's charset or the 2-to-63 cap. Refused and never shortened: a name somebody chose is in every clone URL, and a silently different one is a repository nobody can find."),
+	status: z.literal(400).describe("Bad Request."),
+	...publicFields
+}).describe("A repository name breaks the naming rule (400).");
+const ArtifactsNameTakenPublic = z.object({
+	code: z.literal("artifacts/name_taken").describe("The owner already holds a repository with that display name, or a supplied physical name is already in the namespace. The second happens only where the adopter supplies names, so uniqueness is theirs."),
+	status: z.literal(409).describe("Conflict."),
+	...publicFields
+}).describe("That repository name is already in use (409).");
+const ArtifactsInvalidConfigPublic = z.object({
+	code: z.literal("artifacts/invalid_config").describe("The capability's configuration cannot be honored: a `tokenTtlSeconds` above the ceiling, or `organization` composed with no `managePower` named. Raised at boot, so a mistake fails on deploy rather than at the first mint."),
+	status: z.literal(400).describe("Bad Request — the configuration is malformed."),
+	...publicFields
+}).describe("The artifacts configuration is invalid (400).");
 const SupportNotFoundPublic = z.object({
 	code: z.literal("support/not_found").describe("A requested support thread, message, or attachment does not exist."),
 	status: z.literal(404).describe("Not Found."),
@@ -737,6 +807,8 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	ForbiddenPublic,
 	AuthProviderUnavailablePublic,
 	AuthSessionNotFreshPublic,
+	AuthAccountSuspendedPublic,
+	AuthAccountDeletedPublic,
 	NotFoundPublic,
 	ConflictPublic,
 	RateLimitPublic,
@@ -766,12 +838,17 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	TurnstileMissingTokenPublic,
 	TurnstileFailedPublic,
 	TurnstileConfigPublic,
+	TurnstileAnalyticsWindowPublic,
+	TurnstileAnalyticsUnavailablePublic,
 	AuditInvalidEventPublic,
 	AuditWriteFailedPublic,
 	MediaNotFoundPublic,
+	MediaForbiddenPublic,
 	MediaUnsupportedPublic,
 	MediaStorageFailedPublic,
 	MediaEnrichmentFailedPublic,
+	MediaAnalyticsWindowPublic,
+	MediaAnalyticsUnavailablePublic,
 	LeaderboardBoardNotFoundPublic,
 	LeaderboardEntryNotFoundPublic,
 	LeaderboardScoreRejectedPublic,
@@ -834,6 +911,8 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	PaymentsEntitlementNotInCatalogPublic,
 	PaymentsSubjectUnresolvedPublic,
 	PaymentsSubscriptionChangeRefusedPublic,
+	PaymentsOverrideStalePublic,
+	PaymentsQuotaExceededPublic,
 	ControlPlaneNotConnectedPublic,
 	ControlPlaneInvalidCredentialPublic,
 	ControlPlaneInsufficientScopePublic,
@@ -846,6 +925,11 @@ const KitPublicErrorPayload = z.discriminatedUnion("code", [
 	OrganizationLastAdministratorPublic,
 	OrganizationSlugTakenPublic,
 	OrganizationNominationInvalidPublic,
+	ArtifactsNotFoundPublic,
+	ArtifactsForbiddenPublic,
+	ArtifactsInvalidNamePublic,
+	ArtifactsNameTakenPublic,
+	ArtifactsInvalidConfigPublic,
 	SupportNotFoundPublic,
 	SupportInvalidCategoryPublic,
 	SupportUnparseableMessagePublic,
@@ -871,6 +955,8 @@ const InvalidToken = InvalidTokenPublic.extend(internalFields).describe(InvalidT
 const Forbidden = ForbiddenPublic.extend(internalFields).describe(ForbiddenPublic.description ?? "");
 const AuthProviderUnavailable = AuthProviderUnavailablePublic.extend(internalFields).describe(AuthProviderUnavailablePublic.description ?? "");
 const AuthSessionNotFresh = AuthSessionNotFreshPublic.extend(internalFields).describe(AuthSessionNotFreshPublic.description ?? "");
+const AuthAccountSuspended = AuthAccountSuspendedPublic.extend(internalFields).describe(AuthAccountSuspendedPublic.description ?? "");
+const AuthAccountDeleted = AuthAccountDeletedPublic.extend(internalFields).describe(AuthAccountDeletedPublic.description ?? "");
 const NotFound = NotFoundPublic.extend(internalFields).describe(NotFoundPublic.description ?? "");
 const Conflict = ConflictPublic.extend(internalFields).describe(ConflictPublic.description ?? "");
 const RateLimit = RateLimitPublic.extend(internalFields).describe(RateLimitPublic.description ?? "");
@@ -900,12 +986,17 @@ const EmailSendFailed = EmailSendFailedPublic.extend(internalFields).describe(Em
 const TurnstileMissingToken = TurnstileMissingTokenPublic.extend(internalFields).describe(TurnstileMissingTokenPublic.description ?? "");
 const TurnstileFailed = TurnstileFailedPublic.extend(internalFields).describe(TurnstileFailedPublic.description ?? "");
 const TurnstileConfig = TurnstileConfigPublic.extend(internalFields).describe(TurnstileConfigPublic.description ?? "");
+const TurnstileAnalyticsWindow = TurnstileAnalyticsWindowPublic.extend(internalFields).describe(TurnstileAnalyticsWindowPublic.description ?? "");
+const TurnstileAnalyticsUnavailable = TurnstileAnalyticsUnavailablePublic.extend(internalFields).describe(TurnstileAnalyticsUnavailablePublic.description ?? "");
 const AuditInvalidEvent = AuditInvalidEventPublic.extend(internalFields).describe(AuditInvalidEventPublic.description ?? "");
 const AuditWriteFailed = AuditWriteFailedPublic.extend(internalFields).describe(AuditWriteFailedPublic.description ?? "");
 const MediaNotFound = MediaNotFoundPublic.extend(internalFields).describe(MediaNotFoundPublic.description ?? "");
+const MediaForbidden = MediaForbiddenPublic.extend(internalFields).describe(MediaForbiddenPublic.description ?? "");
 const MediaUnsupported = MediaUnsupportedPublic.extend(internalFields).describe(MediaUnsupportedPublic.description ?? "");
 const MediaStorageFailed = MediaStorageFailedPublic.extend(internalFields).describe(MediaStorageFailedPublic.description ?? "");
 const MediaEnrichmentFailed = MediaEnrichmentFailedPublic.extend(internalFields).describe(MediaEnrichmentFailedPublic.description ?? "");
+const MediaAnalyticsWindow = MediaAnalyticsWindowPublic.extend(internalFields).describe(MediaAnalyticsWindowPublic.description ?? "");
+const MediaAnalyticsUnavailable = MediaAnalyticsUnavailablePublic.extend(internalFields).describe(MediaAnalyticsUnavailablePublic.description ?? "");
 const LeaderboardBoardNotFound = LeaderboardBoardNotFoundPublic.extend(internalFields).describe(LeaderboardBoardNotFoundPublic.description ?? "");
 const LeaderboardEntryNotFound = LeaderboardEntryNotFoundPublic.extend(internalFields).describe(LeaderboardEntryNotFoundPublic.description ?? "");
 const LeaderboardScoreRejected = LeaderboardScoreRejectedPublic.extend(internalFields).describe(LeaderboardScoreRejectedPublic.description ?? "");
@@ -968,6 +1059,8 @@ const PaymentsDiscountInvalid = PaymentsDiscountInvalidPublic.extend(internalFie
 const PaymentsEntitlementNotInCatalog = PaymentsEntitlementNotInCatalogPublic.extend(internalFields).describe(PaymentsEntitlementNotInCatalogPublic.description ?? "");
 const PaymentsSubjectUnresolved = PaymentsSubjectUnresolvedPublic.extend(internalFields).describe(PaymentsSubjectUnresolvedPublic.description ?? "");
 const PaymentsSubscriptionChangeRefused = PaymentsSubscriptionChangeRefusedPublic.extend(internalFields).describe(PaymentsSubscriptionChangeRefusedPublic.description ?? "");
+const PaymentsOverrideStale = PaymentsOverrideStalePublic.extend(internalFields).describe(PaymentsOverrideStalePublic.description ?? "");
+const PaymentsQuotaExceeded = PaymentsQuotaExceededPublic.extend(internalFields).describe(PaymentsQuotaExceededPublic.description ?? "");
 const ControlPlaneNotConnected = ControlPlaneNotConnectedPublic.extend(internalFields).describe(ControlPlaneNotConnectedPublic.description ?? "");
 const ControlPlaneInvalidCredential = ControlPlaneInvalidCredentialPublic.extend(internalFields).describe(ControlPlaneInvalidCredentialPublic.description ?? "");
 const ControlPlaneInsufficientScope = ControlPlaneInsufficientScopePublic.extend(internalFields).describe(ControlPlaneInsufficientScopePublic.description ?? "");
@@ -990,6 +1083,11 @@ const OrganizationInvitationInvalid = OrganizationInvitationInvalidPublic.extend
 const OrganizationLastAdministrator = OrganizationLastAdministratorPublic.extend(internalFields).describe(OrganizationLastAdministratorPublic.description ?? "");
 const OrganizationSlugTaken = OrganizationSlugTakenPublic.extend(internalFields).describe(OrganizationSlugTakenPublic.description ?? "");
 const OrganizationNominationInvalid = OrganizationNominationInvalidPublic.extend(internalFields).describe(OrganizationNominationInvalidPublic.description ?? "");
+const ArtifactsNotFound = ArtifactsNotFoundPublic.extend(internalFields).describe(ArtifactsNotFoundPublic.description ?? "");
+const ArtifactsForbidden = ArtifactsForbiddenPublic.extend(internalFields).describe(ArtifactsForbiddenPublic.description ?? "");
+const ArtifactsInvalidName = ArtifactsInvalidNamePublic.extend(internalFields).describe(ArtifactsInvalidNamePublic.description ?? "");
+const ArtifactsNameTaken = ArtifactsNameTakenPublic.extend(internalFields).describe(ArtifactsNameTakenPublic.description ?? "");
+const ArtifactsInvalidConfig = ArtifactsInvalidConfigPublic.extend(internalFields).describe(ArtifactsInvalidConfigPublic.description ?? "");
 const SupportNotFound = SupportNotFoundPublic.extend(internalFields).describe(SupportNotFoundPublic.description ?? "");
 const SupportInvalidCategory = SupportInvalidCategoryPublic.extend(internalFields).describe(SupportInvalidCategoryPublic.description ?? "");
 const SupportUnparseableMessage = SupportUnparseableMessagePublic.extend(internalFields).describe(SupportUnparseableMessagePublic.description ?? "");
@@ -1010,6 +1108,8 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	Forbidden,
 	AuthProviderUnavailable,
 	AuthSessionNotFresh,
+	AuthAccountSuspended,
+	AuthAccountDeleted,
 	NotFound,
 	Conflict,
 	RateLimit,
@@ -1039,12 +1139,17 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	TurnstileMissingToken,
 	TurnstileFailed,
 	TurnstileConfig,
+	TurnstileAnalyticsWindow,
+	TurnstileAnalyticsUnavailable,
 	AuditInvalidEvent,
 	AuditWriteFailed,
 	MediaNotFound,
+	MediaForbidden,
 	MediaUnsupported,
 	MediaStorageFailed,
 	MediaEnrichmentFailed,
+	MediaAnalyticsWindow,
+	MediaAnalyticsUnavailable,
 	LeaderboardBoardNotFound,
 	LeaderboardEntryNotFound,
 	LeaderboardScoreRejected,
@@ -1107,6 +1212,8 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	PaymentsEntitlementNotInCatalog,
 	PaymentsSubjectUnresolved,
 	PaymentsSubscriptionChangeRefused,
+	PaymentsOverrideStale,
+	PaymentsQuotaExceeded,
 	ControlPlaneNotConnected,
 	ControlPlaneInvalidCredential,
 	ControlPlaneInsufficientScope,
@@ -1119,6 +1226,11 @@ const KitErrorPayload = z.discriminatedUnion("code", [
 	OrganizationLastAdministrator,
 	OrganizationSlugTaken,
 	OrganizationNominationInvalid,
+	ArtifactsNotFound,
+	ArtifactsForbidden,
+	ArtifactsInvalidName,
+	ArtifactsNameTaken,
+	ArtifactsInvalidConfig,
 	SupportNotFound,
 	SupportInvalidCategory,
 	SupportUnparseableMessage,

package/dist/error/pithyError.d.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import type { z } from "zod";
 import type { MessageParams } from "../i18n/catalog";
+import type { UnmarkedString } from "../privacy/types";
 import type { ValidationIssue } from "./payload";
 import { ErrorPayload } from "./payload";
 /**
@@ -15,18 +16,28 @@ import { ErrorPayload } from "./payload";
  */
 export declare class PithyError extends Error {
     readonly payload: ErrorPayload;
-    constructor(payload: ErrorPayload, options?: {
+    /**
+     * `message`, `action` and `detail` are each an {@link UnmarkedString} here and on every subclass's arguments
+     * (#132): a value marked with a privacy class is refused at compile time, because all three ride into every log
+     * line and audit row that carries this error. A template literal is a plain `string`, so interpolation is not caught — see
+     * `privacy/types.ts` for exactly what is.
+     */
+    constructor(payload: ErrorPayload & {
+        message: UnmarkedString;
+        action?: UnmarkedString | undefined;
+        detail?: UnmarkedString | undefined;
+    }, options?: {
         cause?: unknown;
     });
 }
 /** Variable parts every subclass accepts; the `code`/`status` are fixed by the subclass. */
 interface ErrorArgs {
-    /** Override the public, safe-to-expose message. Defaults to a per-code summary. */
-    message?: string;
-    /** A remediation hint (CLI action line). */
-    action?: string;
-    /** Internal context for logs + audit. Never serialized to clients. */
-    detail?: string;
+    /** Override the public, safe-to-expose message. Defaults to a per-code summary. Never a privacy-marked value. */
+    message?: UnmarkedString;
+    /** A remediation hint (CLI action line). Never a privacy-marked value. */
+    action?: UnmarkedString;
+    /** Internal context for logs + audit. Never serialized to clients, and never a privacy-marked value (#132). */
+    detail?: UnmarkedString;
     /**
      * Values a translating client interpolates into its own wording for this code. Client-facing, so —
      * unlike `action` and `detail` — these cross the boundary with `message`. The `code` is the catalog

package/dist/error/pithyError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pithyError.d.ts","sourceRoot":"","sources":["../../src/error/pithyError.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B,YAAY,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAK/D;CACF;AAED,4FAA4F;AAC5F,UAAU,SAAS;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;KAAO,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAa/F;CACF;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YACE,IAAI,GAAE,SAAS,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,EAC5E,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAe9B;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;IAEhF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAErF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IAEjF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,sGAAsG;AACtG,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAEnF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,GAAE,SAAc,GAAG,eAAe,CAarF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGjD"}
+{"version":3,"file":"pithyError.d.ts","sourceRoot":"","sources":["../../src/error/pithyError.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B;;;;;OAKG;IACH,YACE,OAAO,EAAE,YAAY,GAAG;QACtB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;QACpC,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;KACrC,EACD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAM9B;CACF;AAED,4FAA4F;AAC5F,UAAU,SAAS;IACjB,iHAAiH;IACjH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,+GAA+G;IAC/G,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;KAAO,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAa/F;CACF;AAED;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAChD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YACE,IAAI,GAAE,SAAS,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,EAC5E,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAe9B;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,CAAC,CAAC;IAEtF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IACjD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;IAEhF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC;IAErF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IAE5E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;IAEjF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAE3E,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAC,CAAC;IAElF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED,sGAAsG;AACtG,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,SAAiB,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAEnF,YAAY,IAAI,GAAE,SAAc,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY9D;CACF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,GAAE,SAAc,GAAG,eAAe,CAarF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGjD"}

package/dist/error/pithyError.js

@@ -13,6 +13,12 @@ import { ErrorPayload } from "./payload.js";
 */
 var PithyError = class extends Error {
 	payload;
+	/**
+	* `message`, `action` and `detail` are each an {@link UnmarkedString} here and on every subclass's arguments
+	* (#132): a value marked with a privacy class is refused at compile time, because all three ride into every log
+	* line and audit row that carries this error. A template literal is a plain `string`, so interpolation is not caught — see
+	* `privacy/types.ts` for exactly what is.
+	*/
 	constructor(payload, options) {
 		const parsed = ErrorPayload.parse(payload);
 		super(parsed.message, options);

package/dist/http/authContext.d.ts

@@ -12,6 +12,13 @@ import { z } from "zod";
  * stored choice outrank their device's `Accept-Language`. That link read `c.var.locale` at first,
  * which nothing ever wrote, so it silently contributed nothing and the chain degraded to
  * `param → cookie → header → default` while the docs said otherwise.
+ *
+ * **`scopes` answers one question: did this request come from the adopter's own trusted backend, or from a
+ * device?** The name reads like a grant to the user, and it is not one. Tenancy roles went to `c.var.acting`
+ * with `@pithy-sh/organization`; management access is the control plane's, with its own credential and its
+ * own scope type. What is left is an attestation about the caller, which `@pithy-sh/auth`'s `resolveScopes`
+ * makes on every request from something the request proves — a service binding, a verified client
+ * certificate, a short-lived token bound to this origin — and never from anything it merely says (#560).
  */
 export declare const AuthContext: z.ZodObject<{
     userId: z.ZodString;

package/dist/http/authContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authContext.d.ts","sourceRoot":"","sources":["../../src/http/authContext.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;iBAeiE,CAAC;AAC1F,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"authContext.d.ts","sourceRoot":"","sources":["../../src/http/authContext.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW;;;;;;iBAoBiE,CAAC;AAC1F,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/http/authContext.js

@@ -14,11 +14,18 @@ import { z } from "zod";
 * stored choice outrank their device's `Accept-Language`. That link read `c.var.locale` at first,
 * which nothing ever wrote, so it silently contributed nothing and the chain degraded to
 * `param → cookie → header → default` while the docs said otherwise.
+*
+* **`scopes` answers one question: did this request come from the adopter's own trusted backend, or from a
+* device?** The name reads like a grant to the user, and it is not one. Tenancy roles went to `c.var.acting`
+* with `@pithy-sh/organization`; management access is the control plane's, with its own credential and its
+* own scope type. What is left is an attestation about the caller, which `@pithy-sh/auth`'s `resolveScopes`
+* makes on every request from something the request proves — a service binding, a verified client
+* certificate, a short-lived token bound to this origin — and never from anything it merely says (#560).
 */
 const AuthContext = z.object({
 	userId: z.string().describe("ID of the authenticated user (populated by @pithy-sh/auth)."),
 	sessionId: z.string().describe("ID of the active session this request belongs to."),
-	scopes: z.array(z.string()).default([]).describe("Permission scopes granted to this session."),
+	scopes: z.array(z.string()).default([]).describe("Attestations about the caller, not permissions granted to the user: what this request's caller was established to be — the adopter's own trusted backend, say — by the `resolveScopes` seam on `@pithy-sh/auth`, resolved per request and never cached. Empty when no resolver is configured. Tenancy roles are not here; they are `c.var.acting`."),
 	locale: Locale.nullish().describe("The reader's own stored language, from `pithy_auth_users.locale`; null or absent when they have never chosen."),
 	authenticatedAt: z.date().nullish().describe("When the holder of this session last actually authenticated — a sign-in, never a rotation, which carries the value forward unchanged. It rides here for the same reason `locale` does: the session lookup has already loaded the row, so a gate that needs it should not pay for a second read. Distinct from the session's own `createdAt`, which `/token/rotate` stamps fresh and is therefore resettable by anyone holding a stolen refresh token. Null or absent for a session written before the column existed, and for a Worker whose auth capability predates it.")
 }).describe("Per-request authenticated identity; the seam other capabilities depend on.");

package/dist/http/scopeGates.d.ts

@@ -0,0 +1,20 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { Hono } from "hono";
+import type { PithyHonoEnv, ScopeGate } from "../capability/capability";
+/**
+ * **A capability's scope gates, read off its own routes rather than listed beside them (#560).**
+ *
+ * `Capability.scopeGates` is what `pithy doctor` names when nothing composed fills `AuthContext.scopes`.
+ * A list written out by hand next to the routes is a second copy of something the routes already say: every
+ * gated route carries `describeRoute({ scopes })`, because that is how the OpenAPI contract learns it. So the
+ * registrar is run against a throwaway app and the specs are read back — the same walk `openApiDocument`
+ * makes over a composed app, and a route whose scope changes changes what this returns with it.
+ *
+ * **Only `bearer` and `session` routes.** Those are the strategies `requireAuth()` takes, so a scope on one
+ * is an `AuthContext` scope. A `control-plane` route also names scopes, and they are a different credential
+ * entirely — a signed management token with its own type, never `c.var.auth` — so naming one here would tell
+ * an adopter to configure a resolver that could never open it.
+ */
+export declare function scopeGatesOf(register: (app: Hono<PithyHonoEnv>) => void): ScopeGate[];
+//# sourceMappingURL=scopeGates.d.ts.map

package/dist/http/scopeGates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeGates.d.ts","sourceRoot":"","sources":["../../src/http/scopeGates.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGxE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,SAAS,EAAE,CAYrF"}

package/dist/http/scopeGates.js

@@ -0,0 +1,36 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { routeSpecOf } from "./routeSpec.js";
+import { Hono } from "hono";
+//#region src/http/scopeGates.ts
+/**
+* **A capability's scope gates, read off its own routes rather than listed beside them (#560).**
+*
+* `Capability.scopeGates` is what `pithy doctor` names when nothing composed fills `AuthContext.scopes`.
+* A list written out by hand next to the routes is a second copy of something the routes already say: every
+* gated route carries `describeRoute({ scopes })`, because that is how the OpenAPI contract learns it. So the
+* registrar is run against a throwaway app and the specs are read back — the same walk `openApiDocument`
+* makes over a composed app, and a route whose scope changes changes what this returns with it.
+*
+* **Only `bearer` and `session` routes.** Those are the strategies `requireAuth()` takes, so a scope on one
+* is an `AuthContext` scope. A `control-plane` route also names scopes, and they are a different credential
+* entirely — a signed management token with its own type, never `c.var.auth` — so naming one here would tell
+* an adopter to configure a resolver that could never open it.
+*/
+function scopeGatesOf(register) {
+	const app = new Hono();
+	register(app);
+	const gates = [];
+	for (const route of app.routes) {
+		const spec = routeSpecOf(route.handler);
+		if (!spec?.scopes || spec.scopes.length === 0) continue;
+		if (![spec.verification].flat().some((strategy) => strategy === "bearer" || strategy === "session")) continue;
+		for (const scope of spec.scopes) gates.push({
+			scope,
+			route: `${route.method} ${route.path}`
+		});
+	}
+	return gates;
+}
+//#endregion
+export { scopeGatesOf };

package/dist/index.d.ts

@@ -28,7 +28,7 @@ export { type AdminRouteDrift, missingAdminRoutes } from "./controlPlane/discove
 export { type CapabilityHealth, type CapabilityHealthInput, type CapabilityHealthSource, capabilityHealthSources, defineCapabilityHealth, readCapabilityHealth, } from "./controlPlane/discovery/health";
 export { CapabilityHealthReport, type CapabilityHealthWire, HealthCountNominal, HealthNominal, type HealthStanding, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, healthAttention, healthReport, healthWire, type NamedHealthValue, namedHealthValues, standingOf, } from "./controlPlane/discovery/healthSummary";
 export { requireControlPlane } from "./controlPlane/http/guard";
-export { ANY_VERIFIED_CALLER, type ControlPlaneRequirement, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, SEAM_SCOPES, } from "./controlPlane/scope/scope";
+export { ANY_VERIFIED_CALLER, type ControlPlaneRequirement, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES, } from "./controlPlane/scope/scope";
 export { exportPublicJwk, type MintControlPlaneToken, mintControlPlaneToken } from "./controlPlane/token/mint";
 export { CONTROL_PLANE_HEADER, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, type WorkerBuild, workerBuildChanged, } from "./controlPlane/wire";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,YAAY,EACZ,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,EACL,+BAA+B,EAC/B,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,KAAK,eAAe,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAQ1F,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,aAAa,EACb,KAAK,cAAc,EACnB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,UAAU,GACX,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAI/G,OAAO,EACL,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACtG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,YAAY,EACZ,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACzG,OAAO,EACL,+BAA+B,EAC/B,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,KAAK,eAAe,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAQ1F,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,aAAa,EACb,KAAK,cAAc,EACnB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,UAAU,GACX,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAI/G,OAAO,EACL,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, SEAM_SCOPES } from "./controlPlane/scope/scope.js";
+import { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES } from "./controlPlane/scope/scope.js";
 import { ControlPlaneConfig } from "./controlPlane/config/config.js";
 import { ControlPlaneConnection, Ed25519PublicJwk, RegisteredKey } from "./controlPlane/data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE, controlPlaneDatabase } from "./controlPlane/data/tables.js";
@@ -16,4 +16,4 @@ import { CONTROL_PLANE_KV_BINDING } from "./controlPlane/replay/kvGuard.js";
 import { CONTROLPLANE_MIGRATION_ORDER, controlplane, isControlPlaneCapability } from "./controlPlane/capability.js";
 import { missingAdminRoutes } from "./controlPlane/discovery/drift.js";
 import { exportPublicJwk, mintControlPlaneToken } from "./controlPlane/token/mint.js";
-export { ANY_VERIFIED_CALLER, AdminRoute, CONTROLPLANE_MIGRATION_ORDER, CONTROL_PLANE_CONNECTIONS_TABLE, CONTROL_PLANE_HEADER, CONTROL_PLANE_KV_BINDING, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, CapabilityDeclaration, CapabilityDescriptor, CapabilityHealthReport, ControlPlaneAuditActions, ControlPlaneConfig, ControlPlaneConnection, ControlPlaneContext, ControlPlaneManifest, ControlPlaneScope, Ed25519PublicJwk, HealthCountNominal, HealthNominal, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, ManifestConfigKey, ManifestConfigValue, ManifestConfigValues, RegisteredKey, SEAM_SCOPES, capabilityHealthSources, controlPlaneDatabase, controlplane, defineCapabilityHealth, defineManifestConfig, exportPublicJwk, healthAttention, healthReport, healthWire, isControlPlaneCapability, mintControlPlaneToken, missingAdminRoutes, namedConfigValues, namedHealthValues, readCapabilityHealth, requireControlPlane, standingOf, workerBuildChanged };
+export { ANY_VERIFIED_CALLER, AdminRoute, CONTROLPLANE_MIGRATION_ORDER, CONTROL_PLANE_CONNECTIONS_TABLE, CONTROL_PLANE_HEADER, CONTROL_PLANE_KV_BINDING, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, CapabilityDeclaration, CapabilityDescriptor, CapabilityHealthReport, ControlPlaneAuditActions, ControlPlaneConfig, ControlPlaneConnection, ControlPlaneContext, ControlPlaneManifest, ControlPlaneScope, Ed25519PublicJwk, HealthCountNominal, HealthNominal, HealthSummary, HealthSummaryKey, HealthSummaryValue, HealthValueCost, HealthValueKind, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, ManifestConfigKey, ManifestConfigValue, ManifestConfigValues, PRIVACY_READ_SCOPE, RegisteredKey, SEAM_SCOPES, capabilityHealthSources, controlPlaneDatabase, controlplane, defineCapabilityHealth, defineManifestConfig, exportPublicJwk, healthAttention, healthReport, healthWire, isControlPlaneCapability, mintControlPlaneToken, missingAdminRoutes, namedConfigValues, namedHealthValues, readCapabilityHealth, requireControlPlane, standingOf, workerBuildChanged };

package/dist/logger/logger.d.ts

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import type { Loggable, UnmarkedString } from "../privacy/types";
 import { type LogFields, type LogLevel, type LogRecord } from "./record";
 /**
  * The `Logger` seam. Four levels, each taking a message plus **structured fields** (not a formatted
@@ -11,22 +12,28 @@ import { type LogFields, type LogLevel, type LogRecord } from "./record";
  * The reserved `error` field on any call may carry a `PithyError` or `ErrorPayload` — the engine lifts
  * it into the record's `error`, `detail` and all. A log is internal; this is the inverse of the HTTP
  * codec, which strips `detail`. The logger must never be wired to a client-facing surface.
+ *
+ * **A value marked with a privacy class does not compile here** (#132). Every method takes `F & Loggable<F>`,
+ * so a field holding a `pii()`/`phi()`/`secret()`/`pci()` value — the value itself, or one inside an object or
+ * an array, to the depth `privacy/types.ts` states — is refused at that key, and `redact(Schema, value)` is the
+ * way through. The message and a child's name take `UnmarkedString`, so `log.info(user.email)` is refused too. `LogFields` the schema stays permissive: a record that reaches a sink at runtime still parses,
+ * because a brand is a type and a parsed log line has none.
  */
 export interface Logger {
     /** Dev-time diagnostics. Dropped unless the logger's level is `debug`. */
-    debug(msg: string, fields?: LogFields): void;
+    debug<F extends LogFields = LogFields>(msg: UnmarkedString, fields?: F & Loggable<F>): void;
     /** Normal operational events. */
-    info(msg: string, fields?: LogFields): void;
+    info<F extends LogFields = LogFields>(msg: UnmarkedString, fields?: F & Loggable<F>): void;
     /** A recoverable problem worth attention. */
-    warn(msg: string, fields?: LogFields): void;
+    warn<F extends LogFields = LogFields>(msg: UnmarkedString, fields?: F & Loggable<F>): void;
     /** A failure that was observed. Pass `{ error }` (a PithyError) to carry its full payload. */
-    error(msg: string, fields?: LogFields): void;
+    error<F extends LogFields = LogFields>(msg: UnmarkedString, fields?: F & Loggable<F>): void;
     /**
      * A namespaced sub-logger. `name` composes as `parent:child`; bound `fields` merge into every record
      * the child emits. Omit `name` (pass `undefined`) to bind fields only — how request-correlation
      * attaches `request`/`method`/`path` without renaming the logger.
      */
-    child(name?: string, fields?: LogFields): Logger;
+    child<F extends LogFields = LogFields>(name?: UnmarkedString, fields?: F & Loggable<F>): Logger;
 }
 /** A sink receives a finished {@link LogRecord}. Adapters supply one; the engine builds records and calls it. */
 export type LogSink = (record: LogRecord) => void;

package/dist/logger/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logger/logger.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,MAAM;IACrB,0EAA0E;IAC1E,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7C,iCAAiC;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5C,6CAA6C;IAC7C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5C,8FAA8F;IAC9F,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7C;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClD;AAED,iHAAiH;AACjH,MAAM,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;AAElD,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,KAAK,EAAE,QAAQ,CAAC;IAChB,iCAAiC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAoED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAQjE;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,MAMxB,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logger/logger.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,MAAM;IACrB,0EAA0E;IAC1E,KAAK,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5F,iCAAiC;IACjC,IAAI,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3F,6CAA6C;IAC7C,IAAI,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3F,8FAA8F;IAC9F,KAAK,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5F;;;;OAIG;IACH,KAAK,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;CACjG;AAED,iHAAiH;AACjH,MAAM,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;AAElD,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,KAAK,EAAE,QAAQ,CAAC;IAChB,iCAAiC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAoED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAQjE;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,MAMxB,CAAC"}