@pithy-sh/core 0.10.0 → 0.12.0

package/dist/controlPlane/data/connection.js

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ControlPlaneScope } from "../scope/scope.js";
 import { JsonDate, SQLiteDate, sqliteJson } from "../../data/codecs.js";
+import { ControlPlaneScope } from "../scope/scope.js";
 import { z } from "zod";
 //#region src/controlPlane/data/connection.ts
 /**
@@ -35,6 +35,57 @@ const RegisteredKey = z.object({
 	revokedAt: JsonDate.nullable().describe("When this key was revoked outright, or null. Revocation ignores `validUntil` and takes effect immediately — it is the adopter's unilateral control, and it must not wait for a window to close.")
 }).describe("One registered public key with its validity window. Two live at once during a rotation overlap.");
 /**
+* What kind of client a connection is for (#721): `agent`, `dashboard` or `script`.
+*
+* The audit trail's `actorType: "control-plane"` names all three identically, and the questions asked
+* after an incident are exactly the ones that tell them apart — was it a person at the dashboard, a
+* script somebody wrote, or an agent running unattended. So the kind is recorded on the connection when
+* it is registered and stamped from there onto every row its calls write.
+*
+* It follows the path, never a guess: the device-code flow is a dashboard, always, and a key the
+* operator registered themselves is whichever of the other two they say, out loud, with `--kind`.
+*/
+const ControlPlaneActorKind = z.enum([
+	"agent",
+	"dashboard",
+	"script"
+]).describe("What kind of client a connection is for: `agent` (an automated client acting on its own judgment, often unattended), `dashboard` (a management dashboard a person drives, registered through the device-code flow), or `script` (an operator's own automation, doing one fixed thing).");
+/**
+* Who sanctioned a connection: the email address of the signed-in Cloudflare session that registered it.
+*
+* **A plain string, deliberately not a reference.** An adopter's `pithy_auth_users` are their customers,
+* and the operator who registers a connection is their staff, so a join into the organization model would
+* be empty for most of them. A string is readable by anybody, and matchable against a directory where the
+* operator is in one.
+*
+* **Derived, never asserted.** No flag supplies it; the CLI reads it from `GET /user` under the session.
+*/
+const ConnectionPrincipal = z.email().max(254).describe("The email address of the person who sanctioned this connection, read from their signed-in Cloudflare session at registration. Never typed, so never asserted.");
+/** The longest purpose a connection may carry. One line on a review screen, with room to say what it does. */
+const MAX_CONNECTION_PURPOSE = 200;
+/**
+* Characters a purpose may not carry: every C0 and C1 control (so no terminal escape, no newline and no
+* carriage return), the Unicode line and paragraph separators, every `Bidi_Control` character — the
+* embeddings, overrides and isolates, and the LRM, RLM and ALM marks — that lets text render in a
+* different order from the one it is stored in, and the invisible zero-width space, word joiner and
+* byte-order mark that split a word without showing it. The zero-width joiner and non-joiner stay: Persian
+* and the Indic scripts cannot be written without them.
+*
+* Each of those is a way for a sentence to look like something else once it reaches a renderer: a line
+* in `pithy dashboard status` forged beneath the real one, a screen cleared, a scope name read backwards.
+* Escaping them at every renderer is a promise each renderer has to keep. Refusing them at the boundary
+* is one promise, kept here.
+*/
+const UNRENDERABLE = /[\p{Cc}\p{Bidi_Control}\u2028\u2029\u200B\u2060\uFEFF]/u;
+/**
+* What a connection is for, in the words of whoever registered it (#721).
+*
+* **Required at registration, and refused when absent**, because a review listing credentials by key id
+* cannot support the decision it exists for. **Untrusted input**: a customer writes it and something else
+* renders it, so it is validated on the way in, and again on every read of the row.
+*/
+const ConnectionPurpose = z.string().trim().min(1, "Say what this client is for.").max(200, `A purpose is 200 characters at most.`).refine((purpose) => !UNRENDERABLE.test(purpose), "A purpose is one line of plain text: no control, bidi or invisible characters.").describe(`What this connection's client is for, in the registering operator's words — one line of plain text, 200 characters at most, with no control, bidi or invisible characters. Written by a customer and rendered elsewhere, so validated at the boundary.`);
+/**
 * One management-client connection — the row in `pithy_controlplane_connections`.
 *
 * Keys are a versioned JSON column rather than a child table for two reasons. **Rotation becomes one
@@ -49,10 +100,13 @@ const ControlPlaneConnection = z.object({
 	workerUrl: z.url().describe("This environment's deployed Worker URL, captured at connect. The address the management client calls; re-pointed by `pithy dashboard connect --update` when a custom domain or a rename moves it."),
 	basePath: z.string().min(1).default("/control-plane").describe("Where this Worker mounts the control-plane seam, captured at connect from its resolved config. Stored beside `workerUrl` because the two together fully determine the manifest address — and this is the one part of it a client cannot discover, since it *is* the manifest's own address. Defaulted rather than required so a connection registered before the column existed still parses, reading as the default it was necessarily using."),
 	managementOrigin: z.url().nullable().default(null).describe("Where the management client that registered this connection answers — the origin the CLI calls for a verify, a rotation or a disconnect. Stored because it is not derivable: `issuer` is what that client *signs as*, and nothing says a dashboard's API answers at its own `iss`. Null for a connection registered before this column, which reads as the issuer rather than as the hosted dashboard — an older row is still a row about somebody's own deployment. Nothing on the Worker's side reads it; verification cares about `issuer` alone."),
+	authorizedBy: ConnectionPrincipal.nullable().default(null).describe("Who sanctioned this connection: the email of the signed-in Cloudflare session that registered it, never a flag. Null for a connection registered before principals were recorded (#721), which keeps working and reads as exactly that; registering again is the only way to set it."),
+	actorKind: ControlPlaneActorKind.nullable().default(null).describe("What kind of client this connection is for — `agent`, `dashboard` or `script` — stamped onto every audit row its calls write so the trail can tell them apart. Null for a connection registered before it was recorded."),
+	purpose: ConnectionPurpose.nullable().default(null).describe("What this connection's client is for, in the registering operator's words. Required at registration and editable with `pithy dashboard connect --update --purpose`; null only for a connection registered before it was recorded."),
 	scopes: sqliteJson(z.array(ControlPlaneScope)).describe("The operations this connection was granted, stored and enforced on the adopter's side. Enforced only by the caller, a scope would not be a limit at all."),
 	keys: sqliteJson(z.array(RegisteredKey)).describe("Every key this connection may sign with, current and superseded. One JSON column rather than a child table, so a rotation is one atomic UPDATE and verification is one read."),
 	createdAt: SQLiteDate.describe("When the connection was registered. Ms-epoch in SQLite, a Date in TypeScript."),
 	updatedAt: SQLiteDate.describe("When the row last changed — a key registered or expired, or the Worker URL re-pointed.")
 }).describe("One management-client connection: its identity, the environment and URL it is bound to, the operations it was granted, and its versioned public keys.");
 //#endregion
-export { ControlPlaneConnection, Ed25519PublicJwk, RegisteredKey };
+export { ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, ControlPlaneConnection, Ed25519PublicJwk, MAX_CONNECTION_PURPOSE, RegisteredKey };

package/dist/controlPlane/discovery/adminRoute.d.ts

@@ -218,6 +218,35 @@ export declare const ControlPlaneManifest: z.ZodObject<{
     environment: z.ZodString;
     connectionId: z.ZodString;
     version: z.ZodNullable<z.ZodString>;
+    versionCreatedAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    privacy: z.ZodOptional<z.ZodObject<{
+        declared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        observed: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        counts: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        observedNotDeclared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        declaredNotObserved: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        consoleGate: z.ZodEnum<{
+            enforced: "enforced";
+            not_required: "not_required";
+            unattested: "unattested";
+            unverifiable: "unverifiable";
+        }>;
+        consoleGateReason: z.ZodNullable<z.ZodString>;
+        attestedAt: z.ZodNullable<z.ZodISODateTime>;
+        sources: z.ZodArray<z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>>;
+        retirement: z.ZodOptional<z.ZodObject<{
+            blocked: z.ZodBoolean;
+            reasons: z.ZodArray<z.ZodEnum<{
+                "incomplete-coverage": "incomplete-coverage";
+                stale: "stale";
+                unrotatable: "unrotatable";
+            }>>;
+            liveVersions: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     capabilities: z.ZodArray<z.ZodCodec<z.ZodObject<{
         name: z.ZodString;
         version: z.ZodNullable<z.ZodString>;

package/dist/controlPlane/discovery/adminRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminRoute.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/discovery/adminRoute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;GAiBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;EAE8B,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;;;;;;;;;iBAmBpB,CAAC;AACJ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqD/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAiD1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBkE,CAAC;AACpG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"adminRoute.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/discovery/adminRoute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;;;;;;;;GAiBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;EAE8B,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;;;;;;;;;iBAmBpB,CAAC;AACJ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqD/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAiD1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCkE,CAAC;AACpG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/controlPlane/discovery/adminRoute.js

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { ControlPlaneScope } from "../scope/scope.js";
 import { CapabilityHealthReport, HealthSummary, HealthSummaryKey, healthReport, healthWire } from "./healthSummary.js";
+import { PrivacyPosture } from "../../privacy/posture.js";
 import { ManifestConfigKey, ManifestConfigValues } from "./configuration.js";
 import { z } from "zod";
 //#region src/controlPlane/discovery/adminRoute.ts
@@ -138,6 +139,8 @@ const ControlPlaneManifest = z.object({
 	environment: z.string().describe("The environment this connection is bound to, echoed so a client can label what it is looking at."),
 	connectionId: z.string().describe("The connection this call authenticated as."),
 	version: z.string().nullable().describe("The Cloudflare version id of the build answering this call, from the `CF_VERSION_METADATA` binding, or null where the binding is absent. Opaque and per-deploy: it identifies which build is running, never which features it has. Null is honest — a Worker scaffolded before the binding was declared genuinely cannot say."),
+	versionCreatedAt: z.iso.datetime().nullable().optional().describe("When the version answering this call was uploaded, ISO-8601, from the same `CF_VERSION_METADATA` binding as `version` — or null where the binding is absent. The id alone cannot tell a deploy from a rollback: a rollback reactivates an existing version, so the id returns to one already seen while this moves backwards. Relayed, never interpreted. Absent from a Worker older than #132."),
+	privacy: PrivacyPosture.optional().describe("What this project declares about privacy and what its running code holds: classes and counts, never field names (`GET /control-plane/privacy` has those, behind `privacy:read`). Present on every Worker from #132, `declared` explicitly empty when nothing was declared; absent from an older Worker."),
 	capabilities: z.array(CapabilityDescriptor).describe("Every capability composed into this Worker, in composition order with the adopter's own app last. A capability absent here has no data to show, which is a fact the client discovers rather than a setting anybody maintains."),
 	grantedScopes: z.array(ControlPlaneScope).describe("Every scope this connection holds. Together with each route's own `scope`, this is what tells a client which operations to offer and which to hide.")
 }).describe("What this Worker is, what it composes, and how to call the admin surface it exposes.");

package/dist/controlPlane/error/errors.d.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { PithyError } from "../../error/pithyError";
 import type { MessageParams } from "../../i18n/catalog";
+import type { UnmarkedString } from "../../privacy/types";
 /**
  * The `control-plane` strategy's throw sugar. The `controlplane/*` codes live in core's closed
  * `KitErrorPayload` union (CLAUDE.md §Errors); these subclasses are the vehicles that set one.
@@ -16,9 +17,9 @@ import type { MessageParams } from "../../i18n/catalog";
  * the response into an oracle that tells an attacker exactly how far they got.
  */
 interface ControlPlaneErrorArgs {
-    message?: string;
-    action?: string;
-    detail?: string;
+    message?: UnmarkedString;
+    action?: UnmarkedString;
+    detail?: UnmarkedString;
     /**
      * Values a translating client interpolates into its own wording for this code. Client-facing, so —
      * unlike `action` and `detail` — these cross the boundary with `message`.

package/dist/controlPlane/error/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/error/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;;GAYG;AAEH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,UAAU;IAC3D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,sEAAsE;AACtE,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,0DAA0D;AAC1D,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/error/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AAEH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,UAAU;IAC3D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,sEAAsE;AACtE,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,0DAA0D;AAC1D,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF"}

package/dist/controlPlane/http/cors.d.ts

@@ -93,10 +93,10 @@ export declare function corsMiddleware(entry: CorsSurfaceEntry, origins: Readonl
 /**
  * Mount one `app.use(path, …)` per entry.
  *
- * **Called from the capability's `middleware` hook, never its `routes` hook, and that is load-bearing.**
- * `createBackend` runs every capability's `middleware` hook before **any** capability's `routes` hook
- * (`createBackend.ts:262-267`), which is what makes this independent of the order an adopter happens to
- * list their capabilities in.
+ * **Called from `createBackend` ahead of every capability's `middleware`, never from a `routes` hook,
+ * and that is load-bearing.** Registered there, it is independent of the order an adopter happens to
+ * list their capabilities in, and it can put a header on whatever a capability's middleware or a
+ * readiness guard short-circuits.
  *
  * From `routes` it looks like it works and does not. The preflight still answers — an `OPTIONS` has no
  * route handler to lose to, so this `use` is the only thing that matches it — but a capability composed

package/dist/controlPlane/http/cors.js

@@ -170,10 +170,10 @@ function corsMiddleware(entry, origins, maxAgeSeconds) {
 /**
 * Mount one `app.use(path, …)` per entry.
 *
-* **Called from the capability's `middleware` hook, never its `routes` hook, and that is load-bearing.**
-* `createBackend` runs every capability's `middleware` hook before **any** capability's `routes` hook
-* (`createBackend.ts:262-267`), which is what makes this independent of the order an adopter happens to
-* list their capabilities in.
+* **Called from `createBackend` ahead of every capability's `middleware`, never from a `routes` hook,
+* and that is load-bearing.** Registered there, it is independent of the order an adopter happens to
+* list their capabilities in, and it can put a header on whatever a capability's middleware or a
+* readiness guard short-circuits.
 *
 * From `routes` it looks like it works and does not. The preflight still answers — an `OPTIONS` has no
 * route handler to lose to, so this `use` is the only thing that matches it — but a capability composed

package/dist/controlPlane/http/guard.d.ts

@@ -1,8 +1,10 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import type { MiddlewareHandler } from "hono";
+import type { AuditEmit } from "../../audit/recorder";
 import type { PithyHonoEnv } from "../../capability/capability";
 import type { ControlPlaneContext } from "../context";
+import type { ControlPlaneActorKind } from "../data/connection";
 import type { ControlPlaneRequirement } from "../scope/scope";
 import { type ControlPlaneVerifyDeps } from "./verify";
 /**
@@ -76,4 +78,13 @@ export declare const CONTROL_PLANE_GUARD: unique symbol;
 /** Whether a mounted handler is a control-plane gate. */
 export declare function isControlPlaneGuard(handler: unknown): boolean;
 export declare function requireControlPlane(requirement: ControlPlaneRequirement): MiddlewareHandler<PithyHonoEnv>;
+/**
+ * The recorder a verified call's handlers write through: the request's own, with the connection's actor
+ * kind added to every `control-plane` event that does not already carry one.
+ *
+ * Only `control-plane` events, because the kind describes a management client and nothing else — a
+ * handler recording what happened to a user is recording a user. An event that states a kind keeps it.
+ * A connection with no recorded kind adds nothing, so its rows read exactly as they did before.
+ */
+export declare function stampActorKind(emit: AuditEmit, actorKind: ControlPlaneActorKind | null): AuditEmit;
 //# sourceMappingURL=guard.d.ts.map

package/dist/controlPlane/http/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,KAAK,sBAAsB,EAA0B,MAAM,UAAU,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,uBAAuB,KACjC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAElC;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,sBAAsB,GAAG,oBAAoB,CAgB7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzE;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,eAAwC,CAAC;AAEzE,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAkEzG"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,KAAK,sBAAsB,EAA0B,MAAM,UAAU,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,uBAAuB,KACjC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAElC;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,sBAAsB,GAAG,oBAAoB,CAgB7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzE;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,eAAwC,CAAC;AAEzE,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAuEzG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAIlG"}

package/dist/controlPlane/http/guard.js

@@ -85,6 +85,7 @@ function requireControlPlane(requirement) {
 			throw cause;
 		}
 		c.set("controlPlane", context);
+		c.set("emit", stampActorKind(c.var.emit, context.actorKind));
 		await safeEmit(c.var.emit, {
 			action: ControlPlaneAuditActions.callAllowed,
 			outcome: "success",
@@ -110,6 +111,21 @@ function requireControlPlane(requirement) {
 	return guard;
 }
 /**
+* The recorder a verified call's handlers write through: the request's own, with the connection's actor
+* kind added to every `control-plane` event that does not already carry one.
+*
+* Only `control-plane` events, because the kind describes a management client and nothing else — a
+* handler recording what happened to a user is recording a user. An event that states a kind keeps it.
+* A connection with no recorded kind adds nothing, so its rows read exactly as they did before.
+*/
+function stampActorKind(emit, actorKind) {
+	if (actorKind === null) return emit;
+	return (event) => emit(event.actorType === "control-plane" && event.actorKind == null ? {
+		...event,
+		actorKind
+	} : event);
+}
+/**
 * Record a refused call.
 *
 * **Denials are audited, not only successes.** `denied` is a first-class outcome precisely for this, and
@@ -151,4 +167,4 @@ function connectStep(env) {
 	return remedy("dashboard connect", { flags: { "--env": env } }, { runtime: true }).say((command) => `run ${command}`);
 }
 //#endregion
-export { CONTROL_PLANE_GUARD, createControlPlaneVerifier, isControlPlaneGuard, requireControlPlane, workerVersionHeaders };
+export { CONTROL_PLANE_GUARD, createControlPlaneVerifier, isControlPlaneGuard, requireControlPlane, stampActorKind, workerVersionHeaders };

package/dist/controlPlane/http/handlers.d.ts

@@ -2,10 +2,13 @@
 // SPDX-License-Identifier: MIT
 import type { Context } from "hono";
 import type { PithyHonoEnv } from "../../capability/capability";
+import type { PrivacyInventory } from "../../privacy/report";
+import type { RetirementVerdict } from "../../privacy/retirement";
 import type { ControlPlaneConfig } from "../config/config";
 import { type ControlPlaneDatabase } from "../data/tables";
 import type { CapabilityDeclaration } from "../discovery/adminRoute";
 import { type CapabilityHealthSource } from "../discovery/health";
+import { type ComposedMigrationDatabase } from "../migrationState/migrationState";
 import type { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas";
 /** The pieces of the composed capability a handler needs. Passed in, so nothing reaches for a global. */
 export interface ControlPlaneHandlerDeps {
@@ -31,6 +34,21 @@ export interface ControlPlaneHandlerDeps {
      * value is not: the numbers are resolved per request, behind the scope each one is declared under.
      */
     composedHealth: () => ReadonlyMap<string, CapabilityHealthSource>;
+    /**
+     * Every database this Worker binds, with the provider this build composes for it — captured by the same
+     * `compose` hook through `collectMigrationSets`, the function `pithy migrate` composes with (#729).
+     */
+    composedMigrations: () => readonly ComposedMigrationDatabase[];
+    /**
+     * The privacy inventory of every storage schema this Worker composed (#132), walked on the first call and
+     * cached for the isolate. A thunk, so a Worker whose control plane is never called never walks.
+     */
+    privacyInventory: () => PrivacyInventory;
+    /**
+     * The field key's retirement verdict (#390): the guard over this Worker's encrypted columns, read through its own
+     * bindings. Never throws: whatever it cannot read is incomplete coverage.
+     */
+    retirement: (env: Record<string, unknown>) => Promise<RetirementVerdict>;
     /** The clock, injected so a test can stand at any instant. */
     now: () => Date;
 }
@@ -73,6 +91,25 @@ export declare function manifestHandler(deps: ControlPlaneHandlerDeps): (c: Cont
     environment: string;
     connectionId: string;
     version: string | null;
+    versionCreatedAt: string | null;
+    privacy: {
+        declared: string[] | null;
+        observed: string[] | null;
+        counts: {
+            [x: string]: number;
+        } | null;
+        observedNotDeclared: string[] | null;
+        declaredNotObserved: string[] | null;
+        consoleGate: "enforced" | "not_required" | "unattested" | "unverifiable";
+        consoleGateReason: string | null;
+        attestedAt: string | null;
+        sources: ("d1" | "kv")[];
+        retirement: {
+            blocked: boolean;
+            reasons: ("incomplete-coverage" | "stale" | "unrotatable")[];
+            liveVersions: number;
+        };
+    };
     capabilities: {
         health: import("../..").HealthSummary | null;
         healthUnavailable: boolean;
@@ -108,6 +145,57 @@ export declare function manifestHandler(deps: ControlPlaneHandlerDeps): (c: Cont
     }[];
     grantedScopes: string[];
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/**
+ * `GET /control-plane/migrations` — where each database this Worker binds stands (#729).
+ *
+ * Read-only: it reports, and nothing over the seam runs, reverses or resets a migration.
+ *
+ * **One unreadable ledger costs one database its answer.** Each read catches its own failure and lands on
+ * `unreadable`, so `Promise.all` still resolves and the route answers 200 with what it has. The cause is
+ * logged here, for the operator, and never projected: a D1 error can name a table or a query.
+ */
+export declare function migrationsHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>) => Promise<Response & import("hono").TypedResponse<{
+    environment: string;
+    databases: ({
+        state: "readable";
+        database: string;
+        binding: string;
+        applied: {
+            name: string;
+            namespace: string | null;
+        }[];
+        pending: {
+            name: string;
+            namespace: string | null;
+        }[];
+        undeclared: {
+            name: string;
+            namespace: string | null;
+        }[];
+        lastGroup: {
+            group: string;
+            appliedAt: string;
+            migrations: {
+                name: string;
+                namespace: string | null;
+            }[];
+            position: {
+                state: "top";
+            } | {
+                state: "buried";
+                above: string[];
+                ungrouped: {
+                    name: string;
+                    namespace: string | null;
+                }[];
+            };
+        } | null;
+    } | {
+        state: "unreadable";
+        database: string;
+        binding: string;
+    })[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 /** `GET /control-plane/keys` — the registration state, so a client can surface a stale key. */
 export declare function listKeysHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>) => Promise<Response & import("hono").TypedResponse<{
     connectionId: string;
@@ -123,6 +211,9 @@ export declare function listKeysHandler(deps: ControlPlaneHandlerDeps): (c: Cont
         validUntil: string | null;
         revokedAt: string | null;
     }[];
+    authorizedBy: string | null;
+    actorKind: "agent" | "dashboard" | "script" | null;
+    purpose: string | null;
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 /**
  * `POST /control-plane/keys` — register a new public key, authenticated by the key it succeeds.
@@ -179,4 +270,52 @@ export declare function expireKeyHandler(deps: ControlPlaneHandlerDeps): (c: Con
         revokedAt: string | null;
     }[];
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/**
+ * `GET /control-plane/privacy` — the full privacy inventory (#132).
+ *
+ * Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
+ * is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
+ * between. Behind `privacy:read`, because field names are the kind of thing an adopter may withhold from a client
+ * that has no business seeing them. Read-only.
+ */
+export declare function privacyHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>) => Promise<Response & import("hono").TypedResponse<{
+    environment: string;
+    posture: {
+        declared: string[] | null;
+        observed: string[] | null;
+        counts: {
+            [x: string]: number;
+        } | null;
+        observedNotDeclared: string[] | null;
+        declaredNotObserved: string[] | null;
+        consoleGate: "enforced" | "not_required" | "unattested" | "unverifiable";
+        consoleGateReason: string | null;
+        attestedAt: string | null;
+        sources: ("d1" | "kv")[];
+        retirement: {
+            blocked: boolean;
+            reasons: ("incomplete-coverage" | "stale" | "unrotatable")[];
+            liveVersions: number;
+        };
+    };
+    schemasWalked: number;
+    schemas: {
+        capability: string;
+        storage: import("../../privacy/report").PrivacySource;
+        container: string;
+        name: string;
+        fields: {
+            path: string;
+            class: string;
+            truncated?: true;
+            sameAs?: string;
+            encryptedAtRest?: boolean;
+            unrotatable?: true;
+        }[];
+        encrypted: {
+            path: string;
+            unrotatable?: true;
+        }[];
+    }[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/controlPlane/http/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,sBAAsB,EAAwB,MAAM,qBAAqB,CAAC;AAUxF,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAuBvF,yGAAyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,oBAAoB,CAAC;IAC7D;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAClE,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAgED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;kEAUjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAyBvC;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;mEASvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,QAAQ,kBAAkB;;;;;;;;;;;;;;iBAoDjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,UAAU,eAAe,QAAQ,gBAAgB;;;;;;;;;;;;;;mEA8CxF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,sBAAsB,EAAwB,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,KAAK,yBAAyB,EAA0B,MAAM,kCAAkC,CAAC;AAU1G,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAuBvF,yGAAyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,oBAAoB,CAAC;IAC7D;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAClE;;;OAGG;IACH,kBAAkB,EAAE,MAAM,SAAS,yBAAyB,EAAE,CAAC;IAC/D;;;OAGG;IACH,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;IACzC;;;OAGG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAgED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;kEAUjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAoCvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAgBvC;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;mEAcvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,QAAQ,kBAAkB;;;;;;;;;;;;;;iBAoDjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,UAAU,eAAe,QAAQ,gBAAgB;;;;;;;;;;;;;;mEA8CxF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,uBAAuB,OACzC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAiBvC"}

package/dist/controlPlane/http/handlers.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { workerVersion } from "../../worker/identity.js";
+import { workerVersionMetadata } from "../../worker/identity.js";
 import { ControlPlaneConnection } from "../data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE } from "../data/tables.js";
 import { healthWire } from "../discovery/healthSummary.js";
@@ -8,6 +8,9 @@ import { readCapabilityHealth } from "../discovery/health.js";
 import { ControlPlaneAuditActions, safeEmit } from "../audit/actions.js";
 import { ControlPlaneInvalidCredentialError, ControlPlaneKeyConflictError } from "../error/errors.js";
 import { appendKey, expireKey, pruneKeys } from "../data/keyLifecycle.js";
+import { privacyAttestation, privacyPosture } from "../../privacy/posture.js";
+import { causeMessage } from "../../error/cause.js";
+import { readDatabaseMigrations } from "../migrationState/migrationState.js";
 //#region src/controlPlane/http/handlers.ts
 /**
 * The seam's own route handlers.
@@ -112,15 +115,45 @@ function manifestHandler(deps) {
 			...declaration,
 			...healthWire(await readCapabilityHealth(sources.get(declaration.name), context.grantedScopes, (source) => source.read(c)))
 		})));
+		const build = workerVersionMetadata(c.env);
 		return c.json({
 			environment: context.environment,
 			connectionId: context.connectionId,
-			version: workerVersion(c.env),
+			version: build.id,
+			versionCreatedAt: build.createdAt,
+			privacy: {
+				...privacyPosture(privacyAttestation(c.env), deps.privacyInventory),
+				retirement: await deps.retirement(c.env)
+			},
 			capabilities,
 			grantedScopes: [...context.grantedScopes]
 		});
 	};
 }
+/**
+* `GET /control-plane/migrations` — where each database this Worker binds stands (#729).
+*
+* Read-only: it reports, and nothing over the seam runs, reverses or resets a migration.
+*
+* **One unreadable ledger costs one database its answer.** Each read catches its own failure and lands on
+* `unreadable`, so `Promise.all` still resolves and the route answers 200 with what it has. The cause is
+* logged here, for the operator, and never projected: a D1 error can name a table or a query.
+*/
+function migrationsHandler(deps) {
+	return async (c) => {
+		const context = caller(c);
+		const env = c.env;
+		const databases = await Promise.all(deps.composedMigrations().map((entry) => readDatabaseMigrations(env, entry, (failed, cause) => c.var.log.warn("migration ledger unreadable", {
+			database: failed.database,
+			binding: failed.binding,
+			reason: causeMessage(cause) ?? String(cause)
+		}))));
+		return c.json({
+			environment: context.environment,
+			databases
+		});
+	};
+}
 /** `GET /control-plane/keys` — the registration state, so a client can surface a stale key. */
 function listKeysHandler(deps) {
 	return async (c) => {
@@ -129,7 +162,10 @@ function listKeysHandler(deps) {
 		return c.json({
 			connectionId: connection.id,
 			environment: connection.environment,
-			keys: connection.keys.map(publicKeyView)
+			keys: connection.keys.map(publicKeyView),
+			authorizedBy: connection.authorizedBy,
+			actorKind: connection.actorKind,
+			purpose: connection.purpose
 		});
 	};
 }
@@ -243,5 +279,32 @@ function expireKeyHandler(deps) {
 		});
 	};
 }
+/**
+* `GET /control-plane/privacy` — the full privacy inventory (#132).
+*
+* Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
+* is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
+* between. Behind `privacy:read`, because field names are the kind of thing an adopter may withhold from a client
+* that has no business seeing them. Read-only.
+*/
+function privacyHandler(deps) {
+	return async (c) => {
+		const context = caller(c);
+		const inventory = deps.privacyInventory();
+		return c.json({
+			environment: context.environment,
+			posture: {
+				...privacyPosture(privacyAttestation(c.env), () => inventory),
+				retirement: await deps.retirement(c.env)
+			},
+			schemasWalked: inventory.schemasWalked,
+			schemas: inventory.schemas.map((schema) => ({
+				...schema,
+				fields: schema.fields.map((field) => ({ ...field })),
+				encrypted: schema.encrypted.map((field) => ({ ...field }))
+			}))
+		});
+	};
+}
 //#endregion
-export { expireKeyHandler, listKeysHandler, manifestHandler, pingHandler, registerKeyHandler };
+export { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler };

package/dist/controlPlane/http/readiness.d.ts

@@ -0,0 +1,33 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Hono } from "hono";
+import type { PithyHonoEnv, PithyReadinessGuard } from "../../capability/capability";
+/**
+ * Mount every capability's readiness guard, exempting the admin surface.
+ *
+ * **The control plane answers whatever else is wrong with the Worker.** It is the diagnostic surface: a
+ * management client reads the manifest, migration state and drift through it. A guard that refuses every
+ * request because an index drifted would take that surface down on exactly the fault it exists to report,
+ * and the client could not tell drift from a Worker that is simply down.
+ *
+ * **The exemption is the guard, not the middleware.** The seam itself runs on capability middleware —
+ * `controlplane()` publishes the verifier and `audit()` publishes `emit` — so skipping middleware on a
+ * seam request would trade a 500 for a seam that denies everything, or one that stops auditing without a
+ * word. Readiness guards are the only middleware that refuses because the Worker is broken, so they are
+ * the only thing skipped.
+ *
+ * **Hono decides what is on the surface, not a matcher written here.** One `app.use` per admin path marks
+ * the request, so a `:segment` matches exactly as it does for the route and the CORS layer, and a literal
+ * path never matches what is beneath it. The surface is the one `corsSurface(all)` computes, which
+ * `routeContract.test.ts` already holds to the registered routes, so there is no second list to drift.
+ *
+ * The mark is a `WeakSet` over the raw `Request`, closed over here. A context variable would put an
+ * internal flag on `PithyVars`, where every capability could read it and one could set it.
+ *
+ * Call after every capability's `middleware` and before any capability's `routes`. Before the routes,
+ * because a terminal handler never calls `next()` and a guard mounted after it never runs.
+ */
+export declare function registerReadinessGuards(app: Hono<PithyHonoEnv>, surface: readonly {
+    path: string;
+}[], guards: readonly PithyReadinessGuard[]): void;
+//# sourceMappingURL=readiness.d.ts.map

package/dist/controlPlane/http/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/readiness.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,OAAO,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,EACpC,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACrC,IAAI,CAcN"}