@pithy-sh/core 0.10.0 → 0.12.0

package/dist/controlPlane/http/readiness.js

@@ -0,0 +1,39 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/controlPlane/http/readiness.ts
+/**
+* Mount every capability's readiness guard, exempting the admin surface.
+*
+* **The control plane answers whatever else is wrong with the Worker.** It is the diagnostic surface: a
+* management client reads the manifest, migration state and drift through it. A guard that refuses every
+* request because an index drifted would take that surface down on exactly the fault it exists to report,
+* and the client could not tell drift from a Worker that is simply down.
+*
+* **The exemption is the guard, not the middleware.** The seam itself runs on capability middleware —
+* `controlplane()` publishes the verifier and `audit()` publishes `emit` — so skipping middleware on a
+* seam request would trade a 500 for a seam that denies everything, or one that stops auditing without a
+* word. Readiness guards are the only middleware that refuses because the Worker is broken, so they are
+* the only thing skipped.
+*
+* **Hono decides what is on the surface, not a matcher written here.** One `app.use` per admin path marks
+* the request, so a `:segment` matches exactly as it does for the route and the CORS layer, and a literal
+* path never matches what is beneath it. The surface is the one `corsSurface(all)` computes, which
+* `routeContract.test.ts` already holds to the registered routes, so there is no second list to drift.
+*
+* The mark is a `WeakSet` over the raw `Request`, closed over here. A context variable would put an
+* internal flag on `PithyVars`, where every capability could read it and one could set it.
+*
+* Call after every capability's `middleware` and before any capability's `routes`. Before the routes,
+* because a terminal handler never calls `next()` and a guard mounted after it never runs.
+*/
+function registerReadinessGuards(app, surface, guards) {
+	if (guards.length === 0) return;
+	const onSurface = /* @__PURE__ */ new WeakSet();
+	for (const path of new Set(surface.map((entry) => entry.path))) app.use(path, async (c, next) => {
+		onSurface.add(c.req.raw);
+		await next();
+	});
+	for (const guard of guards) app.use("*", (c, next) => onSurface.has(c.req.raw) ? next() : guard(c, next));
+}
+//#endregion
+export { registerReadinessGuards };

package/dist/controlPlane/http/responses.d.ts

@@ -62,6 +62,13 @@ export declare const ControlPlaneKeysResponse: z.ZodObject<{
         validUntil: z.ZodNullable<z.ZodISODateTime>;
         revokedAt: z.ZodNullable<z.ZodISODateTime>;
     }, z.core.$strip>>;
+    authorizedBy: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+    actorKind: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        agent: "agent";
+        dashboard: "dashboard";
+        script: "script";
+    }>>>;
+    purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type ControlPlaneKeysResponse = z.output<typeof ControlPlaneKeysResponse>;
 /** `POST /control-plane/keys` — the appended key, and the set as it now stands. */
@@ -98,4 +105,242 @@ export declare const ExpireKeyResponse: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ExpireKeyResponse = z.output<typeof ExpireKeyResponse>;
+/**
+ * One migration as `GET {basePath}/migrations` reports it: its composed name, and whose it is.
+ *
+ * The namespace is a capability's name, which the manifest already reports in `capabilities[]`. So a
+ * client tells an adopter's own migrations from a composed capability's by comparing the two — no
+ * convention, and no list kept anywhere.
+ */
+export declare const MigrationView: z.ZodObject<{
+    name: z.ZodString;
+    namespace: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type MigrationView = z.output<typeof MigrationView>;
+/** Whether the last group is still reversible by name, or what is in its way. */
+export declare const MigrationGroupPositionView: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"top">;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"buried">;
+    above: z.ZodArray<z.ZodString>;
+    ungrouped: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>], "state">;
+export type MigrationGroupPositionView = z.output<typeof MigrationGroupPositionView>;
+/** The run that last moved a database, and whether it can still be taken back. */
+export declare const MigrationGroupView: z.ZodObject<{
+    group: z.ZodString;
+    appliedAt: z.ZodISODateTime;
+    migrations: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    position: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        state: z.ZodLiteral<"top">;
+    }, z.core.$strip>, z.ZodObject<{
+        state: z.ZodLiteral<"buried">;
+        above: z.ZodArray<z.ZodString>;
+        ungrouped: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            namespace: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>], "state">;
+}, z.core.$strip>;
+export type MigrationGroupView = z.output<typeof MigrationGroupView>;
+/**
+ * One database this Worker binds, read or not.
+ *
+ * **An unreadable database carries no list at all**, never empty ones. `pending: []` reads as up to date,
+ * and a database nobody read is not that. The state is on the value, so a client reaches a list only by
+ * narrowing.
+ */
+export declare const MigrationDatabaseView: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"readable">;
+    database: z.ZodString;
+    binding: z.ZodString;
+    applied: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    pending: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    undeclared: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    lastGroup: z.ZodNullable<z.ZodObject<{
+        group: z.ZodString;
+        appliedAt: z.ZodISODateTime;
+        migrations: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            namespace: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        position: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            state: z.ZodLiteral<"top">;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"buried">;
+            above: z.ZodArray<z.ZodString>;
+            ungrouped: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                namespace: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>], "state">;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"unreadable">;
+    database: z.ZodString;
+    binding: z.ZodString;
+}, z.core.$strip>], "state">;
+export type MigrationDatabaseView = z.output<typeof MigrationDatabaseView>;
+/**
+ * `GET /control-plane/migrations` — where every database this Worker binds stands.
+ *
+ * Asked of the Worker because the Worker *is* the deployed build. `pithy doctor` reads the project on disk,
+ * which is what the operator has and not necessarily what is deployed.
+ */
+export declare const ControlPlaneMigrationsResponse: z.ZodObject<{
+    environment: z.ZodString;
+    databases: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        state: z.ZodLiteral<"readable">;
+        database: z.ZodString;
+        binding: z.ZodString;
+        applied: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            namespace: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        pending: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            namespace: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        undeclared: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            namespace: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        lastGroup: z.ZodNullable<z.ZodObject<{
+            group: z.ZodString;
+            appliedAt: z.ZodISODateTime;
+            migrations: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                namespace: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            position: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"top">;
+            }, z.core.$strip>, z.ZodObject<{
+                state: z.ZodLiteral<"buried">;
+                above: z.ZodArray<z.ZodString>;
+                ungrouped: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    namespace: z.ZodNullable<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>], "state">;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        state: z.ZodLiteral<"unreadable">;
+        database: z.ZodString;
+        binding: z.ZodString;
+    }, z.core.$strip>], "state">>;
+}, z.core.$strip>;
+export type ControlPlaneMigrationsResponse = z.output<typeof ControlPlaneMigrationsResponse>;
+/**
+ * One marked field, as `GET {basePath}/privacy` reports it (#132).
+ *
+ * **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+ * your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
+ */
+export declare const PrivacyFieldView: z.ZodObject<{
+    path: z.ZodString;
+    class: z.ZodString;
+    truncated: z.ZodOptional<z.ZodLiteral<true>>;
+    sameAs: z.ZodOptional<z.ZodString>;
+    encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+    unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strip>;
+export type PrivacyFieldView = z.output<typeof PrivacyFieldView>;
+/** One storage schema holding at least one marked field. */
+export declare const PrivacySchemaView: z.ZodObject<{
+    capability: z.ZodString;
+    storage: z.ZodEnum<{
+        d1: "d1";
+        kv: "kv";
+    }>;
+    container: z.ZodString;
+    name: z.ZodString;
+    fields: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        class: z.ZodString;
+        truncated: z.ZodOptional<z.ZodLiteral<true>>;
+        sameAs: z.ZodOptional<z.ZodString>;
+        encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+        unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>;
+    encrypted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type PrivacySchemaView = z.output<typeof PrivacySchemaView>;
+/**
+ * `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+ *
+ * Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
+ * block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
+ */
+export declare const ControlPlanePrivacyResponse: z.ZodObject<{
+    environment: z.ZodString;
+    posture: z.ZodObject<{
+        declared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        observed: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        counts: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        observedNotDeclared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        declaredNotObserved: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        consoleGate: z.ZodEnum<{
+            enforced: "enforced";
+            not_required: "not_required";
+            unattested: "unattested";
+            unverifiable: "unverifiable";
+        }>;
+        consoleGateReason: z.ZodNullable<z.ZodString>;
+        attestedAt: z.ZodNullable<z.ZodISODateTime>;
+        sources: z.ZodArray<z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>>;
+        retirement: z.ZodOptional<z.ZodObject<{
+            blocked: z.ZodBoolean;
+            reasons: z.ZodArray<z.ZodEnum<{
+                "incomplete-coverage": "incomplete-coverage";
+                stale: "stale";
+                unrotatable: "unrotatable";
+            }>>;
+            liveVersions: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    schemasWalked: z.ZodNumber;
+    schemas: z.ZodArray<z.ZodObject<{
+        capability: z.ZodString;
+        storage: z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>;
+        container: z.ZodString;
+        name: z.ZodString;
+        fields: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            class: z.ZodString;
+            truncated: z.ZodOptional<z.ZodLiteral<true>>;
+            sameAs: z.ZodOptional<z.ZodString>;
+            encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+            unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strip>>;
+        encrypted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlanePrivacyResponse = z.output<typeof ControlPlanePrivacyResponse>;
 //# sourceMappingURL=responses.d.ts.map

package/dist/controlPlane/http/responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/responses.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;;;;;;;;iBAcmF,CAAC;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQwB,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;iBAMwC,CAAC;AAC9E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAQyB,CAAC;AAC1D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM6B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/responses.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;;;;;;;;iBAcmF,CAAC;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQwB,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;iBAuBwE,CAAC;AAC9G,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAQyB,CAAC;AAC1D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM6B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;iBAU+C,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,0BAA0B;;;;;;;;;4BAyBkE,CAAC;AAC1G,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAErF,kFAAkF;AAClF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAW8C,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA+BwE,CAAC;AAC3G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO+D,CAAC;AAC3G,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;iBAmCiB,CAAC;AAC/C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;iBA0BmC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAerC,CAAC;AACJ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/controlPlane/http/responses.js

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { Ed25519PublicJwk } from "../data/connection.js";
+import { PRIVACY_SOURCES } from "../../privacy/report.js";
+import { ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, Ed25519PublicJwk } from "../data/connection.js";
+import { PrivacyPosture } from "../../privacy/posture.js";
 import { z } from "zod";
 //#region src/controlPlane/http/responses.ts
 /**
@@ -47,8 +49,11 @@ const ControlPlanePingResponse = z.object({
 const ControlPlaneKeysResponse = z.object({
 	connectionId: z.string().describe("The connection these keys belong to."),
 	environment: z.string().describe("The environment that connection is bound to."),
-	keys: z.array(PublicKeyView).describe("Every registered key, expired and revoked ones included.")
-}).describe("Every key registered against this connection, with its window.");
+	keys: z.array(PublicKeyView).describe("Every registered key, expired and revoked ones included."),
+	authorizedBy: ConnectionPrincipal.nullable().optional().describe("Who sanctioned this connection — the signed-in session's email at registration. Null for a connection registered before principals were recorded; absent from a Worker older than the field."),
+	actorKind: ControlPlaneActorKind.nullable().optional().describe("What kind of client this connection is for: `agent`, `dashboard` or `script`. Null for a connection registered before it was recorded; absent from an older Worker."),
+	purpose: ConnectionPurpose.nullable().optional().describe("What the client is for, in the registering operator's words. Untrusted text: render it escaped. Null for a connection registered before it was recorded; absent from an older Worker.")
+}).describe("Every key registered against this connection, with its window, and who authorized it for what.");
 /** `POST /control-plane/keys` — the appended key, and the set as it now stands. */
 const RegisterKeyResponse = z.object({
 	keyId: z.string().describe("The key just registered."),
@@ -61,5 +66,97 @@ const ExpireKeyResponse = z.object({
 	validUntil: z.iso.datetime().describe("When its window closed, ISO-8601 — now, by construction."),
 	keys: z.array(PublicKeyView).describe("The connection's keys after the expiry.")
 }).describe("The expired key, and the set it left behind.");
+/**
+* One migration as `GET {basePath}/migrations` reports it: its composed name, and whose it is.
+*
+* The namespace is a capability's name, which the manifest already reports in `capabilities[]`. So a
+* client tells an adopter's own migrations from a composed capability's by comparing the two — no
+* convention, and no list kept anywhere.
+*/
+const MigrationView = z.object({
+	name: z.string().describe("The composed migration name, exactly as the ledger records it: `0250_audit_0001_init`."),
+	namespace: z.string().nullable().describe("The capability this migration belongs to — its name, as `capabilities[]` in the manifest reports it. Null only for an undeclared migration whose name no Pithy registry could have composed.")
+}).describe("One migration, and the capability namespace it belongs to.");
+/** Whether the last group is still reversible by name, or what is in its way. */
+const MigrationGroupPositionView = z.discriminatedUnion("state", [z.object({ state: z.literal("top").describe("The group's migrations are the contiguous tip of this database's chain. Not a promise that `pithy migrate --rollback --group <value>` runs: the CLI also refuses an undeclared migration in the ledger, and keeps back or refuses a database another environment binds.") }).describe("A group nothing on this database's ledger sits over."), z.object({
+	state: z.literal("buried").describe("Something sits over the group or inside it, so reversing it by name is refused."),
+	above: z.array(z.string()).describe("The groups in the way, newest first."),
+	ungrouped: z.array(MigrationView).describe("The migrations in the way that no group claims, newest first. Nothing can be reversed by group while one of them is at the tip.")
+}).describe("A group with something in its way, and what that is.")]).describe("Where the last group sits in this database's chain: the top, or buried under named things.");
+/** The run that last moved a database, and whether it can still be taken back. */
+const MigrationGroupView = z.object({
+	group: z.string().describe("The group's value: the `--group` the run was given, or the ISO-8601 timestamp it generated."),
+	appliedAt: z.iso.datetime().describe("When this group last applied something here, ISO-8601."),
+	migrations: z.array(MigrationView).describe("What this group applied in this database and is still applied, in application order."),
+	position: MigrationGroupPositionView.describe("Whether the group is the top of the chain, or what is in its way.")
+}).describe("The newest group with anything still applied in this database.");
+/**
+* One database this Worker binds, read or not.
+*
+* **An unreadable database carries no list at all**, never empty ones. `pending: []` reads as up to date,
+* and a database nobody read is not that. The state is on the value, so a client reaches a list only by
+* narrowing.
+*/
+const MigrationDatabaseView = z.discriminatedUnion("state", [z.object({
+	state: z.literal("readable").describe("This database's ledger was read."),
+	database: z.string().describe("The database name, as capabilities declare it in `databases`."),
+	binding: z.string().describe("The D1 binding it is read through, as `wrangler.jsonc` declares it."),
+	applied: z.array(MigrationView).describe("Every applied migration, in the order the ledger applied them."),
+	pending: z.array(MigrationView).describe("Declared by this build and not applied here, in the order they would run."),
+	undeclared: z.array(MigrationView).describe("Applied here and not declared by this Worker, sorted. Relative to this Worker: a database shared with another Worker lists that Worker's migrations here. Otherwise Kysely reads one as a corrupted chain and applies nothing."),
+	lastGroup: MigrationGroupView.nullable().describe("The newest group with anything applied here, or null when nothing applied here was ever grouped.")
+}).describe("A database whose ledger was read."), z.object({
+	state: z.literal("unreadable").describe("This database's ledger could not be read on this call."),
+	database: z.string().describe("The database name, as capabilities declare it in `databases`."),
+	binding: z.string().describe("The D1 binding it would be read through.")
+}).describe("A database that could not be read. No lists, so nothing about it reads as zero. The other databases still answer.")]).describe("One database this Worker binds: its migration state, or the fact that it could not be read.");
+/**
+* `GET /control-plane/migrations` — where every database this Worker binds stands.
+*
+* Asked of the Worker because the Worker *is* the deployed build. `pithy doctor` reads the project on disk,
+* which is what the operator has and not necessarily what is deployed.
+*/
+const ControlPlaneMigrationsResponse = z.object({
+	environment: z.string().describe("The environment this Worker answers for."),
+	databases: z.array(MigrationDatabaseView).describe("One entry per database this Worker binds, sorted by database name. One unreadable costs only itself.")
+}).describe("What is applied, pending and undeclared in each bound database, and which run put it there.");
+/**
+* One marked field, as `GET {basePath}/privacy` reports it (#132).
+*
+* **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+* your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
+*/
+const PrivacyFieldView = z.object({
+	path: z.string().describe("Where the field sits. A D1 column path (`email`, `address.line1`, `profile.phone` inside a JSON column), or a KV entry's part first (`key.email`, `value.token`, `metadata.ip`, or `value` for a whole marked value). An array element is `[]`, a record's value `*`."),
+	class: z.string().describe("The privacy class it is marked with: `secret`, `pii`, `phi`, `pci`, or an adopter's own."),
+	truncated: z.literal(true).optional().describe("Set where the class is assumed rather than found: a read ran out of its budget there, or the schema could not be read at all, so any class may be marked below it. Absent where the schema was read to the end."),
+	sameAs: z.string().optional().describe("Set on a reference: the path this field's position was first listed under, once the list reached its cap on paths. The class is marked somewhere beneath both, and the paths beneath this one are those beneath that one."),
+	encryptedAtRest: z.boolean().optional().describe("Whether the field rests encrypted (#390). Absent where the core cannot say — an assumed class, a reference, or a core older than encrypted fields — and never defaulted to false."),
+	unrotatable: z.literal(true).optional().describe("Set on an encrypted field whose storage is not D1: it can never be rotated, and it blocks retirement.")
+}).describe("One marked field and its class.");
+/** One storage schema holding at least one marked field. */
+const PrivacySchemaView = z.object({
+	capability: z.string().describe("The capability that declared the schema, as the manifest's `capabilities[]` names it."),
+	storage: z.enum(PRIVACY_SOURCES).describe("Where it is stored: a `d1` table or a `kv` store."),
+	container: z.string().describe("The D1 database name or the KV namespace name it lives in."),
+	name: z.string().describe("The table name, or the KV store name."),
+	fields: z.array(PrivacyFieldView).describe("Every marked field in it, in schema order."),
+	encrypted: z.array(z.object({
+		path: z.string().describe("Where the encrypted field sits, on the same paths as `fields[].path`."),
+		unrotatable: z.literal(true).optional().describe("Set where the storage is not D1, so the field can never be rotated.")
+	}).describe("One encrypted field.")).optional().describe("Every field marked encrypted at rest, classed or not (#390). Absent on a Worker whose core predates encrypted fields.")
+}).describe("One storage schema and the marked fields it holds.");
+/**
+* `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+*
+* Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
+* block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
+*/
+const ControlPlanePrivacyResponse = z.object({
+	environment: z.string().describe("The environment this Worker answers for."),
+	posture: PrivacyPosture.describe("The declared and observed classes, the delta, and the console gate."),
+	schemasWalked: z.number().int().nonnegative().describe("How many storage schemas were walked, marked or not, across the sources `posture.sources` names."),
+	schemas: z.array(PrivacySchemaView).describe("Every schema holding a marked field, in composition order. A schema with none is not listed.")
+}).describe("Every schema this Worker stores that holds a marked field, each field's path and class, and where it lives.");
 //#endregion
-export { ControlPlaneKeysResponse, ControlPlanePingResponse, ExpireKeyResponse, PublicKeyView, RegisterKeyResponse };
+export { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, MigrationDatabaseView, MigrationGroupPositionView, MigrationGroupView, MigrationView, PrivacyFieldView, PrivacySchemaView, PublicKeyView, RegisterKeyResponse };

package/dist/controlPlane/http/routes.d.ts

@@ -12,6 +12,8 @@ import { type ControlPlaneHandlerDeps } from "./handlers";
  *   GET  /control-plane/keys                  → the registration state       (keys:rotate)
  *   POST /control-plane/keys                  → register a key               (keys:rotate)
  *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
+ *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
+ *   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
  *
  * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
  * and that is the shipped state of a Worker nobody has connected.

package/dist/controlPlane/http/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAGhF,OAAO,EACL,KAAK,uBAAuB,EAM7B,MAAM,YAAY,CAAC;AASpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAiC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA+DN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAShF,OAAO,EACL,KAAK,uBAAuB,EAQ7B,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CA+C3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA2FN"}

package/dist/controlPlane/http/routes.js

@@ -1,12 +1,12 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE } from "../scope/scope.js";
+import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE } from "../scope/scope.js";
 import { requireControlPlane } from "./guard.js";
 import { describeRoute } from "../../http/routeSpec.js";
 import { validate } from "../../http/validation.js";
 import { ControlPlaneManifest } from "../discovery/adminRoute.js";
-import { expireKeyHandler, listKeysHandler, manifestHandler, pingHandler, registerKeyHandler } from "./handlers.js";
-import { ControlPlaneKeysResponse, ControlPlanePingResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
+import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler } from "./handlers.js";
+import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
 import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas.js";
 //#region src/controlPlane/http/routes.ts
 /**
@@ -17,6 +17,8 @@ import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas
 *   GET  /control-plane/keys                  → the registration state       (keys:rotate)
 *   POST /control-plane/keys                  → register a key               (keys:rotate)
 *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
+*   GET  /control-plane/migrations            → where each database stands   (migrations:read)
+*   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
 *
 * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
 * and that is the shipped state of a Worker nobody has connected.
@@ -73,6 +75,18 @@ function controlPlaneRouteDescriptors(basePath) {
 			path: `${basePath}/keys/:keyId/expire`,
 			scope: KEYS_ROTATE_SCOPE,
 			summary: "Retire a superseded key. Must be signed with the successor it names as proven."
+		},
+		{
+			method: "GET",
+			path: `${basePath}/migrations`,
+			scope: MIGRATIONS_READ_SCOPE,
+			summary: "What each bound database has applied, what is pending, what is undeclared, and which run put it there. Undeclared is relative to this Worker."
+		},
+		{
+			method: "GET",
+			path: `${basePath}/privacy`,
+			scope: PRIVACY_READ_SCOPE,
+			summary: "Every stored schema holding a privacy-marked field, each field's path and class, and where it lives. Derived from the running code."
 		}
 	];
 }
@@ -107,6 +121,20 @@ function registerControlPlaneRoutes(app, basePath, deps) {
 		scopes: [KEYS_ROTATE_SCOPE],
 		responses: { 200: ExpireKeyResponse }
 	}), requireControlPlane(KEYS_ROTATE_SCOPE), validate("param", ExpireKeyParams), validate("json", ExpireKeyRequest), (c) => expireKeyHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
+	app.get(`${basePath}/migrations`, describeRoute({
+		summary: "Report where each database this Worker binds stands.",
+		description: "Applied, pending and undeclared migrations per database, each naming its namespace, and the last group with whether it is still reversible. Undeclared is relative to this Worker: a database shared with another Worker lists that Worker's migrations there. Read-only.",
+		verification: "control-plane",
+		scopes: [MIGRATIONS_READ_SCOPE],
+		responses: { 200: ControlPlaneMigrationsResponse }
+	}), requireControlPlane(MIGRATIONS_READ_SCOPE), migrationsHandler(deps));
+	app.get(`${basePath}/privacy`, describeRoute({
+		summary: "Report every stored field marked with a privacy class.",
+		description: "Every D1 table and KV store this Worker composed that holds a privacy-marked field, with each field's path, its class and where it is stored, beside the declared-and-observed posture. Derived at runtime from the deployed schemas. Read-only.",
+		verification: "control-plane",
+		scopes: [PRIVACY_READ_SCOPE],
+		responses: { 200: ControlPlanePrivacyResponse }
+	}), requireControlPlane(PRIVACY_READ_SCOPE), privacyHandler(deps));
 }
 //#endregion
 export { controlPlaneRouteDescriptors, registerControlPlaneRoutes };

package/dist/controlPlane/http/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,gBAAgB,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA2E9B"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,gBAAgB,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA6E9B"}

package/dist/controlPlane/http/verify.js

@@ -47,7 +47,8 @@ async function verifyControlPlaneCall(call, deps) {
 		scope: claims.scope,
 		grantedScopes: connection.scopes,
 		keyId: key.keyId,
-		tokenId: claims.jti
+		tokenId: claims.jti,
+		actorKind: connection.actorKind
 	});
 }
 /**

package/dist/controlPlane/migrationState/migrationState.d.ts

@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { MigrationProvider } from "kysely/migration";
+import type { Capability } from "../../capability/capability";
+import type { HealthSummary } from "../discovery/healthSummary";
+import type { MigrationDatabaseView, MigrationView } from "../http/responses";
+/**
+ * **Migration state over the control plane (#729).**
+ *
+ * A management client could not answer what is applied where, or whether a deploy left something behind:
+ * the seam registered a ping, the manifest and key rotation, and not one field of it was about a database.
+ * The read already existed — {@link readMigrationLedger} answers both directions — and it needs a D1
+ * binding and the composed provider in one process. **The Worker is the only thing holding both**, and it
+ * is the deployed build, so asked from its side the answer cannot be stale the way the project on disk is.
+ *
+ * Two halves. At assembly, {@link composeMigrationDatabases} builds what this Worker declares per bound
+ * database, through `collectMigrationSets` — the function `pithy migrate` composes with, so the route and
+ * `pithy doctor` compose the same way. Not always from the same inputs: on a D1 two Workers share, the CLI
+ * merges both Workers' sets and the route holds only its own, so `pending` and `undeclared` can differ
+ * there. On a database one Worker binds alone they agree. Per request, {@link readDatabaseMigrations} reads
+ * one database for the route and {@link readMigrationHealth} totals all of them for the manifest.
+ *
+ * **Read-only.** Nothing here runs, reverses or resets a migration. A screen somebody opened to ask must
+ * not hand them the thing that changes the schema.
+ *
+ * **`undeclared` is relative to this Worker.** Two Workers can be bound to one physical D1, and the CLI
+ * composes across all of them. A Worker composes only its own capabilities and cannot learn a co-bound
+ * Worker's, so from inside one, every migration the other shipped to the shared database reads as
+ * undeclared. That is why `undeclaredMigrations` grades nothing.
+ */
+/** One database this Worker binds, with what this build declares for it. Built once, at assembly. */
+export interface ComposedMigrationDatabase {
+    /** The database name, as capabilities declare it in `databases`. */
+    database: string;
+    /** The D1 binding it is read through. */
+    binding: string;
+    /** Every migration this build declares for it — empty for a database bound with none. */
+    provider: MigrationProvider;
+    /** Each declared migration's namespace, known from the set it came from. */
+    namespaces: ReadonlyMap<string, string>;
+}
+/**
+ * Every database this Worker binds, with the provider this build composes for it, sorted by name.
+ *
+ * One entry per database `composeDatabases` maps to a binding — the same map the request registry is built
+ * from — so a database bound with no migrations is still reported. Leaving it out would read as not bound.
+ */
+export declare function composeMigrationDatabases(capabilities: readonly Capability[]): ComposedMigrationDatabase[];
+/**
+ * One migration as the route reports it.
+ *
+ * A declared migration's namespace comes from the set it was declared in. An undeclared one has only its
+ * key, so it is decomposed — and a key no registry composed answers null rather than a guess.
+ */
+export declare function migrationView(name: string, namespaces: ReadonlyMap<string, string>): MigrationView;
+/**
+ * Read one database's migration state for the route.
+ *
+ * **A database that cannot be read is `unreadable`, and costs only itself.** The cause goes to
+ * `onUnreadable` — the route logs it, where the operator's context stays the operator's — and never into
+ * the view: a D1 error can name a table or a query, and the view crosses to a management client.
+ */
+export declare function readDatabaseMigrations(env: Record<string, unknown>, entry: ComposedMigrationDatabase, onUnreadable?: (entry: ComposedMigrationDatabase, cause: unknown) => void): Promise<MigrationDatabaseView>;
+/**
+ * The two health keys the seam contributes to its own manifest entry.
+ *
+ * Both `indexed`: one small select per bound database, bounded by the declared migration count rather
+ * than by the adopter's data. Both behind {@link MIGRATIONS_READ_SCOPE}, which the seam's own route
+ * requires, so a connection without it gets no value rather than a zero.
+ *
+ * **`undeclaredMigrations` declares no nominal, on purpose.** From inside one Worker, a database shared
+ * with another lists the other's migrations as undeclared, so `atMost: 0` would report a corrupted chain
+ * on a database that is entirely fine. Null is what a client reads as unknowable, never as healthy (#471).
+ */
+export declare const MIGRATION_HEALTH_KEYS: readonly [{
+    readonly key: "pendingMigrations";
+    readonly kind: "count";
+    readonly states: null;
+    readonly scope: string;
+    readonly cost: "indexed";
+    readonly summary: "Migrations this build declares that a bound database has not applied.";
+    readonly nominal: {
+        readonly atMost: 0;
+    };
+}, {
+    readonly key: "undeclaredMigrations";
+    readonly kind: "count";
+    readonly states: null;
+    readonly scope: string;
+    readonly cost: "indexed";
+    readonly summary: "Migrations a bound database holds that this Worker does not declare. Relative to this Worker: a database shared with another lists that Worker's migrations here.";
+    readonly nominal: null;
+}];
+/**
+ * Total pending and undeclared across every bound database, for the manifest.
+ *
+ * **Throws rather than total a database it could not read.** A partial total is a zero for the database
+ * nobody read. The seam catches the throw and reports the summary `unavailable`, which a client reads as
+ * unknown — null is never zero.
+ */
+export declare function readMigrationHealth(env: Record<string, unknown>, databases: readonly ComposedMigrationDatabase[]): Promise<HealthSummary>;
+//# sourceMappingURL=migrationState.d.ts.map

package/dist/controlPlane/migrationState/migrationState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrationState.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrationState/migrationState.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAQ9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAsB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,qGAAqG;AACrG,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAKD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,yBAAyB,EAAE,CAe1G;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,aAAa,CAElG;AA8BD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,yBAAyB,EAChC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GACxE,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;kBAEzB,mBAAmB;mBAClB,OAAO;;;mBAGP,SAAS;sBACN,uEAAuE;;iBACrE,MAAM,EAAE,CAAC;;;kBAGf,sBAAsB;mBACrB,OAAO;;;mBAGP,SAAS;sBAEb,mKAAmK;;EAGvH,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,SAAS,EAAE,SAAS,yBAAyB,EAAE,GAC9C,OAAO,CAAC,aAAa,CAAC,CAQxB"}