@pithy-sh/core 0.11.0 → 0.12.0

package/dist/controlPlane/capability.js

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { defineCapability } from "../capability/capability.js";
+import { readRetirement } from "../privacy/fieldRotation.js";
+import { lazyPrivacyInventory } from "../privacy/inventory.js";
 import { PACKAGE_NAME, PACKAGE_VERSION } from "../version.generated.js";
 import "../worker/identity.js";
 import { ControlPlaneConfig } from "./config/config.js";
@@ -87,6 +89,8 @@ function controlplane(options = {}) {
 	let composed = [];
 	let health = /* @__PURE__ */ new Map();
 	let migrationDatabases = [];
+	let composedCapabilities = [];
+	const privacy = lazyPrivacyInventory(() => composedCapabilities);
 	return {
 		...defineCapability({
 			name: "controlplane",
@@ -118,6 +122,7 @@ function controlplane(options = {}) {
 				}));
 				health = capabilityHealthSources(capabilities);
 				migrationDatabases = composeMigrationDatabases(capabilities);
+				composedCapabilities = [...capabilities];
 			},
 			middleware: [(app) => {
 				app.use("*", async (c, next) => {
@@ -145,6 +150,8 @@ function controlplane(options = {}) {
 					composedCapabilities: () => composed,
 					composedHealth: () => health,
 					composedMigrations: () => migrationDatabases,
+					privacyInventory: privacy,
+					retirement: (env) => readRetirement(env, composedCapabilities),
 					now
 				});
 			}

package/dist/controlPlane/data/connection.d.ts

@@ -99,18 +99,8 @@ export declare const ControlPlaneConnection: z.ZodObject<{
         script: "script";
     }>>>;
     purpose: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    scopes: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodString>>;
-    keys: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        publicKey: z.ZodObject<{
-            kty: z.ZodLiteral<"OKP">;
-            crv: z.ZodLiteral<"Ed25519">;
-            x: z.ZodString;
-        }, z.core.$strip>;
-        validFrom: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>;
-        validUntil: z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>>;
-        revokedAt: z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>>;
-    }, z.core.$strip>>]>, z.ZodArray<z.ZodObject<{
+    scopes: import("../../data/codecs").SqliteJson<z.ZodArray<z.ZodString>>;
+    keys: import("../../data/codecs").SqliteJson<z.ZodArray<z.ZodObject<{
         keyId: z.ZodString;
         publicKey: z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;

package/dist/controlPlane/data/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;EAI/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,YAK7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,8GAA8G;AAC9G,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAiB1C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAW3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkEhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/data/connection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB;;;;iBAgBoF,CAAC;AAClH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBAoBoF,CAAC;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;EAI/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,YAK7B,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,8GAA8G;AAC9G,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAiB1C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,aAW3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkEhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC7E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/controlPlane/data/connection.js

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ControlPlaneScope } from "../scope/scope.js";
 import { JsonDate, SQLiteDate, sqliteJson } from "../../data/codecs.js";
+import { ControlPlaneScope } from "../scope/scope.js";
 import { z } from "zod";
 //#region src/controlPlane/data/connection.ts
 /**

package/dist/controlPlane/discovery/adminRoute.d.ts

@@ -218,6 +218,35 @@ export declare const ControlPlaneManifest: z.ZodObject<{
     environment: z.ZodString;
     connectionId: z.ZodString;
     version: z.ZodNullable<z.ZodString>;
+    versionCreatedAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    privacy: z.ZodOptional<z.ZodObject<{
+        declared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        observed: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        counts: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        observedNotDeclared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        declaredNotObserved: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        consoleGate: z.ZodEnum<{
+            enforced: "enforced";
+            not_required: "not_required";
+            unattested: "unattested";
+            unverifiable: "unverifiable";
+        }>;
+        consoleGateReason: z.ZodNullable<z.ZodString>;
+        attestedAt: z.ZodNullable<z.ZodISODateTime>;
+        sources: z.ZodArray<z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>>;
+        retirement: z.ZodOptional<z.ZodObject<{
+            blocked: z.ZodBoolean;
+            reasons: z.ZodArray<z.ZodEnum<{
+                "incomplete-coverage": "incomplete-coverage";
+                stale: "stale";
+                unrotatable: "unrotatable";
+            }>>;
+            liveVersions: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     capabilities: z.ZodArray<z.ZodCodec<z.ZodObject<{
         name: z.ZodString;
         version: z.ZodNullable<z.ZodString>;

package/dist/controlPlane/discovery/adminRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminRoute.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/discovery/adminRoute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;GAiBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;EAE8B,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;;;;;;;;;iBAmBpB,CAAC;AACJ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqD/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAiD1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBkE,CAAC;AACpG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"adminRoute.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/discovery/adminRoute.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;;;;;;;;GAiBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;EAE8B,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;;;;;;;;;iBAmBpB,CAAC;AACJ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqD/B,CAAC;AACJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAiD1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCkE,CAAC;AACpG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/controlPlane/discovery/adminRoute.js

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { ControlPlaneScope } from "../scope/scope.js";
 import { CapabilityHealthReport, HealthSummary, HealthSummaryKey, healthReport, healthWire } from "./healthSummary.js";
+import { PrivacyPosture } from "../../privacy/posture.js";
 import { ManifestConfigKey, ManifestConfigValues } from "./configuration.js";
 import { z } from "zod";
 //#region src/controlPlane/discovery/adminRoute.ts
@@ -138,6 +139,8 @@ const ControlPlaneManifest = z.object({
 	environment: z.string().describe("The environment this connection is bound to, echoed so a client can label what it is looking at."),
 	connectionId: z.string().describe("The connection this call authenticated as."),
 	version: z.string().nullable().describe("The Cloudflare version id of the build answering this call, from the `CF_VERSION_METADATA` binding, or null where the binding is absent. Opaque and per-deploy: it identifies which build is running, never which features it has. Null is honest — a Worker scaffolded before the binding was declared genuinely cannot say."),
+	versionCreatedAt: z.iso.datetime().nullable().optional().describe("When the version answering this call was uploaded, ISO-8601, from the same `CF_VERSION_METADATA` binding as `version` — or null where the binding is absent. The id alone cannot tell a deploy from a rollback: a rollback reactivates an existing version, so the id returns to one already seen while this moves backwards. Relayed, never interpreted. Absent from a Worker older than #132."),
+	privacy: PrivacyPosture.optional().describe("What this project declares about privacy and what its running code holds: classes and counts, never field names (`GET /control-plane/privacy` has those, behind `privacy:read`). Present on every Worker from #132, `declared` explicitly empty when nothing was declared; absent from an older Worker."),
 	capabilities: z.array(CapabilityDescriptor).describe("Every capability composed into this Worker, in composition order with the adopter's own app last. A capability absent here has no data to show, which is a fact the client discovers rather than a setting anybody maintains."),
 	grantedScopes: z.array(ControlPlaneScope).describe("Every scope this connection holds. Together with each route's own `scope`, this is what tells a client which operations to offer and which to hide.")
 }).describe("What this Worker is, what it composes, and how to call the admin surface it exposes.");

package/dist/controlPlane/error/errors.d.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { PithyError } from "../../error/pithyError";
 import type { MessageParams } from "../../i18n/catalog";
+import type { UnmarkedString } from "../../privacy/types";
 /**
  * The `control-plane` strategy's throw sugar. The `controlplane/*` codes live in core's closed
  * `KitErrorPayload` union (CLAUDE.md §Errors); these subclasses are the vehicles that set one.
@@ -16,9 +17,9 @@ import type { MessageParams } from "../../i18n/catalog";
  * the response into an oracle that tells an attacker exactly how far they got.
  */
 interface ControlPlaneErrorArgs {
-    message?: string;
-    action?: string;
-    detail?: string;
+    message?: UnmarkedString;
+    action?: UnmarkedString;
+    detail?: UnmarkedString;
     /**
      * Values a translating client interpolates into its own wording for this code. Client-facing, so —
      * unlike `action` and `detail` — these cross the boundary with `message`.

package/dist/controlPlane/error/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/error/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;;GAYG;AAEH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,UAAU;IAC3D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,sEAAsE;AACtE,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,0DAA0D;AAC1D,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/error/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AAEH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,UAAU;IAC3D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,sEAAsE;AACtE,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,0DAA0D;AAC1D,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF"}

package/dist/controlPlane/http/handlers.d.ts

@@ -2,6 +2,8 @@
 // SPDX-License-Identifier: MIT
 import type { Context } from "hono";
 import type { PithyHonoEnv } from "../../capability/capability";
+import type { PrivacyInventory } from "../../privacy/report";
+import type { RetirementVerdict } from "../../privacy/retirement";
 import type { ControlPlaneConfig } from "../config/config";
 import { type ControlPlaneDatabase } from "../data/tables";
 import type { CapabilityDeclaration } from "../discovery/adminRoute";
@@ -37,6 +39,16 @@ export interface ControlPlaneHandlerDeps {
      * `compose` hook through `collectMigrationSets`, the function `pithy migrate` composes with (#729).
      */
     composedMigrations: () => readonly ComposedMigrationDatabase[];
+    /**
+     * The privacy inventory of every storage schema this Worker composed (#132), walked on the first call and
+     * cached for the isolate. A thunk, so a Worker whose control plane is never called never walks.
+     */
+    privacyInventory: () => PrivacyInventory;
+    /**
+     * The field key's retirement verdict (#390): the guard over this Worker's encrypted columns, read through its own
+     * bindings. Never throws: whatever it cannot read is incomplete coverage.
+     */
+    retirement: (env: Record<string, unknown>) => Promise<RetirementVerdict>;
     /** The clock, injected so a test can stand at any instant. */
     now: () => Date;
 }
@@ -79,6 +91,25 @@ export declare function manifestHandler(deps: ControlPlaneHandlerDeps): (c: Cont
     environment: string;
     connectionId: string;
     version: string | null;
+    versionCreatedAt: string | null;
+    privacy: {
+        declared: string[] | null;
+        observed: string[] | null;
+        counts: {
+            [x: string]: number;
+        } | null;
+        observedNotDeclared: string[] | null;
+        declaredNotObserved: string[] | null;
+        consoleGate: "enforced" | "not_required" | "unattested" | "unverifiable";
+        consoleGateReason: string | null;
+        attestedAt: string | null;
+        sources: ("d1" | "kv")[];
+        retirement: {
+            blocked: boolean;
+            reasons: ("incomplete-coverage" | "stale" | "unrotatable")[];
+            liveVersions: number;
+        };
+    };
     capabilities: {
         health: import("../..").HealthSummary | null;
         healthUnavailable: boolean;
@@ -239,4 +270,52 @@ export declare function expireKeyHandler(deps: ControlPlaneHandlerDeps): (c: Con
         revokedAt: string | null;
     }[];
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/**
+ * `GET /control-plane/privacy` — the full privacy inventory (#132).
+ *
+ * Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
+ * is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
+ * between. Behind `privacy:read`, because field names are the kind of thing an adopter may withhold from a client
+ * that has no business seeing them. Read-only.
+ */
+export declare function privacyHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>) => Promise<Response & import("hono").TypedResponse<{
+    environment: string;
+    posture: {
+        declared: string[] | null;
+        observed: string[] | null;
+        counts: {
+            [x: string]: number;
+        } | null;
+        observedNotDeclared: string[] | null;
+        declaredNotObserved: string[] | null;
+        consoleGate: "enforced" | "not_required" | "unattested" | "unverifiable";
+        consoleGateReason: string | null;
+        attestedAt: string | null;
+        sources: ("d1" | "kv")[];
+        retirement: {
+            blocked: boolean;
+            reasons: ("incomplete-coverage" | "stale" | "unrotatable")[];
+            liveVersions: number;
+        };
+    };
+    schemasWalked: number;
+    schemas: {
+        capability: string;
+        storage: import("../../privacy/report").PrivacySource;
+        container: string;
+        name: string;
+        fields: {
+            path: string;
+            class: string;
+            truncated?: true;
+            sameAs?: string;
+            encryptedAtRest?: boolean;
+            unrotatable?: true;
+        }[];
+        encrypted: {
+            path: string;
+            unrotatable?: true;
+        }[];
+    }[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/controlPlane/http/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAIhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,sBAAsB,EAAwB,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,KAAK,yBAAyB,EAA0B,MAAM,kCAAkC,CAAC;AAS1G,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAuBvF,yGAAyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,oBAAoB,CAAC;IAC7D;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAClE;;;OAGG;IACH,kBAAkB,EAAE,MAAM,SAAS,yBAAyB,EAAE,CAAC;IAC/D,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAgED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;kEAUjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAyBvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAgBvC;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;mEAcvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,QAAQ,kBAAkB;;;;;;;;;;;;;;iBAoDjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,UAAU,eAAe,QAAQ,gBAAgB;;;;;;;;;;;;;;mEA8CxF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,sBAAsB,EAAwB,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,KAAK,yBAAyB,EAA0B,MAAM,kCAAkC,CAAC;AAU1G,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAuBvF,yGAAyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,oBAAoB,CAAC;IAC7D;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAClE;;;OAGG;IACH,kBAAkB,EAAE,MAAM,SAAS,yBAAyB,EAAE,CAAC;IAC/D;;;OAGG;IACH,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;IACzC;;;OAGG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAgED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;kEAUjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAoCvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAgBvC;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;mEAcvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,QAAQ,kBAAkB;;;;;;;;;;;;;;iBAoDjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,UAAU,eAAe,QAAQ,gBAAgB;;;;;;;;;;;;;;mEA8CxF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,uBAAuB,OACzC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAiBvC"}

package/dist/controlPlane/http/handlers.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { workerVersion } from "../../worker/identity.js";
+import { workerVersionMetadata } from "../../worker/identity.js";
 import { ControlPlaneConnection } from "../data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE } from "../data/tables.js";
 import { healthWire } from "../discovery/healthSummary.js";
@@ -8,6 +8,7 @@ import { readCapabilityHealth } from "../discovery/health.js";
 import { ControlPlaneAuditActions, safeEmit } from "../audit/actions.js";
 import { ControlPlaneInvalidCredentialError, ControlPlaneKeyConflictError } from "../error/errors.js";
 import { appendKey, expireKey, pruneKeys } from "../data/keyLifecycle.js";
+import { privacyAttestation, privacyPosture } from "../../privacy/posture.js";
 import { causeMessage } from "../../error/cause.js";
 import { readDatabaseMigrations } from "../migrationState/migrationState.js";
 //#region src/controlPlane/http/handlers.ts
@@ -114,10 +115,16 @@ function manifestHandler(deps) {
 			...declaration,
 			...healthWire(await readCapabilityHealth(sources.get(declaration.name), context.grantedScopes, (source) => source.read(c)))
 		})));
+		const build = workerVersionMetadata(c.env);
 		return c.json({
 			environment: context.environment,
 			connectionId: context.connectionId,
-			version: workerVersion(c.env),
+			version: build.id,
+			versionCreatedAt: build.createdAt,
+			privacy: {
+				...privacyPosture(privacyAttestation(c.env), deps.privacyInventory),
+				retirement: await deps.retirement(c.env)
+			},
 			capabilities,
 			grantedScopes: [...context.grantedScopes]
 		});
@@ -272,5 +279,32 @@ function expireKeyHandler(deps) {
 		});
 	};
 }
+/**
+* `GET /control-plane/privacy` — the full privacy inventory (#132).
+*
+* Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
+* is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
+* between. Behind `privacy:read`, because field names are the kind of thing an adopter may withhold from a client
+* that has no business seeing them. Read-only.
+*/
+function privacyHandler(deps) {
+	return async (c) => {
+		const context = caller(c);
+		const inventory = deps.privacyInventory();
+		return c.json({
+			environment: context.environment,
+			posture: {
+				...privacyPosture(privacyAttestation(c.env), () => inventory),
+				retirement: await deps.retirement(c.env)
+			},
+			schemasWalked: inventory.schemasWalked,
+			schemas: inventory.schemas.map((schema) => ({
+				...schema,
+				fields: schema.fields.map((field) => ({ ...field })),
+				encrypted: schema.encrypted.map((field) => ({ ...field }))
+			}))
+		});
+	};
+}
 //#endregion
-export { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, registerKeyHandler };
+export { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler };

package/dist/controlPlane/http/responses.d.ts

@@ -245,4 +245,102 @@ export declare const ControlPlaneMigrationsResponse: z.ZodObject<{
     }, z.core.$strip>], "state">>;
 }, z.core.$strip>;
 export type ControlPlaneMigrationsResponse = z.output<typeof ControlPlaneMigrationsResponse>;
+/**
+ * One marked field, as `GET {basePath}/privacy` reports it (#132).
+ *
+ * **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+ * your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
+ */
+export declare const PrivacyFieldView: z.ZodObject<{
+    path: z.ZodString;
+    class: z.ZodString;
+    truncated: z.ZodOptional<z.ZodLiteral<true>>;
+    sameAs: z.ZodOptional<z.ZodString>;
+    encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+    unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strip>;
+export type PrivacyFieldView = z.output<typeof PrivacyFieldView>;
+/** One storage schema holding at least one marked field. */
+export declare const PrivacySchemaView: z.ZodObject<{
+    capability: z.ZodString;
+    storage: z.ZodEnum<{
+        d1: "d1";
+        kv: "kv";
+    }>;
+    container: z.ZodString;
+    name: z.ZodString;
+    fields: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        class: z.ZodString;
+        truncated: z.ZodOptional<z.ZodLiteral<true>>;
+        sameAs: z.ZodOptional<z.ZodString>;
+        encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+        unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>;
+    encrypted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type PrivacySchemaView = z.output<typeof PrivacySchemaView>;
+/**
+ * `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+ *
+ * Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
+ * block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
+ */
+export declare const ControlPlanePrivacyResponse: z.ZodObject<{
+    environment: z.ZodString;
+    posture: z.ZodObject<{
+        declared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        observed: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        counts: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        observedNotDeclared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        declaredNotObserved: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        consoleGate: z.ZodEnum<{
+            enforced: "enforced";
+            not_required: "not_required";
+            unattested: "unattested";
+            unverifiable: "unverifiable";
+        }>;
+        consoleGateReason: z.ZodNullable<z.ZodString>;
+        attestedAt: z.ZodNullable<z.ZodISODateTime>;
+        sources: z.ZodArray<z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>>;
+        retirement: z.ZodOptional<z.ZodObject<{
+            blocked: z.ZodBoolean;
+            reasons: z.ZodArray<z.ZodEnum<{
+                "incomplete-coverage": "incomplete-coverage";
+                stale: "stale";
+                unrotatable: "unrotatable";
+            }>>;
+            liveVersions: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    schemasWalked: z.ZodNumber;
+    schemas: z.ZodArray<z.ZodObject<{
+        capability: z.ZodString;
+        storage: z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>;
+        container: z.ZodString;
+        name: z.ZodString;
+        fields: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            class: z.ZodString;
+            truncated: z.ZodOptional<z.ZodLiteral<true>>;
+            sameAs: z.ZodOptional<z.ZodString>;
+            encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+            unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strip>>;
+        encrypted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlanePrivacyResponse = z.output<typeof ControlPlanePrivacyResponse>;
 //# sourceMappingURL=responses.d.ts.map

package/dist/controlPlane/http/responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/responses.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;;;;;;;;iBAcmF,CAAC;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQwB,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;iBAuBwE,CAAC;AAC9G,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAQyB,CAAC;AAC1D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM6B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;iBAU+C,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,0BAA0B;;;;;;;;;4BAyBkE,CAAC;AAC1G,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAErF,kFAAkF;AAClF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAW8C,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA+BwE,CAAC;AAC3G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO+D,CAAC;AAC3G,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/responses.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;;;;;;;;iBAcmF,CAAC;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQwB,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;iBAuBwE,CAAC;AAC9G,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAQyB,CAAC;AAC1D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM6B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;iBAU+C,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,0BAA0B;;;;;;;;;4BAyBkE,CAAC;AAC1G,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAErF,kFAAkF;AAClF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAW8C,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA+BwE,CAAC;AAC3G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO+D,CAAC;AAC3G,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;iBAmCiB,CAAC;AAC/C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;iBA0BmC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAerC,CAAC;AACJ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/controlPlane/http/responses.js

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { PRIVACY_SOURCES } from "../../privacy/report.js";
 import { ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, Ed25519PublicJwk } from "../data/connection.js";
+import { PrivacyPosture } from "../../privacy/posture.js";
 import { z } from "zod";
 //#region src/controlPlane/http/responses.ts
 /**
@@ -118,5 +120,43 @@ const ControlPlaneMigrationsResponse = z.object({
 	environment: z.string().describe("The environment this Worker answers for."),
 	databases: z.array(MigrationDatabaseView).describe("One entry per database this Worker binds, sorted by database name. One unreadable costs only itself.")
 }).describe("What is applied, pending and undeclared in each bound database, and which run put it there.");
+/**
+* One marked field, as `GET {basePath}/privacy` reports it (#132).
+*
+* **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+* your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
+*/
+const PrivacyFieldView = z.object({
+	path: z.string().describe("Where the field sits. A D1 column path (`email`, `address.line1`, `profile.phone` inside a JSON column), or a KV entry's part first (`key.email`, `value.token`, `metadata.ip`, or `value` for a whole marked value). An array element is `[]`, a record's value `*`."),
+	class: z.string().describe("The privacy class it is marked with: `secret`, `pii`, `phi`, `pci`, or an adopter's own."),
+	truncated: z.literal(true).optional().describe("Set where the class is assumed rather than found: a read ran out of its budget there, or the schema could not be read at all, so any class may be marked below it. Absent where the schema was read to the end."),
+	sameAs: z.string().optional().describe("Set on a reference: the path this field's position was first listed under, once the list reached its cap on paths. The class is marked somewhere beneath both, and the paths beneath this one are those beneath that one."),
+	encryptedAtRest: z.boolean().optional().describe("Whether the field rests encrypted (#390). Absent where the core cannot say — an assumed class, a reference, or a core older than encrypted fields — and never defaulted to false."),
+	unrotatable: z.literal(true).optional().describe("Set on an encrypted field whose storage is not D1: it can never be rotated, and it blocks retirement.")
+}).describe("One marked field and its class.");
+/** One storage schema holding at least one marked field. */
+const PrivacySchemaView = z.object({
+	capability: z.string().describe("The capability that declared the schema, as the manifest's `capabilities[]` names it."),
+	storage: z.enum(PRIVACY_SOURCES).describe("Where it is stored: a `d1` table or a `kv` store."),
+	container: z.string().describe("The D1 database name or the KV namespace name it lives in."),
+	name: z.string().describe("The table name, or the KV store name."),
+	fields: z.array(PrivacyFieldView).describe("Every marked field in it, in schema order."),
+	encrypted: z.array(z.object({
+		path: z.string().describe("Where the encrypted field sits, on the same paths as `fields[].path`."),
+		unrotatable: z.literal(true).optional().describe("Set where the storage is not D1, so the field can never be rotated.")
+	}).describe("One encrypted field.")).optional().describe("Every field marked encrypted at rest, classed or not (#390). Absent on a Worker whose core predates encrypted fields.")
+}).describe("One storage schema and the marked fields it holds.");
+/**
+* `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+*
+* Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
+* block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
+*/
+const ControlPlanePrivacyResponse = z.object({
+	environment: z.string().describe("The environment this Worker answers for."),
+	posture: PrivacyPosture.describe("The declared and observed classes, the delta, and the console gate."),
+	schemasWalked: z.number().int().nonnegative().describe("How many storage schemas were walked, marked or not, across the sources `posture.sources` names."),
+	schemas: z.array(PrivacySchemaView).describe("Every schema holding a marked field, in composition order. A schema with none is not listed.")
+}).describe("Every schema this Worker stores that holds a marked field, each field's path and class, and where it lives.");
 //#endregion
-export { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ExpireKeyResponse, MigrationDatabaseView, MigrationGroupPositionView, MigrationGroupView, MigrationView, PublicKeyView, RegisterKeyResponse };
+export { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, MigrationDatabaseView, MigrationGroupPositionView, MigrationGroupView, MigrationView, PrivacyFieldView, PrivacySchemaView, PublicKeyView, RegisterKeyResponse };

package/dist/controlPlane/http/routes.d.ts

@@ -13,6 +13,7 @@ import { type ControlPlaneHandlerDeps } from "./handlers";
  *   POST /control-plane/keys                  → register a key               (keys:rotate)
  *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
  *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
+ *   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
  *
  * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
  * and that is the shipped state of a Worker nobody has connected.

package/dist/controlPlane/http/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAGhF,OAAO,EACL,KAAK,uBAAuB,EAO7B,MAAM,YAAY,CAAC;AAUpB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAwC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA6EN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAShF,OAAO,EACL,KAAK,uBAAuB,EAQ7B,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CA+C3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA2FN"}

package/dist/controlPlane/http/routes.js

@@ -1,12 +1,12 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE } from "../scope/scope.js";
+import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE } from "../scope/scope.js";
 import { requireControlPlane } from "./guard.js";
 import { describeRoute } from "../../http/routeSpec.js";
 import { validate } from "../../http/validation.js";
 import { ControlPlaneManifest } from "../discovery/adminRoute.js";
-import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, registerKeyHandler } from "./handlers.js";
-import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
+import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler } from "./handlers.js";
+import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
 import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas.js";
 //#region src/controlPlane/http/routes.ts
 /**
@@ -18,6 +18,7 @@ import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas
 *   POST /control-plane/keys                  → register a key               (keys:rotate)
 *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
 *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
+*   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
 *
 * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
 * and that is the shipped state of a Worker nobody has connected.
@@ -80,6 +81,12 @@ function controlPlaneRouteDescriptors(basePath) {
 			path: `${basePath}/migrations`,
 			scope: MIGRATIONS_READ_SCOPE,
 			summary: "What each bound database has applied, what is pending, what is undeclared, and which run put it there. Undeclared is relative to this Worker."
+		},
+		{
+			method: "GET",
+			path: `${basePath}/privacy`,
+			scope: PRIVACY_READ_SCOPE,
+			summary: "Every stored schema holding a privacy-marked field, each field's path and class, and where it lives. Derived from the running code."
 		}
 	];
 }
@@ -121,6 +128,13 @@ function registerControlPlaneRoutes(app, basePath, deps) {
 		scopes: [MIGRATIONS_READ_SCOPE],
 		responses: { 200: ControlPlaneMigrationsResponse }
 	}), requireControlPlane(MIGRATIONS_READ_SCOPE), migrationsHandler(deps));
+	app.get(`${basePath}/privacy`, describeRoute({
+		summary: "Report every stored field marked with a privacy class.",
+		description: "Every D1 table and KV store this Worker composed that holds a privacy-marked field, with each field's path, its class and where it is stored, beside the declared-and-observed posture. Derived at runtime from the deployed schemas. Read-only.",
+		verification: "control-plane",
+		scopes: [PRIVACY_READ_SCOPE],
+		responses: { 200: ControlPlanePrivacyResponse }
+	}), requireControlPlane(PRIVACY_READ_SCOPE), privacyHandler(deps));
 }
 //#endregion
 export { controlPlaneRouteDescriptors, registerControlPlaneRoutes };

package/dist/controlPlane/scope/scope.d.ts

@@ -56,13 +56,23 @@ export declare const KEYS_ROTATE_SCOPE: ControlPlaneScope;
  * manifest entry sit behind it too, so a connection without it gets no number rather than a zero.
  */
 export declare const MIGRATIONS_READ_SCOPE: ControlPlaneScope;
+/**
+ * Read this Worker's full privacy inventory: every storage schema holding a marked field, each marked field's
+ * path, its class, and where it is stored (#132). Read-only — the one route behind it is a `GET`.
+ *
+ * **Its own scope rather than `manifest:read`**, because field names are the kind of thing an adopter may
+ * reasonably withhold from a client that has no business seeing them. The manifest's privacy block carries
+ * classes and counts only, so a connection without this one still sees the posture headline.
+ */
+export declare const PRIVACY_READ_SCOPE: ControlPlaneScope;
 /**
  * The seam's base grant — what `pithy dashboard connect` grants whatever the Worker composes. Ping is absent
  * because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
  *
- * **{@link MIGRATIONS_READ_SCOPE} is absent on purpose.** It is a read — every route requiring it is a `GET`
- * — so `connect` derives it from the seam's `adminRoutes` the way it derives every capability's reads. The
- * base exists for `keys:rotate`, which is not a read and would otherwise drop out.
+ * **{@link MIGRATIONS_READ_SCOPE} and {@link PRIVACY_READ_SCOPE} are absent on purpose.** Each is a read —
+ * every route requiring it is a `GET` — so `connect` derives it from the seam's `adminRoutes` the way it
+ * derives every capability's reads. The base exists for `keys:rotate`, which is not a read and would
+ * otherwise drop out.
  */
 export declare const SEAM_SCOPES: readonly ControlPlaneScope[];
 /**

package/dist/controlPlane/scope/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/scope/scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAQ3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA2D,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAmC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAAqC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,iBAAiB,EAA6C,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIrH"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/scope/scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAQ3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA2D,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAmC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAAqC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAAkC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,iBAAiB,EAA6C,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIrH"}