@pithy-sh/core 0.11.0 → 0.13.0

package/dist/audit/composed.d.ts

@@ -0,0 +1,18 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Capability } from "../capability/capability";
+import { type AuditEmit } from "./recorder";
+/**
+ * The audit recorder for code with no request — a Workflow step (#622).
+ *
+ * A route records through `c.var.emit`. A Workflow has no `c`: the runtime constructs it with `env` and nothing
+ * else. So it finds the composed capability that declares {@link Capability.auditRecorder} — `@pithy-sh/audit`
+ * — and records through that, built over this run's env. With none composed it is {@link noopEmit}, exactly as
+ * `c.var.emit` is in a Worker that composes no audit, so a step can always record without asking first.
+ *
+ * **Non-fatal, whatever the recorder does.** The contract says a recorder never throws; this holds a recorder
+ * to it rather than trusting it, because what a step records has already happened and a throw here would turn
+ * it into a retried step.
+ */
+export declare function composedAuditEmit(capabilities: readonly Capability[], env: Record<string, unknown>): AuditEmit;
+//# sourceMappingURL=composed.d.ts.map

package/dist/audit/composed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composed.d.ts","sourceRoot":"","sources":["../../src/audit/composed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,KAAK,SAAS,EAAY,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAW9G"}

package/dist/audit/composed.js

@@ -0,0 +1,28 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { noopEmit } from "./recorder.js";
+//#region src/audit/composed.ts
+/**
+* The audit recorder for code with no request — a Workflow step (#622).
+*
+* A route records through `c.var.emit`. A Workflow has no `c`: the runtime constructs it with `env` and nothing
+* else. So it finds the composed capability that declares {@link Capability.auditRecorder} — `@pithy-sh/audit`
+* — and records through that, built over this run's env. With none composed it is {@link noopEmit}, exactly as
+* `c.var.emit` is in a Worker that composes no audit, so a step can always record without asking first.
+*
+* **Non-fatal, whatever the recorder does.** The contract says a recorder never throws; this holds a recorder
+* to it rather than trusting it, because what a step records has already happened and a throw here would turn
+* it into a retried step.
+*/
+function composedAuditEmit(capabilities, env) {
+	const provider = capabilities.find((capability) => capability.auditRecorder !== void 0);
+	if (!provider?.auditRecorder) return noopEmit;
+	const record = provider.auditRecorder(env);
+	return async (event) => {
+		try {
+			await record(event);
+		} catch {}
+	};
+}
+//#endregion
+export { composedAuditEmit };

package/dist/audit/recorder.d.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import type { AuditEventInput } from "./auditEvent";
+import type { Loggable } from "../privacy/types";
+import type { AuditEventInput, AuditMetadata } from "./auditEvent";
 /**
  * The recorder seam. `emit()` on the request context (`c.var.emit`) takes one {@link AuditEventInput}
  * and durably records it. `@pithy-sh/audit`'s middleware replaces the default with a real D1-backed
@@ -10,8 +11,15 @@ import type { AuditEventInput } from "./auditEvent";
  * `emit()` is **non-fatal by contract**: it never throws and never rejects, so an audited action is
  * never broken by an audit write. The real recorder swallows and logs its own failures; the no-op
  * simply resolves.
+ *
+ * **`metadata` refuses a value marked with a privacy class** (#132). The trail is the longest-lived internal
+ * surface there is — a row in the adopter's D1 with no retention window — so a `pii()`/`phi()`/`secret()`/
+ * `pci()` value in it, or inside an object in it, is a compile error, by the same `Loggable` rule the logger
+ * applies. `AuditMetadata` the schema stays permissive: a stored row still parses.
  */
-export type AuditEmit = (event: AuditEventInput) => Promise<void>;
+export type AuditEmit = <M extends AuditMetadata = AuditMetadata>(event: Omit<AuditEventInput, "metadata"> & {
+    metadata?: (M & Loggable<M>) | null | undefined;
+}) => Promise<void>;
 /**
  * The default recorder when no audit capability is composed: accept the event and drop it. Resolves
  * without throwing, so calling `emit()` is always safe whether or not auditing is installed.

package/dist/audit/recorder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../src/audit/recorder.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,SAA0B,CAAC"}
+{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../src/audit/recorder.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EAC9D,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,KAC3F,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,SAA0B,CAAC"}

package/dist/capability/capability.d.ts

@@ -24,6 +24,7 @@ import type { SeedSet } from "../seed/seed";
 import type { WorkflowSpecMap } from "../workflow/spec";
 import { BindingSpec, type BindingSpecInput } from "./bindings";
 import type { ClientProjection, ClientProjectionContext } from "./client";
+import { type PurgeContribution } from "./purge";
 import type { CapabilitySettings } from "./settings";
 /** Hono `Variables` every capability's routes are typed against. `createBackend` seeds these per request. */
 export interface PithyVars {
@@ -611,6 +612,17 @@ export interface Capability<Databases extends DatabaseSpecMap = DatabaseSpecMap,
      * capability that declares one (e.g. `@pithy-sh/email`'s bounce/complaint handler).
      */
     email?: CapabilityEmailHandler;
+    /**
+     * The audit recorder this capability provides **for code that has no request** — a Workflow step, which the
+     * runtime constructs with `env` and nothing else (#622). `@pithy-sh/audit` declares it; nothing else does.
+     *
+     * A route records through `c.var.emit`, which the same capability's middleware fills, and keeps doing that.
+     * This is the other door, for the purge that erases a deleted account: it runs in a Workflow and still owes
+     * the trail its event. `../audit/composed.ts` finds it among the composed capabilities, so a capability that
+     * audits from a step imports no audit package — principle 4, the same reason `c.var.emit` is a seam. Built
+     * from the env per call, like the request recorder is built per request. Non-fatal by the same contract.
+     */
+    auditRecorder?: (env: Record<string, unknown>) => AuditEmit;
     /**
      * Named D1 databases this capability contributes tables to (database name → {@link DatabaseSpec}).
      * `createBackend` merges every capability's slices per database (via `composeDatabases`) and serves
@@ -637,6 +649,17 @@ export interface Capability<Databases extends DatabaseSpecMap = DatabaseSpecMap,
      * time, and read by `pithy doctor`.
      */
     extensions?: readonly CapabilityExtension[];
+    /**
+     * How this capability erases one subject's rows when that subject is purged — see `./purge.ts`. Omit it
+     * when this capability holds nothing keyed to a person, which is the ordinary case.
+     *
+     * **The purge Workflow runs each composed contribution as its own step**, named for this capability, so a
+     * failure retries this capability alone and the steps that finished are not re-run. That is why there is
+     * at most one per subject here, and why `erase` must succeed when there is nothing left to erase.
+     * `defineCapability` refuses a contribution for a subject the kit does not know. An adopter declares one
+     * on their own `app` capability for their own tables, with the same types.
+     */
+    purge?: readonly PurgeContribution[];
     /**
      * The role powers this capability's own routes gate on, through the acting-organization seam —
      * `media:manage`, `storage:manage`. Omit it when a capability asks no power, which is the normal case.

package/dist/capability/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/capability/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACpD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,EAAE,UAAU,CAAC;IACd;;;;;;;;;OASG;IACH,YAAY,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;;;;;;;;OASG;IACH,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,iHAAiH;AACjH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;AAEhE;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,qGAAqG;IACrG,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,gBAAgB,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU,CACzB,SAAS,SAAS,eAAe,GAAG,eAAe,EACnD,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAC1D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,eAAe;IAEnD;;;;OAIG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACtD;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACnD,gCAAgC;IAChC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,gBAAgB,CAAC;IAChE;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,yFAAyF;IACzF,gBAAgB,EAAE,WAAW,EAAE,CAAC;CACjC;AAED,mGAAmG;AACnG,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EACxD,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC5D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IACtD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,kBAAkB,CAAC,GAAG;IACjF,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,CAAC,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAClE,KAAK,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAClC,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,EAAE,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAUpH;AAED,sGAAsG;AACtG,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;AAEpH,kFAAkF;AAClF,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE7G,sFAAsF;AACtF,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3G;;;;;GAKG;AACH,KAAK,gBAAgB,CAAC,CAAC,IACrB,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC,GAC1E;KAAG,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;CAAE,GAC5E,KAAK,CAAC;AAEZ;;;;GAIG;AACH,KAAK,YAAY,CAAC,MAAM,EAAE,KAAK,IAC7B,mBAAmB,CAAC,MAAM,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC;AAEpH,sFAAsF;AACtF,MAAM,MAAM,eAAe,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC5E,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACzB,eAAe,CAChB,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC/E,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC1B,kBAAkB,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CACjF,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/capability/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACpD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C;;;;;;;OAOG;IACH,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,EAAE,UAAU,CAAC;IACd;;;;;;;;;OASG;IACH,YAAY,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClD;;;;;;;;;OASG;IACH,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,iHAAiH;AACjH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;AAEhE;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,qGAAqG;IACrG,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,uBAAuB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,gBAAgB,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU,CACzB,SAAS,SAAS,eAAe,GAAG,eAAe,EACnD,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,EAC1D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,eAAe;IAEnD;;;;OAIG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,wDAAwD;IACxD,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACtD;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACnD,gCAAgC;IAChC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,gBAAgB,CAAC;IAChE;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,yFAAyF;IACzF,gBAAgB,EAAE,WAAW,EAAE,CAAC;CACjC;AAED,mGAAmG;AACnG,MAAM,MAAM,eAAe,CACzB,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EACxD,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC5D,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IACtD,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,kBAAkB,CAAC,GAAG;IACjF,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,CAAC,UAAU,SAAS,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAClE,KAAK,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAClC,KAAK,CAAC,SAAS,SAAS,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAC9D,KAAK,EAAE,eAAe,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAapH;AAED,sGAAsG;AACtG,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;AAEpH,kFAAkF;AAClF,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE7G,sFAAsF;AACtF,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3G;;;;;GAKG;AACH,KAAK,gBAAgB,CAAC,CAAC,IACrB,CAAC,SAAS,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC,GAC1E;KAAG,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;CAAE,GAC5E,KAAK,CAAC;AAEZ;;;;GAIG;AACH,KAAK,YAAY,CAAC,MAAM,EAAE,KAAK,IAC7B,mBAAmB,CAAC,MAAM,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC;AAEpH,sFAAsF;AACtF,MAAM,MAAM,eAAe,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC5E,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EACzB,eAAe,CAChB,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CAC/E,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC1B,kBAAkB,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI,YAAY,CACjF,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC"}

package/dist/capability/capability.js

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { BindingSpec } from "./bindings.js";
 import { declareRetained } from "../migrations/retainedDeclaration.js";
+import { assertPurgeContributions } from "./purge.js";
 //#region src/capability/capability.ts
 /**
 * Author a capability. Parses each binding through `BindingSpec` — normalizing `optional`
@@ -11,6 +12,7 @@ import { declareRetained } from "../migrations/retainedDeclaration.js";
 */
 function defineCapability(input) {
 	for (const spec of Object.values(input.databases ?? {})) if (spec.migrations && spec.retained) declareRetained(spec.migrations, spec.retained);
+	if (input.purge) assertPurgeContributions(input.name, input.purge);
 	return {
 		...input,
 		requiredBindings: input.requiredBindings.map((binding) => BindingSpec.parse(binding))

package/dist/capability/purge.d.ts

@@ -0,0 +1,122 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+/**
+ * How a capability says what erasing one subject means for its own rows — the purge contribution.
+ *
+ * ## Why a contribution, and not a cascade
+ *
+ * A hard delete has to reach rows that `@pithy-sh/media`, `@pithy-sh/support`, `@pithy-sh/testers` and the
+ * adopter's own tables hold, and no foreign key reaches across capabilities: each owns its tables, and none
+ * references another's. So the only party that knows how one person's rows are erased — deleted outright,
+ * or anonymized because a ledger must still add up — is the capability that owns them. It says so here,
+ * the way it states its migrations and its seeds, and the purge runs what was composed.
+ *
+ * ## One capability, one step
+ *
+ * The purge Workflow (#622) runs every composed contribution as **its own step**, named for the
+ * capability. A step that fails retries alone, and the ones that finished are not re-run — which is why a
+ * capability may declare at most one contribution per subject, and why every `erase` must be idempotent:
+ * a step is retried after a failure that may have come after its rows were already gone, and erasing
+ * nothing must then succeed.
+ *
+ * ## The same contribution answers an export (#622)
+ *
+ * An access request arrives before an erasure, not after. So a contribution may also say what this capability
+ * holds about the subject, on the read side: `export` answers one JSON object, and the control plane's export
+ * route assembles one document from every composed contribution, in the same order the purge runs them. A
+ * contribution with no `export` is listed as holding rows it did not say how to export, which is the honest
+ * answer and the one an operator can act on.
+ *
+ * ## An adopter declares one too
+ *
+ * On their own `app` capability, for their own tables, with the same types. The contract is exported for
+ * exactly that, and nothing distinguishes a kit contribution from theirs.
+ */
+/**
+ * The kinds of subject a purge erases. Closed, so a typo is refused where it is written rather than becoming
+ * a contribution no purge ever asks for. `organization` joined with organization state (#623): a capability
+ * holding rows scoped to a tenant declares one for it, and the organization purge runs it.
+ */
+export declare const PurgeSubject: z.ZodEnum<{
+    organization: "organization";
+    user: "user";
+}>;
+export type PurgeSubject = z.output<typeof PurgeSubject>;
+/** What one step is handed: who is being erased, and this run's bindings. */
+export interface PurgeContext {
+    /** The subject being erased — its kind, and its id in that kind's own table. */
+    readonly subject: {
+        readonly type: PurgeSubject;
+        readonly id: string;
+    };
+    /** The Worker's bindings for this run, from which the contribution opens its own database. */
+    readonly env: Record<string, unknown>;
+}
+/** One capability's answer to "how are this subject's rows erased". */
+export interface PurgeContribution {
+    /** The kind of subject this erases. */
+    readonly subject: PurgeSubject;
+    /**
+     * One sentence on what is erased or anonymized — `Deletes the user's uploads and their stored bytes.`
+     * Recorded with the step that ran it, so the trail says what a purge did and not only that it ran.
+     */
+    readonly summary: string;
+    /**
+     * Erase or anonymize this subject's rows. **Idempotent**: run again after it succeeded, or after a failure
+     * that came once the rows were gone, it must succeed having found nothing to do. Throwing fails this step
+     * and only this step.
+     */
+    readonly erase: (context: PurgeContext) => Promise<void>;
+    /**
+     * What this capability holds about the subject, as one JSON object — the read side of `erase` (#622). It
+     * answers an access request, so it carries the subject's own data and never a credential: no session token,
+     * no provider token, no push token. Optional: a contribution without one is listed in the export as rows it
+     * erases and did not say how to export. A throw costs this capability's entry, never the document.
+     */
+    readonly export?: (context: PurgeContext) => Promise<Record<string, unknown>>;
+}
+/** One step of a purge: which capability it runs, and the contribution that capability declared. */
+export interface PurgeStep {
+    /** The step's name — the capability's, so a retried step names who failed. */
+    readonly step: string;
+    /** The contribution this step runs. */
+    readonly contribution: PurgeContribution;
+}
+/**
+ * Refuse a capability's purge contributions that no purge could run as declared: an unknown subject, two for
+ * one subject, or one with nothing to record. Called by `defineCapability`, so the refusal names the capability
+ * where it is written rather than surfacing in a Workflow on the day somebody is deleted.
+ */
+export declare function assertPurgeContributions(capability: string, contributions: readonly PurgeContribution[]): void;
+/** The steps a purge of `subject` runs, in composition order — libraries first, the adopter's `app` last. */
+export declare function purgeSteps(capabilities: readonly {
+    readonly name: string;
+    readonly purge?: readonly PurgeContribution[];
+}[], subject: PurgeSubject): PurgeStep[];
+/** What one step's export answered: its data, that it declared none, or that it could not be read. */
+export type PurgeExportEntry = {
+    readonly capability: string;
+    readonly summary: string;
+    readonly state: "exported";
+    readonly data: Record<string, unknown>;
+} | {
+    readonly capability: string;
+    readonly summary: string;
+    readonly state: "not_exported";
+} | {
+    readonly capability: string;
+    readonly summary: string;
+    readonly state: "unavailable";
+};
+/**
+ * Read every step's export for one subject — the export document's body, in step order (#622).
+ *
+ * **Each read is guarded on its own and they run concurrently**, the shape the user pane's sub-reads have
+ * (#380): one capability whose table will not read costs its own entry as `unavailable`, and the rest of the
+ * document still answers the request. What the read threw is not carried — it names a query and a table, and
+ * the document crosses a trust boundary. An answer that is not one object is `unavailable` too, because the
+ * document promises an object per capability and a client validates it.
+ */
+export declare function purgeExports(steps: readonly PurgeStep[], context: PurgeContext): Promise<PurgeExportEntry[]>;
+//# sourceMappingURL=purge.d.ts.map

package/dist/capability/purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.d.ts","sourceRoot":"","sources":["../../src/capability/purge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;EAItB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,8FAA8F;IAC9F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/E;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,iBAAiB,EAAE,GAAG,IAAI,CAoC9G;AAED,6GAA6G;AAC7G,wBAAgB,UAAU,CACxB,YAAY,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAAE,EAAE,EACjG,OAAO,EAAE,YAAY,GACpB,SAAS,EAAE,CAOb;AAED,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,GACD;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAO7F;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAclH"}

package/dist/capability/purge.js

@@ -0,0 +1,131 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { ValidationError } from "../error/pithyError.js";
+import { z } from "zod";
+//#region src/capability/purge.ts
+/**
+* How a capability says what erasing one subject means for its own rows — the purge contribution.
+*
+* ## Why a contribution, and not a cascade
+*
+* A hard delete has to reach rows that `@pithy-sh/media`, `@pithy-sh/support`, `@pithy-sh/testers` and the
+* adopter's own tables hold, and no foreign key reaches across capabilities: each owns its tables, and none
+* references another's. So the only party that knows how one person's rows are erased — deleted outright,
+* or anonymized because a ledger must still add up — is the capability that owns them. It says so here,
+* the way it states its migrations and its seeds, and the purge runs what was composed.
+*
+* ## One capability, one step
+*
+* The purge Workflow (#622) runs every composed contribution as **its own step**, named for the
+* capability. A step that fails retries alone, and the ones that finished are not re-run — which is why a
+* capability may declare at most one contribution per subject, and why every `erase` must be idempotent:
+* a step is retried after a failure that may have come after its rows were already gone, and erasing
+* nothing must then succeed.
+*
+* ## The same contribution answers an export (#622)
+*
+* An access request arrives before an erasure, not after. So a contribution may also say what this capability
+* holds about the subject, on the read side: `export` answers one JSON object, and the control plane's export
+* route assembles one document from every composed contribution, in the same order the purge runs them. A
+* contribution with no `export` is listed as holding rows it did not say how to export, which is the honest
+* answer and the one an operator can act on.
+*
+* ## An adopter declares one too
+*
+* On their own `app` capability, for their own tables, with the same types. The contract is exported for
+* exactly that, and nothing distinguishes a kit contribution from theirs.
+*/
+/**
+* The kinds of subject a purge erases. Closed, so a typo is refused where it is written rather than becoming
+* a contribution no purge ever asks for. `organization` joined with organization state (#623): a capability
+* holding rows scoped to a tenant declares one for it, and the organization purge runs it.
+*/
+const PurgeSubject = z.enum(["user", "organization"]).describe("The kind of subject a purge erases. `user` is one person's account in `@pithy-sh/auth`, identified by its user id. `organization` is one tenant in `@pithy-sh/organization`, identified by its organization id.");
+/**
+* Refuse a capability's purge contributions that no purge could run as declared: an unknown subject, two for
+* one subject, or one with nothing to record. Called by `defineCapability`, so the refusal names the capability
+* where it is written rather than surfacing in a Workflow on the day somebody is deleted.
+*/
+function assertPurgeContributions(capability, contributions) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const contribution of contributions) {
+		const subject = PurgeSubject.safeParse(contribution.subject);
+		if (!subject.success) throw new ValidationError({
+			message: `The ${capability} capability declares a purge for "${String(contribution.subject)}", which is not a subject a purge erases.`,
+			action: `Declare it for one of: ${PurgeSubject.options.join(", ")}.`
+		});
+		if (seen.has(subject.data)) throw new ValidationError({
+			message: `The ${capability} capability declares two purge contributions for ${subject.data}.`,
+			action: "Fold them into one: each capability is one step of the purge, and a retried step re-runs all of it."
+		});
+		seen.add(subject.data);
+		if (contribution.summary.trim() === "") throw new ValidationError({
+			message: `The ${capability} capability's ${subject.data} purge has no summary.`,
+			action: "Say in one sentence what it erases. The purge records it with the step."
+		});
+		if (contribution.export !== void 0 && typeof contribution.export !== "function") throw new ValidationError({
+			message: `The ${capability} capability's ${subject.data} purge has an export that is not a function.`,
+			action: "Give it an `export` that answers what this capability holds about the subject, or leave it out."
+		});
+		if (typeof contribution.erase !== "function") throw new ValidationError({
+			message: `The ${capability} capability's ${subject.data} purge has no erase function.`,
+			action: "Give it an `erase` that removes or anonymizes the subject's rows."
+		});
+	}
+}
+/** The steps a purge of `subject` runs, in composition order — libraries first, the adopter's `app` last. */
+function purgeSteps(capabilities, subject) {
+	const steps = [];
+	for (const capability of capabilities) {
+		const contribution = capability.purge?.find((candidate) => candidate.subject === subject);
+		if (contribution) steps.push({
+			step: capability.name,
+			contribution
+		});
+	}
+	return steps;
+}
+/** Whether an export answered what the contract promises: one plain object. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read every step's export for one subject — the export document's body, in step order (#622).
+*
+* **Each read is guarded on its own and they run concurrently**, the shape the user pane's sub-reads have
+* (#380): one capability whose table will not read costs its own entry as `unavailable`, and the rest of the
+* document still answers the request. What the read threw is not carried — it names a query and a table, and
+* the document crosses a trust boundary. An answer that is not one object is `unavailable` too, because the
+* document promises an object per capability and a client validates it.
+*/
+async function purgeExports(steps, context) {
+	return Promise.all(steps.map(async ({ step, contribution }) => {
+		const base = {
+			capability: step,
+			summary: contribution.summary
+		};
+		const read = contribution.export;
+		if (read === void 0) return {
+			...base,
+			state: "not_exported"
+		};
+		try {
+			const data = await read(context);
+			return isRecord(data) ? {
+				...base,
+				state: "exported",
+				data
+			} : {
+				...base,
+				state: "unavailable"
+			};
+		} catch {
+			return {
+				...base,
+				state: "unavailable"
+			};
+		}
+	}));
+}
+//#endregion
+export { PurgeSubject, assertPurgeContributions, purgeExports, purgeSteps };

package/dist/cli/commandCatalog.generated.d.ts

@@ -783,7 +783,7 @@ export declare const COMMANDS: {
                 readonly required: false;
                 readonly repeatable: false;
                 readonly default: "welcome";
-                readonly enum: readonly ["magicLink", "supportReply", "otp", "welcome", "securityAlert", "invite", "testerNudge", "passwordChanged", "operationalNotice", "newsletter", "leadCapture", "marketingCampaign"];
+                readonly enum: readonly ["magicLink", "supportReply", "otp", "welcome", "securityAlert", "invite", "testerNudge", "passwordChanged", "accountSuspended", "accountReinstated", "deletionScheduled", "deletionComplete", "organizationMemberAdded", "organizationMemberRemoved", "organizationOwnershipTransferred", "organizationSuspended", "organizationReinstated", "organizationDeletionScheduled", "operationalNotice", "newsletter", "leadCapture", "marketingCampaign"];
             };
             readonly "--from": {
                 readonly type: "string";
@@ -1096,6 +1096,33 @@ export declare const COMMANDS: {
         };
         readonly groups: readonly [];
     };
+    readonly "privacy enable": {
+        readonly positionals: readonly [];
+        readonly flags: {
+            readonly "--class": {
+                readonly type: "string";
+                readonly required: false;
+                readonly repeatable: true;
+            };
+            readonly "--json": {
+                readonly type: "boolean";
+                readonly required: false;
+                readonly repeatable: false;
+            };
+        };
+        readonly groups: readonly [];
+    };
+    readonly "privacy scan": {
+        readonly positionals: readonly [];
+        readonly flags: {
+            readonly "--json": {
+                readonly type: "boolean";
+                readonly required: false;
+                readonly repeatable: false;
+            };
+        };
+        readonly groups: readonly [];
+    };
     readonly provision: {
         readonly positionals: readonly [];
         readonly flags: {
@@ -1285,6 +1312,31 @@ export declare const COMMANDS: {
         };
         readonly groups: readonly [];
     };
+    readonly "secrets retire-version": {
+        readonly positionals: readonly [{
+            readonly name: "version";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly flags: {
+            readonly "--env": {
+                readonly type: "string";
+                readonly required: false;
+                readonly repeatable: false;
+            };
+            readonly "--past-guard": {
+                readonly type: "boolean";
+                readonly required: false;
+                readonly repeatable: false;
+            };
+            readonly "--json": {
+                readonly type: "boolean";
+                readonly required: false;
+                readonly repeatable: false;
+            };
+        };
+        readonly groups: readonly [];
+    };
     readonly "secrets rm": {
         readonly positionals: readonly [{
             readonly name: "name";
@@ -2433,5 +2485,5 @@ export declare const COMMANDS: {
 /** The flags every command takes, answered before any command runs. */
 export declare const GLOBAL_FLAGS: readonly ["--help", "--no-input", "--no-pretty", "--pithier", "--pithiest", "--pretty", "--version", "-h", "-v"];
 /** The groups, which only list their subcommands: a sentence may name one, and nobody runs one. */
-export declare const GROUPS: readonly ["cloudflare", "dashboard", "docs", "email", "feature", "media", "payments", "secrets", "storage", "support", "testers", "token", "turnstile", "ui", "vector", "worker"];
+export declare const GROUPS: readonly ["cloudflare", "dashboard", "docs", "email", "feature", "media", "payments", "privacy", "secrets", "storage", "support", "testers", "token", "turnstile", "ui", "vector", "worker"];
 //# sourceMappingURL=commandCatalog.generated.d.ts.map