@pithy-sh/core 0.11.0 → 0.13.0

package/dist/controlPlane/http/handlers.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { workerVersion } from "../../worker/identity.js";
+import { workerVersionMetadata } from "../../worker/identity.js";
 import { ControlPlaneConnection } from "../data/connection.js";
 import { CONTROL_PLANE_CONNECTIONS_TABLE } from "../data/tables.js";
 import { healthWire } from "../discovery/healthSummary.js";
@@ -8,6 +8,7 @@ import { readCapabilityHealth } from "../discovery/health.js";
 import { ControlPlaneAuditActions, safeEmit } from "../audit/actions.js";
 import { ControlPlaneInvalidCredentialError, ControlPlaneKeyConflictError } from "../error/errors.js";
 import { appendKey, expireKey, pruneKeys } from "../data/keyLifecycle.js";
+import { privacyAttestation, privacyPosture } from "../../privacy/posture.js";
 import { causeMessage } from "../../error/cause.js";
 import { readDatabaseMigrations } from "../migrationState/migrationState.js";
 //#region src/controlPlane/http/handlers.ts
@@ -114,10 +115,16 @@ function manifestHandler(deps) {
 			...declaration,
 			...healthWire(await readCapabilityHealth(sources.get(declaration.name), context.grantedScopes, (source) => source.read(c)))
 		})));
+		const build = workerVersionMetadata(c.env);
 		return c.json({
 			environment: context.environment,
 			connectionId: context.connectionId,
-			version: workerVersion(c.env),
+			version: build.id,
+			versionCreatedAt: build.createdAt,
+			privacy: {
+				...privacyPosture(privacyAttestation(c.env), deps.privacyInventory),
+				retirement: await deps.retirement(c.env)
+			},
 			capabilities,
 			grantedScopes: [...context.grantedScopes]
 		});
@@ -272,5 +279,32 @@ function expireKeyHandler(deps) {
 		});
 	};
 }
+/**
+* `GET /control-plane/privacy` — the full privacy inventory (#132).
+*
+* Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
+* is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
+* between. Behind `privacy:read`, because field names are the kind of thing an adopter may withhold from a client
+* that has no business seeing them. Read-only.
+*/
+function privacyHandler(deps) {
+	return async (c) => {
+		const context = caller(c);
+		const inventory = deps.privacyInventory();
+		return c.json({
+			environment: context.environment,
+			posture: {
+				...privacyPosture(privacyAttestation(c.env), () => inventory),
+				retirement: await deps.retirement(c.env)
+			},
+			schemasWalked: inventory.schemasWalked,
+			schemas: inventory.schemas.map((schema) => ({
+				...schema,
+				fields: schema.fields.map((field) => ({ ...field })),
+				encrypted: schema.encrypted.map((field) => ({ ...field }))
+			}))
+		});
+	};
+}
 //#endregion
-export { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, registerKeyHandler };
+export { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler };

package/dist/controlPlane/http/responses.d.ts

@@ -245,4 +245,102 @@ export declare const ControlPlaneMigrationsResponse: z.ZodObject<{
     }, z.core.$strip>], "state">>;
 }, z.core.$strip>;
 export type ControlPlaneMigrationsResponse = z.output<typeof ControlPlaneMigrationsResponse>;
+/**
+ * One marked field, as `GET {basePath}/privacy` reports it (#132).
+ *
+ * **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+ * your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
+ */
+export declare const PrivacyFieldView: z.ZodObject<{
+    path: z.ZodString;
+    class: z.ZodString;
+    truncated: z.ZodOptional<z.ZodLiteral<true>>;
+    sameAs: z.ZodOptional<z.ZodString>;
+    encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+    unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strip>;
+export type PrivacyFieldView = z.output<typeof PrivacyFieldView>;
+/** One storage schema holding at least one marked field. */
+export declare const PrivacySchemaView: z.ZodObject<{
+    capability: z.ZodString;
+    storage: z.ZodEnum<{
+        d1: "d1";
+        kv: "kv";
+    }>;
+    container: z.ZodString;
+    name: z.ZodString;
+    fields: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        class: z.ZodString;
+        truncated: z.ZodOptional<z.ZodLiteral<true>>;
+        sameAs: z.ZodOptional<z.ZodString>;
+        encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+        unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>;
+    encrypted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type PrivacySchemaView = z.output<typeof PrivacySchemaView>;
+/**
+ * `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+ *
+ * Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
+ * block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
+ */
+export declare const ControlPlanePrivacyResponse: z.ZodObject<{
+    environment: z.ZodString;
+    posture: z.ZodObject<{
+        declared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        observed: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        counts: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+        observedNotDeclared: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        declaredNotObserved: z.ZodNullable<z.ZodArray<z.ZodString>>;
+        consoleGate: z.ZodEnum<{
+            enforced: "enforced";
+            not_required: "not_required";
+            unattested: "unattested";
+            unverifiable: "unverifiable";
+        }>;
+        consoleGateReason: z.ZodNullable<z.ZodString>;
+        attestedAt: z.ZodNullable<z.ZodISODateTime>;
+        sources: z.ZodArray<z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>>;
+        retirement: z.ZodOptional<z.ZodObject<{
+            blocked: z.ZodBoolean;
+            reasons: z.ZodArray<z.ZodEnum<{
+                "incomplete-coverage": "incomplete-coverage";
+                stale: "stale";
+                unrotatable: "unrotatable";
+            }>>;
+            liveVersions: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    schemasWalked: z.ZodNumber;
+    schemas: z.ZodArray<z.ZodObject<{
+        capability: z.ZodString;
+        storage: z.ZodEnum<{
+            d1: "d1";
+            kv: "kv";
+        }>;
+        container: z.ZodString;
+        name: z.ZodString;
+        fields: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            class: z.ZodString;
+            truncated: z.ZodOptional<z.ZodLiteral<true>>;
+            sameAs: z.ZodOptional<z.ZodString>;
+            encryptedAtRest: z.ZodOptional<z.ZodBoolean>;
+            unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strip>>;
+        encrypted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            unrotatable: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlanePrivacyResponse = z.output<typeof ControlPlanePrivacyResponse>;
 //# sourceMappingURL=responses.d.ts.map

package/dist/controlPlane/http/responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/responses.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;;;;;;;;iBAcmF,CAAC;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQwB,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;iBAuBwE,CAAC;AAC9G,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAQyB,CAAC;AAC1D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM6B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;iBAU+C,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,0BAA0B;;;;;;;;;4BAyBkE,CAAC;AAC1G,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAErF,kFAAkF;AAClF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAW8C,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA+BwE,CAAC;AAC3G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO+D,CAAC;AAC3G,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/responses.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;;;;;;;;iBAcmF,CAAC;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAQwB,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,+FAA+F;AAC/F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;iBAuBwE,CAAC;AAC9G,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;iBAQyB,CAAC;AAC1D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM6B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,aAAa;;;iBAU+C,CAAC;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,iFAAiF;AACjF,eAAO,MAAM,0BAA0B;;;;;;;;;4BAyBkE,CAAC;AAC1G,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAErF,kFAAkF;AAClF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAW8C,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA+BwE,CAAC;AAC3G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO+D,CAAC;AAC3G,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;iBAmCiB,CAAC;AAC/C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;iBA0BmC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAerC,CAAC;AACJ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/controlPlane/http/responses.js

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { PRIVACY_SOURCES } from "../../privacy/report.js";
 import { ConnectionPrincipal, ConnectionPurpose, ControlPlaneActorKind, Ed25519PublicJwk } from "../data/connection.js";
+import { PrivacyPosture } from "../../privacy/posture.js";
 import { z } from "zod";
 //#region src/controlPlane/http/responses.ts
 /**
@@ -118,5 +120,43 @@ const ControlPlaneMigrationsResponse = z.object({
 	environment: z.string().describe("The environment this Worker answers for."),
 	databases: z.array(MigrationDatabaseView).describe("One entry per database this Worker binds, sorted by database name. One unreadable costs only itself.")
 }).describe("What is applied, pending and undeclared in each bound database, and which run put it there.");
+/**
+* One marked field, as `GET {basePath}/privacy` reports it (#132).
+*
+* **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+* your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
+*/
+const PrivacyFieldView = z.object({
+	path: z.string().describe("Where the field sits. A D1 column path (`email`, `address.line1`, `profile.phone` inside a JSON column), or a KV entry's part first (`key.email`, `value.token`, `metadata.ip`, or `value` for a whole marked value). An array element is `[]`, a record's value `*`."),
+	class: z.string().describe("The privacy class it is marked with: `secret`, `pii`, `phi`, `pci`, or an adopter's own."),
+	truncated: z.literal(true).optional().describe("Set where the class is assumed rather than found: a read ran out of its budget there, or the schema could not be read at all, so any class may be marked below it. Absent where the schema was read to the end."),
+	sameAs: z.string().optional().describe("Set on a reference: the path this field's position was first listed under, once the list reached its cap on paths. The class is marked somewhere beneath both, and the paths beneath this one are those beneath that one."),
+	encryptedAtRest: z.boolean().optional().describe("Whether the field rests encrypted (#390). Absent where the core cannot say — an assumed class, a reference, or a core older than encrypted fields — and never defaulted to false."),
+	unrotatable: z.literal(true).optional().describe("Set on an encrypted field whose storage is not D1: it can never be rotated, and it blocks retirement.")
+}).describe("One marked field and its class.");
+/** One storage schema holding at least one marked field. */
+const PrivacySchemaView = z.object({
+	capability: z.string().describe("The capability that declared the schema, as the manifest's `capabilities[]` names it."),
+	storage: z.enum(PRIVACY_SOURCES).describe("Where it is stored: a `d1` table or a `kv` store."),
+	container: z.string().describe("The D1 database name or the KV namespace name it lives in."),
+	name: z.string().describe("The table name, or the KV store name."),
+	fields: z.array(PrivacyFieldView).describe("Every marked field in it, in schema order."),
+	encrypted: z.array(z.object({
+		path: z.string().describe("Where the encrypted field sits, on the same paths as `fields[].path`."),
+		unrotatable: z.literal(true).optional().describe("Set where the storage is not D1, so the field can never be rotated.")
+	}).describe("One encrypted field.")).optional().describe("Every field marked encrypted at rest, classed or not (#390). Absent on a Worker whose core predates encrypted fields.")
+}).describe("One storage schema and the marked fields it holds.");
+/**
+* `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+*
+* Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
+* block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
+*/
+const ControlPlanePrivacyResponse = z.object({
+	environment: z.string().describe("The environment this Worker answers for."),
+	posture: PrivacyPosture.describe("The declared and observed classes, the delta, and the console gate."),
+	schemasWalked: z.number().int().nonnegative().describe("How many storage schemas were walked, marked or not, across the sources `posture.sources` names."),
+	schemas: z.array(PrivacySchemaView).describe("Every schema holding a marked field, in composition order. A schema with none is not listed.")
+}).describe("Every schema this Worker stores that holds a marked field, each field's path and class, and where it lives.");
 //#endregion
-export { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ExpireKeyResponse, MigrationDatabaseView, MigrationGroupPositionView, MigrationGroupView, MigrationView, PublicKeyView, RegisterKeyResponse };
+export { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, MigrationDatabaseView, MigrationGroupPositionView, MigrationGroupView, MigrationView, PrivacyFieldView, PrivacySchemaView, PublicKeyView, RegisterKeyResponse };

package/dist/controlPlane/http/routes.d.ts

@@ -13,6 +13,7 @@ import { type ControlPlaneHandlerDeps } from "./handlers";
  *   POST /control-plane/keys                  → register a key               (keys:rotate)
  *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
  *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
+ *   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
  *
  * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
  * and that is the shipped state of a Worker nobody has connected.

package/dist/controlPlane/http/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAGhF,OAAO,EACL,KAAK,uBAAuB,EAO7B,MAAM,YAAY,CAAC;AAUpB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAwC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA6EN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAShF,OAAO,EACL,KAAK,uBAAuB,EAQ7B,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CA+C3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA2FN"}

package/dist/controlPlane/http/routes.js

@@ -1,12 +1,12 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE } from "../scope/scope.js";
+import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE } from "../scope/scope.js";
 import { requireControlPlane } from "./guard.js";
 import { describeRoute } from "../../http/routeSpec.js";
 import { validate } from "../../http/validation.js";
 import { ControlPlaneManifest } from "../discovery/adminRoute.js";
-import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, registerKeyHandler } from "./handlers.js";
-import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
+import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler } from "./handlers.js";
+import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
 import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas.js";
 //#region src/controlPlane/http/routes.ts
 /**
@@ -18,6 +18,7 @@ import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas
 *   POST /control-plane/keys                  → register a key               (keys:rotate)
 *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
 *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
+*   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
 *
 * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
 * and that is the shipped state of a Worker nobody has connected.
@@ -80,6 +81,12 @@ function controlPlaneRouteDescriptors(basePath) {
 			path: `${basePath}/migrations`,
 			scope: MIGRATIONS_READ_SCOPE,
 			summary: "What each bound database has applied, what is pending, what is undeclared, and which run put it there. Undeclared is relative to this Worker."
+		},
+		{
+			method: "GET",
+			path: `${basePath}/privacy`,
+			scope: PRIVACY_READ_SCOPE,
+			summary: "Every stored schema holding a privacy-marked field, each field's path and class, and where it lives. Derived from the running code."
 		}
 	];
 }
@@ -121,6 +128,13 @@ function registerControlPlaneRoutes(app, basePath, deps) {
 		scopes: [MIGRATIONS_READ_SCOPE],
 		responses: { 200: ControlPlaneMigrationsResponse }
 	}), requireControlPlane(MIGRATIONS_READ_SCOPE), migrationsHandler(deps));
+	app.get(`${basePath}/privacy`, describeRoute({
+		summary: "Report every stored field marked with a privacy class.",
+		description: "Every D1 table and KV store this Worker composed that holds a privacy-marked field, with each field's path, its class and where it is stored, beside the declared-and-observed posture. Derived at runtime from the deployed schemas. Read-only.",
+		verification: "control-plane",
+		scopes: [PRIVACY_READ_SCOPE],
+		responses: { 200: ControlPlanePrivacyResponse }
+	}), requireControlPlane(PRIVACY_READ_SCOPE), privacyHandler(deps));
 }
 //#endregion
 export { controlPlaneRouteDescriptors, registerControlPlaneRoutes };

package/dist/controlPlane/scope/scope.d.ts

@@ -56,13 +56,23 @@ export declare const KEYS_ROTATE_SCOPE: ControlPlaneScope;
  * manifest entry sit behind it too, so a connection without it gets no number rather than a zero.
  */
 export declare const MIGRATIONS_READ_SCOPE: ControlPlaneScope;
+/**
+ * Read this Worker's full privacy inventory: every storage schema holding a marked field, each marked field's
+ * path, its class, and where it is stored (#132). Read-only — the one route behind it is a `GET`.
+ *
+ * **Its own scope rather than `manifest:read`**, because field names are the kind of thing an adopter may
+ * reasonably withhold from a client that has no business seeing them. The manifest's privacy block carries
+ * classes and counts only, so a connection without this one still sees the posture headline.
+ */
+export declare const PRIVACY_READ_SCOPE: ControlPlaneScope;
 /**
  * The seam's base grant — what `pithy dashboard connect` grants whatever the Worker composes. Ping is absent
  * because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
  *
- * **{@link MIGRATIONS_READ_SCOPE} is absent on purpose.** It is a read — every route requiring it is a `GET`
- * — so `connect` derives it from the seam's `adminRoutes` the way it derives every capability's reads. The
- * base exists for `keys:rotate`, which is not a read and would otherwise drop out.
+ * **{@link MIGRATIONS_READ_SCOPE} and {@link PRIVACY_READ_SCOPE} are absent on purpose.** Each is a read —
+ * every route requiring it is a `GET` — so `connect` derives it from the seam's `adminRoutes` the way it
+ * derives every capability's reads. The base exists for `keys:rotate`, which is not a read and would
+ * otherwise drop out.
  */
 export declare const SEAM_SCOPES: readonly ControlPlaneScope[];
 /**

package/dist/controlPlane/scope/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/scope/scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAQ3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA2D,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAmC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAAqC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,iBAAiB,EAA6C,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIrH"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/scope/scope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAQ3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA2D,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,OAAO,mBAAmB,CAAC;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAmC,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,iBAAiC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,iBAAqC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAAkC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,iBAAiB,EAA6C,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIrH"}

package/dist/controlPlane/scope/scope.js

@@ -47,12 +47,22 @@ const KEYS_ROTATE_SCOPE = "keys:rotate";
 */
 const MIGRATIONS_READ_SCOPE = "migrations:read";
 /**
+* Read this Worker's full privacy inventory: every storage schema holding a marked field, each marked field's
+* path, its class, and where it is stored (#132). Read-only — the one route behind it is a `GET`.
+*
+* **Its own scope rather than `manifest:read`**, because field names are the kind of thing an adopter may
+* reasonably withhold from a client that has no business seeing them. The manifest's privacy block carries
+* classes and counts only, so a connection without this one still sees the posture headline.
+*/
+const PRIVACY_READ_SCOPE = "privacy:read";
+/**
 * The seam's base grant — what `pithy dashboard connect` grants whatever the Worker composes. Ping is absent
 * because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
 *
-* **{@link MIGRATIONS_READ_SCOPE} is absent on purpose.** It is a read — every route requiring it is a `GET`
-* — so `connect` derives it from the seam's `adminRoutes` the way it derives every capability's reads. The
-* base exists for `keys:rotate`, which is not a read and would otherwise drop out.
+* **{@link MIGRATIONS_READ_SCOPE} and {@link PRIVACY_READ_SCOPE} are absent on purpose.** Each is a read —
+* every route requiring it is a `GET` — so `connect` derives it from the seam's `adminRoutes` the way it
+* derives every capability's reads. The base exists for `keys:rotate`, which is not a read and would
+* otherwise drop out.
 */
 const SEAM_SCOPES = [MANIFEST_READ_SCOPE, KEYS_ROTATE_SCOPE];
 /**
@@ -73,4 +83,4 @@ function scopeCovers(required, presented, granted) {
 	return granted.includes(required);
 }
 //#endregion
-export { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, SEAM_SCOPES, scopeCovers };
+export { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES, scopeCovers };

package/dist/createBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAO9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF,kCAAkC;AAClC,eAAO,MAAM,UAAU;;;iBAQ+B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA0MrF"}
+{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQ9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF,kCAAkC;AAClC,eAAO,MAAM,UAAU;;;iBAQ+B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA6MrF"}

package/dist/createBackend.js

@@ -7,6 +7,7 @@ import { pithyCommandOf } from "./cli/command.js";
 import { BindingSpec } from "./capability/bindings.js";
 import { recordComposition } from "./capability/composition.js";
 import { validateBindings } from "./capability/validateBindings.js";
+import { refuseEncryptedKvStores } from "./privacy/encryptedColumns.js";
 import { workerVersion } from "./worker/identity.js";
 import { describeRoute } from "./http/routeSpec.js";
 import { buildDbRegistry, composeDatabases } from "./data/databases.js";
@@ -99,6 +100,7 @@ function createBackend(options) {
 	const messages = composeMessages(all);
 	const defaultTranslator = bakedTranslator(catalogFor(messages, "en"));
 	const namespaces = composeKv(all);
+	refuseEncryptedKvStores(all);
 	const workflows = composeWorkflows(all);
 	const required = dedupeBindings([
 		...all.flatMap((cap) => cap.requiredBindings),

package/dist/createEntrypoint.d.ts

@@ -23,7 +23,13 @@ export interface PithyEntrypoint {
      */
     email?: (message: ForwardableEmailMessage, env: Record<string, unknown>, ctx: ExecutionContext) => Promise<void>;
     /**
-     * The Worker `scheduled` handler — starts every registered job that declares a `schedule`.
+     * The Worker `scheduled` handler — starts every registered job whose `schedule` is the cron that fired.
+     *
+     * A Worker carries one `scheduled` entry for all of its `triggers.crons`, and the runtime names the one
+     * that fired on `controller.cron`, verbatim as `wrangler.jsonc` declares it. Only the jobs whose
+     * `schedule` is that string start: a daily job composed beside an hourly one must not run every hour,
+     * and the hourly one must not run an extra time at the daily job's minute (#622). An event that names
+     * no cron, or one no job declares, starts nothing.
      *
      * **Present only when at least one job carries a cron.** The reason differs from `email`'s: an
      * inert `email()` silently *drops* mail, which is a correctness bug, whereas an inert `scheduled()`

package/dist/createEntrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createEntrypoint.d.ts","sourceRoot":"","sources":["../src/createEntrypoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AAK3E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG;AAkBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,eAAe,CAyD3D"}
+{"version":3,"file":"createEntrypoint.d.ts","sourceRoot":"","sources":["../src/createEntrypoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AAK3E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG;AAyBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,eAAe,CA2D3D"}

package/dist/createEntrypoint.js

@@ -5,6 +5,12 @@ import { composeWorkflows, scheduledWorkflows } from "./workflow/register.js";
 import { createBackend } from "./createBackend.js";
 import { withLocalServices } from "./worker/serviceLoopback.js";
 //#region src/createEntrypoint.ts
+/** The cron expression a `scheduled` event fired for, or `undefined` when the event names none. */
+function firedCron(controller) {
+	if (typeof controller !== "object" || controller === null) return void 0;
+	const cron = controller.cron;
+	return typeof cron === "string" ? cron : void 0;
+}
 /**
 * The raw MIME stream of a `ForwardableEmailMessage` is **single-use** — once one handler reads it,
 * the next sees an empty stream. When more than one capability handles inbound mail we buffer the
@@ -33,12 +39,16 @@ function createEntrypoint(options) {
 	const registry = composeWorkflows(all);
 	const scheduled = scheduledWorkflows(registry);
 	const entrypoint = { fetch: (request, env, ctx) => app.fetch(request, withLocalServices(env), ctx) };
-	if (scheduled.length > 0) entrypoint.scheduled = async (_controller, env) => {
+	if (scheduled.length > 0) entrypoint.scheduled = async (controller, env) => {
+		const cron = firedCron(controller);
 		const failures = [];
-		for (const entry of scheduled) try {
-			await triggerWorkflow(withLocalServices(env), registry, entry.key, {});
-		} catch (error) {
-			failures.push(error);
+		for (const entry of scheduled) {
+			if (entry.spec.schedule !== cron) continue;
+			try {
+				await triggerWorkflow(withLocalServices(env), registry, entry.key, {});
+			} catch (error) {
+				failures.push(error);
+			}
 		}
 		if (failures[0] !== void 0) throw failures[0];
 	};

package/dist/crypto/envelope.d.ts

@@ -0,0 +1,86 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+/**
+ * **The AES-256-GCM envelope: one primitive, two callers** (#390).
+ *
+ * It was `@pithy-sh/secrets`' own, ported from the CMS `secretsCrypto`, and it sealed that capability's rows and
+ * nothing else. Field encryption needs the same primitive inside an adopter's own Workers, and a capability may not
+ * depend on another's internals (principle 4), so it lives in core now and both callers import it from here. The
+ * format did not change: a row secrets sealed before the move opens after it, byte for byte.
+ *
+ * ## Two version axes
+ *
+ * `currentVersion` says which key seals new writes, and the `keyVersion` persisted on every envelope says which key
+ * opens it. A rotation adds a version, moves the pointer and keeps the old key until nothing is sealed under it, so
+ * a row opens under whichever version sealed it, for as long as that version is in the set. This is the
+ * *encryption-key* version. A secret's *value* version is a separate concern (`secrets/src/crypto/versionedValue.ts`).
+ *
+ * The config is the uniform `{ currentVersion, versions }` shape every versioned value uses, plus `lastRotatedAt`
+ * beside it as rotation metadata. Version keys are stringified integers, so reading the keys is a full-set read:
+ * every still-valid version, never the current one alone.
+ *
+ * ## The bound context is the caller's, and it is authenticated
+ *
+ * Every seal binds a **context** string as AES-GCM additional authenticated data. It is not encrypted; it is bound.
+ * Without it a ciphertext is valid under the key alone, so one lifted from one row and written into another opens
+ * cleanly, and every decision about which value a caller gets lives in the query above. With it, a moved ciphertext
+ * fails inside the primitive, however that query is later rewritten.
+ *
+ * The primitive takes the context whole, because what to bind is the caller's fact, not this module's:
+ *
+ * - `@pithy-sh/secrets` binds `pithy.secrets.v1:<stored name>` — exactly what it always bound.
+ * - A field marked `encrypted()` binds `pithy/enc/1:<declared name>:<field path>:<primary key>` (`../privacy/sealed`).
+ *
+ * Each prefix is versioned, so a later change to what is bound is a deliberate, visible break, and the two prefixes
+ * are distinct, so a secret's ciphertext never opens as a field and a field's never opens as a secret. **What is bound
+ * must be stable for the life of the ciphertext**: each caller states why its own context is.
+ *
+ * An empty context is refused on both halves. It binds nothing, and it would fail open rather than loudly.
+ */
+/** The key set a seal draws from: which version is current, every still-valid key, and when it last rotated. */
+export declare const EncryptionConfig: z.ZodObject<{
+    currentVersion: z.ZodString;
+    versions: z.ZodRecord<z.ZodString, z.ZodString>;
+    lastRotatedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type EncryptionConfig = z.output<typeof EncryptionConfig>;
+/**
+ * One AES-256-GCM envelope: base64 ciphertext, base64 IV, and the key version that sealed it.
+ *
+ * The bound context is deliberately not in here. It is supplied by the caller on the way back in, from the row's own
+ * identity, so a row that has been moved cannot carry its old context with it.
+ */
+export declare const EncryptedEnvelope: z.ZodObject<{
+    encryptedValue: z.ZodString;
+    iv: z.ZodString;
+    keyVersion: z.ZodNumber;
+}, z.core.$strip>;
+export type EncryptedEnvelope = z.output<typeof EncryptedEnvelope>;
+/** What the refusals name the key set by — its binding, so an operator knows which entry to inspect. */
+export interface EnvelopeOptions {
+    /** The binding the key set was read from, e.g. `SECRETS_ENCRYPTION_KEYS`. Defaults to `the key set`. */
+    keys?: string;
+}
+/** Base64-encode raw bytes without spreading into `fromCharCode` (stack-safe, lint-clean). */
+export declare function toBase64(bytes: Uint8Array): string;
+/** Decode base64 to raw bytes. */
+export declare function fromBase64(b64: string): Uint8Array<ArrayBuffer>;
+/** The raw key bytes for `version`, or a refusal naming the key set. Never the key itself. */
+export declare function keyBytes(config: EncryptionConfig, version: number, options?: EnvelopeOptions): Uint8Array<ArrayBuffer>;
+/**
+ * Seal `plaintext` under the config's current key version, binding `context`. The IV is 12 fresh random bytes, so
+ * two seals of one value never share a ciphertext.
+ */
+export declare function encryptValue(config: EncryptionConfig, context: string, plaintext: string, options?: EnvelopeOptions): Promise<EncryptedEnvelope>;
+/**
+ * Open an envelope sealed under `context`. The key version may differ from `currentVersion` during a rotation window;
+ * the matching key must still be in the config.
+ *
+ * A missing key version, a tampered ciphertext, the wrong key, or a ciphertext sealed under another context all throw
+ * — never the plaintext or key material. GCM cannot tell those apart, and separating them for the caller would be an
+ * oracle: the `detail` names the context the open was *attempted under*, which is what an operator needs. Each caller
+ * binds a context composed from validated identifiers, so it is safe in a log; neither binds a value.
+ */
+export declare function decryptValue(config: EncryptionConfig, context: string, envelope: EncryptedEnvelope, options?: EnvelopeOptions): Promise<string>;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/crypto/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/crypto/envelope.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,gHAAgH;AAChH,eAAO,MAAM,gBAAgB;;;;iBAsB1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;iBASqE,CAAC;AACpG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIlD;AAED,kCAAkC;AAClC,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAE/D;AAYD,8FAA8F;AAC9F,wBAAgB,QAAQ,CACtB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,eAAoB,GAC5B,UAAU,CAAC,WAAW,CAAC,CAQzB;AAYD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAkBjB"}