@pithy-sh/core 0.12.0 → 0.14.0

package/dist/controlPlane/scope/scope.js

@@ -41,14 +41,14 @@ const MANIFEST_READ_SCOPE = "manifest:read";
 const KEYS_ROTATE_SCOPE = "keys:rotate";
 /**
 * Read where each database this Worker binds stands: what is applied, what is pending, what is undeclared,
-* and which run put it there (#729). Read-only by construction — every route behind it is a `GET`, and
+* and which run put it there. Read-only by construction — every route behind it is a `GET`, and
 * nothing over the seam runs, reverses or resets a migration. The two migration health keys on the seam's
 * manifest entry sit behind it too, so a connection without it gets no number rather than a zero.
 */
 const MIGRATIONS_READ_SCOPE = "migrations:read";
 /**
 * Read this Worker's full privacy inventory: every storage schema holding a marked field, each marked field's
-* path, its class, and where it is stored (#132). Read-only — the one route behind it is a `GET`.
+* path, its class, and where it is stored. Read-only — the one route behind it is a `GET`.
 *
 * **Its own scope rather than `manifest:read`**, because field names are the kind of thing an adopter may
 * reasonably withhold from a client that has no business seeing them. The manifest's privacy block carries
@@ -56,10 +56,65 @@ const MIGRATIONS_READ_SCOPE = "migrations:read";
 */
 const PRIVACY_READ_SCOPE = "privacy:read";
 /**
+* Read this Worker's evidence pack: the SOC 2 and ISO 27001 evidence it derives from its own declarations.
+* Read-only — the one route behind it is a `GET`, and it performs nothing it reports on.
+*
+* **Its own scope**, because the pack reads across the seam: every connection's principal, kind, purpose and
+* grant, and every route's verification. It never widens another scope. A fact a capability keeps behind its own
+* read — migration counts behind {@link MIGRATIONS_READ_SCOPE}, a capability's health behind that capability's
+* scope — stays behind it, and a connection without that scope gets `not-derivable` naming it.
+*/
+const EVIDENCE_READ_SCOPE = "evidence:read";
+/**
+* Read the erasure attestation: one subject's purge, or every purge in a period, with the audit events that
+* record each step. Read-only — both routes behind it are `GET`s — and kind `reads`.
+*
+* **Its own scope**, because it answers across subjects: which accounts and organizations were deleted, by which
+* kind of actor and why. It carries nothing about a person beyond the id the lifecycle trail already keeps, and it
+* never widens `audit:events:read`: it cites an event by id and chain position, never its contents.
+*/
+const ERASURE_READ_SCOPE = "erasure:read";
+/**
+* Read the record of processing activities, GDPR Article 30: each activity's purpose, data classes, legal basis,
+* recipients, retention and measures, and every gap. Read-only — the one route behind it is a `GET` — and kind
+* `reads`.
+*
+* **Its own scope**, because it reads across the Worker: every activity, the consent counts behind each consent
+* basis, and where each stored class sits. It never widens another: the measures carry the evidence pack's states
+* only for a connection that also holds {@link EVIDENCE_READ_SCOPE}, and a gap names a stored table or field only for
+* one that also holds {@link PRIVACY_READ_SCOPE}. Without it, a gap names the capability and the class.
+*/
+const PROCESSING_READ_SCOPE = "processing:read";
+/**
+* Place and release a legal hold on a user, an organization or a tenant's audit trail. A write — both routes
+* behind it are `POST`s — and kind `writes`, so `pithy dashboard connect` offers it and never grants it by default.
+*
+* **It can only preserve.** A hold suspends purges, prunes and inactivity deletions; releasing one returns the subject
+* to the policy the Worker deploys with. No route behind it, or anywhere, shortens a retention.
+*/
+const RETENTION_HOLD_SCOPE = "retention:hold";
+/**
+* Read the legal holds: every hold, standing or released, with who placed it and why. Read-only — the one
+* route behind it is a `GET` — and kind `reads`. The manifest's count of standing holds sits behind it too:
+* `activeHolds`, in the health of the `controlplane` entry.
+*/
+const RETENTION_READ_SCOPE = "retention:read";
+/**
+* List every connection bound to this Worker's environment: who authorized it, what kind of client it is for, its purpose, its
+* credential kinds, its grant and when it was registered or revoked. Kind `reads`. Never key material.
+*/
+const CONNECTIONS_READ_SCOPE = "connections:read";
+/**
+* Revoke every key and trust another connection in this Worker's environment holds, with a reason. Kind
+* `credentials`. Refused on the caller's own connection, which ends through `disconnect`.
+*/
+const CONNECTIONS_REVOKE_SCOPE = "connections:revoke";
+/**
 * The seam's base grant — what `pithy dashboard connect` grants whatever the Worker composes. Ping is absent
 * because it is not grantable; see {@link ANY_VERIFIED_CALLER}.
 *
-* **{@link MIGRATIONS_READ_SCOPE} and {@link PRIVACY_READ_SCOPE} are absent on purpose.** Each is a read —
+* **The seam's reads are absent on purpose** — {@link MIGRATIONS_READ_SCOPE}, {@link PRIVACY_READ_SCOPE},
+* {@link EVIDENCE_READ_SCOPE}, {@link ERASURE_READ_SCOPE}, {@link PROCESSING_READ_SCOPE}. Each is a read —
 * every route requiring it is a `GET` — so `connect` derives it from the seam's `adminRoutes` the way it
 * derives every capability's reads. The base exists for `keys:rotate`, which is not a read and would
 * otherwise drop out.
@@ -83,4 +138,4 @@ function scopeCovers(required, presented, granted) {
 	return granted.includes(required);
 }
 //#endregion
-export { ANY_VERIFIED_CALLER, ControlPlaneScope, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, SEAM_SCOPES, scopeCovers };
+export { ANY_VERIFIED_CALLER, CONNECTIONS_READ_SCOPE, CONNECTIONS_REVOKE_SCOPE, ControlPlaneScope, ERASURE_READ_SCOPE, EVIDENCE_READ_SCOPE, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, PROCESSING_READ_SCOPE, RETENTION_HOLD_SCOPE, RETENTION_READ_SCOPE, SEAM_SCOPES, scopeCovers };

package/dist/controlPlane/token/jws.js

@@ -1,8 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ControlPlaneClaims, ControlPlaneJwsHeader } from "./claims.js";
 import { ControlPlaneInvalidCredentialError } from "../error/errors.js";
 import { base64UrlDecode } from "./base64url.js";
+import { ControlPlaneClaims, ControlPlaneJwsHeader } from "./claims.js";
 //#region src/controlPlane/token/jws.ts
 /**
 * Split a compact JWS, decode it, and validate both segments through their schemas.

package/dist/controlPlane/token/mint.js

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ControlPlaneClaims } from "./claims.js";
 import { base64UrlEncode } from "./base64url.js";
+import { ControlPlaneClaims } from "./claims.js";
 import { sha256Base64Url } from "./digest.js";
 //#region src/controlPlane/token/mint.ts
 /** Base64url a UTF-8 JSON serialization — the encoding both JWS segments use. */

package/dist/controlPlane/wire.d.ts

@@ -30,6 +30,29 @@
  * carrying that header, so a management call would drag the whole auth stack in. See `http/verify.ts`.
  */
 export declare const CONTROL_PLANE_HEADER = "pithy-control-plane";
+/**
+ * The header a workload presents its OIDC token on, when it calls under a trust rather than a key (#722,
+ * `docs/AGENT-ACCESS.md` §6.2).
+ *
+ * Not `Authorization`, for the same reason as {@link CONTROL_PLANE_HEADER}, and not that header either: a call
+ * presents exactly one credential, and two names make "which one is this" a question the verifier never has
+ * to guess at. The token is the provider's own, verified per call; nothing is exchanged for it.
+ */
+export declare const CONTROL_PLANE_OIDC_HEADER = "pithy-control-plane-oidc";
+/**
+ * The header naming which of this environment's trusts an OIDC call claims, by its id — the way a token's
+ * `kid` names a key. Read before the token is verified, so it selects and grants nothing: the trust's issuer,
+ * audience and claims are what the token is then held to.
+ */
+export declare const CONTROL_PLANE_TRUST_HEADER = "pithy-control-plane-trust";
+/**
+ * The header naming the one scope an OIDC call exercises.
+ *
+ * A signed control-plane token names its scope inside the signature. A provider's identity token cannot — it
+ * proves **who**, never **what** — so the call names it out loud, and the seam checks it against the
+ * connection's grant exactly as it checks a token's. A call that names none is refused.
+ */
+export declare const CONTROL_PLANE_SCOPE_HEADER = "pithy-control-plane-scope";
 /**
  * The response header carrying the build that answered a control-plane call.
  *

package/dist/controlPlane/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/controlPlane/wire.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,iCAAiC,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAEnF"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/controlPlane/wire.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC,iCAAiC,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAEnF"}

package/dist/controlPlane/wire.js

@@ -32,6 +32,29 @@
 */
 const CONTROL_PLANE_HEADER = "pithy-control-plane";
 /**
+* The header a workload presents its OIDC token on, when it calls under a trust rather than a key (#722,
+* `docs/AGENT-ACCESS.md` §6.2).
+*
+* Not `Authorization`, for the same reason as {@link CONTROL_PLANE_HEADER}, and not that header either: a call
+* presents exactly one credential, and two names make "which one is this" a question the verifier never has
+* to guess at. The token is the provider's own, verified per call; nothing is exchanged for it.
+*/
+const CONTROL_PLANE_OIDC_HEADER = "pithy-control-plane-oidc";
+/**
+* The header naming which of this environment's trusts an OIDC call claims, by its id — the way a token's
+* `kid` names a key. Read before the token is verified, so it selects and grants nothing: the trust's issuer,
+* audience and claims are what the token is then held to.
+*/
+const CONTROL_PLANE_TRUST_HEADER = "pithy-control-plane-trust";
+/**
+* The header naming the one scope an OIDC call exercises.
+*
+* A signed control-plane token names its scope inside the signature. A provider's identity token cannot — it
+* proves **who**, never **what** — so the call names it out loud, and the seam checks it against the
+* connection's grant exactly as it checks a token's. A call that names none is refused.
+*/
+const CONTROL_PLANE_SCOPE_HEADER = "pithy-control-plane-scope";
+/**
 * The response header carrying the build that answered a control-plane call.
 *
 * Set on every control-plane response — allowed and denied alike, and on every capability's admin
@@ -122,4 +145,4 @@ function differs(before, after) {
 	return before !== after;
 }
 //#endregion
-export { CONTROL_PLANE_HEADER, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, workerBuildChanged };
+export { CONTROL_PLANE_HEADER, CONTROL_PLANE_OIDC_HEADER, CONTROL_PLANE_SCOPE_HEADER, CONTROL_PLANE_TRUST_HEADER, CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER, workerBuildChanged };

package/dist/createBackend.d.ts

@@ -30,6 +30,19 @@ export interface CreateBackendOptions<Caps extends readonly Capability[], App ex
      * absent — e.g. a non-provisioned local run. Falls through to `unknown` when neither is present.
      */
     env?: string;
+    /**
+     * How long this Worker keeps deleted accounts, the audit trail and each class of personal data — the
+     * `retention` block of the Worker's `pithy.config.ts`, which `createEntrypoint(config)` hands through. Parsed and
+     * resolved here, at assembly, so a block that does not parse, or keeps a floored audit action under the floor,
+     * refuses to deploy. See `retention/policy.ts`.
+     */
+    retention?: unknown;
+    /**
+     * The adopter's own processing activities, and the legal bases they state for a capability's — the `processing`
+     * block of the Worker's `pithy.config.ts`. Resolved here over what this Worker composes, so a block that does not
+     * parse, or overrides an activity nothing declares, refuses to deploy. See `processing/activity.ts`.
+     */
+    processing?: unknown;
 }
 /** The Hono env `createBackend` returns — `db`/`kv`/`workflows` typed precisely from the merged capabilities. */
 type BackendEnv<Caps extends readonly Capability[]> = {

package/dist/createBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQ9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF,kCAAkC;AAClC,eAAO,MAAM,UAAU;;;iBAQ+B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA6MrF"}
+{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF,kCAAkC;AAClC,eAAO,MAAM,UAAU;;;iBAQ+B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAqNrF"}

package/dist/createBackend.js

@@ -7,10 +7,14 @@ import { pithyCommandOf } from "./cli/command.js";
 import { BindingSpec } from "./capability/bindings.js";
 import { recordComposition } from "./capability/composition.js";
 import { validateBindings } from "./capability/validateBindings.js";
+import { recordRouteGroups } from "./openapi/routeGroups.js";
+import { describeRoute } from "./http/routeSpec.js";
+import { registerPresenceRoutes } from "./presence/http/routes.js";
 import { refuseEncryptedKvStores } from "./privacy/encryptedColumns.js";
+import { effectiveRetention, recordRetention } from "./retention/composed.js";
 import { workerVersion } from "./worker/identity.js";
-import { describeRoute } from "./http/routeSpec.js";
 import { buildDbRegistry, composeDatabases } from "./data/databases.js";
+import { effectiveProcessing, recordProcessing } from "./processing/composed.js";
 import { isControlPlaneCapability } from "./controlPlane/capability.js";
 import { allowedOriginSet, corsSurface, registerControlPlaneCors } from "./controlPlane/http/cors.js";
 import { registerReadinessGuards } from "./controlPlane/http/readiness.js";
@@ -20,7 +24,7 @@ import { catalogFor, composeMessages } from "./i18n/registry.js";
 import { buildKvRegistry, composeKv } from "./kv/namespaces.js";
 import { bindRequestContext, createWorkerLogger } from "./logger/worker.js";
 import { loggingErrorHandler } from "./logger/errorHandler.js";
-import { recordRouteGroups } from "./openapi/routeGroups.js";
+import { assertToolDeclarations } from "./mcp/tools.js";
 import { HEALTH_PATH } from "./worker/health.js";
 import { registeredWorkflowBinding } from "./workflow/bindings.js";
 import { buildWorkflowDispatcher } from "./workflow/dispatch.js";
@@ -96,6 +100,8 @@ function createBackend(options) {
 	});
 	for (const cap of all) cap.compose?.({ capabilities: all });
 	recordComposition(all);
+	recordRetention(effectiveRetention(options.retention, all));
+	recordProcessing(effectiveProcessing(options.processing, all));
 	const databases = composeDatabases(all);
 	const messages = composeMessages(all);
 	const defaultTranslator = bakedTranslator(catalogFor(messages, "en"));
@@ -162,7 +168,7 @@ function createBackend(options) {
 	* The path is `worker/health.ts`'s, not a literal here. Three other sites need the same string — the
 	* CLI's route allowlist, `pithy deploy`'s post-deploy probe, and the bare home screen a no-auth
 	* scaffold seeds — and that last one is in somebody else's repository, rendering nothing but this
-	* request's answer (#400).
+	* request's answer.
 	*
 	* The version is what turns `pithy deploy`'s post-deploy check from a liveness probe into an
 	* assertion. `status: "ok"` at the declared domain proves *a* Worker is there; it does not prove it is
@@ -198,12 +204,14 @@ function createBackend(options) {
 	for (const cap of all) {
 		const start = app.routes.length;
 		cap.routes?.(app);
+		if (cap.presence && cap.presence.rooms.length > 0) registerPresenceRoutes(app, cap.presence);
 		groups.push({
 			tag: cap.name,
 			routes: app.routes.slice(start)
 		});
 	}
 	recordRouteGroups(app, groups);
+	assertToolDeclarations(groups);
 	return app;
 }
 //#endregion

package/dist/createEntrypoint.d.ts

@@ -3,6 +3,7 @@
 import type { ExecutionContext, ForwardableEmailMessage } from "@cloudflare/workers-types";
 import type { Capability } from "./capability/capability";
 import { type CreateBackendOptions } from "./createBackend";
+import { type QueueBatch } from "./queue/consumer";
 /**
  * A deployable Worker entrypoint: `fetch`, the single inbound `email` handler the runtime permits
  * per Worker, and the single `scheduled` handler it permits for cron triggers. `createBackend`
@@ -23,7 +24,13 @@ export interface PithyEntrypoint {
      */
     email?: (message: ForwardableEmailMessage, env: Record<string, unknown>, ctx: ExecutionContext) => Promise<void>;
     /**
-     * The Worker `scheduled` handler — starts every registered job that declares a `schedule`.
+     * The Worker `scheduled` handler — starts every registered job whose `schedule` is the cron that fired.
+     *
+     * A Worker carries one `scheduled` entry for all of its `triggers.crons`, and the runtime names the one
+     * that fired on `controller.cron`, verbatim as `wrangler.jsonc` declares it. Only the jobs whose
+     * `schedule` is that string start: a daily job composed beside an hourly one must not run every hour,
+     * and the hourly one must not run an extra time at the daily job's minute (#622). An event that names
+     * no cron, or one no job declares, starts nothing.
      *
      * **Present only when at least one job carries a cron.** The reason differs from `email`'s: an
      * inert `email()` silently *drops* mail, which is a correctness bug, whereas an inert `scheduled()`
@@ -43,6 +50,12 @@ export interface PithyEntrypoint {
      * tested in staging.
      */
     scheduled?: (controller: unknown, env: Record<string, unknown>, ctx: ExecutionContext) => Promise<void>;
+    /**
+     * The Worker `queue` handler — hands each composed capability the messages of a batch that name it (#824).
+     * **Present only when at least one capability consumes a queue**, for `email`'s reason: an inert handler would
+     * acknowledge every message delivered to it and drop it.
+     */
+    queue?: (batch: QueueBatch, env: Record<string, unknown>, ctx: ExecutionContext) => Promise<void>;
 }
 /**
  * Assemble capabilities into a Worker entrypoint object — `{ fetch, email }`. Use this instead of

package/dist/createEntrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createEntrypoint.d.ts","sourceRoot":"","sources":["../src/createEntrypoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AAK3E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG;AAkBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,eAAe,CAyD3D"}
+{"version":3,"file":"createEntrypoint.d.ts","sourceRoot":"","sources":["../src/createEntrypoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAmD,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKpG;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxG;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnG;AAyBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,eAAe,CAoE3D"}

package/dist/createEntrypoint.js

@@ -1,10 +1,18 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { createWorkerLogger } from "./logger/worker.js";
 import { triggerWorkflow } from "./workflow/dispatch.js";
 import { composeWorkflows, scheduledWorkflows } from "./workflow/register.js";
 import { createBackend } from "./createBackend.js";
+import { dispatchQueueBatch } from "./queue/consumer.js";
 import { withLocalServices } from "./worker/serviceLoopback.js";
 //#region src/createEntrypoint.ts
+/** The cron expression a `scheduled` event fired for, or `undefined` when the event names none. */
+function firedCron(controller) {
+	if (typeof controller !== "object" || controller === null) return void 0;
+	const cron = controller.cron;
+	return typeof cron === "string" ? cron : void 0;
+}
 /**
 * The raw MIME stream of a `ForwardableEmailMessage` is **single-use** — once one handler reads it,
 * the next sees an empty stream. When more than one capability handles inbound mail we buffer the
@@ -33,15 +41,21 @@ function createEntrypoint(options) {
 	const registry = composeWorkflows(all);
 	const scheduled = scheduledWorkflows(registry);
 	const entrypoint = { fetch: (request, env, ctx) => app.fetch(request, withLocalServices(env), ctx) };
-	if (scheduled.length > 0) entrypoint.scheduled = async (_controller, env) => {
+	if (scheduled.length > 0) entrypoint.scheduled = async (controller, env) => {
+		const cron = firedCron(controller);
 		const failures = [];
-		for (const entry of scheduled) try {
-			await triggerWorkflow(withLocalServices(env), registry, entry.key, {});
-		} catch (error) {
-			failures.push(error);
+		for (const entry of scheduled) {
+			if (entry.spec.schedule !== cron) continue;
+			try {
+				await triggerWorkflow(withLocalServices(env), registry, entry.key, {});
+			} catch (error) {
+				failures.push(error);
+			}
 		}
 		if (failures[0] !== void 0) throw failures[0];
 	};
+	const consumers = new Map(all.flatMap((cap) => cap.queue ? [[cap.name, cap.queue]] : []));
+	if (consumers.size > 0) entrypoint.queue = (batch, env, ctx) => dispatchQueueBatch(batch, consumers, withLocalServices(env), ctx, createWorkerLogger({ name: "queue" }));
 	if (handlers.length > 0) entrypoint.email = async (message, given, ctx) => {
 		const env = withLocalServices(given);
 		if (handlers.length === 1) {