@pithy-sh/core 0.12.0 → 0.14.0

package/dist/cli/commandFacts.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 //#region src/cli/commandFacts.ts
 /**
-* **What the catalog cannot say about a `pithy` command, written down once (#711).**
+* **What the catalog cannot say about a `pithy` command, written down once.**
 *
 * `commandCatalog.generated.ts` is the parser's own account of every command: its arguments, its flags, which
 * are required, which have defaults, which go together. Four facts are not in any parser, and each was the
@@ -29,6 +29,7 @@ const WORKER_SCOPED = [
 	"add",
 	"dashboard connect",
 	"email provision",
+	"mcp connect",
 	"media provision",
 	"payments provision",
 	"storage provision",
@@ -48,15 +49,20 @@ const WORKER_SCOPED = [
 * first that answers, and the flag narrows.
 */
 const WORKER_NARROWS = [
+	"backup",
 	"contract",
+	"dashboard connections",
 	"dashboard disconnect",
 	"dashboard revoke-key",
+	"dashboard revoke-trust",
 	"dashboard rotate",
 	"dashboard status",
 	"doctor",
 	"env",
 	"init",
+	"mcp disconnect",
 	"migrate",
+	"restore",
 	"secrets tables",
 	"seed",
 	"support deprovision",
@@ -93,8 +99,10 @@ const MEANING_ONLY_WITH = {
 const DESTRUCTIVE_COMMANDS = {
 	"dashboard disconnect": "the environment's dashboard connection and the key it signs with",
 	"dashboard revoke-key": "a signing key the dashboard holds",
+	"dashboard revoke-trust": "an OIDC trust a workload calls under",
 	"email deprovision": "the email Workers, and with --suppression the suppression database",
 	"feature destroy": "the feature's worktree, its branch and every resource it provisioned",
+	"mcp disconnect": "an agent's key or trust, its key file and its client entries",
 	"media deprovision": "the media Worker, and with --storage its bucket",
 	remove: "a capability's wiring",
 	"secrets deprovision": "the secrets manager, and with --keys the store's keys",
@@ -116,6 +124,7 @@ const DESTRUCTIVE_FLAGS = {
 	"--destroy-retained": "a resource kept for recovery",
 	"--drop": "a capability's tables",
 	"--redo": "the data a seed wrote",
+	"--revoke": "every key and trust a principal's connections hold",
 	"--rollback": "the schema a migration group applied"
 };
 /**
@@ -190,14 +199,14 @@ const PRODUCTION_CONFIRMS = {
 	"vector provision": null
 };
 /**
-* **A command that acts on every environment when its `--env` is left off (#711)**, production among them. `pithy
+* **A command that acts on every environment when its `--env` is left off**, production among them. `pithy
 * testers provision` with no `--env` provisions every declared environment, so the bare line touches production as
 * surely as `--env prod` does, and is a person's decision for the same reason. Each declares `--env` with no
 * default; `command.test.ts` holds that against the catalog.
 */
 const EVERY_ENVIRONMENT_WITHOUT_ENV = ["testers provision"];
 /**
-* **A command that acts on every environment on every run (#711)**, production among them, with no `--env` to narrow
+* **A command that acts on every environment on every run**, production among them, with no `--env` to narrow
 * it. `pithy secrets provision` deploys each declared environment's manager and mints its store entries, so every line
 * naming it touches production and is a person's decision — never the fix for one binding, one database or one
 * setting. None declares `--env`; `command.test.ts` holds that against the catalog.

package/dist/consent/purpose.d.ts

@@ -0,0 +1,70 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+/**
+ * Consent purposes: what a person is asked to agree to, declared where the processing is.
+ *
+ * ## Declared, never discovered
+ *
+ * A capability that processes under consent says so, the way it states its migrations: `@pithy-sh/email` declares
+ * `email.marketing` and `email.tracking`. The adopter adds their own to `consent({ purposes })`. The consent
+ * capability composes every declaration into one catalog, and `hasConsent` answers only for a purpose in it.
+ *
+ * ## A purpose says what it covers and what it demands
+ *
+ * Beside its notice version, a purpose names the data classes it covers, whether it is **explicit** (GDPR
+ * Article 9), the **minimum method** a grant needs, and whether a withdrawal must be made at least at the grade
+ * of the grant it withdraws, the way a HIPAA revocation must be in writing.
+ *
+ * ## The id is the capability's own
+ *
+ * `<domain>.<name>`, and a capability may declare purposes only under its own `name`, the rule `pithy_<name>_*`
+ * tables and `<name>/…` error codes follow, for the same reason: the domain is what keeps two declarations from
+ * colliding. `defineCapability` refuses anything else, naming the capability.
+ */
+/**
+ * How a grant was given, weakest first. The order is the grade: a purpose's `minimumMethod` refuses a grant below
+ * it, and a purpose with `writtenWithdrawal` refuses a withdrawal below the grant it withdraws.
+ */
+export declare const CONSENT_METHODS: readonly ["click", "typed", "drawn", "provider"];
+/** How a consent was given or withdrawn. */
+export declare const ConsentMethod: z.ZodEnum<{
+    click: "click";
+    drawn: "drawn";
+    provider: "provider";
+    typed: "typed";
+}>;
+export type ConsentMethod = z.output<typeof ConsentMethod>;
+/** A method's grade: its place in {@link CONSENT_METHODS}, so `click` is 0 and `provider` is 3. */
+export declare function methodRank(method: ConsentMethod): number;
+/** Whether `method` meets `minimum`: at its grade or above. */
+export declare function meetsMethod(method: ConsentMethod, minimum: ConsentMethod): boolean;
+/** A purpose id: `<domain>.<name>`, lowercase, the domain being the declaring capability's name. */
+export declare const ConsentPurposeId: z.ZodString;
+export type ConsentPurposeId = z.output<typeof ConsentPurposeId>;
+/** One purpose a capability or the adopter processes under consent. */
+export declare const ConsentPurpose: z.ZodObject<{
+    id: z.ZodString;
+    summary: z.ZodString;
+    noticeVersion: z.ZodNumber;
+    classes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    explicit: z.ZodDefault<z.ZodBoolean>;
+    minimumMethod: z.ZodDefault<z.ZodEnum<{
+        click: "click";
+        drawn: "drawn";
+        provider: "provider";
+        typed: "typed";
+    }>>;
+    writtenWithdrawal: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type ConsentPurpose = z.output<typeof ConsentPurpose>;
+export type ConsentPurposeInput = z.input<typeof ConsentPurpose>;
+/** The domain half of a purpose id: `email` for `email.marketing`. */
+export declare function purposeDomain(id: string): string;
+/**
+ * Parse one declarer's purposes and refuse what no consent capability could answer for: an id that is not a
+ * purpose id, one under a domain that is not the declarer's, or two with one id. `domain` is the declaring
+ * capability's name, or `null` for the adopter's own, which may use any domain but a reserved one.
+ */
+export declare function parseConsentPurposes(declarer: string, purposes: readonly ConsentPurposeInput[], domain: string | null, reserved?: ReadonlySet<string>): ConsentPurpose[];
+//# sourceMappingURL=purpose.d.ts.map

package/dist/consent/purpose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose.d.ts","sourceRoot":"","sources":["../../src/consent/purpose.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe,YAAI,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAEhF,4CAA4C;AAC5C,eAAO,MAAM,aAAa;;;;;EAIvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAE3D,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAElF;AAED,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,aAS1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,cAAc;;;;;;;;;;;;;iBAuCsF,CAAC;AAClH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAC7D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,EACxC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,cAAc,EAAE,CAiClB"}

package/dist/consent/purpose.js

@@ -0,0 +1,97 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { ValidationError } from "../error/pithyError.js";
+import { PrivacyClassName } from "../privacy/classes.js";
+import { z } from "zod";
+//#region src/consent/purpose.ts
+/**
+* Consent purposes: what a person is asked to agree to, declared where the processing is.
+*
+* ## Declared, never discovered
+*
+* A capability that processes under consent says so, the way it states its migrations: `@pithy-sh/email` declares
+* `email.marketing` and `email.tracking`. The adopter adds their own to `consent({ purposes })`. The consent
+* capability composes every declaration into one catalog, and `hasConsent` answers only for a purpose in it.
+*
+* ## A purpose says what it covers and what it demands
+*
+* Beside its notice version, a purpose names the data classes it covers, whether it is **explicit** (GDPR
+* Article 9), the **minimum method** a grant needs, and whether a withdrawal must be made at least at the grade
+* of the grant it withdraws, the way a HIPAA revocation must be in writing.
+*
+* ## The id is the capability's own
+*
+* `<domain>.<name>`, and a capability may declare purposes only under its own `name`, the rule `pithy_<name>_*`
+* tables and `<name>/…` error codes follow, for the same reason: the domain is what keeps two declarations from
+* colliding. `defineCapability` refuses anything else, naming the capability.
+*/
+/**
+* How a grant was given, weakest first. The order is the grade: a purpose's `minimumMethod` refuses a grant below
+* it, and a purpose with `writtenWithdrawal` refuses a withdrawal below the grant it withdraws.
+*/
+const CONSENT_METHODS = [
+	"click",
+	"typed",
+	"drawn",
+	"provider"
+];
+/** How a consent was given or withdrawn. */
+const ConsentMethod = z.enum(CONSENT_METHODS).describe("How a consent was given or withdrawn, weakest first: `click` (a checkbox or a button), `typed` (the person typed their name), `drawn` (a drawn signature), or `provider` (an e-signature provider's completed envelope). The order is the grade a purpose's minimum is held against.");
+/** A method's grade: its place in {@link CONSENT_METHODS}, so `click` is 0 and `provider` is 3. */
+function methodRank(method) {
+	return CONSENT_METHODS.indexOf(method);
+}
+/** Whether `method` meets `minimum`: at its grade or above. */
+function meetsMethod(method, minimum) {
+	return methodRank(method) >= methodRank(minimum);
+}
+/** A purpose id: `<domain>.<name>`, lowercase, the domain being the declaring capability's name. */
+const ConsentPurposeId = z.string().regex(/^[a-z][a-z0-9-]*\.[a-z][a-z0-9_.-]*$/, "A consent purpose id is `<domain>.<name>`: lowercase, the domain being the declaring capability's name.").max(128).describe("A consent purpose id, `<domain>.<name>` — `email.marketing`. The domain is the declaring capability's name, or the adopter's own domain for a purpose declared in `consent({ purposes })`.");
+/** One purpose a capability or the adopter processes under consent. */
+const ConsentPurpose = z.object({
+	id: ConsentPurposeId,
+	summary: z.string().min(1).max(500).describe("One sentence, written for the person, on what agreeing allows — `Send me news and offers by email.` Shown on the consent settings screen."),
+	noticeVersion: z.number().int().positive().describe("The version of the notice a person agrees to. Bump it when the notice changes: every grant under an older version then needs renewing, and `hasConsent` answers no for it until it is."),
+	classes: z.array(PrivacyClassName).default([]).describe("The data classes this purpose covers — `pii`, `phi`, or an adopter's own. The processing record reads it to name a classed field with no consent behind it."),
+	explicit: z.boolean().default(false).describe("Whether this purpose needs explicit consent (GDPR Article 9), as processing health data does. Recorded so an auditor can see which purposes claim it."),
+	minimumMethod: ConsentMethod.default("click").describe("The weakest method a grant may be given by. A grant below it is refused, and `hasConsent` answers no for one recorded below it before the minimum was raised."),
+	writtenWithdrawal: z.boolean().default(false).describe("Whether a withdrawal must be made at least at the grade of the grant it withdraws, as a HIPAA revocation must be in writing. Off, a click withdraws any grant: withdrawing is then never harder than granting.")
+}).describe("One purpose processed under consent: what it allows, its notice version, and what a grant demands.");
+/** The domain half of a purpose id: `email` for `email.marketing`. */
+function purposeDomain(id) {
+	const dot = id.indexOf(".");
+	return dot === -1 ? id : id.slice(0, dot);
+}
+/**
+* Parse one declarer's purposes and refuse what no consent capability could answer for: an id that is not a
+* purpose id, one under a domain that is not the declarer's, or two with one id. `domain` is the declaring
+* capability's name, or `null` for the adopter's own, which may use any domain but a reserved one.
+*/
+function parseConsentPurposes(declarer, purposes, domain, reserved = /* @__PURE__ */ new Set()) {
+	const seen = /* @__PURE__ */ new Set();
+	return purposes.map((input) => {
+		const parsed = ConsentPurpose.safeParse(input);
+		if (!parsed.success) throw new ValidationError({
+			message: `${declarer} declares a consent purpose that is not valid: ${parsed.error.issues[0]?.message ?? "invalid"}.`,
+			action: "Give it an id of the form `<domain>.<name>`, a summary, and a positive notice version."
+		});
+		const purpose = parsed.data;
+		const own = purposeDomain(purpose.id);
+		if (domain !== null && own !== domain) throw new ValidationError({
+			message: `The ${declarer} capability declares the consent purpose "${purpose.id}" outside its own domain.`,
+			action: `Name it under ${domain}. — a capability declares purposes only under its own name.`
+		});
+		if (domain === null && reserved.has(own)) throw new ValidationError({
+			message: `The consent purpose "${purpose.id}" is under ${own}., which a composed capability owns.`,
+			action: "Name your own purposes under your own domain, such as your app's name."
+		});
+		if (seen.has(purpose.id)) throw new ValidationError({
+			message: `${declarer} declares the consent purpose "${purpose.id}" twice.`,
+			action: "Declare each purpose once."
+		});
+		seen.add(purpose.id);
+		return purpose;
+	});
+}
+//#endregion
+export { CONSENT_METHODS, ConsentMethod, ConsentPurpose, ConsentPurposeId, meetsMethod, methodRank, parseConsentPurposes, purposeDomain };

package/dist/consent/reader.d.ts

@@ -0,0 +1,99 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Capability } from "../capability/capability";
+import type { ConsentPurpose } from "./purpose";
+/**
+ * The consent seam: the one question a capability asks before consent-based processing.
+ *
+ * `@pithy-sh/consent` answers it, and nothing imports that package to ask: a capability finds the composed reader
+ * through {@link composedConsent}, the shape `composedAuditEmit` gives the audit recorder, so `@pithy-sh/email`
+ * gates its tracking without depending on a sibling (principle 4).
+ *
+ * **Absent is not "no".** With no consent capability composed there is no record to consult, so
+ * {@link composedConsent} answers `null`, and a capability gates nothing on it. `pithy doctor`
+ * names that state, because processing that a law may require consent for is running with no record behind it.
+ */
+/** The subject a consent is recorded against: an account's user id, or a visitor's anonymous device id. */
+export interface ConsentSubject {
+    /** `account` — a user id from `@pithy-sh/auth`; `visitor` — an anonymous device id held in a first-party cookie. */
+    readonly kind: "account" | "visitor";
+    /** The id in that kind. */
+    readonly id: string;
+}
+/** What the consent capability answers. */
+export interface ConsentReader {
+    /**
+     * Whether `subject` holds consent to `purpose` now: a grant under the purpose's current notice version, at or
+     * above its minimum method, not withdrawn since, and not expired. An account's answer includes what the visitors
+     * merged into it granted. A purpose the catalog does not know answers no.
+     */
+    hasConsent(subject: ConsentSubject, purpose: string): Promise<boolean>;
+    /**
+     * Every purpose in the composed catalog, the adopter's included, with how many subjects stand where on it now. What
+     * the processing record cites for a consent-based activity. Optional on the seam: a reader without it leaves the
+     * counts unknown, never zero.
+     */
+    standings?(): Promise<readonly ConsentPurposeStanding[]>;
+    /**
+     * Every purpose in the composed catalog, the adopter's included, read from memory and never from the record. What
+     * the processing record checks a consent basis against when `standings` cannot answer. Optional on the seam: a
+     * reader without it leaves the catalog unknown, and the record then reports no gap that rests on the catalog.
+     */
+    purposes?(): readonly ConsentPurpose[];
+}
+/** One purpose in the catalog, and where its subjects stand on it now. */
+export interface ConsentPurposeStanding {
+    /** The purpose as the catalog composed it. */
+    readonly purpose: ConsentPurpose;
+    /** Subjects whose latest choice is a grant, under any notice version, expired or not. */
+    readonly grants: number;
+    /** Subjects whose latest choice is a withdrawal. */
+    readonly withdrawals: number;
+    /**
+     * Subjects `hasConsent` answers yes for now: a grant under the current notice version, at or above the purpose's
+     * minimum method, unexpired, and for a visitor not merged into an account, inside the visitor window.
+     */
+    readonly standing: number;
+}
+/** One withdrawal, as a capability that keeps its own state in step with consent is told of it. */
+export interface ConsentWithdrawal {
+    /** Who withdrew. */
+    readonly subject: ConsentSubject;
+    /** What they withdrew from. */
+    readonly purpose: string;
+    /** The Worker's bindings for this request. */
+    readonly env: Record<string, unknown>;
+    /**
+     * The subject's email address, read on demand from the capability that owns accounts, or `null` for a visitor
+     * or an account with none. A function, so a listener that needs no address reads none.
+     */
+    readonly address: () => Promise<string | null>;
+}
+/**
+ * Hear of a withdrawal from one of this capability's own purposes. `@pithy-sh/email` suppresses the address for
+ * marketing when `email.marketing` is withdrawn, so the suppression list and the consent record never disagree.
+ * Called after the withdrawal is recorded; a throw is the listener's own failure and never undoes the record.
+ */
+export type ConsentWithdrawnListener = (withdrawal: ConsentWithdrawal) => Promise<void>;
+/** One grant that now stands, as a capability that keeps its own state in step with consent is told of it. */
+export type ConsentGrant = ConsentWithdrawal;
+/**
+ * Hear of a grant to one of this capability's own purposes, once it stands. The other half of
+ * {@link ConsentWithdrawnListener}: `@pithy-sh/email` lifts the marketing suppression a withdrawal wrote when
+ * `email.marketing` is granted again, and nothing else, so a person who changes their mind back is heard. Called
+ * after the grant is recorded and only when the subject's standing is `granted`; a throw never undoes the record.
+ */
+export type ConsentGrantedListener = (grant: ConsentGrant) => Promise<void>;
+/** Every purpose the composed capabilities declare, in composition order. */
+export declare function composedConsentPurposes(capabilities: readonly Capability[]): ConsentPurpose[];
+/** The composed consent reader for this env, or `null` when no capability provides one. */
+export declare function composedConsent(capabilities: readonly Capability[], env: Record<string, unknown>): ConsentReader | null;
+/** Whether any composed capability provides the consent seam. */
+export declare function providesConsent(capabilities: readonly Capability[]): boolean;
+/**
+ * The account's address, read through the capability that owns accounts (`@pithy-sh/auth`'s `addressOf`), or
+ * `null` where nothing composed can say. Never throws: a listener that cannot learn the address does less, and the
+ * withdrawal it heard of stands.
+ */
+export declare function composedAddress(capabilities: readonly Capability[], env: Record<string, unknown>, subject: ConsentSubject): Promise<string | null>;
+//# sourceMappingURL=reader.d.ts.map

package/dist/consent/reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../../src/consent/reader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;;;;;GAUG;AAEH,2GAA2G;AAC3G,MAAM,WAAW,cAAc;IAC7B,oHAAoH;IACpH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;IACrC,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;;;;OAIG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,SAAS,cAAc,EAAE,CAAC;CACxC;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,oBAAoB;IACpB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,UAAU,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAExF,8GAA8G;AAC9G,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5E,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,cAAc,EAAE,CAE7F;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAC7B,YAAY,EAAE,SAAS,UAAU,EAAE,EACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,aAAa,GAAG,IAAI,CAGtB;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAE5E;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,SAAS,UAAU,EAAE,EACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB"}

package/dist/consent/reader.js

@@ -0,0 +1,33 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/consent/reader.ts
+/** Every purpose the composed capabilities declare, in composition order. */
+function composedConsentPurposes(capabilities) {
+	return capabilities.flatMap((capability) => [...capability.consentPurposes ?? []]);
+}
+/** The composed consent reader for this env, or `null` when no capability provides one. */
+function composedConsent(capabilities, env) {
+	const provider = capabilities.find((capability) => capability.consentReader !== void 0);
+	return provider?.consentReader ? provider.consentReader(env) : null;
+}
+/** Whether any composed capability provides the consent seam. */
+function providesConsent(capabilities) {
+	return capabilities.some((capability) => capability.consentReader !== void 0);
+}
+/**
+* The account's address, read through the capability that owns accounts (`@pithy-sh/auth`'s `addressOf`), or
+* `null` where nothing composed can say. Never throws: a listener that cannot learn the address does less, and the
+* withdrawal it heard of stands.
+*/
+async function composedAddress(capabilities, env, subject) {
+	if (subject.kind !== "account") return null;
+	const provider = capabilities.find((capability) => capability.addressOf !== void 0);
+	if (!provider?.addressOf) return null;
+	try {
+		return await provider.addressOf(env, subject.id);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { composedAddress, composedConsent, composedConsentPurposes, providesConsent };

package/dist/controlPlane/audit/actions.d.ts

@@ -22,8 +22,8 @@ import type { Logger } from "../../logger/logger";
  * Emission goes through core's `emit` seam (`c.var.emit`), a no-op when the audit capability is
  * absent, so the seam never imports audit at runtime either (principle 4).
  *
- * **Four of these are emitted by a route; three are emitted by the CLI** (#294). The connection
- * lifecycle — registered, updated, removed — is written by `pithy dashboard` opening the adopter's D1
+ * **Most of these are emitted by a route; four are emitted by the CLI, one of them by a route as well.** The
+ * connection lifecycle — registered, updated, removed — is written by `pithy dashboard` opening the adopter's D1
  * directly, because those operations never reach their Worker: a first connect has no key to sign with
  * and the Worker may not be deployed, an update re-points an address the Worker never reads, and a
  * disconnect withdraws trust, which must not depend on a working connection (docs/CONTROL-PLANE.md §15).
@@ -32,8 +32,12 @@ import type { Logger } from "../../logger/logger";
  * `control-plane`, meaning the management client called in and proved it, while a CLI-side event carries
  * the adopter's own operator and no session at all.
  *
- * A declared code that nothing emits is a surface the trail promises and never delivers, which is what
- * these three were until #294. `packages/cli/src/ci/auditActions.test.ts` fails the build on one.
+ * `connectionRevoked` is the one written from both sides: by `POST {basePath}/connections/:connectionId/revoke`,
+ * with `actorType` `control-plane` and the caller's connection, and by `pithy dashboard connections --revoke`, with
+ * the operator as actor and no session.
+ *
+ * A declared code that nothing emits is a surface the trail promises and never delivers.
+ * `packages/cli/src/ci/auditActions.test.ts` fails the build on one.
  */
 export declare const ControlPlaneAuditActions: {
     /** A verified, in-scope management call was admitted. The trail of what the dashboard actually did. */
@@ -50,6 +54,13 @@ export declare const ControlPlaneAuditActions: {
     readonly connectionUpdated: "controlplane/connection_updated";
     /** A connection was removed. The seam returns to its shipped state: connected to nothing, denying everything. */
     readonly connectionRemoved: "controlplane/connection_removed";
+    /**
+     * Another connection's keys and trusts were revoked, with a reason: by a management client over the seam, or by the
+     * operator at the CLI.
+     */
+    readonly connectionRevoked: "controlplane/connection_revoked";
+    readonly holdPlaced: "controlplane/hold_placed";
+    readonly holdReleased: "controlplane/hold_released";
 };
 /** One of the control-plane audit action codes. */
 export type ControlPlaneAuditAction = (typeof ControlPlaneAuditActions)[keyof typeof ControlPlaneAuditActions];

package/dist/controlPlane/audit/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/audit/actions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,wBAAwB;IACnC,uGAAuG;aACvG,WAAW,EAAE,2BAA2B;IACxC,8GAA8G;aAC9G,UAAU,EAAE,0BAA0B;IACtC,mFAAmF;aACnF,aAAa,EAAE,6BAA6B;IAC5C,gFAAgF;aAChF,UAAU,EAAE,0BAA0B;IACtC,qGAAqG;aACrG,oBAAoB,EAAE,oCAAoC;IAC1D,+GAA+G;aAC/G,iBAAiB,EAAE,iCAAiC;IACpD,iHAAiH;aACjH,iBAAiB,EAAE,iCAAiC;CAC5C,CAAC;AAEX,mDAAmD;AACnD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAE/G;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnG"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/audit/actions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,wBAAwB;IACnC,uGAAuG;aACvG,WAAW,EAAE,2BAA2B;IACxC,8GAA8G;aAC9G,UAAU,EAAE,0BAA0B;IACtC,mFAAmF;aACnF,aAAa,EAAE,6BAA6B;IAC5C,gFAAgF;aAChF,UAAU,EAAE,0BAA0B;IACtC,qGAAqG;aACrG,oBAAoB,EAAE,oCAAoC;IAC1D,+GAA+G;aAC/G,iBAAiB,EAAE,iCAAiC;IACpD,iHAAiH;aACjH,iBAAiB,EAAE,iCAAiC;IACpD;;;OAGG;aACH,iBAAiB,EAAE,iCAAiC;aACpD,UAAU,EAAE,0BAA0B;aACtC,YAAY,EAAE,4BAA4B;CAClC,CAAC;AAEX,mDAAmD;AACnD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAE/G;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnG"}

package/dist/controlPlane/audit/actions.js

@@ -20,8 +20,8 @@
 * Emission goes through core's `emit` seam (`c.var.emit`), a no-op when the audit capability is
 * absent, so the seam never imports audit at runtime either (principle 4).
 *
-* **Four of these are emitted by a route; three are emitted by the CLI** (#294). The connection
-* lifecycle — registered, updated, removed — is written by `pithy dashboard` opening the adopter's D1
+* **Most of these are emitted by a route; four are emitted by the CLI, one of them by a route as well.** The
+* connection lifecycle — registered, updated, removed — is written by `pithy dashboard` opening the adopter's D1
 * directly, because those operations never reach their Worker: a first connect has no key to sign with
 * and the Worker may not be deployed, an update re-points an address the Worker never reads, and a
 * disconnect withdraws trust, which must not depend on a working connection (docs/CONTROL-PLANE.md §15).
@@ -30,8 +30,12 @@
 * `control-plane`, meaning the management client called in and proved it, while a CLI-side event carries
 * the adopter's own operator and no session at all.
 *
-* A declared code that nothing emits is a surface the trail promises and never delivers, which is what
-* these three were until #294. `packages/cli/src/ci/auditActions.test.ts` fails the build on one.
+* `connectionRevoked` is the one written from both sides: by `POST {basePath}/connections/:connectionId/revoke`,
+* with `actorType` `control-plane` and the caller's connection, and by `pithy dashboard connections --revoke`, with
+* the operator as actor and no session.
+*
+* A declared code that nothing emits is a surface the trail promises and never delivers.
+* `packages/cli/src/ci/auditActions.test.ts` fails the build on one.
 */
 const ControlPlaneAuditActions = {
 	/** A verified, in-scope management call was admitted. The trail of what the dashboard actually did. */
@@ -47,7 +51,14 @@ const ControlPlaneAuditActions = {
 	/** An existing connection changed — its granted scopes, the Worker URL it points at, or the keys it trusts. */
 	connectionUpdated: "controlplane/connection_updated",
 	/** A connection was removed. The seam returns to its shipped state: connected to nothing, denying everything. */
-	connectionRemoved: "controlplane/connection_removed"
+	connectionRemoved: "controlplane/connection_removed",
+	/**
+	* Another connection's keys and trusts were revoked, with a reason: by a management client over the seam, or by the
+	* operator at the CLI.
+	*/
+	connectionRevoked: "controlplane/connection_revoked",
+	holdPlaced: "controlplane/hold_placed",
+	holdReleased: "controlplane/hold_released"
 };
 /**
 * Emit an audit event and swallow any failure.

package/dist/controlPlane/capability.d.ts

@@ -17,6 +17,16 @@ import { CONTROL_PLANE_KV_BINDING } from "./replay/kvGuard";
  */
 export declare const CONTROLPLANE_MIGRATION_ORDER = 1100;
 export type ControlPlaneOptions = ControlPlaneConfigInput;
+/** The standing legal holds, on the seam's own manifest entry. Behind the scope the holds listing requires. */
+export declare const ACTIVE_HOLDS_HEALTH_KEY: {
+    readonly key: "activeHolds";
+    readonly kind: "count";
+    readonly states: null;
+    readonly scope: string;
+    readonly cost: "indexed";
+    readonly summary: "Legal holds standing. While one stands, no purge, prune or inactivity deletion touches its subject.";
+    readonly nominal: null;
+};
 /** The control-plane capability, with its resolved config attached. */
 export interface ControlPlaneCapability extends Capability<DatabaseSpecMap, KvNamespaceSpecMap, "controlplane"> {
     /** The resolved seam config. */

package/dist/controlPlane/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAKvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAkBnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CA6LtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/controlPlane/capability.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAc,MAAM,kBAAkB,CAAC;AAWvE,OAAO,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAqBnF,OAAO,EACL,wBAAwB,EAIzB,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE1D,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB;aAClC,GAAG,EAAE,aAAa;aAClB,IAAI,EAAE,OAAO;aACb,MAAM;aACN,KAAK;aACL,IAAI,EAAE,SAAS;aACf,OAAO,EAAE,qGAAqG;aAC9G,OAAO;CACC,CAAC;AAEX,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,CAAC;IAC7G,gCAAgC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,sBAAsB,CAErG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,sBAAsB,CAsPtF;AAED,4GAA4G;AAC5G,OAAO,EAAE,wBAAwB,EAAE,CAAC"}