@pithy-sh/core 0.13.0 → 0.14.0

package/dist/controlPlane/http/routes.js

@@ -1,13 +1,19 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE } from "../scope/scope.js";
-import { requireControlPlane } from "./guard.js";
+import { ANY_VERIFIED_CALLER, CONNECTIONS_READ_SCOPE, CONNECTIONS_REVOKE_SCOPE, ERASURE_READ_SCOPE, EVIDENCE_READ_SCOPE, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE, MIGRATIONS_READ_SCOPE, PRIVACY_READ_SCOPE, PROCESSING_READ_SCOPE, RETENTION_HOLD_SCOPE, RETENTION_READ_SCOPE } from "../scope/scope.js";
+import { ControlPlanePresenceTicketRequest } from "../../presence/http/schemas.js";
 import { describeRoute } from "../../http/routeSpec.js";
 import { validate } from "../../http/validation.js";
+import { PresenceTicket } from "../../presence/http/responses.js";
+import { requireControlPlane } from "./guard.js";
 import { ControlPlaneManifest } from "../discovery/adminRoute.js";
-import { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler } from "./handlers.js";
-import { ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
-import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas.js";
+import { erasurePeriodHandler, erasureSubjectHandler, evidenceHandler, expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler } from "./handlers.js";
+import { listConnectionsHandler, revokeConnectionHandler } from "./connections.js";
+import { listHoldsHandler, placeHoldHandler, releaseHoldHandler } from "./holds.js";
+import { presenceTicketGate, presenceTicketHandler } from "./presence.js";
+import { processingHandler } from "./processing.js";
+import { ControlPlaneConnectionsResponse, ControlPlaneErasurePeriodResponse, ControlPlaneErasureSubjectResponse, ControlPlaneEvidenceResponse, ControlPlaneHoldResponse, ControlPlaneHoldsResponse, ControlPlaneKeysResponse, ControlPlaneMigrationsResponse, ControlPlanePingResponse, ControlPlanePrivacyResponse, ControlPlaneProcessingResponse, ExpireKeyResponse, RegisterKeyResponse, RevokeConnectionResponse } from "./responses.js";
+import { ConnectionListQuery, ConnectionParams, ErasurePeriodQuery, ErasureSubjectParams, ExpireKeyParams, ExpireKeyRequest, HoldListQuery, HoldParams, PlaceHoldRequest, RegisterKeyRequest, ReleaseHoldRequest, RevokeConnectionRequest } from "./schemas.js";
 //#region src/controlPlane/http/routes.ts
 /**
 * The seam's own routes, distinct from the admin routes capabilities contribute.
@@ -17,8 +23,18 @@ import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas
 *   GET  /control-plane/keys                  → the registration state       (keys:rotate)
 *   POST /control-plane/keys                  → register a key               (keys:rotate)
 *   POST /control-plane/keys/:keyId/expire    → retire a superseded key      (keys:rotate)
+*   GET  /control-plane/connections           → every connection, by principal (connections:read)
+*   POST /control-plane/connections/:id/revoke → revoke another connection    (connections:revoke)
 *   GET  /control-plane/migrations            → where each database stands   (migrations:read)
 *   GET  /control-plane/privacy               → what each schema holds        (privacy:read)
+*   GET  /control-plane/evidence              → SOC 2 and ISO 27001 evidence  (evidence:read)
+*   GET  /control-plane/processing            → the Article 30 record         (processing:read)
+*   GET  /control-plane/erasure               → every purge in a period       (erasure:read)
+*   GET  /control-plane/erasure/:type/:id     → one subject's purge, attested (erasure:read)
+*   GET  /control-plane/holds                 → every legal hold              (retention:read)
+*   POST /control-plane/holds                 → place a legal hold            (retention:hold)
+*   POST /control-plane/holds/:id/release     → release one, with a reason    (retention:hold)
+*   POST /control-plane/presence/tickets      → a ticket into a presence room (the room kind's scope)
 *
 * Every one is `control-plane` and default-denied — with no connection registered they all answer 403,
 * and that is the shipped state of a Worker nobody has connected.
@@ -48,45 +64,137 @@ function controlPlaneRouteDescriptors(basePath) {
 	return [
 		{
 			method: "GET",
+			operation: "ping",
 			path: `${basePath}/ping`,
 			scope: null,
 			summary: "Prove connectivity and which key answered. Always available to a verified caller."
 		},
 		{
 			method: "GET",
+			operation: "manifest.read",
 			path: `${basePath}/manifest`,
 			scope: MANIFEST_READ_SCOPE,
+			kind: "reads",
 			summary: "What this Worker composes, and how to call each capability's admin surface."
 		},
 		{
 			method: "GET",
+			operation: "keys.list",
 			path: `${basePath}/keys`,
 			scope: KEYS_ROTATE_SCOPE,
+			kind: "credentials",
 			summary: "The registered keys, their validity windows, and their ages."
 		},
 		{
 			method: "POST",
+			operation: "keys.register",
 			path: `${basePath}/keys`,
 			scope: KEYS_ROTATE_SCOPE,
+			kind: "credentials",
 			summary: "Register a successor public key. Signed with the key it replaces; appends only."
 		},
 		{
 			method: "POST",
+			operation: "keys.expire",
 			path: `${basePath}/keys/:keyId/expire`,
 			scope: KEYS_ROTATE_SCOPE,
+			kind: "credentials",
 			summary: "Retire a superseded key. Must be signed with the successor it names as proven."
 		},
 		{
 			method: "GET",
+			operation: "connections.list",
+			path: `${basePath}/connections`,
+			scope: CONNECTIONS_READ_SCOPE,
+			kind: "reads",
+			summary: "Every connection bound to this Worker's environment: who authorized it, what kind of client it is for and why, its credentials, grant and trust constraints, and when it was registered or revoked. Filterable by principal. No key material."
+		},
+		{
+			method: "POST",
+			operation: "connections.revoke",
+			path: `${basePath}/connections/:connectionId/revoke`,
+			scope: CONNECTIONS_REVOKE_SCOPE,
+			kind: "credentials",
+			summary: "Revoke every key and trust another connection in this environment holds, with a reason. Never the calling connection, which ends through disconnect."
+		},
+		{
+			method: "GET",
+			operation: "migrations.read",
 			path: `${basePath}/migrations`,
 			scope: MIGRATIONS_READ_SCOPE,
+			kind: "reads",
 			summary: "What each bound database has applied, what is pending, what is undeclared, and which run put it there. Undeclared is relative to this Worker."
 		},
 		{
 			method: "GET",
+			operation: "privacy.read",
 			path: `${basePath}/privacy`,
 			scope: PRIVACY_READ_SCOPE,
+			kind: "reads",
 			summary: "Every stored schema holding a privacy-marked field, each field's path and class, and where it lives. Derived from the running code."
+		},
+		{
+			method: "GET",
+			operation: "evidence.read",
+			path: `${basePath}/evidence`,
+			scope: EVIDENCE_READ_SCOPE,
+			kind: "reads",
+			summary: "SOC 2 and ISO 27001 evidence derived from what this Worker composes and records: each control's facts, their sources, and what could be said. Evidence for an auditor, never a judgment."
+		},
+		{
+			method: "GET",
+			operation: "processing.read",
+			path: `${basePath}/processing`,
+			scope: PROCESSING_READ_SCOPE,
+			kind: "reads",
+			summary: "The record of processing activities, GDPR Article 30: each purpose, its data classes, legal basis, recipients, retention and measures, and every gap named."
+		},
+		{
+			method: "GET",
+			operation: "erasure.list",
+			path: `${basePath}/erasure`,
+			scope: ERASURE_READ_SCOPE,
+			kind: "reads",
+			summary: "Every purge in a period: how many completed, are in progress or failed, and each failed or overdue one with the step it stopped at."
+		},
+		{
+			method: "GET",
+			operation: "erasure.read",
+			path: `${basePath}/erasure/:subjectType/:subjectId`,
+			scope: ERASURE_READ_SCOPE,
+			kind: "reads",
+			summary: "One user's or organization's erasure: the deletion, every step erased or kept with its reason, the state, and the audit events that record each."
+		},
+		{
+			method: "GET",
+			operation: "holds.list",
+			path: `${basePath}/holds`,
+			scope: RETENTION_READ_SCOPE,
+			kind: "reads",
+			summary: "Every legal hold, standing first: its subject, who placed it and why, and when and why it was released."
+		},
+		{
+			method: "POST",
+			operation: "holds.place",
+			path: `${basePath}/holds`,
+			scope: RETENTION_HOLD_SCOPE,
+			kind: "writes",
+			summary: "Place a legal hold on a user, an organization or a tenant's audit trail, with a reason. Every purge, prune and inactivity deletion touching it stops until it is released."
+		},
+		{
+			method: "POST",
+			operation: "holds.release",
+			path: `${basePath}/holds/:holdId/release`,
+			scope: RETENTION_HOLD_SCOPE,
+			kind: "writes",
+			summary: "Release a legal hold, with a reason. The subject returns to the retention the Worker deploys with."
+		},
+		{
+			method: "POST",
+			operation: "presence.tickets.mint",
+			path: `${basePath}/presence/tickets`,
+			scope: null,
+			summary: "Mint a single-use ticket into one presence room. Needs the room kind's own scope, which the manifest lists beside each kind."
 		}
 	];
 }
@@ -121,6 +229,20 @@ function registerControlPlaneRoutes(app, basePath, deps) {
 		scopes: [KEYS_ROTATE_SCOPE],
 		responses: { 200: ExpireKeyResponse }
 	}), requireControlPlane(KEYS_ROTATE_SCOPE), validate("param", ExpireKeyParams), validate("json", ExpireKeyRequest), (c) => expireKeyHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
+	app.get(`${basePath}/connections`, describeRoute({
+		summary: "List every connection in this Worker's environment.",
+		description: "Every connection bound to this Worker's environment, the caller's own among them; a database shared with another environment never lists that environment's rows. Each connection's id, environment, actor kind, purpose, authorizing principal, credential kind, granted scopes, every trust's subject constraint, whether it is live, and when it was registered and revoked. `principal` narrows to the connections one email authorized; connections registered before principals were recorded are listed apart in `unattributed` and never match. No key material and no secret. Read-only.",
+		verification: "control-plane",
+		scopes: [CONNECTIONS_READ_SCOPE],
+		responses: { 200: ControlPlaneConnectionsResponse }
+	}), requireControlPlane(CONNECTIONS_READ_SCOPE), validate("query", ConnectionListQuery), (c) => listConnectionsHandler(deps)(c, c.req.valid("query")));
+	app.post(`${basePath}/connections/:connectionId/revoke`, describeRoute({
+		summary: "Revoke another connection.",
+		description: "Revokes every key and trust on the connection not yet revoked, at once, with a reason: a live one, and one whose window has not opened yet. A token already minted under a trust stays usable until it expires. Refused on the calling connection, which ends through `pithy dashboard disconnect`, naming its environment with `--env`. A connection bound to another environment answers 404. `pithy dashboard connect` keeps one connection per environment, replacing the one stored, so this route has a target only where the database holds more than one connection for this environment. Audited as `controlplane/connection_revoked`.",
+		verification: "control-plane",
+		scopes: [CONNECTIONS_REVOKE_SCOPE],
+		responses: { 200: RevokeConnectionResponse }
+	}), requireControlPlane(CONNECTIONS_REVOKE_SCOPE), validate("param", ConnectionParams), validate("json", RevokeConnectionRequest), (c) => revokeConnectionHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
 	app.get(`${basePath}/migrations`, describeRoute({
 		summary: "Report where each database this Worker binds stands.",
 		description: "Applied, pending and undeclared migrations per database, each naming its namespace, and the last group with whether it is still reversible. Undeclared is relative to this Worker: a database shared with another Worker lists that Worker's migrations there. Read-only.",
@@ -135,6 +257,61 @@ function registerControlPlaneRoutes(app, basePath, deps) {
 		scopes: [PRIVACY_READ_SCOPE],
 		responses: { 200: ControlPlanePrivacyResponse }
 	}), requireControlPlane(PRIVACY_READ_SCOPE), privacyHandler(deps));
+	app.get(`${basePath}/evidence`, describeRoute({
+		summary: "Report the evidence this Worker derives for SOC 2 and ISO 27001.",
+		description: "Seven controls, each with its SOC 2 and ISO/IEC 27001:2022 references, the facts read, the declaration each came from, and `evidenced`, `gap` or `not-derivable` with the reason. Derived from what this Worker composes and records. Evidence for an auditor to weigh, never a judgment. A fact another read keeps behind its own scope stays behind it. Read-only.",
+		verification: "control-plane",
+		scopes: [EVIDENCE_READ_SCOPE],
+		responses: { 200: ControlPlaneEvidenceResponse }
+	}), requireControlPlane(EVIDENCE_READ_SCOPE), evidenceHandler(deps));
+	app.get(`${basePath}/processing`, describeRoute({
+		summary: "Report the record of processing activities.",
+		description: "Every processing activity the composed capabilities and the `processing` block declare: its purpose, the data classes it uses cross-checked against the privacy inventory, its legal basis or a gap, a consent basis's purpose and grant counts, its recipients with what each receives, its effective retention, and the evidence pack's controls. Every gap is named and none is filled in. It describes the processing and changes none of it. Read-only.",
+		verification: "control-plane",
+		scopes: [PROCESSING_READ_SCOPE],
+		responses: { 200: ControlPlaneProcessingResponse }
+	}), requireControlPlane(PROCESSING_READ_SCOPE), processingHandler(deps));
+	app.get(`${basePath}/erasure`, describeRoute({
+		summary: "Report every purge in a period.",
+		description: "Every user and organization purge that came due, ran a step, failed or completed in the window: counts of scheduled, in progress, complete, failed and overdue, and each failed or overdue one named with the step it stopped at. The window defaults to the 90 days before `until`, and is at most 366 days. Read-only.",
+		verification: "control-plane",
+		scopes: [ERASURE_READ_SCOPE],
+		responses: { 200: ControlPlaneErasurePeriodResponse }
+	}), requireControlPlane(ERASURE_READ_SCOPE), validate("query", ErasurePeriodQuery), (c) => erasurePeriodHandler(deps)(c, c.req.valid("query")));
+	app.get(`${basePath}/erasure/:subjectType/:subjectId`, describeRoute({
+		summary: "Attest one subject's erasure.",
+		description: "For one user or organization: when it was deleted, by which kind of actor and why, soft or hard, every purge step with its capability, whether it erased or kept the rows and why, and when it finished, the purge's state, and the audit events that record each step by event id and chain position. Nothing about the subject beyond its id. Read-only.",
+		verification: "control-plane",
+		scopes: [ERASURE_READ_SCOPE],
+		responses: { 200: ControlPlaneErasureSubjectResponse }
+	}), requireControlPlane(ERASURE_READ_SCOPE), validate("param", ErasureSubjectParams), (c) => erasureSubjectHandler(deps)(c, c.req.valid("param")));
+	app.get(`${basePath}/holds`, describeRoute({
+		summary: "List the legal holds.",
+		description: "Every hold, standing first and newest first within each: the subject, who placed it and why, and when, by whom and why it was released. `active` counts the holds standing. Read-only.",
+		verification: "control-plane",
+		scopes: [RETENTION_READ_SCOPE],
+		responses: { 200: ControlPlaneHoldsResponse }
+	}), requireControlPlane(RETENTION_READ_SCOPE), validate("query", HoldListQuery), (c) => listHoldsHandler(deps)(c, c.req.valid("query")));
+	app.post(`${basePath}/holds`, describeRoute({
+		summary: "Place a legal hold.",
+		description: "Holds one user, one organization, or one tenant's audit trail, with a reason. While it stands no purge, prune or inactivity deletion touches the subject, and a purge already running stops at its next step. Audited. A hold can only preserve: nothing here shortens a retention.",
+		verification: "control-plane",
+		scopes: [RETENTION_HOLD_SCOPE],
+		responses: { 201: ControlPlaneHoldResponse }
+	}), requireControlPlane(RETENTION_HOLD_SCOPE), validate("json", PlaceHoldRequest), (c) => placeHoldHandler(deps)(c, c.req.valid("json")));
+	app.post(`${basePath}/holds/:holdId/release`, describeRoute({
+		summary: "Release a legal hold.",
+		description: "Ends one standing hold, with a reason, and keeps it as a record. The subject returns to the Worker's retention; a purge it stopped resumes on the next daily pass. Audited.",
+		verification: "control-plane",
+		scopes: [RETENTION_HOLD_SCOPE],
+		responses: { 200: ControlPlaneHoldResponse }
+	}), requireControlPlane(RETENTION_HOLD_SCOPE), validate("param", HoldParams), validate("json", ReleaseHoldRequest), (c) => releaseHoldHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
+	app.post(`${basePath}/presence/tickets`, describeRoute({
+		summary: "Mint a presence ticket for a management client.",
+		description: "Admits the participant the body names to one room of any kind this Worker composes. Sign the call with the room kind's own scope, as the manifest lists it; presence adds no scope. Single use, for 60 seconds. Open the socket at `socketPath`, offering `protocol` and `pithy.ticket.<ticket>` in `Sec-WebSocket-Protocol`.",
+		verification: "control-plane",
+		responses: { 201: PresenceTicket }
+	}), presenceTicketGate(deps), validate("json", ControlPlanePresenceTicketRequest), (c) => presenceTicketHandler(deps)(c, c.req.valid("json")));
 }
 //#endregion
 export { controlPlaneRouteDescriptors, registerControlPlaneRoutes };

package/dist/controlPlane/http/schemas.d.ts

@@ -38,4 +38,67 @@ export declare const ExpireKeyRequest: z.ZodObject<{
     provenKeyId: z.ZodString;
 }, z.core.$strip>;
 export type ExpireKeyRequest = z.infer<typeof ExpireKeyRequest>;
+/** `GET /control-plane/erasure/:subjectType/:subjectId` — which subject. */
+export declare const ErasureSubjectParams: z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+    }>;
+    subjectId: z.ZodString;
+}, z.core.$strip>;
+export type ErasureSubjectParams = z.infer<typeof ErasureSubjectParams>;
+/** `GET /control-plane/erasure?since&until` — the period. */
+export declare const ErasurePeriodQuery: z.ZodObject<{
+    since: z.ZodOptional<z.ZodISODateTime>;
+    until: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ErasurePeriodQuery = z.infer<typeof ErasurePeriodQuery>;
+/**
+ * Place a legal hold. The subject and a reason, and nothing else: no field shortens a retention, because a hold
+ * can only preserve.
+ */
+export declare const PlaceHoldRequest: z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        audit: "audit";
+        organization: "organization";
+        user: "user";
+    }>;
+    subjectId: z.ZodNullable<z.ZodString>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type PlaceHoldRequest = z.infer<typeof PlaceHoldRequest>;
+/** The path parameter of the release route. */
+export declare const HoldParams: z.ZodObject<{
+    holdId: z.ZodString;
+}, z.core.$strip>;
+export type HoldParams = z.infer<typeof HoldParams>;
+/** Release a legal hold, with a reason. */
+export declare const ReleaseHoldRequest: z.ZodObject<{
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type ReleaseHoldRequest = z.infer<typeof ReleaseHoldRequest>;
+/** Which holds to list. */
+export declare const HoldListQuery: z.ZodObject<{
+    state: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        released: "released";
+    }>>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type HoldListQuery = z.infer<typeof HoldListQuery>;
+/** Which connections to list. */
+export declare const ConnectionListQuery: z.ZodObject<{
+    principal: z.ZodOptional<z.ZodEmail>;
+}, z.core.$strip>;
+export type ConnectionListQuery = z.infer<typeof ConnectionListQuery>;
+/** The path parameter of the revoke route. */
+export declare const ConnectionParams: z.ZodObject<{
+    connectionId: z.ZodUUID;
+}, z.core.$strip>;
+export type ConnectionParams = z.infer<typeof ConnectionParams>;
+/** Revoke a connection, with a reason. */
+export declare const RevokeConnectionRequest: z.ZodObject<{
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type RevokeConnectionRequest = z.infer<typeof RevokeConnectionRequest>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/controlPlane/http/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/schemas.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;GAgBG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,kBAAkB;;;;;;;iBAa5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4FAA4F;AAC5F,eAAO,MAAM,eAAe;;iBAU+B,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,sGAAsG;AACtG,eAAO,MAAM,gBAAgB;;iBAY1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/schemas.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;GAgBG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,kBAAkB;;;;;;;iBAa5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4FAA4F;AAC5F,eAAO,MAAM,eAAe;;iBAU+B,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,sGAAsG;AACtG,eAAO,MAAM,gBAAgB;;iBAY1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB;;;;;;iBAKkB,CAAC;AACpD,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB;;;iBAWuB,CAAC;AACvD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;kBAyB8B,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+CAA+C;AAC/C,eAAO,MAAM,UAAU;;iBAEY,CAAC;AACpC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,2CAA2C;AAC3C,eAAO,MAAM,kBAAkB;;kBAUoB,CAAC;AACpD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2BAA2B;AAC3B,eAAO,MAAM,aAAa;;;;;;iBAWe,CAAC;AAC1C,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,iCAAiC;AACjC,eAAO,MAAM,mBAAmB;;iBAUS,CAAC;AAC1C,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB;;iBAEW,CAAC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB;;kBAUkB,CAAC;AACvD,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/controlPlane/http/schemas.js

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { HoldState, HoldSubjectType } from "../data/hold.js";
 import { Ed25519PublicJwk } from "../data/connection.js";
 import { z } from "zod";
 //#region src/controlPlane/http/schemas.ts
@@ -29,5 +30,42 @@ const RegisterKeyRequest = z.object({
 const ExpireKeyParams = z.object({ keyId: z.string().min(1).max(64).describe("The key to give an end date. Bounded but unconstrained in shape — an unknown id answers 404, not 400.") }).describe("The path parameters of the key-expiry route.");
 /** `POST /control-plane/keys/:keyId/expire` — the body, carrying the proof that a successor works. */
 const ExpireKeyRequest = z.object({ provenKeyId: z.string().min(1).max(64).describe("The replacement key that has already been proven against a live `ping`. Required, and checked to be currently active: expiring a key without naming a working successor is the one failure mode with no recovery path, so the route refuses rather than trusting the caller to have checked.") }).describe("A request to expire one superseded key. The successor must be named and must already be live — append, verify, then expire, never replace.");
+/** `GET /control-plane/erasure/:subjectType/:subjectId` — which subject. */
+const ErasureSubjectParams = z.object({
+	subjectType: z.enum(["user", "organization"]).describe("The kind of subject: `user` or `organization`."),
+	subjectId: z.string().min(1).max(255).describe("The subject's id.")
+}).describe("The subject whose erasure to attest.");
+/** `GET /control-plane/erasure?since&until` — the period. */
+const ErasurePeriodQuery = z.object({
+	since: z.iso.datetime({ offset: true }).optional().describe("The window's inclusive start, ISO-8601. Defaults to 90 days before `until`."),
+	until: z.iso.datetime({ offset: true }).optional().describe("The window's inclusive end, ISO-8601. Defaults to now.")
+}).describe("The period to attest: at most 366 days.");
+/**
+* Place a legal hold. The subject and a reason, and nothing else: no field shortens a retention, because a hold
+* can only preserve.
+*/
+const PlaceHoldRequest = z.object({
+	subjectType: HoldSubjectType,
+	subjectId: z.string().min(1).max(255).nullable().describe("The user's or organization's id, or the tenant whose audit trail to hold. Null only for `audit`, which then holds the untenanted trail."),
+	reason: z.string().trim().min(1).max(500).describe("Why the hold is placed, in one or two sentences. Required, and recorded with the hold and its audit event.")
+}).strict().refine((body) => body.subjectId !== null || body.subjectType === "audit", {
+	message: "Only an audit hold may name no subject: a user or organization hold names its id.",
+	path: ["subjectId"]
+}).describe("A legal hold to place: the subject, and why.");
+/** The path parameter of the release route. */
+const HoldParams = z.object({ holdId: z.string().min(1).max(64).describe("The hold's id, as placing it returned.") }).describe("The hold to release.");
+/** Release a legal hold, with a reason. */
+const ReleaseHoldRequest = z.object({ reason: z.string().trim().min(1).max(500).describe("Why the hold is released. Required, and recorded with the release and its audit event.") }).strict().describe("A legal hold's release: why it ends.");
+/** Which holds to list. */
+const HoldListQuery = z.object({
+	state: HoldState.optional().describe("Only holds in this state. Absent lists both, standing first."),
+	limit: z.coerce.number().int().min(1).max(500).optional().describe("How many holds to list, at most 500. Defaults to 100.")
+}).describe("Which legal holds to list.");
+/** Which connections to list. */
+const ConnectionListQuery = z.object({ principal: z.email().max(254).optional().describe("Only connections this email authorized, compared without regard to case. Connections with no recorded principal are listed apart either way and never match.") }).describe("Which connections to list.");
+/** The path parameter of the revoke route. */
+const ConnectionParams = z.object({ connectionId: z.uuid().describe("The connection's id, as the listing reports it.") }).describe("The connection to revoke.");
+/** Revoke a connection, with a reason. */
+const RevokeConnectionRequest = z.object({ reason: z.string().trim().min(1).max(500).describe("Why the connection is revoked. Required, and recorded on the revocation's audit event.") }).strict().describe("A connection's revocation: why it ends.");
 //#endregion
-export { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest };
+export { ConnectionListQuery, ConnectionParams, ErasurePeriodQuery, ErasureSubjectParams, ExpireKeyParams, ExpireKeyRequest, HoldListQuery, HoldParams, PlaceHoldRequest, RegisterKeyRequest, ReleaseHoldRequest, RevokeConnectionRequest };

package/dist/controlPlane/http/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,gBAAgB,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA6E9B"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,KAAK,uBAAuB,EAAe,MAAM,gBAAgB,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;GASG;AACH,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAE7E,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACjF;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA8F9B"}

package/dist/controlPlane/http/verify.js

@@ -37,7 +37,19 @@ async function verifyControlPlaneCall(call, deps) {
 	if (claims.exp <= nowSeconds - skew) deny(`token expired at ${claims.exp}, now ${nowSeconds}`);
 	if (claims.iat > nowSeconds + skew) deny(`token issued at ${claims.iat} is in the future, now ${nowSeconds}`);
 	await verifyBodyDigest(call.body, claims.bodySha256);
-	if (!scopeCovers(call.requirement, claims.scope, connection.scopes)) throw new ControlPlaneInsufficientScopeError({ detail: `required ${String(call.requirement)}; token carried ${claims.scope}; connection grants [${connection.scopes.join(", ")}]` });
+	if (!scopeCovers(call.requirement, claims.scope, connection.scopes)) {
+		const firstPresentation = await deps.replay.claim(claims.jti, connection.id);
+		const spent = firstPresentation ? "" : `; jti ${claims.jti} was already spent`;
+		throw new ControlPlaneInsufficientScopeError({
+			detail: `required ${String(call.requirement)}; token carried ${claims.scope}; connection grants [${connection.scopes.join(", ")}]${spent}`,
+			...firstPresentation ? { caller: {
+				connectionId: connection.id,
+				subject: claims.sub,
+				keyId: key.keyId,
+				actorKind: connection.actorKind
+			} } : {}
+		});
+	}
 	if (!await deps.replay.claim(claims.jti, connection.id)) deny(`jti ${claims.jti} was already spent`);
 	return ControlPlaneContext.parse({
 		connectionId: connection.id,

package/dist/controlPlane/http/verifyTrust.d.ts

@@ -0,0 +1,76 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { type JwksCache, type OidcJwksFetch } from "../../http/oidcWebhook";
+import { ControlPlaneContext } from "../context";
+import type { ControlPlaneConnection } from "../data/connection";
+import { type ControlPlaneRequirement } from "../scope/scope";
+/**
+ * Verify one call made under an OIDC trust (#722, `docs/AGENT-ACCESS.md` §6.2) — the second credential kind's
+ * half of the decision `verify.ts` makes for a key.
+ *
+ * ## Per call, and the call still names its scope
+ *
+ * An identity token proves **who**, never **what**. So every call presents the workload's token on
+ * `pithy-control-plane-oidc`, names the trust on `pithy-control-plane-trust`, and names the one scope it
+ * exercises on `pithy-control-plane-scope`; the token is verified against the trust on every call, and the
+ * scope is checked against the connection's grant exactly as a key's token is.
+ *
+ * **No exchange, deliberately.** Trading the token once for a short-lived credential would keep every
+ * property of the key path, and it would put a key on the workload's host — the custody this credential kind
+ * exists to remove. What remains is stated rather than hidden: a captured token replays against this one
+ * audience until it expires, which is the provider's lifetime, minutes, and the same bound as revocation's
+ * latency. There is no `jti` to spend, because one token serves every call in its job.
+ *
+ * ## The existing verifier, not a second one
+ *
+ * The token goes through `verifyOidcToken` from `core/src/http/oidcWebhook.ts`, with its ordering intact:
+ * the algorithm pinned before a key is touched, the key resolved by `kid` from the issuer's published set,
+ * the signature checked over the received segments, and only then a claim read. Its predicate is handed
+ * `() => true` on purpose — the issuer, audience and freshness are still its to check, and the claims match
+ * runs here, after, because a refusal here has to know **what** the token carried, which a boolean cannot say.
+ *
+ * ## One error, with one narrow exception
+ *
+ * Every failure raises {@link ControlPlaneInvalidCredentialError}, as on the key path, with the step in
+ * `detail`. The exception is what it carries, never what it says: a claim mismatch on a token whose signature,
+ * issuer and audience all verified records the claims it carried for the audit row. That is what makes a
+ * custom issuer workable and a profiled one self-correcting. Before those three verify, nothing is recorded.
+ */
+/** What the trust path needs from the outside world. Every one is injectable, so every step is testable. */
+export interface ControlPlaneTrustVerifyDeps {
+    /**
+     * This environment's connection, or null when none is registered. One per environment (`docs/CONTROL-PLANE.md`
+     * §15), so a call names only the trust, and the connection is the one the Worker's own environment owns.
+     */
+    loadEnvironmentConnection: () => Promise<ControlPlaneConnection | null>;
+    /** This Worker's environment name, checked against the connection's. */
+    environment: string;
+    /** The clock. */
+    now: () => Date;
+    /**
+     * Where the issuers' key sets are held between calls. Built once per seam, never per request: an anonymous
+     * caller naming a trust and an invented `kid` must cost a map lookup, not a round trip to the issuer.
+     */
+    jwksCache: JwksCache;
+    /** The HTTP seam the issuers' key endpoints are reached through. Defaults to the runtime's `fetch`. */
+    transport?: OidcJwksFetch;
+    /**
+     * Record the first allowed call under a trust, so a listing can stop saying *awaiting a first call*. Evidence
+     * rather than part of the decision: it runs after the call is allowed, once, and a failure is swallowed.
+     */
+    recordFirstCall: (connectionId: string, trustId: string, at: Date) => Promise<void>;
+}
+/** One inbound call under a trust, reduced to what verification needs. */
+export interface ControlPlaneTrustCall {
+    /** The workload's OIDC token, from `pithy-control-plane-oidc`. */
+    token: string | undefined;
+    /** The trust the call names, from `pithy-control-plane-trust`. */
+    trustId: string | undefined;
+    /** The scope the call names, from `pithy-control-plane-scope`. */
+    scope: string | undefined;
+    /** What the route demands. */
+    requirement: ControlPlaneRequirement;
+}
+/** Verify one call under an OIDC trust, or throw. Returns the context the handler runs under. */
+export declare function verifyControlPlaneTrustCall(call: ControlPlaneTrustCall, deps: ControlPlaneTrustVerifyDeps): Promise<ControlPlaneContext>;
+//# sourceMappingURL=verifyTrust.d.ts.map

package/dist/controlPlane/http/verifyTrust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyTrust.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/verifyTrust.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAmB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAOjE,OAAO,EAAE,KAAK,uBAAuB,EAAkC,MAAM,gBAAgB,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,4GAA4G;AAC5G,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,yBAAyB,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACxE,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB;IACjB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,uGAAuG;IACvG,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,kEAAkE;IAClE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,8BAA8B;IAC9B,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAOD,iGAAiG;AACjG,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAiF9B"}

package/dist/controlPlane/http/verifyTrust.js

@@ -0,0 +1,75 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { WebhookUnverifiedError } from "../../error/pithyError.js";
+import { ControlPlaneScope, scopeCovers } from "../scope/scope.js";
+import { verifyOidcToken } from "../../http/oidcWebhook.js";
+import { ControlPlaneInsufficientScopeError, ControlPlaneInvalidCredentialError, ControlPlaneNotConnectedError } from "../error/errors.js";
+import { claimsMatch, findVerifyingTrust, observedClaims } from "../data/oidcTrust.js";
+import { ControlPlaneContext } from "../context.js";
+//#region src/controlPlane/http/verifyTrust.ts
+/** Raise the one credential error, naming the failing step for the log and nobody else. */
+function deny(step) {
+	throw new ControlPlaneInvalidCredentialError({ detail: step });
+}
+/** Verify one call under an OIDC trust, or throw. Returns the context the handler runs under. */
+async function verifyControlPlaneTrustCall(call, deps) {
+	if (!call.token) deny("no OIDC token presented");
+	if (!call.trustId) deny("an OIDC call named no trust");
+	const scope = ControlPlaneScope.safeParse(call.scope);
+	if (!scope.success) deny("an OIDC call named no well-formed scope");
+	const now = deps.now();
+	const connection = await deps.loadEnvironmentConnection();
+	if (!connection) throw new ControlPlaneNotConnectedError({ detail: `no connection registered in environment ${deps.environment}` });
+	if (connection.environment !== deps.environment) deny(`connection ${connection.id} is bound to ${connection.environment}, not ${deps.environment}`);
+	const trust = findVerifyingTrust(connection.trusts ?? [], call.trustId, now);
+	if (!trust) deny(`trust ${call.trustId} is not a live trust on connection ${connection.id}`);
+	let claims;
+	try {
+		claims = await verifyOidcToken(call.token, {
+			issuers: [trust.issuer],
+			jwksUrl: trust.jwksUrl,
+			audience: trust.audience,
+			claims: () => true,
+			jwksCache: deps.jwksCache,
+			...deps.transport === void 0 ? {} : { transport: deps.transport },
+			now
+		});
+	} catch (error) {
+		if (error instanceof WebhookUnverifiedError) deny(`trust ${trust.trustId}: ${error.payload.detail ?? "unverified"}`);
+		throw error;
+	}
+	if (!claimsMatch(trust.claims, claims)) throw new ControlPlaneInvalidCredentialError({
+		detail: `trust ${trust.trustId}: the token's claims do not match the trust's`,
+		refusedTrust: {
+			connectionId: connection.id,
+			trustId: trust.trustId,
+			observedClaims: observedClaims(claims)
+		}
+	});
+	const subject = typeof claims.sub === "string" && claims.sub !== "" ? claims.sub : `trust:${trust.trustId}`;
+	if (!scopeCovers(call.requirement, scope.data, connection.scopes)) throw new ControlPlaneInsufficientScopeError({
+		detail: `required ${String(call.requirement)}; call named ${scope.data}; connection grants [${connection.scopes.join(", ")}]; trust ${trust.trustId}`,
+		caller: {
+			connectionId: connection.id,
+			subject,
+			keyId: trust.trustId,
+			credentialKind: "trust",
+			actorKind: connection.actorKind
+		}
+	});
+	if (trust.firstCallAt === null) await deps.recordFirstCall(connection.id, trust.trustId, now).catch(() => void 0);
+	return ControlPlaneContext.parse({
+		connectionId: connection.id,
+		environment: connection.environment,
+		issuer: trust.issuer,
+		subject,
+		scope: scope.data,
+		grantedScopes: connection.scopes,
+		keyId: trust.trustId,
+		tokenId: typeof claims.jti === "string" ? claims.jti : "",
+		credentialKind: "trust",
+		actorKind: connection.actorKind
+	});
+}
+//#endregion
+export { verifyControlPlaneTrustCall };

package/dist/controlPlane/migrations/0004_connection_trusts.d.ts

@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Migration } from "kysely/migration";
+/**
+ * A connection's OIDC trusts — `#722`, the second credential kind beside a registered key.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written by it.
+ *
+ * **One JSON column beside `keys`, defaulting to an empty list.** The same reasons `keys` is one column rather
+ * than a child table: verifying a call stays a single read, and revoking a trust is one `UPDATE`. Not null,
+ * with `'[]'` as its default, so every existing row reads as a connection holding no trust — which is exactly
+ * what it is — and nothing is backfilled.
+ */
+export declare const controlplane_0004_connection_trusts: Migration;
+//# sourceMappingURL=0004_connection_trusts.d.ts.map

package/dist/controlPlane/migrations/0004_connection_trusts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0004_connection_trusts.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/migrations/0004_connection_trusts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,EAAE,SAajD,CAAC"}

package/dist/controlPlane/migrations/0004_connection_trusts.js

@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/controlPlane/migrations/0004_connection_trusts.ts
+/**
+* A connection's OIDC trusts — `#722`, the second credential kind beside a registered key.
+*
+* **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written by it.
+*
+* **One JSON column beside `keys`, defaulting to an empty list.** The same reasons `keys` is one column rather
+* than a child table: verifying a call stays a single read, and revoking a trust is one `UPDATE`. Not null,
+* with `'[]'` as its default, so every existing row reads as a connection holding no trust — which is exactly
+* what it is — and nothing is backfilled.
+*/
+const controlplane_0004_connection_trusts = {
+	up: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").addColumn("trusts", "text", (column) => column.notNull().defaultTo("[]")).execute();
+	},
+	down: async (db) => {
+		await db.schema.alterTable("pithyControlplaneConnections").dropColumn("trusts").execute();
+	}
+};
+//#endregion
+export { controlplane_0004_connection_trusts };