@pithy-sh/core 0.13.0 → 0.15.0

package/dist/controlPlane/http/handlers.d.ts

@@ -1,15 +1,19 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import type { Context } from "hono";
-import type { PithyHonoEnv } from "../../capability/capability";
+import type { Capability, PithyHonoEnv } from "../../capability/capability";
+import type { RouteGroup } from "../../openapi/document";
+import type { PresenceDeclaration } from "../../presence/declaration";
 import type { PrivacyInventory } from "../../privacy/report";
 import type { RetirementVerdict } from "../../privacy/retirement";
+import type { EffectiveRetention } from "../../retention/policy";
 import type { ControlPlaneConfig } from "../config/config";
-import { type ControlPlaneDatabase } from "../data/tables";
+import type { ControlPlaneContext } from "../context";
+import type { ControlPlaneDatabase } from "../data/tables";
 import type { CapabilityDeclaration } from "../discovery/adminRoute";
 import { type CapabilityHealthSource } from "../discovery/health";
 import { type ComposedMigrationDatabase } from "../migrationState/migrationState";
-import type { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas";
+import type { ErasurePeriodQuery, ErasureSubjectParams, ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas";
 /** The pieces of the composed capability a handler needs. Passed in, so nothing reaches for a global. */
 export interface ControlPlaneHandlerDeps {
     /** The resolved seam config — pruning bounds, mostly. */
@@ -36,22 +40,44 @@ export interface ControlPlaneHandlerDeps {
     composedHealth: () => ReadonlyMap<string, CapabilityHealthSource>;
     /**
      * Every database this Worker binds, with the provider this build composes for it — captured by the same
-     * `compose` hook through `collectMigrationSets`, the function `pithy migrate` composes with (#729).
+     * `compose` hook through `collectMigrationSets`, the function `pithy migrate` composes with.
      */
     composedMigrations: () => readonly ComposedMigrationDatabase[];
     /**
-     * The privacy inventory of every storage schema this Worker composed (#132), walked on the first call and
+     * The privacy inventory of every storage schema this Worker composed, walked on the first call and
      * cached for the isolate. A thunk, so a Worker whose control plane is never called never walks.
      */
     privacyInventory: () => PrivacyInventory;
     /**
-     * The field key's retirement verdict (#390): the guard over this Worker's encrypted columns, read through its own
+     * The field key's retirement verdict: the guard over this Worker's encrypted columns, read through its own
      * bindings. Never throws: whatever it cannot read is incomplete coverage.
      */
     retirement: (env: Record<string, unknown>) => Promise<RetirementVerdict>;
+    /**
+     * Every presence room kind this Worker composed, by kind, with the declaration that serves it — captured
+     * by the same `compose` hook. A thunk for the same reason as {@link composedCapabilities}.
+     */
+    composedPresence: () => ReadonlyMap<string, PresenceDeclaration>;
+    /**
+     * Every capability this Worker composed, as the objects themselves — the evidence pack reads which one records
+     * audit events and the bindings it writes through. A thunk for the same reason as the rest.
+     */
+    composition: () => readonly Capability[];
+    /**
+     * The route table `createBackend` recorded for the app these routes mounted on, or `undefined` for an app it did
+     * not assemble. Read per call, after every capability's routes have mounted, so the evidence pack sees them all.
+     */
+    routeGroups: () => readonly RouteGroup[] | undefined;
+    /**
+     * The retention block as this Worker resolved it at assembly, or null when no backend recorded one. The
+     * manifest reports it.
+     */
+    retention?: () => EffectiveRetention | null;
     /** The clock, injected so a test can stand at any instant. */
     now: () => Date;
 }
+/** The verified caller. Never null here — `requireControlPlane` ran first, or this code is unreachable. */
+export declare function caller(c: Context<PithyHonoEnv>): ControlPlaneContext;
 /**
  * `GET /control-plane/ping` — connectivity and key proof.
  *
@@ -76,11 +102,11 @@ export declare function pingHandler(deps: ControlPlaneHandlerDeps): (c: Context<
  * Discovery over configuration. A client builds its navigation from this rather than from settings
  * someone maintains, so a Worker with no payments capability has no purchases pane as a matter of fact.
  *
- * **And the numbers a client would otherwise pay a second round trip for** (#317). Each capability's
+ * **And the numbers a client would otherwise pay a second round trip for**. Each capability's
  * bounded summary is resolved here, behind the scope that capability's own read is behind: a connection
  * without it gets no number rather than a zero, and never costs the adopter's Worker the query.
  *
- * **One capability's failure costs one capability's number** (#350). A producer that throws, or that
+ * **One capability's failure costs one capability's number**. A producer that throws, or that
  * reports something its declaration cannot name, lands on `unavailable` for that entry alone —
  * `readCapabilityHealth` catches it, so nothing rejects, so `Promise.all` still resolves and every
  * sibling still reports. This route is what the whole management surface is built from; a manifest that
@@ -121,6 +147,11 @@ export declare function manifestHandler(deps: ControlPlaneHandlerDeps): (c: Cont
             path: string;
             scope: string | null;
             summary: string;
+            kind?: "charges" | "credentials" | "deletes" | "reads" | "sends" | "writes" | undefined;
+            operation?: string | undefined;
+            input?: {
+                [x: string]: import("hono/utils/types").JSONValue;
+            } | undefined;
         }[];
         healthKeys: {
             key: string;
@@ -142,11 +173,40 @@ export declare function manifestHandler(deps: ControlPlaneHandlerDeps): (c: Cont
         config: {
             [x: string]: string | number | boolean;
         };
+        presenceRooms?: {
+            kind: string;
+            scope: string;
+            activities: string[];
+            maxParticipants: number;
+            sessionTicketPath: string | null;
+            socketPath: string;
+        }[] | undefined;
     }[];
     grantedScopes: string[];
+    retention?: {
+        purgeWindows: {
+            subject: "organization" | "user";
+            days: number;
+            source: "capability" | "floor" | "policy";
+        }[];
+        audit: {
+            defaultDays: number | null;
+            floorDays: number;
+            rules: {
+                prefix: string;
+                days: number;
+                source: "capability" | "floor" | "policy";
+            }[];
+            floored: string[];
+        };
+        classAges: {
+            class: string;
+            days: number;
+        }[];
+    } | undefined;
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 /**
- * `GET /control-plane/migrations` — where each database this Worker binds stands (#729).
+ * `GET /control-plane/migrations` — where each database this Worker binds stands.
  *
  * Read-only: it reports, and nothing over the seam runs, reverses or resets a migration.
  *
@@ -214,6 +274,18 @@ export declare function listKeysHandler(deps: ControlPlaneHandlerDeps): (c: Cont
     authorizedBy: string | null;
     actorKind: "agent" | "dashboard" | "script" | null;
     purpose: string | null;
+    trusts: {
+        trustId: string;
+        issuer: string;
+        audience: string;
+        claims: {
+            [x: string]: string;
+        };
+        authorizedBy: string;
+        validFrom: string;
+        revokedAt: string | null;
+        firstCallAt: string | null;
+    }[];
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 /**
  * `POST /control-plane/keys` — register a new public key, authenticated by the key it succeeds.
@@ -271,7 +343,7 @@ export declare function expireKeyHandler(deps: ControlPlaneHandlerDeps): (c: Con
     }[];
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 /**
- * `GET /control-plane/privacy` — the full privacy inventory (#132).
+ * `GET /control-plane/privacy` — the full privacy inventory.
  *
  * Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
  * is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
@@ -318,4 +390,134 @@ export declare function privacyHandler(deps: ControlPlaneHandlerDeps): (c: Conte
         }[];
     }[];
 }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/**
+ * `GET /control-plane/evidence` — the evidence pack.
+ *
+ * SOC 2 and ISO 27001 evidence derived from what this Worker composes, records and declares: each control's
+ * references, the facts read and their sources, and `evidenced`, `gap` or `not-derivable` with the reason. It
+ * proves controls present and performs nothing. Behind `evidence:read`, and it never widens another scope: what
+ * a capability keeps behind its own read stays there. Read-only.
+ */
+export declare function evidenceHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>) => Promise<Response & import("hono").TypedResponse<{
+    environment: string;
+    generatedAt: string;
+    version: string | null;
+    mappingVersion: number;
+    controls: {
+        control: "audit-logging" | "change-history" | "csrf" | "data-protection" | "key-rotation" | "management-access" | "route-verification";
+        title: string;
+        soc2: string[];
+        iso27001: string[];
+        state: "evidenced" | "gap" | "not-derivable";
+        reasons: string[];
+        facts: {
+            fact: string;
+            subject?: string | undefined;
+            value: string | number | boolean | string[] | null;
+            source: "auditRecorder" | "bindings" | "capabilityHealth" | "composition" | "connection" | "connectionKeys" | "encryptedMarkers" | "fieldKeyRetirement" | "migrationLedger" | "privacyAttestation" | "privacyMarkers" | "routeSpec" | "sameOriginGate";
+        }[];
+    }[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/**
+ * `GET /control-plane/erasure/:subjectType/:subjectId` — one subject's erasure, attested.
+ *
+ * Read from the purge's own lifecycle rows, through the capability that owns the subject, and cited in the audit
+ * chain through the composed audit. A subject with no deletion in force is a 404. Read-only.
+ */
+export declare function erasureSubjectHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>, params: ErasureSubjectParams) => Promise<Response & import("hono").TypedResponse<{
+    generatedAt: string;
+    attestation: {
+        subject: {
+            type: "organization" | "user";
+            id: string;
+        };
+        deletion: {
+            at: string;
+            actorType: string;
+            reason: string | null;
+            mode: "hard" | "soft" | null;
+            purgeAfter: string | null;
+            audit: {
+                eventId: string;
+                action: string;
+                occurredAt: string;
+                tenant: string | null;
+                seq: number | null;
+                hash: string | null;
+            } | null;
+        };
+        state: "complete" | "failed" | "in_progress" | "scheduled";
+        overdue: boolean;
+        stoppedAt: string | null;
+        steps: {
+            capability: string;
+            disposition: "erased" | "retained";
+            reason: string | null;
+            summary: string | null;
+            completedAt: string;
+            audit: {
+                eventId: string;
+                action: string;
+                occurredAt: string;
+                tenant: string | null;
+                seq: number | null;
+                hash: string | null;
+            } | null;
+        }[];
+        completedAt: string | null;
+        completion: {
+            eventId: string;
+            action: string;
+            occurredAt: string;
+            tenant: string | null;
+            seq: number | null;
+            hash: string | null;
+        } | null;
+        failure: {
+            eventId: string;
+            action: string;
+            occurredAt: string;
+            tenant: string | null;
+            seq: number | null;
+            hash: string | null;
+        } | null;
+        trail: "absent" | "recorded";
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** `GET /control-plane/erasure?since&until` — every purge in a period, counted. Read-only. */
+export declare function erasurePeriodHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>, query: ErasurePeriodQuery) => Promise<Response & import("hono").TypedResponse<{
+    generatedAt: string;
+    since: string;
+    until: string;
+    subjects: ("organization" | "user")[];
+    counts: {
+        scheduled: number;
+        inProgress: number;
+        complete: number;
+        failed: number;
+        overdue: number;
+    };
+    attention: {
+        subject: {
+            type: "organization" | "user";
+            id: string;
+        };
+        state: "complete" | "failed" | "in_progress" | "scheduled";
+        overdue: boolean;
+        purgeAfter: string | null;
+        completedAt: string | null;
+        stoppedAt: string | null;
+    }[];
+    purges: {
+        subject: {
+            type: "organization" | "user";
+            id: string;
+        };
+        state: "complete" | "failed" | "in_progress" | "scheduled";
+        overdue: boolean;
+        purgeAfter: string | null;
+        completedAt: string | null;
+        stoppedAt: string | null;
+    }[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/controlPlane/http/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI3D,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,sBAAsB,EAAwB,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,KAAK,yBAAyB,EAA0B,MAAM,kCAAkC,CAAC;AAU1G,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAuBvF,yGAAyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,oBAAoB,CAAC;IAC7D;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAClE;;;OAGG;IACH,kBAAkB,EAAE,MAAM,SAAS,yBAAyB,EAAE,CAAC;IAC/D;;;OAGG;IACH,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;IACzC;;;OAGG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAgED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;kEAUjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAoCvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAgBvC;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;mEAcvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,QAAQ,kBAAkB;;;;;;;;;;;;;;iBAoDjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,UAAU,eAAe,QAAQ,gBAAgB;;;;;;;;;;;;;;mEA8CxF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,uBAAuB,OACzC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAiBvC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/handlers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,KAAK,sBAAsB,EAAwB,MAAM,qBAAqB,CAAC;AAMxF,OAAO,EAAE,KAAK,yBAAyB,EAA0B,MAAM,kCAAkC,CAAC;AAc1G,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,WAAW,CAAC;AAuBnB,yGAAyG;AACzG,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,oBAAoB,CAAC;IAC7D;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,SAAS,qBAAqB,EAAE,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAClE;;;OAGG;IACH,kBAAkB,EAAE,MAAM,SAAS,yBAAyB,EAAE,CAAC;IAC/D;;;OAGG;IACH,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;IACzC;;;OAGG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE;;;OAGG;IACH,gBAAgB,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACjE;;;OAGG;IACH,WAAW,EAAE,MAAM,SAAS,UAAU,EAAE,CAAC;IACzC;;;OAGG;IACH,WAAW,EAAE,MAAM,SAAS,UAAU,EAAE,GAAG,SAAS,CAAC;IACrD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,2GAA2G;AAC3G,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,mBAAmB,CASpE;AA+ED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;kEAUjC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAS1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAsCvC;AAQD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,uBAAuB,OAC5C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAgBvC;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAevC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,QAAQ,kBAAkB;;;;;;;;;;;;;;iBAsDjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,UAAU,eAAe,QAAQ,gBAAgB;;;;;;;;;;;;;;mEAgDxF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,uBAAuB,OACzC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAiBvC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,OAC1C,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;mEAIvC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,uBAAuB,OAChD,OAAO,CAAC,YAAY,CAAC,UAAU,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAYrE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,uBAAuB,OAC/C,OAAO,CAAC,YAAY,CAAC,SAAS,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAKlE"}

package/dist/controlPlane/http/handlers.js

@@ -1,16 +1,19 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { commandName } from "../../cli/command.js";
+import { ControlPlaneInvalidCredentialError, ControlPlaneKeyConflictError } from "../error/errors.js";
 import { workerVersionMetadata } from "../../worker/identity.js";
-import { ControlPlaneConnection } from "../data/connection.js";
-import { CONTROL_PLANE_CONNECTIONS_TABLE } from "../data/tables.js";
 import { healthWire } from "../discovery/healthSummary.js";
 import { readCapabilityHealth } from "../discovery/health.js";
 import { ControlPlaneAuditActions, safeEmit } from "../audit/actions.js";
-import { ControlPlaneInvalidCredentialError, ControlPlaneKeyConflictError } from "../error/errors.js";
 import { appendKey, expireKey, pruneKeys } from "../data/keyLifecycle.js";
 import { privacyAttestation, privacyPosture } from "../../privacy/posture.js";
+import { readConnectionForWrite, writeKeys } from "../data/connections.js";
 import { causeMessage } from "../../error/cause.js";
+import { routeInputs, withRouteInputs } from "../discovery/routeInput.js";
+import { readErasurePeriod, readErasureSubject } from "../erasure/read.js";
 import { readDatabaseMigrations } from "../migrationState/migrationState.js";
+import { readEvidencePack } from "../evidence/pack.js";
 //#region src/controlPlane/http/handlers.ts
 /**
 * The seam's own route handlers.
@@ -37,19 +40,23 @@ function caller(c) {
 	if (!context) throw new ControlPlaneInvalidCredentialError({ detail: "handler reached with no verified control-plane caller" });
 	return context;
 }
-/** Load the connection this call authenticated against. It verified moments ago, so it exists. */
+/** Load the connection this call authenticated against, as stored, for a key write. It verified moments ago. */
 async function loadConnection(db, connectionId) {
-	const row = await db.selectFrom(CONTROL_PLANE_CONNECTIONS_TABLE).selectAll().where("id", "=", connectionId).executeTakeFirst();
-	if (!row) throw new ControlPlaneInvalidCredentialError({ detail: `connection ${connectionId} disappeared mid-request` });
-	return { connection: ControlPlaneConnection.parse(row) };
+	const loaded = await readConnectionForWrite(db, connectionId);
+	if (loaded === null) throw new ControlPlaneInvalidCredentialError({ detail: `connection ${connectionId} disappeared mid-request` });
+	return loaded;
 }
-/** Write a connection's key array back, stamping `updatedAt`. One UPDATE — a rotation cannot half-apply. */
-async function saveKeys(db, connectionId, keys, now) {
-	const encoded = ControlPlaneConnection.shape.keys.encode([...keys]);
-	await db.updateTable(CONTROL_PLANE_CONNECTIONS_TABLE).set({
-		keys: encoded,
-		updatedAt: ControlPlaneConnection.shape.updatedAt.encode(now)
-	}).where("id", "=", connectionId).execute();
+/**
+* Write a connection's key array back, stamping `updatedAt`. One UPDATE, so a rotation cannot half-apply, and only
+* while the keys are still what `loaded` read: a revocation landing between the read and this write is never undone.
+*/
+async function saveKeys(db, loaded, keys, now) {
+	if (await writeKeys(db, loaded, keys, now)) return;
+	throw new ControlPlaneKeyConflictError({
+		message: "The connection's keys changed while this call ran.",
+		action: "Make the call again.",
+		detail: `connection ${loaded.connection.id} had its keys written between this call's read and its write`
+	});
 }
 /**
 * The public view of one registered key. Windows and ages, never anything secret.
@@ -67,6 +74,35 @@ function publicKeyView(key) {
 		revokedAt: key.revokedAt?.toISOString() ?? null
 	};
 }
+/** The public view of one OIDC trust: its issuer, audience and claims — the population it admits. */
+function trustView(trust) {
+	return {
+		trustId: trust.trustId,
+		issuer: trust.issuer,
+		audience: trust.audience,
+		claims: { ...trust.claims },
+		authorizedBy: trust.authorizedBy,
+		validFrom: trust.validFrom.toISOString(),
+		revokedAt: trust.revokedAt?.toISOString() ?? null,
+		firstCallAt: trust.firstCallAt?.toISOString() ?? null
+	};
+}
+/**
+* Refuse a key write to a caller that verified under an OIDC trust.
+*
+* A trust exists so that no key is held on the workload's host. Letting a trust's caller register a key would
+* turn a short-lived identity into a standing credential at the first call — an exchange by another name, and
+* the custody the trust was registered to avoid. Granting `keys:rotate` to a connection is a statement about
+* its keys, never a license for a workload to mint one.
+*/
+function refuseTrustCaller(context, what) {
+	if (context.credentialKind !== "trust") return;
+	throw new ControlPlaneKeyConflictError({
+		message: "A call under a workload trust cannot change this connection's keys.",
+		action: `Register or expire a key from a client that holds one, or with ${commandName("dashboard connect")}.`,
+		detail: `${what} refused: trust ${context.keyId} verified this call`
+	});
+}
 /**
 * `GET /control-plane/ping` — connectivity and key proof.
 *
@@ -96,11 +132,11 @@ function pingHandler(deps) {
 * Discovery over configuration. A client builds its navigation from this rather than from settings
 * someone maintains, so a Worker with no payments capability has no purchases pane as a matter of fact.
 *
-* **And the numbers a client would otherwise pay a second round trip for** (#317). Each capability's
+* **And the numbers a client would otherwise pay a second round trip for**. Each capability's
 * bounded summary is resolved here, behind the scope that capability's own read is behind: a connection
 * without it gets no number rather than a zero, and never costs the adopter's Worker the query.
 *
-* **One capability's failure costs one capability's number** (#350). A producer that throws, or that
+* **One capability's failure costs one capability's number**. A producer that throws, or that
 * reports something its declaration cannot name, lands on `unavailable` for that entry alone —
 * `readCapabilityHealth` catches it, so nothing rejects, so `Promise.all` still resolves and every
 * sibling still reports. This route is what the whole management surface is built from; a manifest that
@@ -108,10 +144,19 @@ function pingHandler(deps) {
 * name.
 */
 function manifestHandler(deps) {
+	let converted;
+	const inputsFor = (groups) => {
+		if (groups === void 0) return void 0;
+		if (converted?.groups !== groups) converted = {
+			groups,
+			inputs: routeInputs(groups)
+		};
+		return converted.inputs;
+	};
 	return async (c) => {
 		const context = caller(c);
 		const sources = deps.composedHealth();
-		const capabilities = await Promise.all(deps.composedCapabilities().map(async (declaration) => ({
+		const capabilities = await Promise.all(withRouteInputs(deps.composedCapabilities(), inputsFor(deps.routeGroups())).map(async (declaration) => ({
 			...declaration,
 			...healthWire(await readCapabilityHealth(sources.get(declaration.name), context.grantedScopes, (source) => source.read(c)))
 		})));
@@ -126,12 +171,18 @@ function manifestHandler(deps) {
 				retirement: await deps.retirement(c.env)
 			},
 			capabilities,
-			grantedScopes: [...context.grantedScopes]
+			grantedScopes: [...context.grantedScopes],
+			...retentionOf(deps)
 		});
 	};
 }
+/** The resolved retention for the manifest, or nothing where this Worker recorded none. */
+function retentionOf(deps) {
+	const retention = deps.retention?.() ?? null;
+	return retention === null ? {} : { retention };
+}
 /**
-* `GET /control-plane/migrations` — where each database this Worker binds stands (#729).
+* `GET /control-plane/migrations` — where each database this Worker binds stands.
 *
 * Read-only: it reports, and nothing over the seam runs, reverses or resets a migration.
 *
@@ -165,7 +216,8 @@ function listKeysHandler(deps) {
 			keys: connection.keys.map(publicKeyView),
 			authorizedBy: connection.authorizedBy,
 			actorKind: connection.actorKind,
-			purpose: connection.purpose
+			purpose: connection.purpose,
+			trusts: (connection.trusts ?? []).map(trustView)
 		});
 	};
 }
@@ -182,9 +234,11 @@ function listKeysHandler(deps) {
 function registerKeyHandler(deps) {
 	return async (c, body) => {
 		const context = caller(c);
+		refuseTrustCaller(context, "key registration");
 		const db = deps.database(c);
 		const now = deps.now();
-		const { connection } = await loadConnection(db, context.connectionId);
+		const loaded = await loadConnection(db, context.connectionId);
+		const { connection } = loaded;
 		const appended = appendKey(connection.keys, {
 			keyId: body.keyId,
 			publicKey: body.publicKey,
@@ -197,7 +251,7 @@ function registerKeyHandler(deps) {
 			retentionMs: deps.config.keyRetentionDays * MS_PER_DAY,
 			maxKeys: deps.config.maxKeys
 		});
-		await saveKeys(db, connection.id, pruned, now);
+		await saveKeys(db, loaded, pruned, now);
 		await safeEmit(c.var.emit, {
 			action: ControlPlaneAuditActions.keyRegistered,
 			outcome: "success",
@@ -241,9 +295,11 @@ function registerKeyHandler(deps) {
 function expireKeyHandler(deps) {
 	return async (c, params, body) => {
 		const context = caller(c);
+		refuseTrustCaller(context, "key expiry");
 		const db = deps.database(c);
 		const now = deps.now();
-		const { connection } = await loadConnection(db, context.connectionId);
+		const loaded = await loadConnection(db, context.connectionId);
+		const { connection } = loaded;
 		if (body.provenKeyId !== context.keyId) throw new ControlPlaneKeyConflictError({
 			message: "Sign this request with the replacement key you are naming as proven.",
 			action: "Rotate to the new key, make a call with it, then expire the old one in that same call.",
@@ -253,7 +309,7 @@ function expireKeyHandler(deps) {
 			provenKeyId: body.provenKeyId,
 			now
 		});
-		await saveKeys(db, connection.id, expired, now);
+		await saveKeys(db, loaded, expired, now);
 		await safeEmit(c.var.emit, {
 			action: ControlPlaneAuditActions.keyExpired,
 			outcome: "success",
@@ -280,7 +336,7 @@ function expireKeyHandler(deps) {
 	};
 }
 /**
-* `GET /control-plane/privacy` — the full privacy inventory (#132).
+* `GET /control-plane/privacy` — the full privacy inventory.
 *
 * Every storage schema this Worker composed that holds a marked field, each field's path and class, and where it
 * is stored — derived from the running code, so unmarking a field removes it on the next deploy with nothing in
@@ -306,5 +362,40 @@ function privacyHandler(deps) {
 		});
 	};
 }
+/**
+* `GET /control-plane/evidence` — the evidence pack.
+*
+* SOC 2 and ISO 27001 evidence derived from what this Worker composes, records and declares: each control's
+* references, the facts read and their sources, and `evidenced`, `gap` or `not-derivable` with the reason. It
+* proves controls present and performs nothing. Behind `evidence:read`, and it never widens another scope: what
+* a capability keeps behind its own read stays there. Read-only.
+*/
+function evidenceHandler(deps) {
+	return async (c) => {
+		const context = caller(c);
+		return c.json(await readEvidencePack(c, deps, context));
+	};
+}
+/**
+* `GET /control-plane/erasure/:subjectType/:subjectId` — one subject's erasure, attested.
+*
+* Read from the purge's own lifecycle rows, through the capability that owns the subject, and cited in the audit
+* chain through the composed audit. A subject with no deletion in force is a 404. Read-only.
+*/
+function erasureSubjectHandler(deps) {
+	return async (c, params) => {
+		caller(c);
+		const env = c.env ?? {};
+		return c.json(await readErasureSubject(env, deps, params.subjectType, params.subjectId));
+	};
+}
+/** `GET /control-plane/erasure?since&until` — every purge in a period, counted. Read-only. */
+function erasurePeriodHandler(deps) {
+	return async (c, query) => {
+		caller(c);
+		const env = c.env ?? {};
+		return c.json(await readErasurePeriod(env, deps, query));
+	};
+}
 //#endregion
-export { expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler };
+export { caller, erasurePeriodHandler, erasureSubjectHandler, evidenceHandler, expireKeyHandler, listKeysHandler, manifestHandler, migrationsHandler, pingHandler, privacyHandler, registerKeyHandler };

package/dist/controlPlane/http/holds.d.ts

@@ -0,0 +1,57 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Context } from "hono";
+import type { PithyHonoEnv } from "../../capability/capability";
+import type { LegalHold } from "../data/hold";
+import { type ControlPlaneHandlerDeps } from "./handlers";
+import type { LegalHoldView } from "./responses";
+import type { HoldListQuery, HoldParams, PlaceHoldRequest, ReleaseHoldRequest } from "./schemas";
+/** A hold, as the routes answer it. */
+export declare function holdView(hold: LegalHold): LegalHoldView;
+/** `POST /control-plane/holds` — place a hold. */
+export declare function placeHoldHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>, body: PlaceHoldRequest) => Promise<Response & import("hono").TypedResponse<{
+    hold: {
+        id: string;
+        subjectType: "audit" | "organization" | "user";
+        subjectId: string | null;
+        reason: string;
+        placedBy: string;
+        placedAt: string;
+        state: "active" | "released";
+        releasedAt: string | null;
+        releasedBy: string | null;
+        releaseReason: string | null;
+    };
+}, 201, "json">>;
+/** `POST /control-plane/holds/:holdId/release` — release a hold, with a reason. */
+export declare function releaseHoldHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>, params: HoldParams, body: ReleaseHoldRequest) => Promise<Response & import("hono").TypedResponse<{
+    hold: {
+        id: string;
+        subjectType: "audit" | "organization" | "user";
+        subjectId: string | null;
+        reason: string;
+        placedBy: string;
+        placedAt: string;
+        state: "active" | "released";
+        releasedAt: string | null;
+        releasedBy: string | null;
+        releaseReason: string | null;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** `GET /control-plane/holds` — every hold, standing first. Read-only. */
+export declare function listHoldsHandler(deps: ControlPlaneHandlerDeps): (c: Context<PithyHonoEnv>, query: HoldListQuery) => Promise<Response & import("hono").TypedResponse<{
+    active: number;
+    holds: {
+        id: string;
+        subjectType: "audit" | "organization" | "user";
+        subjectId: string | null;
+        reason: string;
+        placedBy: string;
+        placedAt: string;
+        state: "active" | "released";
+        releasedAt: string | null;
+        releasedBy: string | null;
+        releaseReason: string | null;
+    }[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+//# sourceMappingURL=holds.d.ts.map

package/dist/controlPlane/http/holds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holds.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/holds.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,KAAK,uBAAuB,EAAU,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAuD,aAAa,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAcjG,uCAAuC;AACvC,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CAavD;AAwBD,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,QAAQ,gBAAgB;;;;;;;;;;;;;iBAY/D;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,OAC7C,OAAO,CAAC,YAAY,CAAC,UAAU,UAAU,QAAQ,kBAAkB;;;;;;;;;;;;;mEAWrF;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,OAC3C,OAAO,CAAC,YAAY,CAAC,SAAS,aAAa;;;;;;;;;;;;;;mEAY7D"}