@pithy-sh/core 0.13.0 → 0.15.0

package/src/controlPlane/http/verifyTrust.ts

@@ -0,0 +1,176 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { WebhookUnverifiedError } from "../../error/pithyError";
+import { type JwksCache, type OidcJwksFetch, verifyOidcToken } from "../../http/oidcWebhook";
+import { ControlPlaneContext } from "../context";
+import type { ControlPlaneConnection } from "../data/connection";
+import { claimsMatch, findVerifyingTrust, observedClaims } from "../data/oidcTrust";
+import {
+  ControlPlaneInsufficientScopeError,
+  ControlPlaneInvalidCredentialError,
+  ControlPlaneNotConnectedError,
+} from "../error/errors";
+import { type ControlPlaneRequirement, ControlPlaneScope, scopeCovers } from "../scope/scope";
+
+/**
+ * Verify one call made under an OIDC trust (#722, `docs/AGENT-ACCESS.md` §6.2) — the second credential kind's
+ * half of the decision `verify.ts` makes for a key.
+ *
+ * ## Per call, and the call still names its scope
+ *
+ * An identity token proves **who**, never **what**. So every call presents the workload's token on
+ * `pithy-control-plane-oidc`, names the trust on `pithy-control-plane-trust`, and names the one scope it
+ * exercises on `pithy-control-plane-scope`; the token is verified against the trust on every call, and the
+ * scope is checked against the connection's grant exactly as a key's token is.
+ *
+ * **No exchange, deliberately.** Trading the token once for a short-lived credential would keep every
+ * property of the key path, and it would put a key on the workload's host — the custody this credential kind
+ * exists to remove. What remains is stated rather than hidden: a captured token replays against this one
+ * audience until it expires, which is the provider's lifetime, minutes, and the same bound as revocation's
+ * latency. There is no `jti` to spend, because one token serves every call in its job.
+ *
+ * ## The existing verifier, not a second one
+ *
+ * The token goes through `verifyOidcToken` from `core/src/http/oidcWebhook.ts`, with its ordering intact:
+ * the algorithm pinned before a key is touched, the key resolved by `kid` from the issuer's published set,
+ * the signature checked over the received segments, and only then a claim read. Its predicate is handed
+ * `() => true` on purpose — the issuer, audience and freshness are still its to check, and the claims match
+ * runs here, after, because a refusal here has to know **what** the token carried, which a boolean cannot say.
+ *
+ * ## One error, with one narrow exception
+ *
+ * Every failure raises {@link ControlPlaneInvalidCredentialError}, as on the key path, with the step in
+ * `detail`. The exception is what it carries, never what it says: a claim mismatch on a token whose signature,
+ * issuer and audience all verified records the claims it carried for the audit row. That is what makes a
+ * custom issuer workable and a profiled one self-correcting. Before those three verify, nothing is recorded.
+ */
+
+/** What the trust path needs from the outside world. Every one is injectable, so every step is testable. */
+export interface ControlPlaneTrustVerifyDeps {
+  /**
+   * This environment's connection, or null when none is registered. One per environment (`docs/CONTROL-PLANE.md`
+   * §15), so a call names only the trust, and the connection is the one the Worker's own environment owns.
+   */
+  loadEnvironmentConnection: () => Promise<ControlPlaneConnection | null>;
+  /** This Worker's environment name, checked against the connection's. */
+  environment: string;
+  /** The clock. */
+  now: () => Date;
+  /**
+   * Where the issuers' key sets are held between calls. Built once per seam, never per request: an anonymous
+   * caller naming a trust and an invented `kid` must cost a map lookup, not a round trip to the issuer.
+   */
+  jwksCache: JwksCache;
+  /** The HTTP seam the issuers' key endpoints are reached through. Defaults to the runtime's `fetch`. */
+  transport?: OidcJwksFetch;
+  /**
+   * Record the first allowed call under a trust, so a listing can stop saying *awaiting a first call*. Evidence
+   * rather than part of the decision: it runs after the call is allowed, once, and a failure is swallowed.
+   */
+  recordFirstCall: (connectionId: string, trustId: string, at: Date) => Promise<void>;
+}
+
+/** One inbound call under a trust, reduced to what verification needs. */
+export interface ControlPlaneTrustCall {
+  /** The workload's OIDC token, from `pithy-control-plane-oidc`. */
+  token: string | undefined;
+  /** The trust the call names, from `pithy-control-plane-trust`. */
+  trustId: string | undefined;
+  /** The scope the call names, from `pithy-control-plane-scope`. */
+  scope: string | undefined;
+  /** What the route demands. */
+  requirement: ControlPlaneRequirement;
+}
+
+/** Raise the one credential error, naming the failing step for the log and nobody else. */
+function deny(step: string): never {
+  throw new ControlPlaneInvalidCredentialError({ detail: step });
+}
+
+/** Verify one call under an OIDC trust, or throw. Returns the context the handler runs under. */
+export async function verifyControlPlaneTrustCall(
+  call: ControlPlaneTrustCall,
+  deps: ControlPlaneTrustVerifyDeps,
+): Promise<ControlPlaneContext> {
+  // 1. Everything the call must name, before anything is loaded. A lookup an anonymous caller can buy with a
+  //    header it did not finish writing is a lookup nobody needed.
+  if (!call.token) deny("no OIDC token presented");
+  if (!call.trustId) deny("an OIDC call named no trust");
+  const scope = ControlPlaneScope.safeParse(call.scope);
+  if (!scope.success) deny("an OIDC call named no well-formed scope");
+
+  // 2. The environment's connection, and the trust it names. Lookups, not grants.
+  const now = deps.now();
+  const connection = await deps.loadEnvironmentConnection();
+  if (!connection) {
+    throw new ControlPlaneNotConnectedError({ detail: `no connection registered in environment ${deps.environment}` });
+  }
+  if (connection.environment !== deps.environment) {
+    deny(`connection ${connection.id} is bound to ${connection.environment}, not ${deps.environment}`);
+  }
+  const trust = findVerifyingTrust(connection.trusts ?? [], call.trustId, now);
+  if (!trust) deny(`trust ${call.trustId} is not a live trust on connection ${connection.id}`);
+
+  // 3. The token, against the trust's issuer and audience, through the verifier the webhooks use. Its own
+  //    errors for an unreachable key endpoint (502) and a misconfiguration (500) pass through: neither is the
+  //    caller's, and both still refuse the call.
+  let claims: Record<string, unknown>;
+  try {
+    claims = await verifyOidcToken(call.token, {
+      issuers: [trust.issuer],
+      jwksUrl: trust.jwksUrl,
+      audience: trust.audience,
+      claims: () => true,
+      jwksCache: deps.jwksCache,
+      ...(deps.transport === undefined ? {} : { transport: deps.transport }),
+      now,
+    });
+  } catch (error) {
+    if (error instanceof WebhookUnverifiedError)
+      deny(`trust ${trust.trustId}: ${error.payload.detail ?? "unverified"}`);
+    throw error;
+  }
+
+  // 4. The subject constraint — the boundary. Signature, issuer and audience have verified, so the claims the
+  //    token carried are recorded on the refusal; the response is the same one every other step gives.
+  if (!claimsMatch(trust.claims, claims)) {
+    throw new ControlPlaneInvalidCredentialError({
+      detail: `trust ${trust.trustId}: the token's claims do not match the trust's`,
+      refusedTrust: { connectionId: connection.id, trustId: trust.trustId, observedClaims: observedClaims(claims) },
+    });
+  }
+
+  // 5. Scope: what the call named, and what the adopter granted. The same check, and the same refusal, as a key's.
+  const subject = typeof claims.sub === "string" && claims.sub !== "" ? claims.sub : `trust:${trust.trustId}`;
+  if (!scopeCovers(call.requirement, scope.data, connection.scopes)) {
+    throw new ControlPlaneInsufficientScopeError({
+      detail: `required ${String(call.requirement)}; call named ${scope.data}; connection grants [${connection.scopes.join(", ")}]; trust ${trust.trustId}`,
+      caller: {
+        connectionId: connection.id,
+        subject,
+        keyId: trust.trustId,
+        credentialKind: "trust",
+        actorKind: connection.actorKind,
+      },
+    });
+  }
+
+  // 6. The first call this trust has answered, recorded once. Never part of the decision: the call is allowed.
+  if (trust.firstCallAt === null) {
+    await deps.recordFirstCall(connection.id, trust.trustId, now).catch(() => undefined);
+  }
+
+  return ControlPlaneContext.parse({
+    connectionId: connection.id,
+    environment: connection.environment,
+    issuer: trust.issuer,
+    subject,
+    scope: scope.data,
+    grantedScopes: connection.scopes,
+    keyId: trust.trustId,
+    tokenId: typeof claims.jti === "string" ? claims.jti : "",
+    credentialKind: "trust",
+    actorKind: connection.actorKind,
+  });
+}

package/src/controlPlane/migrations/0004_connection_trusts.ts

@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { Kysely } from "kysely";
+import type { Migration } from "kysely/migration";
+
+/**
+ * A connection's OIDC trusts — `#722`, the second credential kind beside a registered key.
+ *
+ * **Appended, not folded into `0001`.** The seam has shipped and adopters' databases hold rows written by it.
+ *
+ * **One JSON column beside `keys`, defaulting to an empty list.** The same reasons `keys` is one column rather
+ * than a child table: verifying a call stays a single read, and revoking a trust is one `UPDATE`. Not null,
+ * with `'[]'` as its default, so every existing row reads as a connection holding no trust — which is exactly
+ * what it is — and nothing is backfilled.
+ */
+export const controlplane_0004_connection_trusts: Migration = {
+  up: async (db: Kysely<unknown>): Promise<void> => {
+    await db.schema
+      .alterTable("pithyControlplaneConnections")
+      .addColumn("trusts", "text", (column) => column.notNull().defaultTo("[]"))
+      .execute();
+  },
+
+  down: async (db: Kysely<unknown>): Promise<void> => {
+    // Dropped in place, for the reason `0002` gives: a rebuild would rewrite every row of a table holding live
+    // credentials. Every key on the row survives; the trusts go with their column.
+    await db.schema.alterTable("pithyControlplaneConnections").dropColumn("trusts").execute();
+  },
+};

package/src/controlPlane/migrations/0005_holds.ts

@@ -0,0 +1,40 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { Kysely } from "kysely";
+import type { Migration } from "kysely/migration";
+
+/**
+ * Legal holds. Appended: the seam has shipped and adopters' databases hold its rows.
+ *
+ * One row per hold, kept after it is released, so the table is the record of every hold that ever stood. Indexed on
+ * `(state, subject_type, subject_id)`, because the question every purge and prune asks is "is an active hold on this
+ * subject", and it is asked once per step.
+ */
+export const controlplane_0005_holds: Migration = {
+  up: async (db: Kysely<unknown>): Promise<void> => {
+    await db.schema
+      .createTable("pithyControlplaneHolds")
+      .addColumn("id", "text", (c) => c.primaryKey())
+      .addColumn("subjectType", "text", (c) => c.notNull())
+      .addColumn("subjectId", "text")
+      .addColumn("reason", "text", (c) => c.notNull())
+      .addColumn("placedBy", "text", (c) => c.notNull())
+      .addColumn("placedAt", "integer", (c) => c.notNull())
+      .addColumn("state", "text", (c) => c.notNull())
+      .addColumn("releasedAt", "integer")
+      .addColumn("releasedBy", "text")
+      .addColumn("releaseReason", "text")
+      .execute();
+    await db.schema
+      .createIndex("pithyControlplaneHoldsSubjectIdx")
+      .on("pithyControlplaneHolds")
+      .columns(["state", "subjectType", "subjectId"])
+      .execute();
+  },
+
+  down: async (db: Kysely<unknown>): Promise<void> => {
+    await db.schema.dropIndex("pithyControlplaneHoldsSubjectIdx").execute();
+    await db.schema.dropTable("pithyControlplaneHolds").execute();
+  },
+};

package/src/controlPlane/processing/derive.ts

@@ -0,0 +1,359 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { ConsentPurpose } from "../../consent/purpose";
+import type { ConsentPurposeStanding } from "../../consent/reader";
+import type { PrivacyInventory } from "../../privacy/report";
+import type { ResolvedActivity } from "../../processing/activity";
+import type { RecipientSource } from "../../processing/vocabulary";
+import type { EffectiveRetention } from "../../retention/policy";
+import { EVIDENCE_CONTROLS, type EvidenceControlId, type EvidenceState } from "../evidence/mapping";
+import type {
+  ControlPlaneProcessingResponse,
+  ProcessingConsentView,
+  ProcessingEntry,
+  ProcessingGap,
+  ProcessingRecipientView,
+  ProcessingRetentionView,
+} from "../http/responses";
+
+/**
+ * The record of processing activities, derived. Pure: `./read.ts` gathers what the Worker declares and records, and
+ * this turns it into the GDPR Article 30 record.
+ *
+ * **It describes the processing and changes none of it.** Every gap is named and none is filled in: an activity with
+ * no legal basis reads as having none, and the record never guesses one.
+ */
+
+/** The evidence pack's controls that protect stored personal data, which every activity cites. */
+export const PROCESSING_MEASURES = [
+  "data-protection",
+  "audit-logging",
+  "management-access",
+  "key-rotation",
+  "route-verification",
+  "csrf",
+] as const satisfies readonly EvidenceControlId[];
+
+/** The platform every Worker runs on, which receives everything it serves and stores. */
+export const CLOUDFLARE = "Cloudflare";
+
+const CLOUDFLARE_RECEIVES =
+  "Every request this Worker serves, and everything it stores in D1, KV, R2 and Durable Objects.";
+
+/** What the record knows of consent. */
+export type ConsentInput =
+  /** The composed reader answered: every purpose in its catalog, with counts. */
+  | { readonly state: "read"; readonly standings: readonly ConsentPurposeStanding[] }
+  /** No consent capability is composed: purposes may be declared, and no grant can be recorded. */
+  | { readonly state: "not-composed"; readonly declared: readonly ConsentPurpose[] }
+  /**
+   * A reader is composed and its record could not be read: its whole catalog, read from memory, or null where the
+   * reader cannot list one.
+   */
+  | { readonly state: "unreadable"; readonly catalog: readonly ConsentPurpose[] | null };
+
+/** A recipient a binding implies, on the capability that declares the binding. */
+export interface BindingRecipient {
+  readonly name: string;
+  readonly receives: string;
+  readonly classes: readonly string[];
+  readonly capability: string;
+}
+
+/** Everything the derivation reads. */
+export interface ProcessingInputs {
+  readonly activities: readonly ResolvedActivity[];
+  /** The privacy inventory, or null where it could not be walked. */
+  readonly inventory: PrivacyInventory | null;
+  /** The resolved retention, or null where the Worker recorded none. */
+  readonly retention: EffectiveRetention | null;
+  readonly consent: ConsentInput;
+  readonly bindingRecipients: readonly BindingRecipient[];
+  /** Each control's state from the evidence pack, or null where the connection may not read it. */
+  readonly measures: Readonly<Partial<Record<EvidenceControlId, EvidenceState>>> | null;
+  /** Whether a gap may name a stored table and field, which only a connection holding `privacy:read` may read. */
+  readonly fieldNames: boolean;
+}
+
+/** The record, without the envelope the route adds. */
+export type DerivedProcessingRecord = Omit<ControlPlaneProcessingResponse, "environment" | "generatedAt" | "version">;
+
+/** A capability shaped enough to say which bindings it needs. */
+interface BindingDeclarer {
+  readonly name: string;
+  readonly requiredBindings: readonly { readonly type: string; readonly name: string }[];
+}
+
+/** Workers AI, once for each capability whose `ai` binding this Worker has. */
+export function workersAiRecipients(
+  capabilities: readonly BindingDeclarer[],
+  env: Record<string, unknown>,
+): BindingRecipient[] {
+  return capabilities.flatMap((capability) =>
+    capability.requiredBindings
+      .filter((binding) => binding.type === "ai" && env[binding.name] != null)
+      .map((binding) => ({
+        name: "Cloudflare Workers AI",
+        receives: `What ${capability.name} sends for inference through the ${binding.name} binding.`,
+        classes: [],
+        capability: capability.name,
+      })),
+  );
+}
+
+/** The catalog's purposes, however the record learned of them, or null where it could learn none. */
+function catalogOf(consent: ConsentInput): ReadonlyMap<string, ConsentPurpose> | null {
+  const purposes =
+    consent.state === "read"
+      ? consent.standings.map((entry) => entry.purpose)
+      : consent.state === "unreadable"
+        ? consent.catalog
+        : consent.declared;
+  return purposes === null ? null : new Map(purposes.map((purpose) => [purpose.id, purpose]));
+}
+
+/** A consent-based activity's purpose and its counts, where they are known. */
+function consentView(id: string, consent: ConsentInput): ProcessingConsentView {
+  const purpose = catalogOf(consent)?.get(id);
+  const counted = consent.state === "read" ? consent.standings.find((entry) => entry.purpose.id === id) : undefined;
+  const zero = consent.state === "not-composed" && purpose !== undefined ? 0 : null;
+  return {
+    purpose: id,
+    noticeVersion: purpose?.noticeVersion ?? null,
+    explicit: purpose?.explicit ?? null,
+    grants: counted?.grants ?? zero,
+    withdrawals: counted?.withdrawals ?? zero,
+    standing: counted?.standing ?? zero,
+  };
+}
+
+/** The retention behind an activity's classes. */
+function retentionView(
+  classes: readonly string[],
+  retention: EffectiveRetention | null,
+): ProcessingRetentionView | null {
+  if (retention === null) return null;
+  return {
+    classAges: retention.classAges.filter((age) => classes.includes(age.class)).map((age) => ({ ...age })),
+    purgeWindows: retention.purgeWindows.map((window) => ({ ...window })),
+  };
+}
+
+/** A recipient as the record shows it. */
+function recipient(
+  name: string,
+  receives: string,
+  classes: readonly string[],
+  source: RecipientSource,
+): ProcessingRecipientView {
+  return { name, receives, classes: [...classes], source };
+}
+
+/** The gaps one activity has. */
+function activityGaps(
+  activity: ResolvedActivity,
+  stored: ReadonlySet<string> | null,
+  catalog: ReadonlyMap<string, ConsentPurpose> | null,
+): ProcessingGap[] {
+  const gaps: ProcessingGap[] = [];
+  if (activity.legalBasis === null) {
+    gaps.push({
+      kind: "no-legal-basis",
+      subject: activity.id,
+      detail: "No legal basis is declared. State one on the activity, or in the processing block's overrides.",
+    });
+  }
+  if (activity.legalBasis === "consent") {
+    if (activity.consentPurpose === null) {
+      gaps.push({
+        kind: "no-consent-purpose",
+        subject: activity.id,
+        detail: "The basis is consent and no consent purpose is named.",
+      });
+    } else if (catalog !== null && !catalog.has(activity.consentPurpose)) {
+      gaps.push({
+        kind: "no-consent-purpose",
+        subject: activity.id,
+        detail: `The basis is consent, and no composed catalog declares the purpose ${activity.consentPurpose}.`,
+      });
+    }
+  }
+  if (stored !== null) {
+    const unstored = activity.classes.filter((each) => !stored.has(each));
+    if (unstored.length > 0) {
+      gaps.push({
+        kind: "class-not-stored",
+        subject: activity.id,
+        detail: `It claims ${unstored.join(", ")}, which no composed schema stores.`,
+      });
+    }
+  }
+  return gaps;
+}
+
+/** Stored classes no activity of their capability, and none of the adopter's, claims. Tables only with field names. */
+function unclaimedGaps(
+  activities: readonly ResolvedActivity[],
+  inventory: PrivacyInventory,
+  fieldNames: boolean,
+): ProcessingGap[] {
+  const adopter = new Set(activities.filter((each) => each.declaredBy === "config").flatMap((each) => each.classes));
+  const byCapability = new Map<string, Map<string, Set<string>>>();
+  for (const schema of inventory.schemas) {
+    const claimed = new Set(
+      activities.filter((each) => each.declaredBy === schema.capability).flatMap((each) => each.classes),
+    );
+    for (const field of schema.fields) {
+      if (claimed.has(field.class) || adopter.has(field.class)) continue;
+      const classes = byCapability.get(schema.capability) ?? new Map<string, Set<string>>();
+      const tables = classes.get(field.class) ?? new Set<string>();
+      tables.add(schema.name);
+      classes.set(field.class, tables);
+      byCapability.set(schema.capability, classes);
+    }
+  }
+  return [...byCapability].flatMap(([capability, classes]) =>
+    [...classes].map(([cls, tables]) => ({
+      kind: "class-unclaimed" as const,
+      subject: capability,
+      detail: fieldNames
+        ? `It stores ${cls} in ${[...tables].join(", ")}, and no processing activity claims it.`
+        : `It stores ${cls}, and no processing activity claims it.`,
+    })),
+  );
+}
+
+/**
+ * Every stored `phi` field no consent purpose in the catalog covers: field by field with field names, and otherwise
+ * once for each capability that stores one. Silent where the catalog is unknown.
+ */
+function uncoveredPhi(
+  inventory: PrivacyInventory,
+  catalog: ReadonlyMap<string, ConsentPurpose> | null,
+  fieldNames: boolean,
+): ProcessingGap[] {
+  if (catalog === null) return [];
+  const covered = [...catalog.values()].some((purpose) => purpose.classes.includes("phi"));
+  if (covered) return [];
+  if (!fieldNames) {
+    const capabilities = new Set(
+      inventory.schemas
+        .filter((schema) => schema.fields.some((field) => field.class === "phi"))
+        .map((schema) => schema.capability),
+    );
+    return [...capabilities].map((capability) => ({
+      kind: "phi-not-covered" as const,
+      subject: capability,
+      detail: "It stores phi, and no consent purpose covers phi.",
+    }));
+  }
+  return inventory.schemas.flatMap((schema) =>
+    schema.fields
+      .filter((field) => field.class === "phi")
+      .map((field) => ({
+        kind: "phi-not-covered" as const,
+        subject: `${schema.capability}/${schema.name}.${field.path}`,
+        detail: "A phi field is stored, and no consent purpose covers phi.",
+      })),
+  );
+}
+
+/** Every purpose covering a class that holds no standing grant. Silent where the record could not be read. */
+function grantlessPurposes(consent: ConsentInput): ProcessingGap[] {
+  if (consent.state === "unreadable") return [];
+  if (consent.state === "not-composed") {
+    return consent.declared
+      .filter((purpose) => purpose.classes.length > 0)
+      .map((purpose) => ({
+        kind: "no-standing-grant" as const,
+        subject: purpose.id,
+        detail: `It covers ${purpose.classes.join(", ")}, and no consent capability is composed to record a grant.`,
+      }));
+  }
+  return consent.standings
+    .filter((entry) => entry.purpose.classes.length > 0 && entry.standing === 0)
+    .map((entry) => ({
+      kind: "no-standing-grant" as const,
+      subject: entry.purpose.id,
+      detail: `It covers ${entry.purpose.classes.join(", ")}, and no subject holds a current, unexpired grant.`,
+    }));
+}
+
+/** Derive the record from what the Worker declares and records. */
+export function deriveProcessingRecord(inputs: ProcessingInputs): DerivedProcessingRecord {
+  const { activities, inventory, retention, consent } = inputs;
+  const stored = inventory === null ? null : new Set(inventory.observed);
+  const catalog = catalogOf(consent);
+
+  const entries: ProcessingEntry[] = activities.map((activity) => ({
+    id: activity.id,
+    purpose: activity.purpose,
+    declaredBy: activity.declaredBy,
+    classes: [...activity.classes],
+    legalBasis: activity.legalBasis,
+    basisSource: activity.basisSource,
+    consent:
+      activity.legalBasis === "consent" && activity.consentPurpose !== null
+        ? consentView(activity.consentPurpose, consent)
+        : null,
+    recipients: [
+      recipient(CLOUDFLARE, CLOUDFLARE_RECEIVES, activity.classes, "platform"),
+      ...inputs.bindingRecipients
+        .filter((each) => each.capability === activity.declaredBy)
+        .map((each) => recipient(each.name, each.receives, each.classes, "binding")),
+      ...activity.recipients.map((each) => recipient(each.name, each.receives, each.classes, "declared")),
+    ],
+    retention: retentionView(activity.classes, retention),
+    measures: [...PROCESSING_MEASURES],
+    gaps: activityGaps(activity, stored, catalog),
+  }));
+
+  const recipients: ProcessingRecipientView[] = [
+    recipient(CLOUDFLARE, CLOUDFLARE_RECEIVES, inventory?.observed ?? [], "platform"),
+  ];
+  const seen = new Set<string>();
+  const others = [
+    ...inputs.bindingRecipients.map((each) => recipient(each.name, each.receives, each.classes, "binding")),
+    ...activities.flatMap((activity) =>
+      activity.recipients.map((each) => recipient(each.name, each.receives, each.classes, "declared")),
+    ),
+  ];
+  for (const each of others) {
+    const key = `${each.name}\u0000${each.receives}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    recipients.push(each);
+  }
+
+  const notDerivable: string[] = [];
+  if (inventory === null) {
+    notDerivable.push("The privacy inventory could not be walked, so data classes are not cross-checked.");
+  }
+  if (consent.state === "unreadable") {
+    notDerivable.push("The consent record could not be read, so grant counts are unknown.");
+  }
+  if (catalog === null) {
+    notDerivable.push(
+      "The consent catalog could not be listed, so consent purposes and phi coverage are not cross-checked.",
+    );
+  }
+
+  return {
+    activities: entries,
+    recipients,
+    measures: PROCESSING_MEASURES.map((control) => ({
+      control,
+      title: EVIDENCE_CONTROLS[control].title,
+      soc2: [...EVIDENCE_CONTROLS[control].soc2],
+      iso27001: [...EVIDENCE_CONTROLS[control].iso27001],
+      state: inputs.measures?.[control] ?? null,
+    })),
+    gaps: [
+      ...(inventory === null ? [] : unclaimedGaps(activities, inventory, inputs.fieldNames)),
+      ...(inventory === null ? [] : uncoveredPhi(inventory, catalog, inputs.fieldNames)),
+      ...grantlessPurposes(consent),
+    ],
+    notDerivable,
+  };
+}