@pithy-sh/core 0.1.3 → 0.1.5

package/dist/controlPlane/token/claims.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ControlPlaneScope } from "../scope/scope.js";
 import { z } from "zod";
 //#region src/controlPlane/token/claims.ts

package/dist/controlPlane/token/digest.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The two primitives the body-binding check needs: hash a request body, then compare that hash to the
  * one the token committed to.

package/dist/controlPlane/token/digest.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { base64UrlEncode } from "./base64url.js";
 //#region src/controlPlane/token/digest.ts
 /**

package/dist/controlPlane/token/jws.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Ed25519PublicJwk } from "../data/connection";
 import { ControlPlaneClaims, ControlPlaneJwsHeader } from "./claims";
 /**

package/dist/controlPlane/token/jws.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ControlPlaneClaims, ControlPlaneJwsHeader } from "./claims.js";
 import { ControlPlaneInvalidCredentialError } from "../error/errors.js";
 import { base64UrlDecode } from "./base64url.js";

package/dist/controlPlane/token/mint.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Ed25519PublicJwk } from "../data/connection";
 /**
  * Mint a control-plane token — the management client's half of the seam.

package/dist/controlPlane/token/mint.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ControlPlaneClaims } from "./claims.js";
 import { base64UrlEncode } from "./base64url.js";
 import { sha256Base64Url } from "./digest.js";

package/dist/controlPlane/wire.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The control-plane wire contract: the names both ends of the seam must spell identically, and the one
  * rule for reading what they carry.

package/dist/controlPlane/wire.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/controlPlane/wire.ts
 /**
 * The control-plane wire contract: the names both ends of the seam must spell identically, and the one

package/dist/createBackend.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { Hono } from "hono";
 import type { Capability, MergedDatabases, MergedKvNamespaces, MergedWorkflowParams, PithyVars } from "./capability/capability";
 import { type DbRegistry } from "./data/databases";

package/dist/createBackend.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { noopEmit } from "./audit/recorder.js";
 import { BindingSpec } from "./capability/bindings.js";
 import { ValidationError } from "./error/pithyError.js";

package/dist/createEntrypoint.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { ExecutionContext, ForwardableEmailMessage } from "@cloudflare/workers-types";
 import type { Capability } from "./capability/capability";
 import { type CreateBackendOptions } from "./createBackend";

package/dist/createEntrypoint.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { triggerWorkflow } from "./workflow/dispatch.js";
 import { composeWorkflows, scheduledWorkflows } from "./workflow/register.js";
 import { createBackend } from "./createBackend.js";

package/dist/data/boundParameters.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { D1Database } from "@cloudflare/workers-types";
 /**
  * D1's bound-parameter ceiling, and the chunking every `in (...)` list needs to stay under it.

package/dist/data/boundParameters.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 //#region src/data/boundParameters.ts
 /**

package/dist/data/codecs.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /** SQLiteBoolean: boolean ↔ 0|1. Decode is lenient (number/boolean/string). */
 export declare const SQLiteBoolean: z.ZodCodec<z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodBoolean, z.ZodString]>, z.ZodBoolean>;

package/dist/data/codecs.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 //#region src/data/codecs.ts
 const TRUTHY = [

package/dist/data/cursor.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * Keyset pagination, once, for every capability that lists an unbounded table.

package/dist/data/cursor.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 //#region src/data/cursor.ts
 /**

package/dist/data/databases.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Kysely } from "kysely";
 import type { Migration } from "kysely/migration";
 import type { z } from "zod";

package/dist/data/databases.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { createDatabase } from "./db.js";
 import { bindingGroupsFrom, composeBindingGroups } from "../capability/compose.js";
 //#region src/data/databases.ts

package/dist/data/db.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { D1Database } from "@cloudflare/workers-types";
 import { type Generated, Kysely } from "kysely";
 import type { z } from "zod";

package/dist/data/db.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { guardBoundParameters } from "./boundParameters.js";
 import { CamelCasePlugin, Kysely } from "kysely";
 import { D1Dialect } from "kysely-d1";

package/dist/data/withD1Retry.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * Retry a D1 write through transient faults. Ported from the CMS `withD1Retry`, adapted to
  * Pithy: no injected logger (core has none), an optional `onRetry` notifier instead, and a

package/dist/data/withD1Retry.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/data/withD1Retry.ts
 /**
 * Retry a D1 write through transient faults. Ported from the CMS `withD1Retry`, adapted to

package/dist/entitlement/entitlement.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 export declare const EntitlementKey: z.ZodString;
 export type EntitlementKey = z.output<typeof EntitlementKey>;

package/dist/entitlement/entitlement.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 const EntitlementKey = z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "An entitlement key is lowercase letters, digits, and underscores, starting with a letter.").describe("A logical entitlement key (`pro`, `ads_removed`) — what gating code names. Never a store SKU: many products across many rails grant one key.");
 /**

package/dist/entitlement/gateScan.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The source with its comments blanked, so a `// TODO: requireEntitlement("pro")` is not read as a gate.
  *

package/dist/entitlement/gateScan.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/entitlement/gateScan.ts
 /**
 * Finding an entitlement gate in source text — the pure half of the composition check.

package/dist/entitlement/require.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { MiddlewareHandler } from "hono";
 import type { PithyHonoEnv } from "../capability/capability";
 /**

package/dist/entitlement/require.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError, PithyError, UnauthorizedError, messageOf } from "../error/pithyError.js";
 import { ENTITLEMENT_DENIED_ACTION, EntitlementKey, grantedEntitlementKeys } from "./entitlement.js";
 //#region src/entitlement/require.ts

package/dist/env/ambient.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * What the *ambient* environment says about the composition being assembled — the two questions a
  * capability may ask before it registers anything, and the one reader for both.

package/dist/env/ambient.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import "../worker/identity.js";
 //#region src/env/ambient.ts
 /**

package/dist/env/ci.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { type AmbientEnv } from "./ambient";
 /**
  * Is this continuous integration? One read, one rule, one place — the convention starts here.

package/dist/env/ci.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ambientEnv, ambientFlag } from "./ambient.js";
 //#region src/env/ci.ts
 /**

package/dist/env/stem.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * How a member of the dev set publishes its address, and how a sibling looks it up.
  *

package/dist/env/stem.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/env/stem.ts
 /**
 * How a member of the dev set publishes its address, and how a sibling looks it up.

package/dist/error/cause.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * Reading a thrown value that no type describes — the one place the kit records **what a runtime does to
  * an error on its way out** (#223), and **the one place that decides whether what it says may be shown**
@@ -130,6 +132,39 @@ export interface FailurePosition {
  * coincidence of the path's own characters — and a fabricated position reads as authoritative.
  */
 export declare function failurePosition(cause: unknown): FailurePosition | undefined;
+/** What kind of thing failed to resolve. Three causes that wore one sentence until #489. */
+export type UnresolvedKind = 
+/** A bare specifier for a package that is not installed. Installing dependencies is the remedy. */
+"package"
+/** An installed package asked for a subpath it does not provide. Installing again changes nothing. */
+ | "package-subpath"
+/** A relative import of a file in the project's own tree. Installing again changes nothing. */
+ | "local-file";
+/**
+ * Which of the three unresolved-import causes this was, or `undefined` when it cannot be told.
+ *
+ * **The discriminator was already in the message and was being thrown away.** `unresolvedSpecifier`
+ * matches `Cannot find (?:package|module)` — and `package` versus `module` is exactly the fact that
+ * separates a missing dependency from the other two. It sat in a non-capturing group, so every cause
+ * arrived wearing one sentence, and for two of the three that sentence advised an install which is
+ * *guaranteed* to change nothing. That is #489's class exactly: guidance a caller cannot follow, worst
+ * for the caller it is written for, which has no human to shrug and try something else.
+ *
+ * Measured across Node 24.13.0 and Bun 1.3.14, because the two runtimes hand back different halves and
+ * each hands back exactly one usable one:
+ *
+ * | cause | Node says | Bun's `specifier` |
+ * |---|---|---|
+ * | package absent | `Cannot find package 'pkg'`, no `url` | `pkg` |
+ * | subpath missing | `Cannot find module '/abs/node_modules/pkg/src/nope.js'`, `url` under node_modules | `pkg/src/nope` |
+ * | adopter's file | `Cannot find module '/abs/apps/board/src/x'`, `url` outside node_modules | `./src/x` |
+ *
+ * Bun gives the **specifier as written**, so a leading `.` settles it. Node gives the **already-resolved
+ * path**, where being under `node_modules` settles it. Neither read works on both runtimes; the pair
+ * does, and it is the same predicate — *is this inside node_modules* — applied to whichever fact the
+ * runtime supplied.
+ */
+export declare function unresolvedKind(cause: unknown): UnresolvedKind | undefined;
 /**
  * The specifier that did not resolve.
  *
@@ -140,4 +175,37 @@ export declare function failurePosition(cause: unknown): FailurePosition | undef
  * Whether a surface names it, and what it advises when it does, is that surface's policy and stays there.
  */
 export declare function unresolvedSpecifier(cause: unknown): string | undefined;
+/**
+ * The package whose own source contained the import that did not resolve — **never a path**.
+ *
+ * {@link unresolvedSpecifier} answers *what* did not resolve. This answers *where the import lives*, and
+ * the two are different facts whenever the failing import is not the adopter's own. #480 is that case
+ * verbatim: `pithy add email` on a fresh project refused with
+ *
+ * > Nothing resolves "@pithy-sh/core/src/capability/capability".
+ *
+ * while `@pithy-sh/core` resolved from the Worker at every step of the run, before and after. The
+ * specifier was honest — the runtime really could not resolve it — but the import belonged to
+ * `@pithy-sh/email`, which had just been installed and was the package genuinely not linked. So the
+ * refusal named the one dependency that was definitely fine, and an adopter following it ran `bun
+ * install` against a tree that already had core in it. The importer is the half that would have pointed
+ * at `email`, and both runtimes hand it over: **Bun's `ResolveMessage` carries `referrer` as a field**
+ * (measured on 1.3.14) and Node states it in prose as `imported from <path>`.
+ *
+ * **A package name, or nothing.** The referrer is an absolute path — our frame, and the reason
+ * {@link unresolvedSpecifier} drops the prose around the specifier — so what travels is the one part of
+ * it that is not a path: the package directory it sits under. A referrer outside `node_modules` is the
+ * adopter's own file, and there is nothing to say about it that the refusal does not already say by
+ * naming the config, so it answers `undefined` rather than a path. The path itself is never returned
+ * from this module, which is what makes leaking it impossible rather than merely discouraged.
+ *
+ * The **last** `node_modules` in the path, because every store layout nests: pnpm's
+ * `node_modules/.pnpm/<id>/node_modules/<pkg>` and Bun's isolated linker's
+ * `node_modules/.bun/<pkg>@<version>/node_modules/<pkg>` (both measured) put the real owner last, and so
+ * does an ordinary nested install. The name is then checked against what npm allows, so a store's own
+ * bookkeeping directory (`.bun`, `.pnpm`, `hono@4.6.3`) can only ever answer nothing.
+ *
+ * Whether a surface names it, and what it advises when it does, is that surface's policy and stays there.
+ */
+export declare function importingPackage(cause: unknown): string | undefined;
 //# sourceMappingURL=cause.d.ts.map

package/dist/error/cause.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cause.d.ts","sourceRoot":"","sources":["../../src/error/cause.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQjD;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAeD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ7D;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAS3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKtE"}
+{"version":3,"file":"cause.d.ts","sourceRoot":"","sources":["../../src/error/cause.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQjD;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAeD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ7D;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAS3E;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc;AACxB,mGAAmG;AACjG,SAAS;AACX,sGAAsG;GACpG,iBAAiB;AACnB,+FAA+F;GAC7F,YAAY,CAAC;AAOjB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAiBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKtE;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASnE"}

package/dist/error/cause.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/error/cause.ts
 /**
 * Reading a thrown value that no type describes — the one place the kit records **what a runtime does to
@@ -174,6 +176,43 @@ function failurePosition(cause) {
 		column: Number(match[2])
 	};
 }
+/** Whether a path sits inside an installed package. */
+function insideNodeModules(path) {
+	return path.split(/[\\/]/).includes("node_modules");
+}
+/**
+* Which of the three unresolved-import causes this was, or `undefined` when it cannot be told.
+*
+* **The discriminator was already in the message and was being thrown away.** `unresolvedSpecifier`
+* matches `Cannot find (?:package|module)` — and `package` versus `module` is exactly the fact that
+* separates a missing dependency from the other two. It sat in a non-capturing group, so every cause
+* arrived wearing one sentence, and for two of the three that sentence advised an install which is
+* *guaranteed* to change nothing. That is #489's class exactly: guidance a caller cannot follow, worst
+* for the caller it is written for, which has no human to shrug and try something else.
+*
+* Measured across Node 24.13.0 and Bun 1.3.14, because the two runtimes hand back different halves and
+* each hands back exactly one usable one:
+*
+* | cause | Node says | Bun's `specifier` |
+* |---|---|---|
+* | package absent | `Cannot find package 'pkg'`, no `url` | `pkg` |
+* | subpath missing | `Cannot find module '/abs/node_modules/pkg/src/nope.js'`, `url` under node_modules | `pkg/src/nope` |
+* | adopter's file | `Cannot find module '/abs/apps/board/src/x'`, `url` outside node_modules | `./src/x` |
+*
+* Bun gives the **specifier as written**, so a leading `.` settles it. Node gives the **already-resolved
+* path**, where being under `node_modules` settles it. Neither read works on both runtimes; the pair
+* does, and it is the same predicate — *is this inside node_modules* — applied to whichever fact the
+* runtime supplied.
+*/
+function unresolvedKind(cause) {
+	if (/Cannot find package /.test(causeMessage(cause) ?? "")) return "package";
+	const specifier = unresolvedSpecifier(cause);
+	if (specifier === void 0) return void 0;
+	if (/^(?:\.|\/|[A-Za-z]:[\\/])/.test(specifier)) return insideNodeModules(specifier) ? "package-subpath" : "local-file";
+	const url = prop(cause, "url");
+	if (typeof url === "string" && url.length > 0) return insideNodeModules(url) ? "package-subpath" : "local-file";
+	return "package-subpath";
+}
 /**
 * The specifier that did not resolve.
 *
@@ -188,5 +227,59 @@ function unresolvedSpecifier(cause) {
 	if (typeof field === "string" && field.length > 0) return field;
 	return /Cannot find (?:package|module) ['"]([^'"]+)['"]/.exec(causeMessage(cause) ?? "")?.[1];
 }
+/** A package name as npm allows one: an optional `@scope/`, and never a store's dot-directory. */
+const PACKAGE_NAME = /^(?:@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*$/i;
+/**
+* The file the failing import was written in, as the runtime named it. **Module-private on purpose**: it
+* is an absolute path, and {@link importingPackage} exists to make sure only its package half leaves here.
+*/
+function importerPath(cause) {
+	const field = prop(cause, "referrer");
+	if (typeof field === "string" && field.length > 0) return field;
+	const message = causeMessage(cause) ?? "";
+	return (/ imported from (.+)$/.exec(message) ?? /\bfrom ['"]([^'"]+)['"]/.exec(message))?.[1];
+}
+/**
+* The package whose own source contained the import that did not resolve — **never a path**.
+*
+* {@link unresolvedSpecifier} answers *what* did not resolve. This answers *where the import lives*, and
+* the two are different facts whenever the failing import is not the adopter's own. #480 is that case
+* verbatim: `pithy add email` on a fresh project refused with
+*
+* > Nothing resolves "@pithy-sh/core/src/capability/capability".
+*
+* while `@pithy-sh/core` resolved from the Worker at every step of the run, before and after. The
+* specifier was honest — the runtime really could not resolve it — but the import belonged to
+* `@pithy-sh/email`, which had just been installed and was the package genuinely not linked. So the
+* refusal named the one dependency that was definitely fine, and an adopter following it ran `bun
+* install` against a tree that already had core in it. The importer is the half that would have pointed
+* at `email`, and both runtimes hand it over: **Bun's `ResolveMessage` carries `referrer` as a field**
+* (measured on 1.3.14) and Node states it in prose as `imported from <path>`.
+*
+* **A package name, or nothing.** The referrer is an absolute path — our frame, and the reason
+* {@link unresolvedSpecifier} drops the prose around the specifier — so what travels is the one part of
+* it that is not a path: the package directory it sits under. A referrer outside `node_modules` is the
+* adopter's own file, and there is nothing to say about it that the refusal does not already say by
+* naming the config, so it answers `undefined` rather than a path. The path itself is never returned
+* from this module, which is what makes leaking it impossible rather than merely discouraged.
+*
+* The **last** `node_modules` in the path, because every store layout nests: pnpm's
+* `node_modules/.pnpm/<id>/node_modules/<pkg>` and Bun's isolated linker's
+* `node_modules/.bun/<pkg>@<version>/node_modules/<pkg>` (both measured) put the real owner last, and so
+* does an ordinary nested install. The name is then checked against what npm allows, so a store's own
+* bookkeeping directory (`.bun`, `.pnpm`, `hono@4.6.3`) can only ever answer nothing.
+*
+* Whether a surface names it, and what it advises when it does, is that surface's policy and stays there.
+*/
+function importingPackage(cause) {
+	const referrer = importerPath(cause);
+	if (referrer === void 0) return void 0;
+	const segments = referrer.split(/[\\/]/);
+	const at = segments.lastIndexOf("node_modules");
+	const head = at === -1 ? void 0 : segments[at + 1];
+	if (head === void 0) return void 0;
+	const name = head.startsWith("@") ? `${head}/${segments[at + 2] ?? ""}` : head;
+	return PACKAGE_NAME.test(name) ? name : void 0;
+}
 //#endregion
-export { causeMessage, failurePosition, isBuildFailureWrapper, prop, rootCause, safeReason, unresolvedSpecifier };
+export { causeMessage, failurePosition, importingPackage, isBuildFailureWrapper, prop, rootCause, safeReason, unresolvedKind, unresolvedSpecifier };

package/dist/error/client.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { z } from "zod";
 import type { ErrorPayload } from "./payload";
 import { PublicErrorPayload } from "./payload";

package/dist/error/client.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { PublicErrorPayload } from "./payload.js";
 //#region src/error/client.ts
 /**

package/dist/error/extend.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { MessageParams } from "../i18n/catalog";
 import type { ErrorPayload, KitErrorDomain } from "./payload";
 import { ExtendedErrorPayload } from "./payload";

package/dist/error/extend.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ExtendedErrorPayload } from "./payload.js";
 import { InternalError } from "./pithyError.js";
 //#region src/error/extend.ts

package/dist/error/http.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Context } from "hono";
 import { z } from "zod";
 /**

package/dist/error/http.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ErrorPayload, PublicErrorPayload } from "./payload.js";
 import { InternalError, PithyError, ValidationError, messageOf } from "./pithyError.js";
 import { clientError } from "./client.js";

package/dist/error/payload.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * The error object model. One Zod schema is the whole definition of every failure Pithy

package/dist/error/payload.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { MessageParams } from "../i18n/catalog.js";
 import { z } from "zod";
 //#region src/error/payload.ts

package/dist/error/pithyError.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { z } from "zod";
 import type { MessageParams } from "../i18n/catalog";
 import type { ValidationIssue } from "./payload";

package/dist/error/pithyError.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ErrorPayload } from "./payload.js";
 //#region src/error/pithyError.ts
 /**

package/dist/error/terminal.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { ErrorPayload } from "./payload";
 import { PublicErrorPayload } from "./payload";
 /**

package/dist/error/terminal.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { PublicErrorPayload } from "./payload.js";
 //#region src/error/terminal.ts
 /**

package/dist/http/authContext.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * The auth seam. `@pithy-sh/core` defines this shape; `@pithy-sh/auth` populates it on the

package/dist/http/authContext.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { Locale } from "../i18n/locale.js";
 import { z } from "zod";
 //#region src/http/authContext.ts

package/dist/http/routeContract.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Hono } from "hono";
 /**
  * Gate 2 of the route request contract (issue #74). Its sibling, the `no-raw-request-input` Biome

package/dist/http/routeContract.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/http/routeContract.ts
 /** The `:segment` names in a path pattern, in order. */
 function pathParams(path) {

package/dist/http/sameOrigin.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { MiddlewareHandler } from "hono";
 import type { PithyHonoEnv } from "../capability/capability";
 /**

package/dist/http/sameOrigin.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ForbiddenError } from "../error/pithyError.js";
 //#region src/http/sameOrigin.ts
 /**

package/dist/http/signedWebhook.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { MiddlewareHandler } from "hono";
 import type { PithyHonoEnv } from "../capability/capability";
 /**

package/dist/http/signedWebhook.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError, WebhookUnverifiedError } from "../error/pithyError.js";
 //#region src/http/signedWebhook.ts
 /**

package/dist/http/validation.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { z } from "zod";
 /**
  * How a route declares what it accepts. Its sibling {@link ./verification.VerificationStrategy}