@pithy-sh/core 0.1.4 → 0.2.0

package/dist/naming/limits.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { MAX_ENVIRONMENT_NAME } from "./environment.js";
 //#region src/naming/limits.ts
 /**

package/dist/naming/provisionScope.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { type FeatureIdentity, type FeatureResourceKind } from "./feature";
 /**
  * **What a provisioning run names its resources, and which `env.<name>` stanza it writes them into —

package/dist/naming/provisionScope.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { FEATURE_ENVIRONMENT, assertValidEnvironment } from "./environment.js";
 import { featureResourceName, featureSecretEntryName, featureWorkerName } from "./feature.js";
 import { resourceNames } from "./resourceNames.js";

package/dist/naming/resource.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * One naming rule, in one module: **`<project>-<env>-<thing>`**, kebab-case.
  *

package/dist/naming/resource.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { NAME_SEGMENT } from "./segment.js";
 import { InternalError, ValidationError } from "../error/pithyError.js";
 import { MAX_ENVIRONMENT_NAME } from "./environment.js";

package/dist/naming/resourceNames.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { type FeatureIdentity, type FeatureResourceKind } from "./feature";
 /**
  * Every Cloudflare name a project composes, behind one object — **the facade**.

package/dist/naming/resourceNames.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError, ValidationError } from "../error/pithyError.js";
 import { GLOBAL_SCOPE, assertValidEnvironment } from "./environment.js";
 import { NAMESPACE_LIMITS } from "./limits.js";

package/dist/naming/segment.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * What a single segment of a composed name may look like — one pattern, one home.
  *

package/dist/naming/segment.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/naming/segment.ts
 /**
 * What a single segment of a composed name may look like — one pattern, one home.

package/dist/projection/asRead.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * The reader's contract: a capability's own response object, restated for a client that does not

package/dist/projection/asRead.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 import { z } from "zod";
 //#region src/projection/asRead.ts

package/dist/projection/published.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The gate primitive for a projection that crosses a trust boundary: **nothing left this surface but the
  * facts it publishes.**

package/dist/projection/published.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/projection/published.ts
 /**
 * Everything in `document` that {@link PublishedFacts} does not permit, as lines naming what and where.

package/dist/schema/describedness.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * The children of one schema, by kind. **Throws for a kind this walk has never been taught** — a

package/dist/schema/describedness.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 import { z } from "zod";
 //#region src/schema/describedness.ts

package/dist/seed/compose.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Capability } from "../capability/capability";
 import type { SeedSet } from "./seed";
 /** Maximum per-set `order`, derived from the prefix width so the two never drift. */

package/dist/seed/compose.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 //#region src/seed/compose.ts
 /** Width of the zero-padded `order` prefix in a composed key — the stable sort anchor. */

package/dist/seed/devLogin.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * The dev-login artifact: the one file a seed run writes so `pithy dev` can say how to sign in.

package/dist/seed/devLogin.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { JsonDate } from "../data/codecs.js";
 import { z } from "zod";
 //#region src/seed/devLogin.ts

package/dist/seed/exampleIdentities.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The canonical example identities — a small, fixed cast of demo users that every capability's
  * example seed set references. It is what makes `pithy seed` (with `seed.includeExamples`) fill a

package/dist/seed/exampleIdentities.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/seed/exampleIdentities.ts
 /**
 * The canonical demo cast, in a stable order. Referenced by every capability's example seed set so

package/dist/seed/metadata.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The standard Cloudflare-asset metadata convention.
  *

package/dist/seed/metadata.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/seed/metadata.ts
 /**
 * The standard Cloudflare-asset metadata convention.

package/dist/seed/seed.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { z } from "zod";
 import type { KvStoreSpec } from "../kv/namespaces";
 import type { SeededRows } from "./seededRows";

package/dist/seed/seed.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/seed/seed.ts
 /**
 * Author a seed set. A pass-through that anchors the {@link SeedSet} type at the author site (the

package/dist/seed/seededRows.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { SeedSet } from "./seed";
 /**
  * The run's own inventory: which rows a seed run declares, per table, before it writes any of them.

package/dist/seed/seededRows.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/seed/seededRows.ts
 /**
 * Index every set's statically declared D1 rows into one lookup, in composed order.

package/dist/seed/writeD1.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Kysely } from "kysely";
 import { z } from "zod";
 import type { D1SeedGroup } from "./seed";

package/dist/seed/writeD1.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { fromZodError } from "../error/pithyError.js";
 import { chunkRowsByBoundParameters } from "../data/boundParameters.js";
 import { z } from "zod";

package/dist/seed/writeKv.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 import type { TypedKv } from "../kv/kv";
 import type { KvStoreSpec } from "../kv/namespaces";

package/dist/seed/writeKv.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { fromZodError } from "../error/pithyError.js";
 import { z } from "zod";
 //#region src/seed/writeKv.ts

package/dist/semver/semver.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * Semantic versions: one parse, one format, one order.
  *

package/dist/semver/semver.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 //#region src/semver/semver.ts
 /**

package/dist/text/comments.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * `source` with every comment blanked — the one comment stripper this repository's gates share.
  *

package/dist/text/comments.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/text/comments.ts
 /**
 * `source` with every comment blanked — the one comment stripper this repository's gates share.

package/dist/version.generated.d.ts

@@ -1,5 +1,7 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.1.4";
+export declare const PACKAGE_VERSION = "0.2.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -1,7 +1,9 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/version.generated.ts
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.1.4";
+const PACKAGE_VERSION = "0.2.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/worker/health.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * **Where every Pithy Worker answers liveness — written once, read by everyone who needs it.**
  *

package/dist/worker/health.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/worker/health.ts
 /**
 * **Where every Pithy Worker answers liveness — written once, read by everyone who needs it.**

package/dist/worker/identity.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * What a running Worker knows about itself — the three vars every Pithy Worker is scaffolded with, and
  * the one reader for them.

package/dist/worker/identity.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/worker/identity.ts
 /**
 * What a running Worker knows about itself — the three vars every Pithy Worker is scaffolded with, and

package/dist/workflow/bindings.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { BindingSpecInput } from "../capability/bindings";
 import type { RegisteredWorkflow, WorkflowSpec, WorkflowSpecMap } from "./spec";
 /**

package/dist/workflow/bindings.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/workflow/bindings.ts
 /**
 * The one derivation from a durable job to the `workflow` binding that job needs.

package/dist/workflow/dispatch.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Logger } from "../logger/logger";
 import { type LoopbackFetch } from "./loopback";
 import type { WorkflowBinding, WorkflowRegistry } from "./spec";

package/dist/workflow/dispatch.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { PithyError, messageOf } from "../error/pithyError.js";
 import "../worker/identity.js";
 import { noopLogger } from "../logger/logger.js";

package/dist/workflow/dispatchRoute.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Hono } from "hono";
 import type { PithyHonoEnv } from "../capability/capability";
 import { type AmbientEnv } from "../env/ambient";

package/dist/workflow/dispatchRoute.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { ForbiddenError, PithyError } from "../error/pithyError.js";
 import { validationHook } from "../http/validation.js";
 import { WORKFLOW_DISPATCH_ROUTE, WorkflowDispatchParams, WorkflowDispatchRequest } from "./schemas.js";

package/dist/workflow/faults.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * **Every fault that reaches a durable step is classified — retryable or terminal — at a stated site.**
  *

package/dist/workflow/faults.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { PithyError } from "../error/pithyError.js";
 import { d1TransientFault } from "../data/withD1Retry.js";
 import { encodeWorkflowStepMessage } from "./stepMessage.js";

package/dist/workflow/host.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { type WorkflowHostNameParts } from "./naming";
 import type { WorkflowRegistry } from "./spec";
 /**

package/dist/workflow/host.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 import { ENVIRONMENT_VAR, PROJECT_VAR } from "../worker/identity.js";
 import { workflowHostName, workflowScriptName } from "./naming.js";

package/dist/workflow/hostEntry.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * The default export of a Workflow host that serves nothing over HTTP (#426).
  *

package/dist/workflow/hostEntry.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { NotFoundError } from "../error/pithyError.js";
 import { HttpError } from "../error/http.js";
 //#region src/workflow/hostEntry.ts

package/dist/workflow/hostEnv.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 import type { Logger } from "../logger/logger";
 /**

package/dist/workflow/hostEnv.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 import { createWorkerLogger } from "../logger/worker.js";
 import { z } from "zod";

package/dist/workflow/loopback.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { WorkflowBinding } from "./spec";
 /**
  * The loopback dispatcher: the one-method dispatch seam, carried over a sibling's origin instead of

package/dist/workflow/loopback.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { UpstreamError, UpstreamTimeoutError } from "../error/pithyError.js";
 import { workflowDispatchPath } from "./schemas.js";
 //#region src/workflow/loopback.ts

package/dist/workflow/naming.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * Every name a durable job answers to, in one module. The CLI writes these into a host worker's
  * resolved `wrangler.jsonc`, the provisioner deploys under them, and the dispatcher resolves

package/dist/workflow/naming.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { NAME_SEGMENT } from "../naming/segment.js";
 import { InternalError } from "../error/pithyError.js";
 import { NAMESPACE_LIMITS } from "../naming/limits.js";

package/dist/workflow/register.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { Capability } from "../capability/capability";
 import type { RegisteredWorkflow, WorkflowRegistry } from "./spec";
 /**

package/dist/workflow/register.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { InternalError } from "../error/pithyError.js";
 import { workflowKey } from "./naming.js";
 //#region src/workflow/register.ts

package/dist/workflow/schemas.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 /**
  * The request and response contract of the host's dispatch route ({@link ./dispatchRoute.ts}).

package/dist/workflow/schemas.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import { z } from "zod";
 //#region src/workflow/schemas.ts
 /**

package/dist/workflow/spec.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 import type { z } from "zod";
 /**
  * The durable-job seam. A capability declares the Cloudflare Workflows it owns as a map of

package/dist/workflow/spec.js

@@ -0,0 +1,2 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT

package/dist/workflow/stepMessage.d.ts

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 /**
  * **The one statement of what a terminal Workflow step writes into its error text, and the one reader of it.**
  *

package/dist/workflow/stepMessage.js

@@ -1,3 +1,5 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
 //#region src/workflow/stepMessage.ts
 /**
 * **The one statement of what a terminal Workflow step writes into its error text, and the one reader of it.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
     }
   },
   "scripts": {
-    "build": "tsdown && tsc -p tsconfig.build.json",
+    "build": "tsdown && tsc -p tsconfig.build.json && bun ../../tooling/build/src/stampDeclarations.ts",
     "typecheck": "tsc -p tsconfig.json",
     "test": "vitest run",
     "test:node": "vitest run --project=node",

package/src/capability/capability.ts

@@ -410,6 +410,24 @@ export interface Capability<
    * every {@link Capability.secretRegistry} slice here into one combined registry.
    */
   compose?: (context: CapabilityComposeContext) => void;
+  /**
+   * Optional **entrypoint** hook, called once by {@link createEntrypoint} with every composed
+   * capability, after {@link Capability.compose} has run for all of them.
+   *
+   * **The distinction from `compose` is the audience, and it is load-bearing.** `createBackend` assembles
+   * a backend for anything that wants to look at one, and the CLI is a caller: `pithy ui` builds the app
+   * to read its route tree, and `composeCapabilities` runs every `compose` hook to read what a capability
+   * reports. `createEntrypoint` is the other thing — it is only ever called by a Worker's own
+   * `src/index.ts`, so a throw from here is a Worker that does not serve, and nothing else.
+   *
+   * So this is where a capability refuses a composition that must never take a request but must still
+   * *load*, because the adopter's own toolchain has to keep working on the project while they fix it.
+   * `@pithy-sh/payments` is the case it exists for: `pithy add` scaffolds an unimplemented
+   * `resolveSubject`, every CLI command keeps loading that config, and the Worker refuses to boot until
+   * the adopter has written it (#500). A check that can be made at composition still belongs at
+   * composition — earlier is better, and a refusal the CLI can raise is a refusal an adopter sees sooner.
+   */
+  boot?: (context: CapabilityComposeContext) => void;
   /** Mounts a Hono sub-router. */
   routes?: (app: Hono<PithyHonoEnv>) => void;
   /** Composable middleware (e.g. turnstile(), requireAuth()). */