@pithy-sh/core 0.7.4 → 0.8.0

package/dist/seed/seed.d.ts

@@ -178,6 +178,31 @@ export interface SeedPrepareContext {
      * can write and never read.
      */
     secret: (name: string) => Promise<string | undefined>;
+    /**
+     * The value **this run just minted** for a secret, or `undefined` — never what the environment holds.
+     *
+     * `pithy provision` creates a random value for every `cf-secrets-store` secret the registry declares
+     * mintable, writes it into the account's Secrets Store, and lets it go. The Secrets Store is write-only
+     * from the CLI, so that write is the only moment the value exists anywhere the toolchain can see it —
+     * and provisioning migrates and seeds in the same process, a few steps later. A fixture that must
+     * *seal* something at creation time (encrypt a private key under the environment's key-encryption
+     * secret, derive an id that the running app will re-derive) can only do it then. Afterwards the value
+     * is unrecoverable by design.
+     *
+     * **This is not {@link secret}, and the two are not interchangeable.** `secret` answers what the
+     * environment holds and refuses outside `dev`, absolutely (#159); that rule is untouched. This answers
+     * the strictly narrower question *did this run create one, a moment ago, in memory*. A set asking here
+     * for a secret this run did not mint gets `undefined` wherever it runs, in `dev` or anywhere else.
+     *
+     * **Synchronous, because it cannot fetch.** There is no file to open and no request to make; a promise
+     * in this signature would suggest otherwise.
+     *
+     * **Empty is ordinary.** A re-run mints nothing — absence is checked before anything is generated — and
+     * a standalone `pithy seed` mints nothing at all. Both answer `undefined` for every name, and neither
+     * is an error. A set that needs a minted value and is handed none says so itself; nothing is invented
+     * on its behalf.
+     */
+    mintedThisRun: (name: string) => string | undefined;
     /**
      * The developer's machine-local preferences for this project, read from the Pithy config directory
      * (`~/.config/pithy/<project>/dev.json`, or `%APPDATA%\pithy\<project>\dev.json` on Windows), parsed but

package/dist/seed/seed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/seed/seed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAC9D,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,wEAAwE;IACxE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,yFAAyF;IACzF,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,6CAA6C;QAC7C,KAAK,EAAE,MAAM,CAAC;QACd,8EAA8E;QAC9E,GAAG,EAAE,OAAO,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,6CAA6C;IAC7C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB;IACrB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,uBAAuB;IACvB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,kBAAkB;IAClB,EAAE,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC3B,yDAAyD;IACzD,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACrE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EACjD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,EACb,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAC/B,WAAW,CAAC,KAAK,CAAC,CAGpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EACzF,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC1B,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GACvC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGtB"}
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/seed/seed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAC9D,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,wEAAwE;IACxE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,yFAAyF;IACzF,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,6CAA6C;QAC7C,KAAK,EAAE,MAAM,CAAC;QACd,8EAA8E;QAC9E,GAAG,EAAE,OAAO,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,6CAA6C;IAC7C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB;IACrB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,uBAAuB;IACvB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,kBAAkB;IAClB,EAAE,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC3B,yDAAyD;IACzD,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACrE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EACjD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,EACb,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAC/B,WAAW,CAAC,KAAK,CAAC,CAGpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EACzF,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC1B,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GACvC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGtB"}

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.7.4";
+export declare const PACKAGE_VERSION = "0.8.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.7.4";
+const PACKAGE_VERSION = "0.8.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/workflow/faults.d.ts

@@ -65,10 +65,42 @@ export interface WorkflowFault {
  * test rather than a claim — and so the same function decides in a test, in Miniflare, and in production.
  */
 export declare function classifyWorkflowFault(error: unknown, policy: WorkflowRetryPolicy): WorkflowFault;
-/** The half of a Workflow step this kit uses: run a named body, or serve its journalled result. */
+/**
+ * The half of a Workflow step this kit uses: run a named body, or serve its journalled result.
+ *
+ * **`sleep` is optional here and required on what {@link classifiedSteps} hands back, and the asymmetry
+ * is the truth rather than a convenience.** The platform's own `WorkflowStep` always offers one. What
+ * does not are this kit's hand-written test doubles, which exist to exercise the classification and
+ * nothing else — and demanding a primitive the classifier never classifies would cost every one of them
+ * a line of noise. Handing an optional one back instead would push a null check into the one caller that
+ * genuinely pauses.
+ */
 export interface WorkflowStepLike {
     /** Run a named step, or return its journalled result if this instance already completed it. */
     do<T>(name: string, fn: () => Promise<T>): Promise<T>;
+    /**
+     * Pause the instance for `durationMs` and resume it afterwards — possibly in a fresh isolate, which
+     * is the whole reason a caller reaches for it rather than for a timer. Absent only on a test double.
+     */
+    sleep?(name: string, durationMs: number): Promise<void>;
+}
+/**
+ * A step runner that can pause — what {@link classifiedSteps} hands back, always.
+ *
+ * The durable pause is why this type exists rather than being a convenience over the one above. A `sleep`
+ * is journalled, so a wait survives the instance being evicted during it; a `setTimeout` inside one step
+ * burns that step's wall clock and dies with the instance holding it.
+ *
+ * **It was introduced on a stronger claim, and the claim did not survive contact (pithy-sh/pithy#647).** The
+ * argument was that a Secrets Store binding answers the same for its isolate's whole life, so only a resume
+ * into a fresh isolate could ever see a write land. Measured against a real store on 2026-09-25, that is
+ * false: a binding refreshes inside a live isolate roughly 1.3-1.5s after the REST write, proved by holding
+ * two isolates warm through a write and watching each serve the old value before it and the new one after,
+ * over 328 samples. The durability argument above is the true one and is sufficient on its own.
+ */
+export interface DurableStepLike extends WorkflowStepLike {
+    /** Pause the instance for `durationMs`, then resume. */
+    sleep(name: string, durationMs: number): Promise<void>;
 }
 /**
  * The platform's terminal-error class — `NonRetryableError` from `cloudflare:workflows`, taken as a
@@ -95,5 +127,5 @@ export interface TerminalErrorConstructor {
  * `runSendBatch`, `runAtRestKeyRotation`) takes this instead with no change: the classification is
  * declared once, at the entrypoint, and every step below it inherits the decision.
  */
-export declare function classifiedSteps(step: WorkflowStepLike, policy: WorkflowRetryPolicy, terminalError: TerminalErrorConstructor): WorkflowStepLike;
+export declare function classifiedSteps(step: WorkflowStepLike, policy: WorkflowRetryPolicy, terminalError: TerminalErrorConstructor): DurableStepLike;
 //# sourceMappingURL=faults.d.ts.map

package/dist/workflow/faults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"faults.d.ts","sourceRoot":"","sources":["../../src/workflow/faults.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,2FAA2F;AAC3F,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iHAAiH;IACjH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,WAAW,EAAE,wBAAwB,CAAC;IACtC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAsDD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,aAAa,CA0BhG;AAED,mGAAmG;AACnG,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,wBAAwB,GACtC,gBAAgB,CA2BlB"}
+{"version":3,"file":"faults.d.ts","sourceRoot":"","sources":["../../src/workflow/faults.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,2FAA2F;AAC3F,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iHAAiH;IACjH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,WAAW,EAAE,wBAAwB,CAAC;IACtC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAsDD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,aAAa,CA0BhG;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD;;;OAGG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,wDAAwD;IACxD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,wBAAwB,GACtC,eAAe,CAmDjB"}

package/dist/workflow/faults.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { PithyError } from "../error/pithyError.js";
+import { InternalError, PithyError } from "../error/pithyError.js";
 import { d1TransientFault } from "../data/withD1Retry.js";
 import { encodeWorkflowStepMessage } from "./stepMessage.js";
 //#region src/workflow/faults.ts
@@ -91,23 +91,47 @@ function classifyWorkflowFault(error, policy) {
 * declared once, at the entrypoint, and every step below it inherits the decision.
 */
 function classifiedSteps(step, policy, terminalError) {
-	return { do(name, fn) {
-		return step.do(name, async () => {
-			try {
-				return await fn();
-			} catch (error) {
-				const fault = classifyWorkflowFault(error, policy);
-				if (fault.disposition === "retry") throw error;
-				const terminal = new terminalError(encodeWorkflowStepMessage({
-					code: fault.code,
-					message: messageOf(error),
-					action: pithyActionOf(error)
-				}));
-				terminal.cause = error;
-				throw terminal;
-			}
-		});
-	} };
+	const runner = {
+		do(name, fn) {
+			return step.do(name, async () => {
+				try {
+					return await fn();
+				} catch (error) {
+					const fault = classifyWorkflowFault(error, policy);
+					if (fault.disposition === "retry") throw error;
+					const terminal = new terminalError(encodeWorkflowStepMessage({
+						code: fault.code,
+						message: messageOf(error),
+						action: pithyActionOf(error)
+					}));
+					terminal.cause = error;
+					throw terminal;
+				}
+			});
+		},
+		/**
+		* Forwarded, and deliberately unclassified. A pause raises no fault of the capability's — the
+		* instance either resumes or it is gone — so there is nothing here for a policy to decide.
+		*
+		* A runner that cannot pause is refused, and the refusal is raised **through `do`** rather than
+		* thrown from here. A throw from here is a throw the engine never classifies, so it is free to
+		* re-drive the instance — and re-driving is the unbounded loop the caller is spending its sleeps to
+		* avoid. Going through `do` makes the refusal terminal on its first attempt, like every other
+		* answer that cannot change.
+		*/
+		sleep(name, durationMs) {
+			const pause = step.sleep;
+			if (pause === void 0) return runner.do(`${name}/cannot-pause`, async () => {
+				throw new InternalError({
+					message: "This Workflow step runner cannot pause.",
+					action: "Give the step runner a `sleep`; the platform's own `WorkflowStep` always has one.",
+					detail: `step '${name}' asked to pause ${durationMs}ms through a runner that declares no sleep`
+				});
+			});
+			return pause.call(step, name, durationMs);
+		}
+	};
+	return runner;
 }
 //#endregion
 export { classifiedSteps, classifyWorkflowFault };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.7.4",
+  "version": "0.8.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/seed/seed.ts

@@ -196,6 +196,31 @@ export interface SeedPrepareContext {
    * can write and never read.
    */
   secret: (name: string) => Promise<string | undefined>;
+  /**
+   * The value **this run just minted** for a secret, or `undefined` — never what the environment holds.
+   *
+   * `pithy provision` creates a random value for every `cf-secrets-store` secret the registry declares
+   * mintable, writes it into the account's Secrets Store, and lets it go. The Secrets Store is write-only
+   * from the CLI, so that write is the only moment the value exists anywhere the toolchain can see it —
+   * and provisioning migrates and seeds in the same process, a few steps later. A fixture that must
+   * *seal* something at creation time (encrypt a private key under the environment's key-encryption
+   * secret, derive an id that the running app will re-derive) can only do it then. Afterwards the value
+   * is unrecoverable by design.
+   *
+   * **This is not {@link secret}, and the two are not interchangeable.** `secret` answers what the
+   * environment holds and refuses outside `dev`, absolutely (#159); that rule is untouched. This answers
+   * the strictly narrower question *did this run create one, a moment ago, in memory*. A set asking here
+   * for a secret this run did not mint gets `undefined` wherever it runs, in `dev` or anywhere else.
+   *
+   * **Synchronous, because it cannot fetch.** There is no file to open and no request to make; a promise
+   * in this signature would suggest otherwise.
+   *
+   * **Empty is ordinary.** A re-run mints nothing — absence is checked before anything is generated — and
+   * a standalone `pithy seed` mints nothing at all. Both answer `undefined` for every name, and neither
+   * is an error. A set that needs a minted value and is handed none says so itself; nothing is invented
+   * on its behalf.
+   */
+  mintedThisRun: (name: string) => string | undefined;
   /**
    * The developer's machine-local preferences for this project, read from the Pithy config directory
    * (`~/.config/pithy/<project>/dev.json`, or `%APPDATA%\pithy\<project>\dev.json` on Windows), parsed but

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.7.4";
+export const PACKAGE_VERSION = "0.8.0";

package/src/workflow/faults.ts

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 import { d1TransientFault } from "../data/withD1Retry";
-import { PithyError } from "../error/pithyError";
+import { InternalError, PithyError } from "../error/pithyError";
 import { encodeWorkflowStepMessage } from "./stepMessage";
 
 /**
@@ -153,10 +153,43 @@ export function classifyWorkflowFault(error: unknown, policy: WorkflowRetryPolic
   };
 }
 
-/** The half of a Workflow step this kit uses: run a named body, or serve its journalled result. */
+/**
+ * The half of a Workflow step this kit uses: run a named body, or serve its journalled result.
+ *
+ * **`sleep` is optional here and required on what {@link classifiedSteps} hands back, and the asymmetry
+ * is the truth rather than a convenience.** The platform's own `WorkflowStep` always offers one. What
+ * does not are this kit's hand-written test doubles, which exist to exercise the classification and
+ * nothing else — and demanding a primitive the classifier never classifies would cost every one of them
+ * a line of noise. Handing an optional one back instead would push a null check into the one caller that
+ * genuinely pauses.
+ */
 export interface WorkflowStepLike {
   /** Run a named step, or return its journalled result if this instance already completed it. */
   do<T>(name: string, fn: () => Promise<T>): Promise<T>;
+  /**
+   * Pause the instance for `durationMs` and resume it afterwards — possibly in a fresh isolate, which
+   * is the whole reason a caller reaches for it rather than for a timer. Absent only on a test double.
+   */
+  sleep?(name: string, durationMs: number): Promise<void>;
+}
+
+/**
+ * A step runner that can pause — what {@link classifiedSteps} hands back, always.
+ *
+ * The durable pause is why this type exists rather than being a convenience over the one above. A `sleep`
+ * is journalled, so a wait survives the instance being evicted during it; a `setTimeout` inside one step
+ * burns that step's wall clock and dies with the instance holding it.
+ *
+ * **It was introduced on a stronger claim, and the claim did not survive contact (pithy-sh/pithy#647).** The
+ * argument was that a Secrets Store binding answers the same for its isolate's whole life, so only a resume
+ * into a fresh isolate could ever see a write land. Measured against a real store on 2026-09-25, that is
+ * false: a binding refreshes inside a live isolate roughly 1.3-1.5s after the REST write, proved by holding
+ * two isolates warm through a write and watching each serve the old value before it and the new one after,
+ * over 328 samples. The durability argument above is the true one and is sufficient on its own.
+ */
+export interface DurableStepLike extends WorkflowStepLike {
+  /** Pause the instance for `durationMs`, then resume. */
+  sleep(name: string, durationMs: number): Promise<void>;
 }
 
 /**
@@ -189,8 +222,8 @@ export function classifiedSteps(
   step: WorkflowStepLike,
   policy: WorkflowRetryPolicy,
   terminalError: TerminalErrorConstructor,
-): WorkflowStepLike {
-  return {
+): DurableStepLike {
+  const runner: DurableStepLike = {
     do<T>(name: string, fn: () => Promise<T>): Promise<T> {
       return step.do(name, async () => {
         try {
@@ -215,5 +248,29 @@ export function classifiedSteps(
         }
       });
     },
+    /**
+     * Forwarded, and deliberately unclassified. A pause raises no fault of the capability's — the
+     * instance either resumes or it is gone — so there is nothing here for a policy to decide.
+     *
+     * A runner that cannot pause is refused, and the refusal is raised **through `do`** rather than
+     * thrown from here. A throw from here is a throw the engine never classifies, so it is free to
+     * re-drive the instance — and re-driving is the unbounded loop the caller is spending its sleeps to
+     * avoid. Going through `do` makes the refusal terminal on its first attempt, like every other
+     * answer that cannot change.
+     */
+    sleep(name: string, durationMs: number): Promise<void> {
+      const pause = step.sleep;
+      if (pause === undefined) {
+        return runner.do<void>(`${name}/cannot-pause`, async () => {
+          throw new InternalError({
+            message: "This Workflow step runner cannot pause.",
+            action: "Give the step runner a `sleep`; the platform's own `WorkflowStep` always has one.",
+            detail: `step '${name}' asked to pause ${durationMs}ms through a runner that declares no sleep`,
+          });
+        });
+      }
+      return pause.call(step, name, durationMs);
+    },
   };
+  return runner;
 }