@pithy-sh/core 0.7.4 → 0.9.0

package/dist/naming/domains.d.ts

@@ -9,6 +9,19 @@ import { type AmbientEnv } from "../env/ambient";
  *
  * The one test for "is this a host" that an origin read from a stamp and an origin typed on a command line
  * both pass, so the two cannot accept different things.
+ *
+ * **It answers the same on every runtime, and that is why the punycode rule is stated here.** It used to be
+ * borrowed: `seedHostOrigin` asked `new URL` to parse the host and took a throw as the answer, and an invalid
+ * A-label like `xn--a.test` was refused because the parser refused it. Node 24.20.0 bumped Ada from 3.4.4 to
+ * 4.0.0, Ada 4 stopped rejecting invalid punycode, and the same `pithy seed --host` began succeeding on Node 24
+ * while still failing on Node 22 — one command, two answers, decided by the adopter's Node. A rule borrowed from
+ * a parser changes under you, so this owns it.
+ *
+ * **Every A-label is refused, valid or not.** Telling a good one from a bad one is UTS-46, which needs IDNA
+ * mapping tables this package is not carrying into a Worker for the sake of a hostname check — and
+ * {@link HOSTNAME_PATTERN} is ASCII-only anyway, so a Unicode domain never reached here to begin with. This
+ * closes the hand-encoded spelling, and internationalized domains are a feature with a specification behind
+ * them rather than a side effect of a parser version.
  */
 export declare function isPublicHostname(hostname: string): boolean;
 /** The environments a domain may be declared for — every managed one, never `dev`. */

package/dist/naming/domains.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/naming/domains.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,gBAAgB,CAAC;AAuC7D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,wBAA8D,CAAC;AAE/F,uDAAuD;AACvD,eAAO,MAAM,YAAY;;;iBA+BrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAOvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAKlH;AAED,gHAAgH;AAChH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAetG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAC3B,cAAc,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CACvB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,GAAG,GAAE,UAAyB,GAC7B,MAAM,CAER"}
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/naming/domains.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,gBAAgB,CAAC;AAgD7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,wBAA8D,CAAC;AAE/F,uDAAuD;AACvD,eAAO,MAAM,YAAY;;;iBA+BrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAOvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAKlH;AAED,gHAAgH;AAChH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAetG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAC3B,cAAc,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CACvB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,GAAG,GAAE,UAAyB,GAC7B,MAAM,CAER"}

package/dist/naming/domains.js

@@ -39,15 +39,36 @@ import { z } from "zod";
 /** A hostname a Worker answers on. No scheme, no path, no port — wrangler's `routes` pattern is a host. */
 const HOSTNAME_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/;
 /**
+* **A label that is a punycode A-label — the ASCII spelling of an internationalized name.**
+*
+* Anchored to a label boundary, so it is `xn--a.test` and `example.xn--p1ai` and never `myxn--a.test`:
+* a name that merely reads that way is an ordinary name, and refusing it would be this rule reaching
+* past what it is about.
+*/
+const PUNYCODE_LABEL = /(^|\.)xn--/;
+/**
 * Whether a string is a public hostname: dot-separated DNS labels, at least two, lowercase. No scheme, no
 * port, no trailing dot, and nothing a URL parser decoded into one — `%2e%2e` is `..` once parsed, which is an
 * empty label rather than a host (#643). `localhost` is not one: it has a single label, and it is this machine.
 *
 * The one test for "is this a host" that an origin read from a stamp and an origin typed on a command line
 * both pass, so the two cannot accept different things.
+*
+* **It answers the same on every runtime, and that is why the punycode rule is stated here.** It used to be
+* borrowed: `seedHostOrigin` asked `new URL` to parse the host and took a throw as the answer, and an invalid
+* A-label like `xn--a.test` was refused because the parser refused it. Node 24.20.0 bumped Ada from 3.4.4 to
+* 4.0.0, Ada 4 stopped rejecting invalid punycode, and the same `pithy seed --host` began succeeding on Node 24
+* while still failing on Node 22 — one command, two answers, decided by the adopter's Node. A rule borrowed from
+* a parser changes under you, so this owns it.
+*
+* **Every A-label is refused, valid or not.** Telling a good one from a bad one is UTS-46, which needs IDNA
+* mapping tables this package is not carrying into a Worker for the sake of a hostname check — and
+* {@link HOSTNAME_PATTERN} is ASCII-only anyway, so a Unicode domain never reached here to begin with. This
+* closes the hand-encoded spelling, and internationalized domains are a feature with a specification behind
+* them rather than a side effect of a parser version.
 */
 function isPublicHostname(hostname) {
-	return hostname.length <= 253 && HOSTNAME_PATTERN.test(hostname);
+	return hostname.length <= 253 && HOSTNAME_PATTERN.test(hostname) && !PUNYCODE_LABEL.test(hostname);
 }
 /** The environments a domain may be declared for — every managed one, never `dev`. */
 const DOMAIN_ENVIRONMENTS = ENVIRONMENTS.filter((environment) => environment !== "dev");

package/dist/seed/devLogin.d.ts

@@ -56,4 +56,37 @@ export declare const DevLogin: z.ZodObject<{
     expiresAt: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>;
 }, z.core.$strip>;
 export type DevLogin = z.output<typeof DevLogin>;
+/**
+ * Every seeded dev login, keyed by `userId` — what `logs/dev-login.json` holds.
+ *
+ * **One entry per user the seed creates — `#667`.** It used to hold exactly one, named by a per-machine
+ * `dev.json`, so being a second seeded user meant reseeding or minting a claim by hand. Both are slow
+ * enough that people stop doing it, and the screens only one user can reach stop getting looked at. A
+ * claim is a signature over a user id and an expiry, so N of them cost no extra seeded rows and a few
+ * hundred bytes each.
+ *
+ * The key is the `userId`, which each entry also carries: the key is how the record is addressed and the
+ * field is what an entry means on its own, once something has picked one out of here.
+ *
+ * **Order is the file's, and for integer-like ids the language's.** `pithy dev` offers the identities in the
+ * order they are read, which is insertion order — except that JS enumerates canonical array-index keys
+ * first, in ascending numeric order, so a project whose user ids are stringified integers gets them
+ * numerically however the seed wrote them. Nothing depends on the order being the seed's; it is an offer
+ * order, not an identity.
+ *
+ * **The whole file is still one live credential, and the three properties that made one acceptable are
+ * what make N acceptable** — `logs/` is gitignored by the starter template, the artifact is written
+ * `0600`, and the writer refuses a symlink at the target.
+ *
+ * **Nothing migrates.** The single-entry file this replaced has strings where an entry belongs, so it does
+ * not parse, and every reader already answers "no dev login" to a file that does not — the banner stays
+ * quiet until the next `pithy seed`. The artifact is gitignored and regenerated, so that is the plan.
+ */
+export declare const DevLogins: z.ZodRecord<z.ZodString, z.ZodObject<{
+    email: z.ZodString;
+    userId: z.ZodString;
+    claim: z.ZodString;
+    expiresAt: z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodDate]>, z.ZodDate>;
+}, z.core.$strip>>;
+export type DevLogins = z.output<typeof DevLogins>;
 //# sourceMappingURL=devLogin.d.ts.map

package/dist/seed/devLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../src/seed/devLogin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,gHAAgH;AAChH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,uGAAuG;AACvG,eAAO,MAAM,cAAc,wBAA2C,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,QAAQ;;;;;iBAWqF,CAAC;AAC3G,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../src/seed/devLogin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,gHAAgH;AAChH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,uGAAuG;AACvG,eAAO,MAAM,cAAc,wBAA2C,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,uGAAuG;AACvG,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,QAAQ;;;;;iBAWqF,CAAC;AAC3G,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,SAAS;;;;;kBAEuE,CAAC;AAC9F,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,SAAS,CAAC,CAAC"}

package/dist/seed/devLogin.js

@@ -57,5 +57,32 @@ const DevLogin = z.object({
 	claim: z.string().describe("The signed, URI-encoded claim naming the user to sign in as. A live credential for the local database — never logged, never committed, never in an error payload. **Not a session:** it names a user and the route mints a session against it, so revoking a session leaves it working."),
 	expiresAt: JsonDate.describe("When the claim stops being accepted. ISO-8601 text on disk; a `Date` in app code.")
 }).describe("A seeded dev login: the signed claim for one seeded user, written to `logs/dev-login.json`.");
+/**
+* Every seeded dev login, keyed by `userId` — what `logs/dev-login.json` holds.
+*
+* **One entry per user the seed creates — `#667`.** It used to hold exactly one, named by a per-machine
+* `dev.json`, so being a second seeded user meant reseeding or minting a claim by hand. Both are slow
+* enough that people stop doing it, and the screens only one user can reach stop getting looked at. A
+* claim is a signature over a user id and an expiry, so N of them cost no extra seeded rows and a few
+* hundred bytes each.
+*
+* The key is the `userId`, which each entry also carries: the key is how the record is addressed and the
+* field is what an entry means on its own, once something has picked one out of here.
+*
+* **Order is the file's, and for integer-like ids the language's.** `pithy dev` offers the identities in the
+* order they are read, which is insertion order — except that JS enumerates canonical array-index keys
+* first, in ascending numeric order, so a project whose user ids are stringified integers gets them
+* numerically however the seed wrote them. Nothing depends on the order being the seed's; it is an offer
+* order, not an identity.
+*
+* **The whole file is still one live credential, and the three properties that made one acceptable are
+* what make N acceptable** — `logs/` is gitignored by the starter template, the artifact is written
+* `0600`, and the writer refuses a symlink at the target.
+*
+* **Nothing migrates.** The single-entry file this replaced has strings where an entry belongs, so it does
+* not parse, and every reader already answers "no dev login" to a file that does not — the banner stays
+* quiet until the next `pithy seed`. The artifact is gitignored and regenerated, so that is the plan.
+*/
+const DevLogins = z.record(z.string(), DevLogin).describe("Every seeded dev login, keyed by user id, as `logs/dev-login.json` holds them.");
 //#endregion
-export { DEV_LOGIN_CLAIM_PARAM, DEV_LOGIN_FILE, DEV_LOGIN_PATH, DEV_LOGIN_ROUTE, DevLogin, SEED_ARTIFACT_DIR };
+export { DEV_LOGIN_CLAIM_PARAM, DEV_LOGIN_FILE, DEV_LOGIN_PATH, DEV_LOGIN_ROUTE, DevLogin, DevLogins, SEED_ARTIFACT_DIR };

package/dist/seed/seed.d.ts

@@ -178,6 +178,31 @@ export interface SeedPrepareContext {
      * can write and never read.
      */
     secret: (name: string) => Promise<string | undefined>;
+    /**
+     * The value **this run just minted** for a secret, or `undefined` — never what the environment holds.
+     *
+     * `pithy provision` creates a random value for every `cf-secrets-store` secret the registry declares
+     * mintable, writes it into the account's Secrets Store, and lets it go. The Secrets Store is write-only
+     * from the CLI, so that write is the only moment the value exists anywhere the toolchain can see it —
+     * and provisioning migrates and seeds in the same process, a few steps later. A fixture that must
+     * *seal* something at creation time (encrypt a private key under the environment's key-encryption
+     * secret, derive an id that the running app will re-derive) can only do it then. Afterwards the value
+     * is unrecoverable by design.
+     *
+     * **This is not {@link secret}, and the two are not interchangeable.** `secret` answers what the
+     * environment holds and refuses outside `dev`, absolutely (#159); that rule is untouched. This answers
+     * the strictly narrower question *did this run create one, a moment ago, in memory*. A set asking here
+     * for a secret this run did not mint gets `undefined` wherever it runs, in `dev` or anywhere else.
+     *
+     * **Synchronous, because it cannot fetch.** There is no file to open and no request to make; a promise
+     * in this signature would suggest otherwise.
+     *
+     * **Empty is ordinary.** A re-run mints nothing — absence is checked before anything is generated — and
+     * a standalone `pithy seed` mints nothing at all. Both answer `undefined` for every name, and neither
+     * is an error. A set that needs a minted value and is handed none says so itself; nothing is invented
+     * on its behalf.
+     */
+    mintedThisRun: (name: string) => string | undefined;
     /**
      * The developer's machine-local preferences for this project, read from the Pithy config directory
      * (`~/.config/pithy/<project>/dev.json`, or `%APPDATA%\pithy\<project>\dev.json` on Windows), parsed but

package/dist/seed/seed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/seed/seed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAC9D,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,wEAAwE;IACxE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,yFAAyF;IACzF,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,6CAA6C;QAC7C,KAAK,EAAE,MAAM,CAAC;QACd,8EAA8E;QAC9E,GAAG,EAAE,OAAO,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,6CAA6C;IAC7C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB;IACrB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,uBAAuB;IACvB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,kBAAkB;IAClB,EAAE,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC3B,yDAAyD;IACzD,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACrE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EACjD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,EACb,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAC/B,WAAW,CAAC,KAAK,CAAC,CAGpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EACzF,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC1B,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GACvC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGtB"}
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../src/seed/seed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAC9D,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,wEAAwE;IACxE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAC/B,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EACnC,CAAC,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;IAE/B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,yFAAyF;IACzF,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAC;QACjB,6CAA6C;QAC7C,KAAK,EAAE,MAAM,CAAC;QACd,8EAA8E;QAC9E,GAAG,EAAE,OAAO,CAAC;KACd,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD;;;;;;OAMG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,6CAA6C;IAC7C,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qBAAqB;IACrB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,uBAAuB;IACvB,EAAE,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5B,kBAAkB;IAClB,EAAE,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC3B,yDAAyD;IACzD,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACrE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EACjD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,EACb,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAC/B,WAAW,CAAC,KAAK,CAAC,CAGpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EACzF,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAC1B,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GACvC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGtB"}

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.7.4";
+export declare const PACKAGE_VERSION = "0.9.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.7.4";
+const PACKAGE_VERSION = "0.9.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/workflow/faults.d.ts

@@ -65,10 +65,42 @@ export interface WorkflowFault {
  * test rather than a claim — and so the same function decides in a test, in Miniflare, and in production.
  */
 export declare function classifyWorkflowFault(error: unknown, policy: WorkflowRetryPolicy): WorkflowFault;
-/** The half of a Workflow step this kit uses: run a named body, or serve its journalled result. */
+/**
+ * The half of a Workflow step this kit uses: run a named body, or serve its journalled result.
+ *
+ * **`sleep` is optional here and required on what {@link classifiedSteps} hands back, and the asymmetry
+ * is the truth rather than a convenience.** The platform's own `WorkflowStep` always offers one. What
+ * does not are this kit's hand-written test doubles, which exist to exercise the classification and
+ * nothing else — and demanding a primitive the classifier never classifies would cost every one of them
+ * a line of noise. Handing an optional one back instead would push a null check into the one caller that
+ * genuinely pauses.
+ */
 export interface WorkflowStepLike {
     /** Run a named step, or return its journalled result if this instance already completed it. */
     do<T>(name: string, fn: () => Promise<T>): Promise<T>;
+    /**
+     * Pause the instance for `durationMs` and resume it afterwards — possibly in a fresh isolate, which
+     * is the whole reason a caller reaches for it rather than for a timer. Absent only on a test double.
+     */
+    sleep?(name: string, durationMs: number): Promise<void>;
+}
+/**
+ * A step runner that can pause — what {@link classifiedSteps} hands back, always.
+ *
+ * The durable pause is why this type exists rather than being a convenience over the one above. A `sleep`
+ * is journalled, so a wait survives the instance being evicted during it; a `setTimeout` inside one step
+ * burns that step's wall clock and dies with the instance holding it.
+ *
+ * **It was introduced on a stronger claim, and the claim did not survive contact (pithy-sh/pithy#647).** The
+ * argument was that a Secrets Store binding answers the same for its isolate's whole life, so only a resume
+ * into a fresh isolate could ever see a write land. Measured against a real store on 2026-09-25, that is
+ * false: a binding refreshes inside a live isolate roughly 1.3-1.5s after the REST write, proved by holding
+ * two isolates warm through a write and watching each serve the old value before it and the new one after,
+ * over 328 samples. The durability argument above is the true one and is sufficient on its own.
+ */
+export interface DurableStepLike extends WorkflowStepLike {
+    /** Pause the instance for `durationMs`, then resume. */
+    sleep(name: string, durationMs: number): Promise<void>;
 }
 /**
  * The platform's terminal-error class — `NonRetryableError` from `cloudflare:workflows`, taken as a
@@ -95,5 +127,5 @@ export interface TerminalErrorConstructor {
  * `runSendBatch`, `runAtRestKeyRotation`) takes this instead with no change: the classification is
  * declared once, at the entrypoint, and every step below it inherits the decision.
  */
-export declare function classifiedSteps(step: WorkflowStepLike, policy: WorkflowRetryPolicy, terminalError: TerminalErrorConstructor): WorkflowStepLike;
+export declare function classifiedSteps(step: WorkflowStepLike, policy: WorkflowRetryPolicy, terminalError: TerminalErrorConstructor): DurableStepLike;
 //# sourceMappingURL=faults.d.ts.map

package/dist/workflow/faults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"faults.d.ts","sourceRoot":"","sources":["../../src/workflow/faults.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,2FAA2F;AAC3F,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iHAAiH;IACjH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,WAAW,EAAE,wBAAwB,CAAC;IACtC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAsDD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,aAAa,CA0BhG;AAED,mGAAmG;AACnG,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,wBAAwB,GACtC,gBAAgB,CA2BlB"}
+{"version":3,"file":"faults.d.ts","sourceRoot":"","sources":["../../src/workflow/faults.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,2FAA2F;AAC3F,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iHAAiH;IACjH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7C;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,WAAW,EAAE,wBAAwB,CAAC;IACtC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAsDD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,aAAa,CA0BhG;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD;;;OAGG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,wDAAwD;IACxD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,wBAAwB,GACtC,eAAe,CAmDjB"}

package/dist/workflow/faults.js

@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { PithyError } from "../error/pithyError.js";
+import { InternalError, PithyError } from "../error/pithyError.js";
 import { d1TransientFault } from "../data/withD1Retry.js";
 import { encodeWorkflowStepMessage } from "./stepMessage.js";
 //#region src/workflow/faults.ts
@@ -91,23 +91,47 @@ function classifyWorkflowFault(error, policy) {
 * declared once, at the entrypoint, and every step below it inherits the decision.
 */
 function classifiedSteps(step, policy, terminalError) {
-	return { do(name, fn) {
-		return step.do(name, async () => {
-			try {
-				return await fn();
-			} catch (error) {
-				const fault = classifyWorkflowFault(error, policy);
-				if (fault.disposition === "retry") throw error;
-				const terminal = new terminalError(encodeWorkflowStepMessage({
-					code: fault.code,
-					message: messageOf(error),
-					action: pithyActionOf(error)
-				}));
-				terminal.cause = error;
-				throw terminal;
-			}
-		});
-	} };
+	const runner = {
+		do(name, fn) {
+			return step.do(name, async () => {
+				try {
+					return await fn();
+				} catch (error) {
+					const fault = classifyWorkflowFault(error, policy);
+					if (fault.disposition === "retry") throw error;
+					const terminal = new terminalError(encodeWorkflowStepMessage({
+						code: fault.code,
+						message: messageOf(error),
+						action: pithyActionOf(error)
+					}));
+					terminal.cause = error;
+					throw terminal;
+				}
+			});
+		},
+		/**
+		* Forwarded, and deliberately unclassified. A pause raises no fault of the capability's — the
+		* instance either resumes or it is gone — so there is nothing here for a policy to decide.
+		*
+		* A runner that cannot pause is refused, and the refusal is raised **through `do`** rather than
+		* thrown from here. A throw from here is a throw the engine never classifies, so it is free to
+		* re-drive the instance — and re-driving is the unbounded loop the caller is spending its sleeps to
+		* avoid. Going through `do` makes the refusal terminal on its first attempt, like every other
+		* answer that cannot change.
+		*/
+		sleep(name, durationMs) {
+			const pause = step.sleep;
+			if (pause === void 0) return runner.do(`${name}/cannot-pause`, async () => {
+				throw new InternalError({
+					message: "This Workflow step runner cannot pause.",
+					action: "Give the step runner a `sleep`; the platform's own `WorkflowStep` always has one.",
+					detail: `step '${name}' asked to pause ${durationMs}ms through a runner that declares no sleep`
+				});
+			});
+			return pause.call(step, name, durationMs);
+		}
+	};
+	return runner;
 }
 //#endregion
 export { classifiedSteps, classifyWorkflowFault };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.7.4",
+  "version": "0.9.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/naming/domains.ts

@@ -41,6 +41,15 @@ import { ENVIRONMENTS, FEATURE_ENVIRONMENT } from "./environment";
 /** A hostname a Worker answers on. No scheme, no path, no port — wrangler's `routes` pattern is a host. */
 const HOSTNAME_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/;
 
+/**
+ * **A label that is a punycode A-label — the ASCII spelling of an internationalized name.**
+ *
+ * Anchored to a label boundary, so it is `xn--a.test` and `example.xn--p1ai` and never `myxn--a.test`:
+ * a name that merely reads that way is an ordinary name, and refusing it would be this rule reaching
+ * past what it is about.
+ */
+const PUNYCODE_LABEL = /(^|\.)xn--/;
+
 /**
  * Whether a string is a public hostname: dot-separated DNS labels, at least two, lowercase. No scheme, no
  * port, no trailing dot, and nothing a URL parser decoded into one — `%2e%2e` is `..` once parsed, which is an
@@ -48,9 +57,22 @@ const HOSTNAME_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!
  *
  * The one test for "is this a host" that an origin read from a stamp and an origin typed on a command line
  * both pass, so the two cannot accept different things.
+ *
+ * **It answers the same on every runtime, and that is why the punycode rule is stated here.** It used to be
+ * borrowed: `seedHostOrigin` asked `new URL` to parse the host and took a throw as the answer, and an invalid
+ * A-label like `xn--a.test` was refused because the parser refused it. Node 24.20.0 bumped Ada from 3.4.4 to
+ * 4.0.0, Ada 4 stopped rejecting invalid punycode, and the same `pithy seed --host` began succeeding on Node 24
+ * while still failing on Node 22 — one command, two answers, decided by the adopter's Node. A rule borrowed from
+ * a parser changes under you, so this owns it.
+ *
+ * **Every A-label is refused, valid or not.** Telling a good one from a bad one is UTS-46, which needs IDNA
+ * mapping tables this package is not carrying into a Worker for the sake of a hostname check — and
+ * {@link HOSTNAME_PATTERN} is ASCII-only anyway, so a Unicode domain never reached here to begin with. This
+ * closes the hand-encoded spelling, and internationalized domains are a feature with a specification behind
+ * them rather than a side effect of a parser version.
  */
 export function isPublicHostname(hostname: string): boolean {
-  return hostname.length <= 253 && HOSTNAME_PATTERN.test(hostname);
+  return hostname.length <= 253 && HOSTNAME_PATTERN.test(hostname) && !PUNYCODE_LABEL.test(hostname);
 }
 
 /** The environments a domain may be declared for — every managed one, never `dev`. */

package/src/seed/devLogin.ts

@@ -71,3 +71,34 @@ export const DevLogin = z
   })
   .describe("A seeded dev login: the signed claim for one seeded user, written to `logs/dev-login.json`.");
 export type DevLogin = z.output<typeof DevLogin>;
+
+/**
+ * Every seeded dev login, keyed by `userId` — what `logs/dev-login.json` holds.
+ *
+ * **One entry per user the seed creates — `#667`.** It used to hold exactly one, named by a per-machine
+ * `dev.json`, so being a second seeded user meant reseeding or minting a claim by hand. Both are slow
+ * enough that people stop doing it, and the screens only one user can reach stop getting looked at. A
+ * claim is a signature over a user id and an expiry, so N of them cost no extra seeded rows and a few
+ * hundred bytes each.
+ *
+ * The key is the `userId`, which each entry also carries: the key is how the record is addressed and the
+ * field is what an entry means on its own, once something has picked one out of here.
+ *
+ * **Order is the file's, and for integer-like ids the language's.** `pithy dev` offers the identities in the
+ * order they are read, which is insertion order — except that JS enumerates canonical array-index keys
+ * first, in ascending numeric order, so a project whose user ids are stringified integers gets them
+ * numerically however the seed wrote them. Nothing depends on the order being the seed's; it is an offer
+ * order, not an identity.
+ *
+ * **The whole file is still one live credential, and the three properties that made one acceptable are
+ * what make N acceptable** — `logs/` is gitignored by the starter template, the artifact is written
+ * `0600`, and the writer refuses a symlink at the target.
+ *
+ * **Nothing migrates.** The single-entry file this replaced has strings where an entry belongs, so it does
+ * not parse, and every reader already answers "no dev login" to a file that does not — the banner stays
+ * quiet until the next `pithy seed`. The artifact is gitignored and regenerated, so that is the plan.
+ */
+export const DevLogins = z
+  .record(z.string(), DevLogin)
+  .describe("Every seeded dev login, keyed by user id, as `logs/dev-login.json` holds them.");
+export type DevLogins = z.output<typeof DevLogins>;

package/src/seed/seed.ts

@@ -196,6 +196,31 @@ export interface SeedPrepareContext {
    * can write and never read.
    */
   secret: (name: string) => Promise<string | undefined>;
+  /**
+   * The value **this run just minted** for a secret, or `undefined` — never what the environment holds.
+   *
+   * `pithy provision` creates a random value for every `cf-secrets-store` secret the registry declares
+   * mintable, writes it into the account's Secrets Store, and lets it go. The Secrets Store is write-only
+   * from the CLI, so that write is the only moment the value exists anywhere the toolchain can see it —
+   * and provisioning migrates and seeds in the same process, a few steps later. A fixture that must
+   * *seal* something at creation time (encrypt a private key under the environment's key-encryption
+   * secret, derive an id that the running app will re-derive) can only do it then. Afterwards the value
+   * is unrecoverable by design.
+   *
+   * **This is not {@link secret}, and the two are not interchangeable.** `secret` answers what the
+   * environment holds and refuses outside `dev`, absolutely (#159); that rule is untouched. This answers
+   * the strictly narrower question *did this run create one, a moment ago, in memory*. A set asking here
+   * for a secret this run did not mint gets `undefined` wherever it runs, in `dev` or anywhere else.
+   *
+   * **Synchronous, because it cannot fetch.** There is no file to open and no request to make; a promise
+   * in this signature would suggest otherwise.
+   *
+   * **Empty is ordinary.** A re-run mints nothing — absence is checked before anything is generated — and
+   * a standalone `pithy seed` mints nothing at all. Both answer `undefined` for every name, and neither
+   * is an error. A set that needs a minted value and is handed none says so itself; nothing is invented
+   * on its behalf.
+   */
+  mintedThisRun: (name: string) => string | undefined;
   /**
    * The developer's machine-local preferences for this project, read from the Pithy config directory
    * (`~/.config/pithy/<project>/dev.json`, or `%APPDATA%\pithy\<project>\dev.json` on Windows), parsed but

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.7.4";
+export const PACKAGE_VERSION = "0.9.0";

package/src/workflow/faults.ts

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 import { d1TransientFault } from "../data/withD1Retry";
-import { PithyError } from "../error/pithyError";
+import { InternalError, PithyError } from "../error/pithyError";
 import { encodeWorkflowStepMessage } from "./stepMessage";
 
 /**
@@ -153,10 +153,43 @@ export function classifyWorkflowFault(error: unknown, policy: WorkflowRetryPolic
   };
 }
 
-/** The half of a Workflow step this kit uses: run a named body, or serve its journalled result. */
+/**
+ * The half of a Workflow step this kit uses: run a named body, or serve its journalled result.
+ *
+ * **`sleep` is optional here and required on what {@link classifiedSteps} hands back, and the asymmetry
+ * is the truth rather than a convenience.** The platform's own `WorkflowStep` always offers one. What
+ * does not are this kit's hand-written test doubles, which exist to exercise the classification and
+ * nothing else — and demanding a primitive the classifier never classifies would cost every one of them
+ * a line of noise. Handing an optional one back instead would push a null check into the one caller that
+ * genuinely pauses.
+ */
 export interface WorkflowStepLike {
   /** Run a named step, or return its journalled result if this instance already completed it. */
   do<T>(name: string, fn: () => Promise<T>): Promise<T>;
+  /**
+   * Pause the instance for `durationMs` and resume it afterwards — possibly in a fresh isolate, which
+   * is the whole reason a caller reaches for it rather than for a timer. Absent only on a test double.
+   */
+  sleep?(name: string, durationMs: number): Promise<void>;
+}
+
+/**
+ * A step runner that can pause — what {@link classifiedSteps} hands back, always.
+ *
+ * The durable pause is why this type exists rather than being a convenience over the one above. A `sleep`
+ * is journalled, so a wait survives the instance being evicted during it; a `setTimeout` inside one step
+ * burns that step's wall clock and dies with the instance holding it.
+ *
+ * **It was introduced on a stronger claim, and the claim did not survive contact (pithy-sh/pithy#647).** The
+ * argument was that a Secrets Store binding answers the same for its isolate's whole life, so only a resume
+ * into a fresh isolate could ever see a write land. Measured against a real store on 2026-09-25, that is
+ * false: a binding refreshes inside a live isolate roughly 1.3-1.5s after the REST write, proved by holding
+ * two isolates warm through a write and watching each serve the old value before it and the new one after,
+ * over 328 samples. The durability argument above is the true one and is sufficient on its own.
+ */
+export interface DurableStepLike extends WorkflowStepLike {
+  /** Pause the instance for `durationMs`, then resume. */
+  sleep(name: string, durationMs: number): Promise<void>;
 }
 
 /**
@@ -189,8 +222,8 @@ export function classifiedSteps(
   step: WorkflowStepLike,
   policy: WorkflowRetryPolicy,
   terminalError: TerminalErrorConstructor,
-): WorkflowStepLike {
-  return {
+): DurableStepLike {
+  const runner: DurableStepLike = {
     do<T>(name: string, fn: () => Promise<T>): Promise<T> {
       return step.do(name, async () => {
         try {
@@ -215,5 +248,29 @@ export function classifiedSteps(
         }
       });
     },
+    /**
+     * Forwarded, and deliberately unclassified. A pause raises no fault of the capability's — the
+     * instance either resumes or it is gone — so there is nothing here for a policy to decide.
+     *
+     * A runner that cannot pause is refused, and the refusal is raised **through `do`** rather than
+     * thrown from here. A throw from here is a throw the engine never classifies, so it is free to
+     * re-drive the instance — and re-driving is the unbounded loop the caller is spending its sleeps to
+     * avoid. Going through `do` makes the refusal terminal on its first attempt, like every other
+     * answer that cannot change.
+     */
+    sleep(name: string, durationMs: number): Promise<void> {
+      const pause = step.sleep;
+      if (pause === undefined) {
+        return runner.do<void>(`${name}/cannot-pause`, async () => {
+          throw new InternalError({
+            message: "This Workflow step runner cannot pause.",
+            action: "Give the step runner a `sleep`; the platform's own `WorkflowStep` always has one.",
+            detail: `step '${name}' asked to pause ${durationMs}ms through a runner that declares no sleep`,
+          });
+        });
+      }
+      return pause.call(step, name, durationMs);
+    },
   };
+  return runner;
 }