@pithy-sh/core 0.10.0 → 0.12.0

package/dist/naming/limits.d.ts

@@ -123,6 +123,47 @@ export declare const NAMESPACE_LIMITS: {
         readonly policy: "truncate";
         readonly source: "cloudflare";
     };
+    /**
+     * A Queue name: **1 to 63 characters**, lowercase letters, digits and dashes, starting and ending with a letter
+     * or number ([Queues · Get started](https://developers.cloudflare.com/queues/get-started/), verified
+     * 2026-10-18). Truncated rather than refused: Pithy recomputes a queue's name from its binding on every run,
+     * as it does a bucket's, so a deterministic hash is safe (#662). The same 63 as R2, so a feature's queue fits
+     * the shape {@link FEATURE_DERIVED_PROJECT_NAME} is derived against and moves no budget.
+     */
+    readonly queue: {
+        readonly label: "a Queue name";
+        readonly maxLength: 63;
+        readonly minLength: 1;
+        readonly policy: "truncate";
+        readonly source: "cloudflare";
+    };
+    /**
+     * An Artifacts namespace: **2 to 63 characters**, starting with a letter or digit, the rest letters, digits, `.`,
+     * `_` and `-` ([Artifacts · Limits](https://developers.cloudflare.com/artifacts/platform/limits/), verified
+     * 2026-10-18). Truncated rather than refused: the kit derives it from the project and the environment on every
+     * run, like an R2 bucket name, and the longest project and environment compose 34 characters, so it never is (#673).
+     */
+    readonly artifactsNamespace: {
+        readonly label: "an Artifacts namespace name";
+        readonly maxLength: 63;
+        readonly minLength: 2;
+        readonly policy: "truncate";
+        readonly source: "cloudflare";
+    };
+    /**
+     * An Artifacts repo name. **The charset is Cloudflare's** — a letter or digit, then letters, digits, `.`, `_` and
+     * `-` ([Artifacts · Limits](https://developers.cloudflare.com/artifacts/platform/limits/), verified 2026-10-18) —
+     * and **the length is ours**: that page states one for a namespace and none for a repo, so 2 to 63 mirrors the
+     * namespace rather than inventing a second number. Refused, never truncated: a repo name is either a UUID or a
+     * name somebody chose, and a name somebody chose is never silently shortened (#673).
+     */
+    readonly artifactsRepo: {
+        readonly label: "an Artifacts repo name";
+        readonly maxLength: 63;
+        readonly minLength: 2;
+        readonly policy: "refuse";
+        readonly source: "pithy";
+    };
     /**
      * A D1 database name: `^[a-zA-Z0-9][a-zA-Z0-9_-]*$` in the OpenAPI schema, and **no documented
      * length cap** — the limits page has no row for it. So the ceiling here is {@link MAX_PITHY_NAME}.
@@ -211,7 +252,10 @@ export declare const FEATURE_TAIL_SEPARATOR = "--";
  * and teardown recomputes the name rather than matching a prefix.
  */
 export declare const MIN_VERBATIM_BINDING = 12;
-/** The longest feature resource kind — `d1`, `kv`, `r2` are all two characters. `feature.test.ts` pins it. */
+/**
+ * The longest feature resource kind segment — `d1`, `kv`, `r2`, and a queue's `q` (#662). `feature.test.ts` pins
+ * every kind's `FEATURE_KIND_SEGMENT` to it, so a longer segment fails rather than shrinking every project's budget.
+ */
 export declare const MAX_FEATURE_KIND = 2;
 /**
  * What the longest Workflow name leaves a project.
@@ -229,7 +273,7 @@ export declare const MAX_FEATURE_KIND = 2;
 export declare const WORKFLOW_DERIVED_PROJECT_NAME: number;
 /**
  * What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>--<binding>-<kind>`,
- * against R2's 63 (the strictest of the three kinds a feature provisions, and the same number a
+ * against R2's 63 (the strictest of the kinds a feature provisions, a queue's number too, and the same number a
  * feature Worker script gets).
  *
  * ```
@@ -238,7 +282,7 @@ export declare const WORKFLOW_DERIVED_PROJECT_NAME: number;
  *   -  6   the issue number, six digits — `f999999` (MAX_ISSUE_DIGITS)
  *   - 12   `-` + a legible slug (MIN_LEGIBLE_SLUG)
  *   - 14   `--` + a binding kept whole (FEATURE_TAIL_SEPARATOR, MIN_VERBATIM_BINDING)
- *   -  3   `-` + the kind, `d1` | `kv` | `r2`
+ *   -  3   `-` + the kind, `d1` | `kv` | `r2` | `q`
  *   ----
  *     26
  * ```

package/dist/naming/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/naming/limits.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AAEH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;;OAGG;;iBACS,KAAK,EAAE,iBAAiB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IACzG;;;;;;OAMG;;iBACO,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IAC5G;;;OAGG;;iBACG,KAAK,EAAE,mBAAmB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IACvG;;;;OAIG;;iBAED,KAAK,EAAE,wBAAwB;iBAC/B,SAAS,EAAE,EAAE;iBACb,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,QAAQ;iBAChB,MAAM,EAAE,YAAY;;IAEtB;;;;;OAKG;;iBACG,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,GAAG;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IAC3G;;;OAGG;;iBACG,KAAK,EAAE,oBAAoB;iBAAE,SAAS;iBAAkB,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,OAAO;;IAC/G;;;OAGG;;iBAED,KAAK,EAAE,4BAA4B;iBACnC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;IAEjB;;;OAGG;;iBAED,KAAK,EAAE,6BAA6B;iBACpC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;CAEgC,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,QAC+C,CAAC;AAE1F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,QAMjB,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/naming/limits.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AAEH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;;OAGG;;iBACS,KAAK,EAAE,iBAAiB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IACzG;;;;;;OAMG;;iBACO,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IAC5G;;;OAGG;;iBACG,KAAK,EAAE,mBAAmB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IACvG;;;;OAIG;;iBAED,KAAK,EAAE,wBAAwB;iBAC/B,SAAS,EAAE,EAAE;iBACb,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,QAAQ;iBAChB,MAAM,EAAE,YAAY;;IAEtB;;;;;OAKG;;iBACG,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,GAAG;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IAC3G;;;;;;OAMG;;iBACM,KAAK,EAAE,cAAc;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IACrG;;;;;OAKG;;iBAED,KAAK,EAAE,6BAA6B;iBACpC,SAAS,EAAE,EAAE;iBACb,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,YAAY;;IAEtB;;;;;;OAMG;;iBACc,KAAK,EAAE,wBAAwB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,OAAO;;IAChH;;;OAGG;;iBACG,KAAK,EAAE,oBAAoB;iBAAE,SAAS;iBAAkB,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,OAAO;;IAC/G;;;OAGG;;iBAED,KAAK,EAAE,4BAA4B;iBACnC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;IAEjB;;;OAGG;;iBAED,KAAK,EAAE,6BAA6B;iBACpC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;CAEgC,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,QAC+C,CAAC;AAE1F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,QAMjB,CAAC"}

package/dist/naming/limits.js

@@ -80,6 +80,47 @@ const NAMESPACE_LIMITS = {
 		source: "cloudflare"
 	},
 	/**
+	* A Queue name: **1 to 63 characters**, lowercase letters, digits and dashes, starting and ending with a letter
+	* or number ([Queues · Get started](https://developers.cloudflare.com/queues/get-started/), verified
+	* 2026-10-18). Truncated rather than refused: Pithy recomputes a queue's name from its binding on every run,
+	* as it does a bucket's, so a deterministic hash is safe (#662). The same 63 as R2, so a feature's queue fits
+	* the shape {@link FEATURE_DERIVED_PROJECT_NAME} is derived against and moves no budget.
+	*/
+	queue: {
+		label: "a Queue name",
+		maxLength: 63,
+		minLength: 1,
+		policy: "truncate",
+		source: "cloudflare"
+	},
+	/**
+	* An Artifacts namespace: **2 to 63 characters**, starting with a letter or digit, the rest letters, digits, `.`,
+	* `_` and `-` ([Artifacts · Limits](https://developers.cloudflare.com/artifacts/platform/limits/), verified
+	* 2026-10-18). Truncated rather than refused: the kit derives it from the project and the environment on every
+	* run, like an R2 bucket name, and the longest project and environment compose 34 characters, so it never is (#673).
+	*/
+	artifactsNamespace: {
+		label: "an Artifacts namespace name",
+		maxLength: 63,
+		minLength: 2,
+		policy: "truncate",
+		source: "cloudflare"
+	},
+	/**
+	* An Artifacts repo name. **The charset is Cloudflare's** — a letter or digit, then letters, digits, `.`, `_` and
+	* `-` ([Artifacts · Limits](https://developers.cloudflare.com/artifacts/platform/limits/), verified 2026-10-18) —
+	* and **the length is ours**: that page states one for a namespace and none for a repo, so 2 to 63 mirrors the
+	* namespace rather than inventing a second number. Refused, never truncated: a repo name is either a UUID or a
+	* name somebody chose, and a name somebody chose is never silently shortened (#673).
+	*/
+	artifactsRepo: {
+		label: "an Artifacts repo name",
+		maxLength: 63,
+		minLength: 2,
+		policy: "refuse",
+		source: "pithy"
+	},
+	/**
 	* A D1 database name: `^[a-zA-Z0-9][a-zA-Z0-9_-]*$` in the OpenAPI schema, and **no documented
 	* length cap** — the limits page has no row for it. So the ceiling here is {@link MAX_PITHY_NAME}.
 	*/
@@ -165,7 +206,10 @@ const FEATURE_TAIL_SEPARATOR = "--";
 * and teardown recomputes the name rather than matching a prefix.
 */
 const MIN_VERBATIM_BINDING = 12;
-/** The longest feature resource kind — `d1`, `kv`, `r2` are all two characters. `feature.test.ts` pins it. */
+/**
+* The longest feature resource kind segment — `d1`, `kv`, `r2`, and a queue's `q` (#662). `feature.test.ts` pins
+* every kind's `FEATURE_KIND_SEGMENT` to it, so a longer segment fails rather than shrinking every project's budget.
+*/
 const MAX_FEATURE_KIND = 2;
 /**
 * What the longest Workflow name leaves a project.
@@ -183,7 +227,7 @@ const MAX_FEATURE_KIND = 2;
 const WORKFLOW_DERIVED_PROJECT_NAME = NAMESPACE_LIMITS.workflow.maxLength - 1 - MAX_ENVIRONMENT_NAME - 1 - 22;
 /**
 * What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>--<binding>-<kind>`,
-* against R2's 63 (the strictest of the three kinds a feature provisions, and the same number a
+* against R2's 63 (the strictest of the kinds a feature provisions, a queue's number too, and the same number a
 * feature Worker script gets).
 *
 * ```
@@ -192,7 +236,7 @@ const WORKFLOW_DERIVED_PROJECT_NAME = NAMESPACE_LIMITS.workflow.maxLength - 1 -
 *   -  6   the issue number, six digits — `f999999` (MAX_ISSUE_DIGITS)
 *   - 12   `-` + a legible slug (MIN_LEGIBLE_SLUG)
 *   - 14   `--` + a binding kept whole (FEATURE_TAIL_SEPARATOR, MIN_VERBATIM_BINDING)
-*   -  3   `-` + the kind, `d1` | `kv` | `r2`
+*   -  3   `-` + the kind, `d1` | `kv` | `r2` | `q`
 *   ----
 *     26
 * ```

package/dist/naming/provisionScope.d.ts

@@ -171,6 +171,12 @@ export interface ProvisionScope {
      * `<project>-feature-email-send` would be one Workflow every open branch deployed over every other's.
      */
     readonly workflowHost: Omit<WorkflowHostNameParts, "capability">;
+    /**
+     * The Artifacts namespace an `artifacts` binding names in this scope (#673): `<project>-<env>` in a declared
+     * environment, `<project>-f<issue>-<slug>--artifacts` in a feature. On the scope for the reason every other name
+     * is: the stanza a run writes and the namespace it writes into it are one decision.
+     */
+    readonly artifactsNamespace: string;
 }
 /**
  * The same branch, one line down, for a provisioned resource: a `global` binding resolves to the

package/dist/naming/provisionScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionScope.d.ts","sourceRoot":"","sources":["../../src/naming/provisionScope.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAIzB,MAAM,WAAW,CAAC;AAInB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,2GAA2G;IAC3G,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IACpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChE;;;;;;;OAOG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,MAAM,CAAC;IAClE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;CAClE;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAAC;AACV,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAChC,MAAM,CAAC;AAsBV;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CA8BrF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAiBtE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,EAAE,CAY1G"}
+{"version":3,"file":"provisionScope.d.ts","sourceRoot":"","sources":["../../src/naming/provisionScope.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAKzB,MAAM,WAAW,CAAC;AAInB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,2GAA2G;IAC3G,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IACpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChE;;;;;;;OAOG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,MAAM,CAAC;IAClE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;IACjE;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAAC;AACV,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAChC,MAAM,CAAC;AAsBV;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CA+BrF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAsBtE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,EAAE,CAY1G"}

package/dist/naming/provisionScope.js

@@ -4,14 +4,15 @@ import { InternalError, ValidationError } from "../error/pithyError.js";
 import { commandName } from "../cli/command.js";
 import { FEATURE_ENVIRONMENT, assertValidEnvironment, isFeatureMarker } from "./environment.js";
 import { kebab } from "./resource.js";
-import { featureResourceName, featureSecretEntryName, featureWorkerName } from "./feature.js";
+import { featureArtifactsNamespace, featureResourceName, featureSecretEntryName, featureWorkerName } from "./feature.js";
 import { resourceNames } from "./resourceNames.js";
 //#region src/naming/provisionScope.ts
 /** The wrangler binding array a resource kind's name is composed for. */
 const KIND_NAMER = {
 	d1: "d1",
 	kv: "kv",
-	r2: "r2"
+	r2: "r2",
+	queue: "queue"
 };
 /**
 * The one branch every scope shares: a `global` secret resolves to the project's single
@@ -102,7 +103,8 @@ function environmentScope(project, environment) {
 		workflowHost: {
 			project,
 			env: environment
-		}
+		},
+		artifactsNamespace: names.artifactsNamespace()
 	};
 }
 /**
@@ -145,6 +147,9 @@ function featureScope(identity) {
 			project: identity.project,
 			env: FEATURE_ENVIRONMENT,
 			feature: identity
+		},
+		get artifactsNamespace() {
+			return featureArtifactsNamespace(identity);
 		}
 	};
 }

package/dist/naming/resourceNames.d.ts

@@ -49,6 +49,8 @@ export interface ScopedNames {
     kv(binding: string): string;
     /** An R2 bucket. Cloudflare's 63 — the one namespace where that number was always right. */
     r2(binding: string): string;
+    /** A Queue. Cloudflare's 63, truncated with a stable hash like a bucket (#662). */
+    queue(binding: string): string;
     /** A Vectorize index. 64 bytes, refused rather than truncated: a renamed index has no vectors. */
     vectorizeIndex(index: string): string;
     /** A Secrets Store entry. No Cloudflare cap; Pithy's ceiling. */
@@ -56,22 +58,39 @@ export interface ScopedNames {
     /** A Cloudflare API token label. No Cloudflare cap; Pithy's ceiling. */
     apiToken(profile: string): string;
 }
+/**
+ * The names in one declared environment: everything a scope has, and the one name that exists per environment
+ * and never at `global`.
+ */
+export interface EnvironmentNames extends ScopedNames {
+    /**
+     * The Artifacts namespace — `<project>-<env>`, with no `<thing>` (#673). One per environment, so a feature's
+     * repos never sit beside production's and the per-namespace rate limit splits per environment. There is no
+     * global one, because a namespace shared across environments is exactly that mix.
+     */
+    artifactsNamespace(): string;
+}
 /** The names a feature environment provisions under, with the project already bound. */
 export interface FeatureNames {
-    /** A feature's D1, KV, or R2 resource — `<project>-f<issue>-<slug>-<binding>-<kind>`. */
+    /** A feature's D1, KV, R2 or Queue resource — `<project>-f<issue>-<slug>--<binding>-<kind>`. */
     resource(binding: string, kind: FeatureResourceKind): string;
     /**
      * A feature's Worker script — `<project>-f<issue>-<slug>-<app>`, from the `apps/<app>` directory and
      * never the deploy name, which already leads with the project (#587).
      */
     worker(app: string): string;
+    /**
+     * A feature's Artifacts namespace — `<project>-f<issue>-<slug>--artifacts` (#673). The tail is what makes it a
+     * feature name `isFeatureOwnedName` reads back, so teardown reaps this feature's repos and no sibling's.
+     */
+    artifactsNamespace(): string;
 }
 /** Everything a project can be asked to name. Created once, from the project, by {@link resourceNames}. */
 export interface ProjectNames {
     /** The kebabbed project name every name below leads with. */
     readonly project: string;
     /** The names in one environment. Throws if the environment is not one this scheme accepts. */
-    env(environment: string): ScopedNames;
+    env(environment: string): EnvironmentNames;
     /** The names shared by every environment — the `global` scope, without typing the word. */
     readonly global: ScopedNames;
     /** The names a feature environment provisions under. */

package/dist/naming/resourceNames.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceNames.d.ts","sourceRoot":"","sources":["../../src/naming/resourceNames.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAA0C,MAAM,WAAW,CAAC;AAInH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,sGAAsG;IACtG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,uFAAuF;IACvF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kFAAkF;IAClF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kGAAkG;IAClG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,iEAAiE;IACjE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAC7D;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AAED,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,wDAAwD;IACxD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC;CACnE;AA8DD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAmB3D"}
+{"version":3,"file":"resourceNames.d.ts","sourceRoot":"","sources":["../../src/naming/resourceNames.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAIzB,MAAM,WAAW,CAAC;AAInB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,sGAAsG;IACtG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,uFAAuF;IACvF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kFAAkF;IAClF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,mFAAmF;IACnF,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,kGAAkG;IAClG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,iEAAiE;IACjE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,CAAC;CAC9B;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAC7D;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,IAAI,MAAM,CAAC;CAC9B;AAED,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC3C,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,wDAAwD;IACxD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC;CACnE;AA+ED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAuB3D"}

package/dist/naming/resourceNames.js

@@ -4,7 +4,7 @@ import { InternalError, ValidationError } from "../error/pithyError.js";
 import { GLOBAL_SCOPE, assertValidEnvironment } from "./environment.js";
 import { NAMESPACE_LIMITS } from "./limits.js";
 import { assertValidProjectName, kebab, resourceName } from "./resource.js";
-import { featureResourceName, featureWorkerName } from "./feature.js";
+import { featureArtifactsNamespace, featureResourceName, featureWorkerName } from "./feature.js";
 import { workflowHostName, workflowScriptName } from "../workflow/naming.js";
 //#region src/naming/resourceNames.ts
 /**
@@ -49,6 +49,19 @@ function scopedName(project, scope, thing, limit) {
 	});
 	return name;
 }
+/**
+* `<project>-<env>`, under the Artifacts namespace rule. The project and environment are both validated by now, and
+* the longest of each compose 34 characters, so the cap is a check rather than a truncation that ever happens.
+*/
+function artifactsNamespaceName(project, environment) {
+	const limit = NAMESPACE_LIMITS.artifactsNamespace;
+	const name = `${project}-${environment}`;
+	if (name.length > limit.maxLength || name.length < limit.minLength) throw new InternalError({
+		message: `"${name}" does not fit ${limit.label}, which takes ${limit.minLength} to ${limit.maxLength} characters.`,
+		action: "Shorten the project or environment name."
+	});
+	return name;
+}
 /** The getters for one scope. `global` and every environment share this, so nothing special-cases either. */
 function scopedNames(project, scope) {
 	return {
@@ -66,6 +79,7 @@ function scopedNames(project, scope) {
 		d1: (binding) => scopedName(project, scope, binding, NAMESPACE_LIMITS.d1),
 		kv: (binding) => scopedName(project, scope, binding, NAMESPACE_LIMITS.kv),
 		r2: (binding) => scopedName(project, scope, binding, NAMESPACE_LIMITS.r2),
+		queue: (binding) => scopedName(project, scope, binding, NAMESPACE_LIMITS.queue),
 		vectorizeIndex: (index) => scopedName(project, scope, index, NAMESPACE_LIMITS.vectorizeIndex),
 		secretEntry: (secret) => scopedName(project, scope, secret, NAMESPACE_LIMITS.secretEntry),
 		apiToken: (profile) => scopedName(project, scope, profile, NAMESPACE_LIMITS.apiToken)
@@ -85,7 +99,10 @@ function resourceNames(project) {
 		project: normalized,
 		env(environment) {
 			assertValidEnvironment(environment);
-			return scopedNames(normalized, environment);
+			return {
+				...scopedNames(normalized, environment),
+				artifactsNamespace: () => artifactsNamespaceName(normalized, environment)
+			};
 		},
 		global: scopedNames(normalized, GLOBAL_SCOPE),
 		feature(identity) {
@@ -95,7 +112,8 @@ function resourceNames(project) {
 			};
 			return {
 				resource: (binding, kind) => featureResourceName(full, binding, kind),
-				worker: (app) => featureWorkerName(full, app)
+				worker: (app) => featureWorkerName(full, app),
+				artifactsNamespace: () => featureArtifactsNamespace(full)
 			};
 		}
 	};

package/dist/privacy/blindIndex.d.ts

@@ -0,0 +1,27 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { type EncryptionConfig } from "../crypto/envelope";
+import { type BlindIndexNormalizer } from "./encrypted";
+/**
+ * **A blind index: a keyed hash an encrypted column can be found by** (#390).
+ *
+ * An encrypted column cannot answer `WHERE email = ?`. A sibling column holding `HMAC(key, normalize(value))` can,
+ * for equality and nothing else. One rule here is shared by the app Worker that seals, `sealed().match` that looks
+ * up, and the rotator that re-indexes inside the manager, so the three cannot hash one value two ways.
+ *
+ * - **The key is derived, on the field key's own version axis.** Each version's index key is HKDF-SHA256 over that
+ *   version's field key, with the label `pithy/blind-index/<normalizer>`. One secret, one rotation.
+ * - **The value carries its version**: `<version>:<hmac>`, so the stale count reaches an index exactly as it reaches
+ *   an envelope, by reading the prefix.
+ * - **The normalizer is in the label**, so changing a field's normalizer cannot silently miss against old hashes: they
+ *   are hashes under a different key, and the change reads as a re-index.
+ */
+/** The HKDF label one normalizer's index keys are derived under. */
+export declare function blindIndexLabel(normalizer: BlindIndexNormalizer): string;
+/** The HMAC key for one version and normalizer: HKDF-SHA256 over that version's field key. */
+export declare function blindIndexKey(config: EncryptionConfig, version: number, normalizer: BlindIndexNormalizer): Promise<CryptoKey>;
+/** The blind index of `value` under `version`: `<version>:<hmac>`. The value is normalized first. */
+export declare function blindIndexValue(config: EncryptionConfig, version: number, normalizer: BlindIndexNormalizer, value: string): Promise<string>;
+/** The version a blind-index value was written under, or `null` for a value that is not one. */
+export declare function blindIndexVersion(value: string): number | null;
+//# sourceMappingURL=blindIndex.d.ts.map

package/dist/privacy/blindIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blindIndex.d.ts","sourceRoot":"","sources":["../../src/privacy/blindIndex.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,gBAAgB,EAAY,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,KAAK,oBAAoB,EAAqB,MAAM,aAAa,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AAEH,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,UAAU,EAAE,oBAAoB,GAAG,MAAM,CAExE;AASD,8FAA8F;AAC9F,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,SAAS,CAAC,CAmBpB;AAED,qGAAqG;AACrG,wBAAsB,eAAe,CACnC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,oBAAoB,EAChC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D"}

package/dist/privacy/blindIndex.js

@@ -0,0 +1,57 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { keyBytes } from "../crypto/envelope.js";
+import { FIELD_KEYS_BINDING } from "../crypto/fieldKeys.js";
+import { normalizeForIndex } from "./encrypted.js";
+//#region src/privacy/blindIndex.ts
+/**
+* **A blind index: a keyed hash an encrypted column can be found by** (#390).
+*
+* An encrypted column cannot answer `WHERE email = ?`. A sibling column holding `HMAC(key, normalize(value))` can,
+* for equality and nothing else. One rule here is shared by the app Worker that seals, `sealed().match` that looks
+* up, and the rotator that re-indexes inside the manager, so the three cannot hash one value two ways.
+*
+* - **The key is derived, on the field key's own version axis.** Each version's index key is HKDF-SHA256 over that
+*   version's field key, with the label `pithy/blind-index/<normalizer>`. One secret, one rotation.
+* - **The value carries its version**: `<version>:<hmac>`, so the stale count reaches an index exactly as it reaches
+*   an envelope, by reading the prefix.
+* - **The normalizer is in the label**, so changing a field's normalizer cannot silently miss against old hashes: they
+*   are hashes under a different key, and the change reads as a re-index.
+*/
+/** The HKDF label one normalizer's index keys are derived under. */
+function blindIndexLabel(normalizer) {
+	return `pithy/blind-index/${normalizer}`;
+}
+/** Unpadded base64url, the alphabet a blind index is written in. */
+function base64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** The HMAC key for one version and normalizer: HKDF-SHA256 over that version's field key. */
+async function blindIndexKey(config, version, normalizer) {
+	const material = await crypto.subtle.importKey("raw", keyBytes(config, version, { keys: FIELD_KEYS_BINDING }), "HKDF", false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: Uint8Array.from(new TextEncoder().encode(blindIndexLabel(normalizer)))
+	}, material, 256);
+	return crypto.subtle.importKey("raw", bits, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+}
+/** The blind index of `value` under `version`: `<version>:<hmac>`. The value is normalized first. */
+async function blindIndexValue(config, version, normalizer, value) {
+	const key = await blindIndexKey(config, version, normalizer);
+	const mac = await crypto.subtle.sign("HMAC", key, Uint8Array.from(new TextEncoder().encode(normalizeForIndex(normalizer, value))));
+	return `${version}:${base64Url(new Uint8Array(mac))}`;
+}
+/** The version a blind-index value was written under, or `null` for a value that is not one. */
+function blindIndexVersion(value) {
+	const match = /^(\d+):/.exec(value);
+	return match ? Number(match[1]) : null;
+}
+//#endregion
+export { blindIndexKey, blindIndexLabel, blindIndexValue, blindIndexVersion };

package/dist/privacy/classes.d.ts

@@ -0,0 +1,142 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+/**
+ * **A field declares its own privacy class, and the declaration drives everything downstream** (#132).
+ *
+ * One marker, several consumers — the shape `@pithy-sh/vector` already uses, where `.meta({ filterable: true
+ * })` drives provisioning, the filter type, the drift check and the boot check. Here the marker drives the
+ * type gate on the three internal surfaces (the logger, `AuditEvent.metadata`, `PithyError.detail`), the
+ * masked view `redact` returns, the classification `classifyPrivacy` derives, and the inventory the control
+ * plane reports.
+ *
+ * ## What a marker does, in one call
+ *
+ * `pii(schema)` does two things. It attaches `.meta({ privacy: "pii" })`, which is **introspectable** — that is
+ * what `redact`, `classifyPrivacy` and the inventory read. And it applies Zod's `.brand()`, which changes the
+ * **inferred type** — that is what makes a log call carrying the value fail to compile. The brand lands on the
+ * field, not on the object, so extracting the field does not launder it: `user.email` is as branded as `user`.
+ *
+ * **A marker over another marker adds its class.** `pii(secret(x))` and `secret(pii(x))` are the same field: it
+ * carries both classes, in its `meta` (as a list, strongest first) and in its type (both brands). It is masked with the
+ * strongest one's placeholder and listed once per class. The same marker twice is one class.
+ *
+ * **The brand key is `privacy:<class>`, not the bare class name.** An adopter's own `.brand<"pii">()` for some
+ * unrelated purpose must not trip a gate it never opted into, and an adopter's `UserId` brand must not either:
+ * the gate reads a brand under the `privacy:` namespace and nothing else, which is the federated-key rule
+ * (`auth/invalid_token`, `pithy_auth_users`) applied one more time.
+ *
+ * **Nothing at runtime changes.** Zod's `.brand()` returns the same schema object — the brand exists only in
+ * the type — and `.meta()` returns a clone that parses exactly as its source. `Schema.parse(row)` returns the
+ * same data it did before the marker, and no column is added anywhere.
+ *
+ * ## The set is open
+ *
+ * Four classes ship named — `secret`, `pii`, `phi`, `pci` — and {@link definePrivacyClass} registers more
+ * (`genetic`, `biometric`, whatever a regulator names) without a change to core. A closed union is what #117
+ * records the cost of, and a healthcare adopter should not have to wait on us.
+ *
+ * ## Where `secret` stops and `@pithy-sh/secrets` starts
+ *
+ * Two different facts, kept apart on purpose. `@pithy-sh/secrets` decides **where a credential the Worker reads
+ * is stored** — its registry names a backend, and its reader redacts the value it hands back. `secret()` says
+ * **what a field in a data shape is** — a receipt, a magic-link token, a session id, a key hash — values that
+ * live in rows and payloads and that no secrets registry ever holds. Merging them would make core depend on a
+ * capability (principle 4) and would make a storage decision answer a classification question.
+ */
+/** The `meta` key a marker writes and every reader reads. */
+export declare const PRIVACY_META_KEY = "privacy";
+/** The prefix of every privacy brand, so the gate never reads a brand that means something else. */
+export declare const PRIVACY_BRAND_PREFIX = "privacy:";
+/** A class name: a lowercase identifier. It becomes a brand key, a config value and a report column. */
+export declare const PrivacyClassName: z.ZodString;
+export type PrivacyClassName = z.output<typeof PrivacyClassName>;
+/** The four classes the kit names, in the order every report lists them. */
+export declare const BUILT_IN_PRIVACY_CLASSES: readonly ["secret", "pii", "phi", "pci"];
+/** One of the four built-in class names. */
+export type BuiltInPrivacyClass = (typeof BUILT_IN_PRIVACY_CLASSES)[number];
+/** How a class masks a value: the string that stands in its place on every internal surface. */
+export type PrivacyMask = (value: unknown) => string;
+/** One registered class: its name, what it means, and how it masks. */
+export interface PrivacyClass {
+    /** The class name — the `meta` value and the brand's suffix. */
+    readonly name: string;
+    /** What the class means, in one sentence an auditor reads. */
+    readonly description: string;
+    /** The masked form of a value of this class. */
+    readonly mask: PrivacyMask;
+}
+/**
+ * The brand a marker puts on a schema's output type. Zod's own brand machinery, under the `privacy:` key.
+ *
+ * `"out"` on purpose: the **input** side stays unbranded, so `z.input` — the SQLite row shape, the Kysely
+ * table type, a KV write's pre-parse value — is exactly what it was. A row read from D1 parses into the
+ * branded app shape, and `Schema.encode()` hands Kysely the plain row back.
+ */
+export type Marked<S extends z.ZodType, C extends string> = z.core.$ZodBranded<S, `${typeof PRIVACY_BRAND_PREFIX}${C}`, "out">;
+/** A marker for one class: wraps a schema and returns it marked. Carries its class name for a reader. */
+export interface PrivacyMarker<C extends string> {
+    <S extends z.ZodType>(schema: S): Marked<S, C>;
+    /** The class this marker applies. */
+    readonly className: C;
+}
+/**
+ * Mask a primary account number to its first six and last four digits — `424242******4242`.
+ *
+ * **The one class whose mask is not a placeholder, because the masked form is the useful one.** First-six and
+ * last-four is the display PCI-DSS permits, and it is what an operator reading a log needs to match a
+ * complaint to a card without holding the card. Spaces and dashes are separators and are dropped; anything
+ * that is not 13 to 19 digits once they are is not a card number, and masks to `[pci]` rather than to a
+ * partial reveal of something else.
+ *
+ * Every payment rail Pithy ships is hosted, so no PAN ever reaches an adopter's Worker through the kit. The
+ * class is here for the adopter's own schemas.
+ */
+export declare function maskPan(value: unknown): string;
+/** The class a name refers to, or `undefined` for a name nothing registered. */
+export declare function privacyClass(name: string): PrivacyClass | undefined;
+/** Every registered class, built-ins first in their fixed order, then each adopter class in registration order. */
+export declare function privacyClasses(): PrivacyClass[];
+/**
+ * `names` from the strongest to the weakest, each once: `secret`, then `phi`, then `pci`, then each adopter class, then
+ * `pii`. An adopter registers a class because its data is more specific than `pii`, so it ranks above it; adopter
+ * classes rank among themselves by name. The order a marker records several classes in, whatever order they came.
+ */
+export declare function rankPrivacyClasses(names: Iterable<string>): string[];
+/**
+ * The strongest of `names`, the class a value is masked with when it carries several and is masked whole. See
+ * {@link rankPrivacyClasses}. `undefined` for none.
+ */
+export declare function strongestPrivacyClass(names: Iterable<string>): string | undefined;
+/**
+ * The classes a schema's own `privacy` meta records: one class as its name, several as a list, strongest first. Read
+ * from this exact schema, never through a wrapper. Empty where it records none.
+ */
+export declare function ownPrivacyClasses(schema: z.ZodType): string[];
+/** What {@link definePrivacyClass} takes. */
+export interface PrivacyClassSpec<C extends string> {
+    /** The class name: a lowercase identifier, unique across the isolate. */
+    name: C;
+    /** What the class means. Defaults to a sentence naming it as adopter-registered. */
+    description?: string;
+    /** How a value masks. Defaults to the `[name]` placeholder. */
+    mask?: PrivacyMask;
+}
+/**
+ * Register a class of the adopter's own — `genetic`, `biometric`, whatever their regulator names — and get its
+ * marker back. Usable exactly like the built-ins: the same `meta`, the same brand, the same gate, the same
+ * inventory row.
+ *
+ * **A duplicate is refused at registration**, a built-in name included. Two modules each believing they own
+ * `genetic` would disagree about its mask, and the one that loaded second would win silently.
+ */
+export declare function definePrivacyClass<const C extends string>(spec: PrivacyClassSpec<C>): PrivacyMarker<C>;
+/** Mark a field as a credential or bearer artifact. See {@link BUILT_INS}. */
+export declare const secret: PrivacyMarker<"secret">;
+/** Mark a field as personal data under GDPR or CCPA. */
+export declare const pii: PrivacyMarker<"pii">;
+/** Mark a field as Protected Health Information under HIPAA. */
+export declare const phi: PrivacyMarker<"phi">;
+/** Mark a field as cardholder data under PCI-DSS. Masks to first six and last four. */
+export declare const pci: PrivacyMarker<"pci">;
+//# sourceMappingURL=classes.d.ts.map

package/dist/privacy/classes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classes.d.ts","sourceRoot":"","sources":["../../src/privacy/classes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C,wGAAwG;AACxG,eAAO,MAAM,gBAAgB,aAK1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,YAAI,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAEjF,4CAA4C;AAC5C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,gGAAgG;AAChG,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;AAErD,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAC5E,CAAC,EACD,GAAG,OAAO,oBAAoB,GAAG,CAAC,EAAE,EACpC,KAAK,CACN,CAAC;AAEF,yGAAyG;AACzG,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM;IAC7C,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAK9C;AAqCD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEnE;AAED,mHAAmH;AACnH,wBAAgB,cAAc,IAAI,YAAY,EAAE,CAE/C;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAKpE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAEjF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAK7D;AAkBD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,MAAM;IAChD,yEAAyE;IACzE,IAAI,EAAE,CAAC,CAAC;IACR,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAoBtG;AAED,8EAA8E;AAC9E,eAAO,MAAM,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAoB,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,GAAG,EAAE,aAAa,CAAC,KAAK,CAAiB,CAAC;AAEvD,gEAAgE;AAChE,eAAO,MAAM,GAAG,EAAE,aAAa,CAAC,KAAK,CAAiB,CAAC;AAEvD,uFAAuF;AACvF,eAAO,MAAM,GAAG,EAAE,aAAa,CAAC,KAAK,CAAiB,CAAC"}