@pithy-sh/core 0.6.1 → 0.7.0

package/dist/naming/provisionScope.js

@@ -1,7 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { InternalError } from "../error/pithyError.js";
-import { FEATURE_ENVIRONMENT, assertValidEnvironment } from "./environment.js";
+import { InternalError, ValidationError } from "../error/pithyError.js";
+import { FEATURE_ENVIRONMENT, assertValidEnvironment, isFeatureMarker } from "./environment.js";
+import { kebab } from "./resource.js";
 import { featureResourceName, featureSecretEntryName, featureWorkerName } from "./feature.js";
 import { resourceNames } from "./resourceNames.js";
 //#region src/naming/provisionScope.ts
@@ -32,19 +33,52 @@ function bindingResourceName(project, binding, kind, naming, scoped) {
 	return scoped(thing);
 }
 /**
+* **Is this name inside a feature's namespace** — `<project>-f<issue>-…`, the project and then a feature's
+* marker, with something after it?
+*
+* The namespace, not one feature's names, because that is what has to stay disjoint: `pithy feature destroy`
+* deletes by exact name, and a feature Worker's name has no kind suffix, so a declared environment's name
+* that lands anywhere in here is one some branch's teardown can delete (#587). Every name {@link featureScope}
+* composes is inside; {@link environmentScope} refuses to name a Worker inside, and `isValidEnvironment`
+* refuses every environment whose composed names could be.
+*
+* **What it does not see.** It is stated for one project. A second project on the same account whose name is
+* this one's plus `-f<issue>` — `acme-f1` beside `acme` — composes names inside `acme`'s namespace from an
+* ordinary environment, and nothing here can tell, because a project name carries no boundary a later hyphen
+* cannot fake. That is the hyphen ambiguity every composed name carries, one segment further left.
+*/
+function isFeatureName(project, name) {
+	const head = `${kebab(project)}-`;
+	if (!name.startsWith(head)) return false;
+	const [marker, ...rest] = name.slice(head.length).split("-");
+	return isFeatureMarker(marker ?? "") && rest.length > 0;
+}
+/**
 * A declared environment's scope — `staging`, `prod`, or whatever the root `pithy.config.ts` lists.
 *
 * The environment is validated here, once, before a single name exists: it is the middle segment of
 * every name below, so an illegal one must fail before anything is created rather than at the fourth
 * getter that happened to use it.
 *
-* **A Worker's script name is wrangler's own, `<script>-<env>`, deliberately.** It is the one name here
-* that is not `<project>-<env>-<thing>`, because `wrangler deploy --env staging` has always appended the
-* environment to the top-level `name` — so every project that ever deployed is already at that address.
-* A Worker script is a `refuse`-policy namespace precisely because renaming one orphans the deployment
-* and every `service` binding pointing at it; composing a "more correct" name here would do exactly
-* that, silently, on the next deploy. The name is written out rather than left implicit so a service
-* binding and a deploy agree on one string that is in the file.
+* **A declared name wins; the fallback is wrangler's own, `<script>-<env>`.**
+*
+* This reverses the rule that stood here until #580, and the reversal is worth reading rather than
+* assuming. The old rule *recomputed* `<script>-<env>` on every provision and wrote it over whatever the
+* stanza said, on the argument that wrangler has always appended the environment to the top-level `name`,
+* so every project that ever deployed is already at that address.
+*
+* That argument is still true about the **fallback**, and the fallback is unchanged: a stanza that names
+* nothing gets `<script>-<env>` and every existing adopter deploys exactly where they always did. What was
+* wrong was recomputing over a name somebody wrote down. Since #580 the starter template writes one —
+* `<project>-<env>-<worker>`, the shape every other resource here takes — so recompute would have made the
+* template's stamp pointless, and worse: it would have silently renamed the Worker of every project that
+* had taken the new shape, on their next `pithy provision`. A Worker script is a `refuse`-policy namespace
+* precisely because renaming one orphans the deployment, its routes, and every `service` binding pointing
+* at it. Doing that as a side effect of provisioning is the failure the old rule was written to prevent,
+* arriving from the other direction.
+*
+* So the name is read, not composed, when the file already holds one — and written out when it does not,
+* so a service binding and a deploy still agree on one string that is in the file.
 */
 function environmentScope(project, environment) {
 	assertValidEnvironment(environment);
@@ -54,7 +88,15 @@ function environmentScope(project, environment) {
 		source: true,
 		honorsGlobal: true,
 		resource: (binding, kind, naming) => bindingResourceName(project, binding, kind, naming, (thing) => names[KIND_NAMER[kind]](thing)),
-		worker: (worker) => `${worker}-${environment}`,
+		worker: ({ script }, declared) => {
+			const name = declared ?? `${script}-${environment}`;
+			if (isFeatureName(project, name)) throw new ValidationError({
+				message: `The ${environment} Worker "${name}" is named the way a feature's Worker is.`,
+				action: `Rename it in env.${environment}.name, or the Worker's top-level name, so it does not follow ${kebab(project)}- with f and a number.`,
+				detail: `${declared === void 0 ? "Composed by wrangler from the deploy name" : `Declared in env.${environment}.name`}. A feature's Worker is <project>-f<issue>-<slug>-<app>, and \`pithy feature destroy\` deletes it by that exact name.`
+			});
+			return name;
+		},
 		secretEntry: (secret, secretScope) => secretEntryName(project, secret, secretScope, () => names.secretEntry(secret))
 	};
 }
@@ -77,6 +119,12 @@ function environmentScope(project, environment) {
 * `resource` is ignored for the same reason it is moot: a feature's `<thing>` segment is the binding plus
 * the kind, and the whole name is recomputed on teardown rather than looked up, so nothing outside the
 * feature reads the string.
+*
+* **And a declared Worker name is ignored here too — the other half of the #580 asymmetry.** A declared
+* environment's script name is the adopter's, written in a tracked file, and provisioning reads it. A
+* feature's is the kit's: it is composed from the branch, written into a generated config nobody commits,
+* and **recomputed on teardown**. Honoring a declared one would leave `pithy feature destroy` computing a
+* name the deployment does not answer to, which is a Worker nothing deletes.
 */
 function featureScope(identity) {
 	return {
@@ -84,9 +132,36 @@ function featureScope(identity) {
 		source: false,
 		honorsGlobal: false,
 		resource: (binding, kind) => featureResourceName(identity, binding, kind),
-		worker: (worker) => featureWorkerName(identity, worker),
+		worker: ({ app }) => featureWorkerName(identity, app),
 		secretEntry: (secret, secretScope) => secretEntryName(identity.project, secret, secretScope, () => featureSecretEntryName(identity, secret))
 	};
 }
+/**
+* **Every script name one Worker can be deployed under in a feature — what teardown looks for (#592).**
+*
+* The first is the name {@link featureScope} composes today, taken from the scope rather than composed a
+* second time, so provisioning and teardown cannot disagree about it. The second is the one it composed
+* until #587, from the deploy name: `<project>-f<issue>-<slug>-<project>-<app>`. A feature provisioned and
+* deployed before that upgrade is still running under it, and after its next deploy it runs under both —
+* so teardown looks for both. One entry when the two coincide, as they do for a Worker whose deploy name
+* is its directory.
+*
+* **Exact names, never a prefix.** A prefix scan of `<project>-f<issue>-<slug>-` reaches a sibling whose
+* slug extends this one's. The exact names can still meet a sibling in one shape: the doubled name for
+* slug `demo` and deploy name `acme-api` is the current name for slug `demo-acme` and directory `api`, on
+* the same issue number. That is the same hyphen ambiguity every feature name here carries.
+*
+* **They cannot meet a declared environment's Worker**, which has no suffix either and is `<project>-<env>-<app>`
+* since #580: every name either shape yields is inside {@link isFeatureName}'s namespace, no environment may
+* start with a feature's marker, and {@link environmentScope} refuses a declared or fallback Worker name inside
+* it. What that does not reach is a name nothing in the kit chose — a stanza written by hand and deployed
+* without `pithy provision --env` ever reading it, or another project on the account, as {@link isFeatureName}
+* says.
+*/
+function featureWorkerScriptNames(identity, worker) {
+	const current = featureScope(identity).worker(worker);
+	const beforeSingleProject = featureWorkerName(identity, worker.script);
+	return current === beforeSingleProject ? [current] : [current, beforeSingleProject];
+}
 //#endregion
-export { bindingResourceName, environmentScope, featureScope };
+export { bindingResourceName, environmentScope, featureScope, featureWorkerScriptNames, isFeatureName };

package/dist/naming/resourceNames.d.ts

@@ -60,8 +60,11 @@ export interface ScopedNames {
 export interface FeatureNames {
     /** A feature's D1, KV, or R2 resource — `<project>-f<issue>-<slug>-<binding>-<kind>`. */
     resource(binding: string, kind: FeatureResourceKind): string;
-    /** A feature's Worker script — `<project>-f<issue>-<slug>-<worker>`. */
-    worker(worker: string): string;
+    /**
+     * A feature's Worker script — `<project>-f<issue>-<slug>-<app>`, from the `apps/<app>` directory and
+     * never the deploy name, which already leads with the project (#587).
+     */
+    worker(app: string): string;
 }
 /** Everything a project can be asked to name. Created once, from the project, by {@link resourceNames}. */
 export interface ProjectNames {

package/dist/naming/resourceNames.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceNames.d.ts","sourceRoot":"","sources":["../../src/naming/resourceNames.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAA0C,MAAM,WAAW,CAAC;AAInH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,sGAAsG;IACtG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,uFAAuF;IACvF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kFAAkF;IAClF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kGAAkG;IAClG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,iEAAiE;IACjE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAC7D,wEAAwE;IACxE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,wDAAwD;IACxD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC;CACnE;AA8DD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAmB3D"}
+{"version":3,"file":"resourceNames.d.ts","sourceRoot":"","sources":["../../src/naming/resourceNames.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAA0C,MAAM,WAAW,CAAC;AAInH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,sGAAsG;IACtG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,uFAAuF;IACvF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kFAAkF;IAClF,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,kGAAkG;IAClG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,iEAAiE;IACjE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAAC;IAC7D;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AAED,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,wDAAwD;IACxD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC;CACnE;AA8DD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAmB3D"}

package/dist/naming/resourceNames.js

@@ -95,7 +95,7 @@ function resourceNames(project) {
 			};
 			return {
 				resource: (binding, kind) => featureResourceName(full, binding, kind),
-				worker: (worker) => featureWorkerName(full, worker)
+				worker: (app) => featureWorkerName(full, app)
 			};
 		}
 	};

package/dist/text/comments.d.ts

@@ -61,4 +61,18 @@
  * `worker-safety.test.ts` exists to enforce, so the gate now polices the stripper it reads with.
  */
 export declare function blankComments(source: string): string;
+/**
+ * `source` with every comment **and every string's contents** blanked — for a gate asking whether a name is
+ * *called*, where {@link blankComments}' own rule points the wrong way.
+ *
+ * `blankComments` keeps strings because its callers look for a forbidden read, and a string that merely contains
+ * one is a false positive, the safe direction. A gate looking for a *required* call inverts that: a validator named
+ * only inside an error message — `"requireEnvironment(args.env)"` — is a call that never runs, and counting it
+ * passes the file. So this blanks the contents too, delimiters kept, character for character.
+ *
+ * **A template literal goes whole, `${}` included.** A call written only inside an interpolation is not seen. For
+ * a presence check that is the safe direction again — the file is flagged, never passed — and a scan for a read
+ * belongs on {@link blankComments}, where the interpolation stays.
+ */
+export declare function blankCommentsAndStrings(source: string): string;
 //# sourceMappingURL=comments.d.ts.map

package/dist/text/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../src/text/comments.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgCpD"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../src/text/comments.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9D"}

package/dist/text/comments.js

@@ -62,6 +62,26 @@
 * `worker-safety.test.ts` exists to enforce, so the gate now polices the stripper it reads with.
 */
 function blankComments(source) {
+	return blank(source, false);
+}
+/**
+* `source` with every comment **and every string's contents** blanked — for a gate asking whether a name is
+* *called*, where {@link blankComments}' own rule points the wrong way.
+*
+* `blankComments` keeps strings because its callers look for a forbidden read, and a string that merely contains
+* one is a false positive, the safe direction. A gate looking for a *required* call inverts that: a validator named
+* only inside an error message — `"requireEnvironment(args.env)"` — is a call that never runs, and counting it
+* passes the file. So this blanks the contents too, delimiters kept, character for character.
+*
+* **A template literal goes whole, `${}` included.** A call written only inside an interpolation is not seen. For
+* a presence check that is the safe direction again — the file is flagged, never passed — and a scan for a read
+* belongs on {@link blankComments}, where the interpolation stays.
+*/
+function blankCommentsAndStrings(source) {
+	return blank(source, true);
+}
+/** The one walk behind both: comments always blanked, a quoted run kept or blanked inside its delimiters. */
+function blank(source, strings) {
 	let out = "";
 	let previous = "";
 	let index = 0;
@@ -76,7 +96,8 @@ function blankComments(source) {
 		}
 		if (char === "\"" || char === "'" || char === "`") {
 			const stop = endOfQuoted(source, index, char, char !== "`");
-			out += source.slice(index, stop);
+			const run = source.slice(index, stop);
+			out += strings ? blankInside(run, char) : run;
 			index = stop;
 			previous = char;
 			continue;
@@ -94,6 +115,11 @@ function blankComments(source) {
 	}
 	return out;
 }
+/** A quoted run with everything between its delimiters blanked, newlines kept. An unterminated run has no closer. */
+function blankInside(run, quote) {
+	const closed = run.length > 1 && run.endsWith(quote);
+	return `${quote}${run.slice(1, closed ? -1 : void 0).replace(/[^\n]/g, " ")}${closed ? quote : ""}`;
+}
 /**
 * After one of these, a `/` opens a regex literal; after anything else it divides. The empty string is
 * the start of the file. A wrong guess is bounded — see {@link endOfRegex}.
@@ -160,4 +186,4 @@ function endOfRegex(source, start) {
 	return source.length;
 }
 //#endregion
-export { blankComments };
+export { blankComments, blankCommentsAndStrings };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.6.1";
+export declare const PACKAGE_VERSION = "0.7.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.6.1";
+const PACKAGE_VERSION = "0.7.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/workflow/host.d.ts

@@ -127,6 +127,14 @@ export interface WorkflowHostParams {
      * not depend on `@pithy-sh/secrets`, which owns that naming.
      */
     masterKeySecretName?: string;
+    /**
+     * Secrets Store binding name → the entry it resolves to in this environment, for every store secret the
+     * host reads besides the master key. Filled **only** for the bindings listed, like
+     * {@link databaseNames}; the names come from the capability, which composes them with the same namer
+     * provisioning created the entries with. Core composes none of them itself, for the reason
+     * {@link masterKeySecretName} gives.
+     */
+    secretNames?: Record<string, string>;
     /** Vars merged over the template's, e.g. the capability's config serialized as one JSON blob. */
     vars?: Record<string, string>;
     /**

package/dist/workflow/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/workflow/host.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,qBAAqB,EAAwC,MAAM,UAAU,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kGAAkG;AAClG,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qCAAqC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CAyFpH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,qBAAqB,GAC3B;IAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBvD"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/workflow/host.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,qBAAqB,EAAwC,MAAM,UAAU,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kGAAkG;AAClG,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qCAAqC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CA2FpH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,qBAAqB,GAC3B;IAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBvD"}

package/dist/workflow/host.js

@@ -59,11 +59,14 @@ function resolveWorkflowHost(template, params) {
 	if (resolved.send_email) resolved.send_email = resolved.send_email.map((entry) => withRemote(entry, entry.name, remote));
 	if (resolved.secrets_store_secrets && params.secretsStoreId !== void 0) {
 		const storeId = params.secretsStoreId;
-		const masterKey = params.masterKeySecretName;
+		const names = {
+			...params.masterKeySecretName !== void 0 ? { SECRETS_ENCRYPTION_KEYS: params.masterKeySecretName } : {},
+			...params.secretNames
+		};
 		resolved.secrets_store_secrets = resolved.secrets_store_secrets.map((entry) => ({
 			...entry,
 			store_id: storeId,
-			secret_name: masterKey !== void 0 && entry.binding === "SECRETS_ENCRYPTION_KEYS" ? masterKey : entry.secret_name
+			secret_name: Object.hasOwn(names, entry.binding) ? names[entry.binding] : entry.secret_name
 		}));
 	}
 	if (resolved.workflows) {

package/dist/workflow/hostEnv.d.ts

@@ -40,7 +40,7 @@ export type HostEnvProviderKind = z.infer<typeof HostEnvProviderKind>;
 /**
  * What provides one field. The whole point of the declaration: a report that says `BASE_URL is
  * missing` sends a developer looking, and a report that says `Var BASE_URL in the host's
- * wrangler.jsonc. Run pithy email provision --env dev.` ends the search.
+ * wrangler.jsonc. Run pithy email provision.` ends the search.
  */
 export declare const HostEnvProvider: z.ZodObject<{
     kind: z.ZodEnum<{

package/dist/workflow/hostEnv.js

@@ -41,7 +41,7 @@ const HostEnvProviderKind = z.enum([
 /**
 * What provides one field. The whole point of the declaration: a report that says `BASE_URL is
 * missing` sends a developer looking, and a report that says `Var BASE_URL in the host's
-* wrangler.jsonc. Run pithy email provision --env dev.` ends the search.
+* wrangler.jsonc. Run pithy email provision.` ends the search.
 */
 const HostEnvProvider = z.object({
 	kind: HostEnvProviderKind.describe("Which kind of thing fills this field."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/capability/capability.ts

@@ -19,6 +19,7 @@ import type { LocaleContext } from "../i18n/locale";
 import type { Translator } from "../i18n/translator";
 import type { KvNamespaceSpecMap } from "../kv/namespaces";
 import type { Logger } from "../logger/logger";
+import { declareRetained } from "../migrations/retainedDeclaration";
 import type { SeedSet } from "../seed/seed";
 import type { WorkflowSpecMap } from "../workflow/spec";
 import { BindingSpec, type BindingSpecInput } from "./bindings";
@@ -595,6 +596,11 @@ export function defineCapability<
   const Name extends string = string,
   const Workflows extends WorkflowSpecMap = Record<never, never>,
 >(input: CapabilityInput<Databases, Namespaces, Name, Workflows>): Capability<Databases, Namespaces, Name, Workflows> {
+  // A retained table is declared on the `down`s that could drop it the moment the capability exists, so a
+  // migration the runner is handed carries it however its provider was built (#588).
+  for (const spec of Object.values(input.databases ?? {})) {
+    if (spec.migrations && spec.retained) declareRetained(spec.migrations, spec.retained);
+  }
   return {
     ...input,
     requiredBindings: input.requiredBindings.map((binding) => BindingSpec.parse(binding)),

package/src/capability/settings.ts

@@ -112,8 +112,21 @@ export interface SettingsAccountReader {
   d1Databases(): Promise<readonly string[]>;
   /** Whether this account holds a Cloudflare zone covering the hostname — the prerequisite for onboarding it. */
   zone(hostname: string): Promise<boolean>;
-  /** Whether a declared secret has a value in that environment. The name is the registry's, not a binding's. */
-  secret(request: { name: string; environment: string }): Promise<boolean>;
+  /**
+   * Whether that environment's **D1 vault** holds a value under this registry name — asked of its manager
+   * Worker, the only thing that can open it.
+   *
+   * Named for the store it asks, because it used to be `secret()` — "does this secret have a value" — and
+   * that question has two stores behind it (#596). A check asking it about a `cf-secrets-store` secret got a
+   * confident `false` from a vault the secret never lives in. Ask {@link storeEntry} about one of those.
+   */
+  vaultSecret(request: { name: string; environment: string }): Promise<boolean>;
+  /**
+   * Whether the account's **Secrets Store** holds an entry of exactly this name. The name is the entry's, not
+   * the registry's: compose it with `environmentScope(project, env).secretEntry(...)`, the namer provisioning
+   * created it with, so the check looks where the value went.
+   */
+  storeEntry(name: string): Promise<boolean>;
 }
 
 /** What the account tier is told: everything the local tier gets, plus the account it may ask. */

package/src/data/databases.ts

@@ -29,6 +29,17 @@ export interface DatabaseSpec<Tables extends SchemaMap = SchemaMap> {
   migrations?: Record<string, Migration>;
   /** Sort order within this database relative to other capabilities (core low, app high). Required with `migrations`. */
   migrationOrder?: number;
+  /**
+   * The tables in this slice whose rows **exist nowhere else** — a vault's sealed credentials, a
+   * suppression list of people who asked not to be mailed. Keys of `tables`, declared beside the
+   * `migrations` that create them (required with them).
+   *
+   * A schema `down` is right to drop a table; for these it destroys the only copy. So while one of them
+   * holds rows, no `down` runs against this database — a rollback, a `seed --redo` reset, a
+   * `remove --drop` — unless the operator passes the exact row count (`--destroy-retained <n>`). The
+   * refusal lives in the migration runner, so a new command that reverses migrations inherits it (#588).
+   */
+  retained?: readonly (keyof Tables & string)[];
 }
 
 /** A capability's databases: database name → {@link DatabaseSpec}. */

package/src/migrations/registry.ts

@@ -3,6 +3,7 @@
 
 import type { Migration, MigrationProvider } from "kysely/migration";
 import { InternalError } from "../error/pithyError";
+import { declareRetained } from "./retainedDeclaration";
 
 /** Width of the zero-padded `order` prefix in a composed key — the stable anchor. */
 const ORDER_DIGITS = 4;
@@ -29,6 +30,12 @@ export interface NamespacedMigrations {
   order: number;
   /** Stable, per-namespace keys, each `^\d{4}_[a-z0-9_]+$` (e.g. "0001_init"). */
   migrations: Record<string, Migration>;
+  /**
+   * The table keys (camelCase, as the capability's `tables` declares them) this set's capability retains
+   * in this database — rows that exist nowhere else. Recorded on this set's `down`s, and the runner refuses
+   * any `down` against the database while one of them holds rows. See `./retained`.
+   */
+  retained?: readonly string[];
 }
 
 // These guard build-time registry invariants — a capability author wired its migrations wrong.
@@ -85,6 +92,9 @@ function composeDatabase(database: string, sets: NamespacedMigrations[]): Migrat
     }
   }
 
+  // Recorded on each migration's own `down`, so the runner enforces it on this provider and on anything
+  // later built from these same migrations — no caller has to remember to pass it along (#588).
+  for (const set of sets) declareRetained(set.migrations, set.retained ?? []);
   return {
     getMigrations: async (): Promise<Record<string, Migration>> => composed,
   };