@pithy-sh/core 0.6.2 → 0.7.0

package/src/migrations/runner.ts

@@ -8,6 +8,7 @@ import { causeMessage } from "../error/cause";
 import { InternalError } from "../error/pithyError";
 import { batchedProvider } from "./batch";
 import { MIGRATION_LOCK_TABLE, MIGRATION_TABLE, migrationKysely } from "./bookkeeping";
+import { guardRetained, isDownRefusal, RetainedBudget } from "./retained";
 
 /**
  * The per-database migration runner. The registry yields one `MigrationProvider` per database
@@ -49,12 +50,18 @@ import { MIGRATION_LOCK_TABLE, MIGRATION_TABLE, migrationKysely } from "./bookke
  * capability arrives with its whole set. Refusing the add with an actionable error was the
  * alternative; it explains the corner instead of removing it.
  */
-function migrator(database: D1Database, provider: MigrationProvider): Migrator {
+function migrator(
+  database: D1Database,
+  provider: MigrationProvider,
+  target: MigrationTarget | undefined,
+  consent: RetainedConsent | undefined,
+): Migrator {
   return new Migrator({
     db: migrationKysely(database),
     // Each migration body applies in one `d1.batch()`; the ledger row stays on the ordinary path,
-    // so nothing batches across a migration boundary. See `./batch`.
-    provider: batchedProvider(provider, database),
+    // so nothing batches across a migration boundary. See `./batch`. Every `down` is guarded before it
+    // is batched: no reversal runs while a retained table in this database holds rows (#588).
+    provider: batchedProvider(guardRetained(provider, database, guardOptions(target, consent)), database),
     migrationTableName: MIGRATION_TABLE,
     migrationLockTableName: MIGRATION_LOCK_TABLE,
     allowUnorderedMigrations: true,
@@ -76,13 +83,35 @@ export interface MigrationTarget {
   database: string;
 }
 
+/**
+ * What a caller that reverses migrations says about retained rows (#588) — see `./retained`.
+ *
+ * Optional, and absent is the safe answer: a caller that says nothing has counted nothing, so any `down`
+ * against a database holding retained rows is refused.
+ */
+export interface RetainedConsent {
+  /**
+   * The retained rows the caller agreed to destroy. Pass one budget to every database in a run, so one
+   * agreement is spent once; a caller reversing a single database builds its own. Absent means none.
+   */
+  budget?: RetainedBudget;
+}
+
+/** The guard's options: the binding its refusal names, and the budget the caller agreed to. */
+function guardOptions(
+  target: MigrationTarget | undefined,
+  consent: RetainedConsent | undefined,
+): { binding: string; budget: RetainedBudget } {
+  return { binding: target?.binding ?? "this database", budget: consent?.budget ?? new RetainedBudget(undefined) };
+}
+
 /** Run every pending migration to latest. An empty provider resolves to `[]`. */
 export async function runMigrations(
   database: D1Database,
   provider: MigrationProvider,
   target?: MigrationTarget,
 ): Promise<MigrationResult[]> {
-  const { error, results } = await migrator(database, provider).migrateToLatest();
+  const { error, results } = await migrator(database, provider, target, undefined).migrateToLatest();
   return settle("run", error, results, target);
 }
 
@@ -123,13 +152,18 @@ export async function readMigrationLedger(database: D1Database, provider: Migrat
   };
 }
 
-/** Step the latest applied migration back — one step, the `pithy migrate --rollback` seam. */
+/**
+ * Step this database's latest applied migration back — one step, per database. `pithy migrate --rollback`
+ * calls it once for **every** database in its fan-out. Refused while a retained table here holds rows the
+ * caller has not counted in `consent` (#588).
+ */
 export async function rollbackMigration(
   database: D1Database,
   provider: MigrationProvider,
   target?: MigrationTarget,
+  consent?: RetainedConsent,
 ): Promise<MigrationResult[]> {
-  const { error, results } = await migrator(database, provider).migrateDown();
+  const { error, results } = await migrator(database, provider, target, consent).migrateDown();
   return settle("rollback", error, results, target);
 }
 
@@ -139,14 +173,16 @@ export async function rollbackMigration(
  * `up` reapplies from empty. The seam behind `pithy seed --redo`'s destructive rebuild: because the
  * schema comes back empty, the ordinary non-destructive seed writes (`INSERT OR IGNORE`, KV
  * skip-if-exists) simply work afterward — there is no per-row identity problem to solve. An empty
- * ledger rolls back nothing; an empty provider reapplies nothing.
+ * ledger rolls back nothing; an empty provider reapplies nothing. Refused, before the first `down`, while a
+ * retained table here holds rows the caller has not counted in `consent` (#588).
  */
 export async function resetMigrations(
   database: D1Database,
   provider: MigrationProvider,
   target?: MigrationTarget,
+  consent?: RetainedConsent,
 ): Promise<MigrationResult[]> {
-  const runner = migrator(database, provider);
+  const runner = migrator(database, provider, target, consent);
   const down = await runner.migrateTo(NO_MIGRATIONS);
   const downResults = settle("resetDown", down.error, down.results, target);
   const up = await runner.migrateToLatest();
@@ -169,26 +205,57 @@ async function appliedMigrationNames(db: Kysely<unknown>): Promise<Set<string>>
 }
 
 /**
- * Surgically drop **one capability's** migrations: run each of the provider's `down` functions in
+ * What a drop reverses, and the database it reverses it in.
+ *
+ * Two providers because they answer two questions. `reverse` is the part being removed — one capability's
+ * migrations. `database` is every migration composed into that D1, and it is what the retained guard counts:
+ * a table is retained in a *database*, and the capability being dropped is the one least likely to declare
+ * the vault it shares a database with (#588). Handed only the part, the guard counted what the part declared
+ * — nothing — while the vault beside it held rows.
+ */
+export interface DropSelection {
+  /** Every migration composed into this database — the set whose retained declarations are counted. */
+  database: MigrationProvider;
+  /** The migrations to reverse: a part of `database`, by composed name. */
+  reverse: MigrationProvider;
+}
+
+/**
+ * Surgically drop **one capability's** migrations: run each of `drop.reverse`'s `down` functions in
  * reverse order and delete only those ledger rows, leaving every other capability's tables and
  * bookkeeping untouched. The seam behind `pithy remove --drop`. Kysely's stepwise `Migrator` refuses a
  * provider that doesn't span the whole ledger (it reads a foreign row as corrupt state), so a
  * per-capability drop can't go through it — this reverses the capability's own migrations directly.
- * Only migrations recorded in the ledger are reversed; an absent ledger drops nothing.
+ * Only migrations recorded in the ledger are reversed; an absent ledger drops nothing. Refused, before the
+ * first `down`, while a retained table **anywhere in `drop.database`** holds rows the caller has not counted
+ * in `consent` (#588). A name `drop.reverse` carries that `drop.database` does not is an internal fault: the
+ * guard would not have counted the database the `down` runs in.
  */
 export async function dropMigrations(
   database: D1Database,
-  provider: MigrationProvider,
+  drop: DropSelection,
   target?: MigrationTarget,
+  consent?: RetainedConsent,
 ): Promise<MigrationResult[]> {
   const db = migrationKysely(database);
-  // Batched here too: `down` pays the same per-statement cost `up` does, and a drop is all DDL.
-  const migrations = await batchedProvider(provider, database).getMigrations();
+  // Batched here too: `down` pays the same per-statement cost `up` does, and a drop is all DDL. Guarded
+  // first, exactly as the `Migrator` path is (#588) — over the whole database's set, so the count is too.
+  const guarded = guardRetained(drop.database, database, guardOptions(target, consent));
+  const migrations = await batchedProvider(guarded, database).getMigrations();
+  const reversing = Object.keys(await drop.reverse.getMigrations());
+  const stray = reversing.filter((name) => !(name in migrations));
+  if (stray.length > 0) {
+    throw new InternalError({
+      message: `Couldn't drop ${stray.map((name) => `"${name}"`).join(", ")}${on(target)}. The database's migrations do not carry it.`,
+      detail: `${where(target)} A drop counts retained rows over the database's whole set, so every migration it reverses must be in it.`,
+      action: "Build the drop from the database's composed migrations. Nothing was dropped.",
+    });
+  }
   const applied = await appliedMigrationNames(db);
 
   const results: MigrationResult[] = [];
   // Reverse application order: drop the newest of the capability's migrations first.
-  for (const name of Object.keys(migrations).sort().reverse()) {
+  for (const name of reversing.sort().reverse()) {
     if (!applied.has(name)) continue;
     // No `down` — the migration can't be reversed, so leave both its table and its ledger row in place
     // (deleting the row would desync the ledger from the schema). Every Pithy migration ships a `down`.
@@ -199,6 +266,8 @@ export async function dropMigrations(
       await sql`delete from ${sql.table(MIGRATION_TABLE)} where name = ${name}`.execute(db);
       results.push({ migrationName: name, direction: "Down", status: "Success" });
     } catch (error) {
+      // A refusal is not a failed drop: nothing is broken, and "fix the migration's down" would be a lie.
+      if (isDownRefusal(error)) throw error;
       const dropped = results.map((result) => `"${result.migrationName}"`);
       throw new InternalError(
         {
@@ -223,7 +292,9 @@ const VOICE = {
   rollback: {
     failed: (key: string) => `Couldn't roll back "${key}"`,
     fallback: "The rollback failed",
-    action: "Fix the migration. Run pithy migrate --rollback again.",
+    // Never "run --rollback again": a rollback steps back every database, so a second one after a partial
+    // failure reverses a second migration in each database that already moved (#588).
+    action: "Fix the migration's down. Run pithy doctor to see where each database stands.",
   },
   resetDown: {
     failed: (key: string) => `Couldn't roll back "${key}" during reset`,
@@ -273,6 +344,9 @@ function settle(
   target?: MigrationTarget,
 ): MigrationResult[] {
   if (error !== undefined) {
+    // A guard refused before a `down` ran. It already names what it protected and the way past it, and
+    // nothing about it is a migration to fix — so it reaches the operator as itself (#588).
+    if (isDownRefusal(error)) throw error;
     const voice = VOICE[verb];
     const failed = results?.find((result) => result.status === "Error");
     const applied = results?.filter((result) => result.status === "Success").map((result) => result.migrationName);

package/src/naming/environment.ts

@@ -52,6 +52,41 @@ export const GLOBAL_SCOPE = "global";
  */
 export const FEATURE_ENVIRONMENT = "feature";
 
+/**
+ * **The segment a feature takes where an environment sits** — `f<issue>`, as in `<project>-f69-demo-db-d1`.
+ *
+ * Defined here, beside the environment rule, because the two share a slot in every composed name and the
+ * environment rule has to refuse this shape: `feature.ts` composes a feature's head with it, and
+ * {@link isValidEnvironment} refuses an environment that starts with one. A marker composed in one module and
+ * recognized in another would be two statements of one shape, and the next person to change one would not
+ * find the other.
+ */
+export function featureMarker(issue: string): string {
+  return `f${issue}`;
+}
+
+/** Every string {@link featureMarker} can compose: an `f` and one or more digits, as a whole segment. */
+const FEATURE_MARKER = /^f[0-9]+$/;
+
+/** Is this whole hyphen-delimited segment a feature's marker? `f1` and `f01` are; `f1a` and `feature` are not. */
+export function isFeatureMarker(segment: string): boolean {
+  return FEATURE_MARKER.test(segment);
+}
+
+/**
+ * Does this environment start where a feature's name does?
+ *
+ * **Exactly the environments that can collide with a feature (#587).** A declared environment composes
+ * `<project>-<env>-<thing>`, a feature `<project>-f<issue>-<slug>-<thing>`, and a feature Worker's name has no
+ * kind suffix to tell the two apart. After the shared `<project>-`, the two strings can only be equal when the
+ * environment's first segment is the feature's marker — `f1-demo` meets feature 1-demo's Worker `api`, and `f1`
+ * meets it too, through a Worker called `demo-api`. Any other first segment differs from every marker, so no
+ * name composed under it can be a feature's. So this is the whole rule, not one case of it.
+ */
+function startsWithFeatureMarker(name: string): boolean {
+  return isFeatureMarker(name.split("-")[0] ?? "");
+}
+
 /**
  * The longest an environment name may be — **the longest canonical one, `staging`**.
  *
@@ -77,6 +112,7 @@ export const MAX_ENVIRONMENT_NAME = Math.max(...ENVIRONMENTS.map((environment) =
  */
 export function isValidEnvironment(name: string): boolean {
   if (name === GLOBAL_SCOPE) return false;
+  if (startsWithFeatureMarker(name)) return false;
   return name.length <= MAX_ENVIRONMENT_NAME && NAME_SEGMENT.test(name);
 }
 
@@ -104,6 +140,13 @@ export function assertValidEnvironment(name: string): void {
       detail: `${GLOBAL_SCOPE} occupies the environment slot of a composed name for values shared across every environment.`,
     });
   }
+  if (startsWithFeatureMarker(name)) {
+    throw new ValidationError({
+      message: `"${name}" starts the way a feature's name does.`,
+      action: "Start the environment with something other than f and a number.",
+      detail: `A feature takes the environment's slot with f<issue>, so <project>-${name}-<worker> can be a feature's Worker name exactly, and \`pithy feature destroy\` deletes that Worker.`,
+    });
+  }
   if (name.length > MAX_ENVIRONMENT_NAME && NAME_SEGMENT.test(name)) {
     throw new ValidationError({
       message: `"${name}" is ${name.length} characters. An environment stops at ${MAX_ENVIRONMENT_NAME}.`,

package/src/naming/feature.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 import { ValidationError } from "../error/pithyError";
+import { featureMarker } from "./environment";
 import { MAX_ISSUE_DIGITS, NAMESPACE_LIMITS } from "./limits";
 import { assertValidProjectName, fitSegment, kebab } from "./resource";
 
@@ -63,7 +64,7 @@ function assertIssue(issue: string): void {
 function head(identity: FeatureIdentity): string {
   assertValidProjectName(identity.project);
   assertIssue(identity.issue);
-  return `${kebab(identity.project)}-f${identity.issue}`;
+  return `${kebab(identity.project)}-${featureMarker(identity.issue)}`;
 }
 
 /**
@@ -156,7 +157,13 @@ export function featureSecretEntryName(identity: FeatureIdentity, secret: string
  * floored the slug at one character and never touched the worker segment, so it ran unbounded — 69
  * characters for a worker called `collaboration-realtime-gateway`, 109 for a 70-character one. `apps/<name>`
  * has a charset rule and no length rule, so nothing upstream was going to stop it either.
+ *
+ * **`app` is the `apps/<app>` directory, never the deploy name.** A scaffolded Worker deploys as
+ * `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>-<project>-<app>` — the
+ * project twice, spent out of the budget above (#587). This function takes a string and cannot tell the
+ * two apart, so the provisioning path reaches it only through `featureScope`, which is handed both names
+ * and picks.
  */
-export function featureWorkerName(identity: FeatureIdentity, worker: string): string {
-  return composeFeatureName(head(identity), kebab(identity.slug), kebab(worker), "", NAMESPACE_LIMITS.worker.maxLength);
+export function featureWorkerName(identity: FeatureIdentity, app: string): string {
+  return composeFeatureName(head(identity), kebab(identity.slug), kebab(app), "", NAMESPACE_LIMITS.worker.maxLength);
 }

package/src/naming/provisionScope.ts

@@ -1,8 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 
-import { InternalError } from "../error/pithyError";
-import { assertValidEnvironment, FEATURE_ENVIRONMENT, GLOBAL_SCOPE } from "./environment";
+import { InternalError, ValidationError } from "../error/pithyError";
+import { assertValidEnvironment, FEATURE_ENVIRONMENT, GLOBAL_SCOPE, isFeatureMarker } from "./environment";
 import {
   type FeatureIdentity,
   type FeatureResourceKind,
@@ -10,6 +10,7 @@ import {
   featureSecretEntryName,
   featureWorkerName,
 } from "./feature";
+import { kebab } from "./resource";
 import { resourceNames } from "./resourceNames";
 
 /**
@@ -89,6 +90,28 @@ export interface ProjectGlobalNaming extends BindingNaming {
   readonly scope: "global";
 }
 
+/**
+ * The two names one Worker answers to before a scope has named it — **and why a scope is handed both.**
+ *
+ * `pithy init replay --worker board` writes `apps/board/wrangler.jsonc` with `"name": "replay-board"`.
+ * So the Worker's directory says `board` and its deploy name says `replay-board`, and the two scopes need
+ * different ones. A declared environment's fallback is wrangler's own `<script>-<env>`, which is built on
+ * the deploy name. A feature's name is `<project>-f<issue>-<slug>-<app>`, which already leads with the
+ * project, so it is built on the directory.
+ *
+ * This was one string until #587, and the string was the deploy name, so every feature Worker carried the
+ * project twice: `replay-f69-demo-replay-board`. That was not only untidy. The name is held to the Worker
+ * cap of 63, and the doubled segment spent that budget where the truncation lands on the part that says
+ * *which* Worker. Carrying both names is what lets each scope take the one its shape is built from, and
+ * lets neither caller choose on the scope's behalf.
+ */
+export interface ProvisionWorkerNames {
+  /** The Worker's `apps/<app>` directory basename — the name a sibling's `service` binding targets it by. */
+  readonly app: string;
+  /** The Worker's deploy name — the top-level `name` of its `wrangler.jsonc`, e.g. `replay-board`. */
+  readonly script: string;
+}
+
 /** Where a provisioning run's resources are named, and where their ids are written. */
 export interface ProvisionScope {
   /** The `env.<stanza>` key in each Worker's config that this scope's ids are written into. */
@@ -136,11 +159,15 @@ export interface ProvisionScope {
   /**
    * The script name a Worker deploys under in this scope.
    *
+   * `worker` carries **both** of the Worker's names, because the two scopes compose from different ones:
+   * a declared environment falls back to wrangler's `<script>-<env>`, and a feature composes
+   * `<project>-f<issue>-<slug>-<app>`. See {@link ProvisionWorkerNames}.
+   *
    * `declared` is the name that scope's stanza already carries, when it carries one. A scope may honor it
    * or compose its own; see {@link environmentScope} and {@link featureScope}, which answer differently
    * and say why. Passing it is how a caller asks the scope rather than deciding for itself.
    */
-  worker(worker: string, declared?: string): string;
+  worker(worker: ProvisionWorkerNames, declared?: string): string;
   /**
    * This scope's CF Secrets Store entry name for a declared secret.
    *
@@ -227,6 +254,28 @@ export function bindingResourceName(
   return scoped(thing);
 }
 
+/**
+ * **Is this name inside a feature's namespace** — `<project>-f<issue>-…`, the project and then a feature's
+ * marker, with something after it?
+ *
+ * The namespace, not one feature's names, because that is what has to stay disjoint: `pithy feature destroy`
+ * deletes by exact name, and a feature Worker's name has no kind suffix, so a declared environment's name
+ * that lands anywhere in here is one some branch's teardown can delete (#587). Every name {@link featureScope}
+ * composes is inside; {@link environmentScope} refuses to name a Worker inside, and `isValidEnvironment`
+ * refuses every environment whose composed names could be.
+ *
+ * **What it does not see.** It is stated for one project. A second project on the same account whose name is
+ * this one's plus `-f<issue>` — `acme-f1` beside `acme` — composes names inside `acme`'s namespace from an
+ * ordinary environment, and nothing here can tell, because a project name carries no boundary a later hyphen
+ * cannot fake. That is the hyphen ambiguity every composed name carries, one segment further left.
+ */
+export function isFeatureName(project: string, name: string): boolean {
+  const head = `${kebab(project)}-`;
+  if (!name.startsWith(head)) return false;
+  const [marker, ...rest] = name.slice(head.length).split("-");
+  return isFeatureMarker(marker ?? "") && rest.length > 0;
+}
+
 /**
  * A declared environment's scope — `staging`, `prod`, or whatever the root `pithy.config.ts` lists.
  *
@@ -265,7 +314,21 @@ export function environmentScope(project: string, environment: string): Provisio
     honorsGlobal: true,
     resource: (binding, kind, naming) =>
       bindingResourceName(project, binding, kind, naming, (thing) => names[KIND_NAMER[kind]](thing)),
-    worker: (worker, declared) => declared ?? `${worker}-${environment}`,
+    worker: ({ script }, declared) => {
+      const name = declared ?? `${script}-${environment}`;
+      // The environment rule already keeps every name composed from the environment out of a feature's
+      // namespace. A declared name and wrangler's fallback are not composed from it — the stanza says one,
+      // the deploy name leads the other — so either can still sit there, and a branch's teardown would
+      // delete the Worker (#587). Refused here, where the name is chosen, rather than spared at teardown.
+      if (isFeatureName(project, name)) {
+        throw new ValidationError({
+          message: `The ${environment} Worker "${name}" is named the way a feature's Worker is.`,
+          action: `Rename it in env.${environment}.name, or the Worker's top-level name, so it does not follow ${kebab(project)}- with f and a number.`,
+          detail: `${declared === undefined ? "Composed by wrangler from the deploy name" : `Declared in env.${environment}.name`}. A feature's Worker is <project>-f<issue>-<slug>-<app>, and \`pithy feature destroy\` deletes it by that exact name.`,
+        });
+      }
+      return name;
+    },
     secretEntry: (secret, secretScope) =>
       secretEntryName(project, secret, secretScope, () => names.secretEntry(secret)),
   };
@@ -306,8 +369,38 @@ export function featureScope(identity: FeatureIdentity): ProvisionScope {
     // part company here.
     honorsGlobal: false,
     resource: (binding, kind) => featureResourceName(identity, binding, kind),
-    worker: (worker) => featureWorkerName(identity, worker),
+    // The directory, not the deploy name: the head already carries the project, and the deploy name
+    // usually leads with it too, which composed `<project>-f<issue>-<slug>-<project>-<app>` (#587).
+    worker: ({ app }) => featureWorkerName(identity, app),
     secretEntry: (secret, secretScope) =>
       secretEntryName(identity.project, secret, secretScope, () => featureSecretEntryName(identity, secret)),
   };
 }
+
+/**
+ * **Every script name one Worker can be deployed under in a feature — what teardown looks for (#592).**
+ *
+ * The first is the name {@link featureScope} composes today, taken from the scope rather than composed a
+ * second time, so provisioning and teardown cannot disagree about it. The second is the one it composed
+ * until #587, from the deploy name: `<project>-f<issue>-<slug>-<project>-<app>`. A feature provisioned and
+ * deployed before that upgrade is still running under it, and after its next deploy it runs under both —
+ * so teardown looks for both. One entry when the two coincide, as they do for a Worker whose deploy name
+ * is its directory.
+ *
+ * **Exact names, never a prefix.** A prefix scan of `<project>-f<issue>-<slug>-` reaches a sibling whose
+ * slug extends this one's. The exact names can still meet a sibling in one shape: the doubled name for
+ * slug `demo` and deploy name `acme-api` is the current name for slug `demo-acme` and directory `api`, on
+ * the same issue number. That is the same hyphen ambiguity every feature name here carries.
+ *
+ * **They cannot meet a declared environment's Worker**, which has no suffix either and is `<project>-<env>-<app>`
+ * since #580: every name either shape yields is inside {@link isFeatureName}'s namespace, no environment may
+ * start with a feature's marker, and {@link environmentScope} refuses a declared or fallback Worker name inside
+ * it. What that does not reach is a name nothing in the kit chose — a stanza written by hand and deployed
+ * without `pithy provision --env` ever reading it, or another project on the account, as {@link isFeatureName}
+ * says.
+ */
+export function featureWorkerScriptNames(identity: FeatureIdentity, worker: ProvisionWorkerNames): string[] {
+  const current = featureScope(identity).worker(worker);
+  const beforeSingleProject = featureWorkerName(identity, worker.script);
+  return current === beforeSingleProject ? [current] : [current, beforeSingleProject];
+}

package/src/naming/resourceNames.ts

@@ -69,8 +69,11 @@ export interface ScopedNames {
 export interface FeatureNames {
   /** A feature's D1, KV, or R2 resource — `<project>-f<issue>-<slug>-<binding>-<kind>`. */
   resource(binding: string, kind: FeatureResourceKind): string;
-  /** A feature's Worker script — `<project>-f<issue>-<slug>-<worker>`. */
-  worker(worker: string): string;
+  /**
+   * A feature's Worker script — `<project>-f<issue>-<slug>-<app>`, from the `apps/<app>` directory and
+   * never the deploy name, which already leads with the project (#587).
+   */
+  worker(app: string): string;
 }
 
 /** Everything a project can be asked to name. Created once, from the project, by {@link resourceNames}. */
@@ -167,7 +170,7 @@ export function resourceNames(project: string): ProjectNames {
       const full: FeatureIdentity = { ...identity, project: normalized };
       return {
         resource: (binding, kind) => featureResourceName(full, binding, kind),
-        worker: (worker) => featureWorkerName(full, worker),
+        worker: (app) => featureWorkerName(full, app),
       };
     },
   };

package/src/text/comments.ts

@@ -62,6 +62,28 @@
  * `worker-safety.test.ts` exists to enforce, so the gate now polices the stripper it reads with.
  */
 export function blankComments(source: string): string {
+  return blank(source, false);
+}
+
+/**
+ * `source` with every comment **and every string's contents** blanked — for a gate asking whether a name is
+ * *called*, where {@link blankComments}' own rule points the wrong way.
+ *
+ * `blankComments` keeps strings because its callers look for a forbidden read, and a string that merely contains
+ * one is a false positive, the safe direction. A gate looking for a *required* call inverts that: a validator named
+ * only inside an error message — `"requireEnvironment(args.env)"` — is a call that never runs, and counting it
+ * passes the file. So this blanks the contents too, delimiters kept, character for character.
+ *
+ * **A template literal goes whole, `${}` included.** A call written only inside an interpolation is not seen. For
+ * a presence check that is the safe direction again — the file is flagged, never passed — and a scan for a read
+ * belongs on {@link blankComments}, where the interpolation stays.
+ */
+export function blankCommentsAndStrings(source: string): string {
+  return blank(source, true);
+}
+
+/** The one walk behind both: comments always blanked, a quoted run kept or blanked inside its delimiters. */
+function blank(source: string, strings: boolean): string {
   let out = "";
   let previous = "";
   let index = 0;
@@ -76,7 +98,8 @@ export function blankComments(source: string): string {
     }
     if (char === '"' || char === "'" || char === "`") {
       const stop = endOfQuoted(source, index, char, char !== "`");
-      out += source.slice(index, stop);
+      const run = source.slice(index, stop);
+      out += strings ? blankInside(run, char) : run;
       index = stop;
       previous = char;
       continue;
@@ -95,6 +118,13 @@ export function blankComments(source: string): string {
   return out;
 }
 
+/** A quoted run with everything between its delimiters blanked, newlines kept. An unterminated run has no closer. */
+function blankInside(run: string, quote: string): string {
+  const closed = run.length > 1 && run.endsWith(quote);
+  const body = run.slice(1, closed ? -1 : undefined).replace(/[^\n]/g, " ");
+  return `${quote}${body}${closed ? quote : ""}`;
+}
+
 /**
  * After one of these, a `/` opens a regex literal; after anything else it divides. The empty string is
  * the start of the file. A wrong guess is bounded — see {@link endOfRegex}.

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.6.2";
+export const PACKAGE_VERSION = "0.7.0";

package/src/workflow/host.ts

@@ -139,6 +139,14 @@ export interface WorkflowHostParams {
    * not depend on `@pithy-sh/secrets`, which owns that naming.
    */
   masterKeySecretName?: string;
+  /**
+   * Secrets Store binding name → the entry it resolves to in this environment, for every store secret the
+   * host reads besides the master key. Filled **only** for the bindings listed, like
+   * {@link databaseNames}; the names come from the capability, which composes them with the same namer
+   * provisioning created the entries with. Core composes none of them itself, for the reason
+   * {@link masterKeySecretName} gives.
+   */
+  secretNames?: Record<string, string>;
   /** Vars merged over the template's, e.g. the capability's config serialized as one JSON blob. */
   vars?: Record<string, string>;
   /**
@@ -241,13 +249,15 @@ export function resolveWorkflowHost(template: WorkflowHostTemplate, params: Work
 
   if (resolved.secrets_store_secrets && params.secretsStoreId !== undefined) {
     const storeId = params.secretsStoreId;
-    const masterKey = params.masterKeySecretName;
+    const names: Record<string, string> = {
+      ...(params.masterKeySecretName !== undefined ? { SECRETS_ENCRYPTION_KEYS: params.masterKeySecretName } : {}),
+      ...params.secretNames,
+    };
     resolved.secrets_store_secrets = resolved.secrets_store_secrets.map((entry) => ({
       ...entry,
       store_id: storeId,
-      // Only the master key is environment-scoped; every other entry keeps its declared name.
-      secret_name:
-        masterKey !== undefined && entry.binding === "SECRETS_ENCRYPTION_KEYS" ? masterKey : entry.secret_name,
+      // A named binding takes the entry its capability composed; an unnamed one keeps its declared name.
+      secret_name: Object.hasOwn(names, entry.binding) ? (names[entry.binding] as string) : entry.secret_name,
     }));
   }
 

package/src/workflow/hostEnv.ts

@@ -45,7 +45,7 @@ export type HostEnvProviderKind = z.infer<typeof HostEnvProviderKind>;
 /**
  * What provides one field. The whole point of the declaration: a report that says `BASE_URL is
  * missing` sends a developer looking, and a report that says `Var BASE_URL in the host's
- * wrangler.jsonc. Run pithy email provision --env dev.` ends the search.
+ * wrangler.jsonc. Run pithy email provision.` ends the search.
  */
 export const HostEnvProvider = z
   .object({