@pithy-sh/core 0.7.2 → 0.7.4

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.7.2";
+export declare const PACKAGE_VERSION = "0.7.4";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.7.2";
+const PACKAGE_VERSION = "0.7.4";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/dist/worker/identity.d.ts

@@ -24,6 +24,15 @@
 export declare const PROJECT_VAR = "PROJECT";
 /** The var naming the environment this deployment serves — `dev`, `staging`, or `prod`. */
 export declare const ENVIRONMENT_VAR = "ENVIRONMENT";
+/**
+ * The var naming where a deployed Worker answers — `https://<host>`, no path, no trailing slash.
+ *
+ * Generated, never hand-set: `pithy worker sync` writes it from a declared domain, and `pithy provision
+ * --feature` writes a feature's from its `workers.dev` address (#643). It is the one statement of a feature's
+ * origin a running Worker can read, because the account's `workers.dev` subdomain is something only the
+ * Cloudflare API knows, and a Worker has no business calling it at module scope.
+ */
+export declare const BASE_URL_VAR = "BASE_URL";
 /**
  * The var carrying a Worker's **own** dev origin, from `pithy dev` to whatever launches that Worker.
  *

package/dist/worker/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/worker/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qFAAqF;AACrF,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,2FAA2F;AAC3F,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAW3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAazE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEzD"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/worker/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qFAAqF;AACrF,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,2FAA2F;AAC3F,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,WAAW,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAW3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAazE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEzD"}

package/dist/worker/identity.js

@@ -26,6 +26,15 @@ const PROJECT_VAR = "PROJECT";
 /** The var naming the environment this deployment serves — `dev`, `staging`, or `prod`. */
 const ENVIRONMENT_VAR = "ENVIRONMENT";
 /**
+* The var naming where a deployed Worker answers — `https://<host>`, no path, no trailing slash.
+*
+* Generated, never hand-set: `pithy worker sync` writes it from a declared domain, and `pithy provision
+* --feature` writes a feature's from its `workers.dev` address (#643). It is the one statement of a feature's
+* origin a running Worker can read, because the account's `workers.dev` subdomain is something only the
+* Cloudflare API knows, and a Worker has no business calling it at module scope.
+*/
+const BASE_URL_VAR = "BASE_URL";
+/**
 * The var carrying a Worker's **own** dev origin, from `pithy dev` to whatever launches that Worker.
 *
 * Not stamped into `wrangler.jsonc` like the three above, and that is the whole point of it. A dev port
@@ -175,4 +184,4 @@ function workerVersion(env) {
 	return workerVersionMetadata(env).id;
 }
 //#endregion
-export { ENVIRONMENT_VAR, PROJECT_VAR, SELF_BINDING, VERSION_METADATA_BINDING, WORKER_ORIGIN_VAR, WORKER_VAR, workerIdentity, workerVersion, workerVersionMetadata };
+export { BASE_URL_VAR, ENVIRONMENT_VAR, PROJECT_VAR, SELF_BINDING, VERSION_METADATA_BINDING, WORKER_ORIGIN_VAR, WORKER_VAR, workerIdentity, workerVersion, workerVersionMetadata };

package/dist/workflow/host.d.ts

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import type { FeatureIdentity } from "../naming/feature";
 import { type WorkflowHostNameParts } from "./naming";
 import type { WorkflowRegistry } from "./spec";
 /**
@@ -106,6 +107,12 @@ export interface WorkflowHostParams {
     capability: string;
     /** The target environment (`dev` | `staging` | `production`). */
     env: string;
+    /**
+     * The feature this host serves, when it serves one (#643). Its name then takes the feature's head —
+     * `<project>-f<issue>-<slug>-<capability>` — as the Workflows derived with the same parts do; `env` still
+     * says `feature`, and that is what the host's `ENVIRONMENT` var is stamped with.
+     */
+    feature?: FeatureIdentity;
     /** D1 binding name → database id. An unlisted binding keeps the template's id. */
     databaseIds?: Record<string, string>;
     /**

package/dist/workflow/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/workflow/host.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,qBAAqB,EAAwC,MAAM,UAAU,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kGAAkG;AAClG,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qCAAqC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CA2FpH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,qBAAqB,GAC3B;IAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBvD"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/workflow/host.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,KAAK,qBAAqB,EAAwC,MAAM,UAAU,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,4GAA4G;AAC5G,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kGAAkG;AAClG,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAClD,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qCAAqC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,iGAAiG;IACjG,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CAgGpH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,qBAAqB,GAC3B;IAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAsBvD"}

package/dist/workflow/host.js

@@ -31,7 +31,8 @@ function resolveWorkflowHost(template, params) {
 	resolved.name = workflowHostName({
 		project: params.project,
 		capability: params.capability,
-		env: params.env
+		env: params.env,
+		...params.feature ? { feature: params.feature } : {}
 	});
 	if (resolved.d1_databases) resolved.d1_databases = resolved.d1_databases.map((entry) => ({
 		...entry,
@@ -91,7 +92,7 @@ function resolveWorkflowHost(template, params) {
 * `className` cannot be hosted: there would be no class for wrangler to instantiate.
 */
 function hostWorkflowsFor(registry, parts) {
-	const { project, capability, env } = parts;
+	const { project, capability, env, feature } = parts;
 	const owned = Object.values(registry).filter((entry) => entry.capability === capability);
 	const workflows = [];
 	const crons = [];
@@ -106,7 +107,8 @@ function hostWorkflowsFor(registry, parts) {
 				project,
 				capability,
 				job: entry.job,
-				env
+				env,
+				...feature ? { feature } : {}
 			}),
 			class_name: entry.spec.className
 		});

package/dist/workflow/naming.d.ts

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { type FeatureIdentity } from "../naming/feature";
 /**
  * Every name a durable job answers to, in one module. The CLI writes these into a host worker's
  * resolved `wrangler.jsonc`, the provisioner deploys under them, and the dispatcher resolves
@@ -43,6 +44,13 @@ export interface WorkflowHostNameParts {
     capability: string;
     /** The deployment environment (e.g. `staging`). */
     env: string;
+    /**
+     * **The feature this deployment is, when it is one (#643).** A feature's host Worker and Workflows take the
+     * feature's head — `<project>-f<issue>-<slug>-…` — not `<project>-feature-…`, which every open branch would
+     * share: Worker and Workflow names are account-wide, so a second branch's deploy would replace the first's.
+     * `env` stays `feature`, which is what the host's `ENVIRONMENT` var says; only the names change.
+     */
+    feature?: FeatureIdentity;
 }
 /** The identity of one durable job's Workflow in one environment. */
 export interface WorkflowScriptNameParts extends WorkflowHostNameParts {

package/dist/workflow/naming.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/workflow/naming.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,IAAsC,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,IAAoC,CAAC;AAmEvE,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,gHAAgH;IAChH,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAKzE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAGrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAInE"}
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/workflow/naming.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAA0C,MAAM,mBAAmB,CAAC;AAKjG;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,IAAsC,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,IAAoC,CAAC;AAkFvE,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,gHAAgH;IAChH,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAMzE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAIrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAInE"}

package/dist/workflow/naming.js

@@ -4,6 +4,7 @@ import { InternalError } from "../error/pithyError.js";
 import { NAME_SEGMENT } from "../naming/segment.js";
 import { NAMESPACE_LIMITS } from "../naming/limits.js";
 import { assertValidProjectName, kebab } from "../naming/resource.js";
+import { featureWorkerName, featureWorkflowName } from "../naming/feature.js";
 //#region src/workflow/naming.ts
 /**
 * Every name a durable job answers to, in one module. The CLI writes these into a host worker's
@@ -96,6 +97,18 @@ function head(project, env) {
 	return `${kebab(project)}-${env}`;
 }
 /**
+* The feature a name is composed for, held to the project the parts name — two projects in one set of parts is
+* a name composed for somebody else's feature.
+*/
+function featureOf(parts) {
+	const feature = parts.feature;
+	if (feature.project !== parts.project) throw new InternalError({
+		message: "A feature's Workflow name was asked for with two different projects.",
+		detail: `parts name project "${parts.project}" and a feature of project "${feature.project}".`
+	});
+	return feature;
+}
+/**
 * The deployed name of one job's Workflow in one environment — `<project>-<env>-<capability>-<job>`,
 * e.g. `acme-staging-media-image-to-text`. This is what the CLI writes as the `name` of a
 * `workflows` entry, and what `CloudflareWorkflowsClient` addresses when triggering from outside
@@ -109,6 +122,7 @@ function workflowScriptName(parts) {
 	assertSegment(parts.capability, "capability");
 	assertSegment(parts.job, "job");
 	assertCapabilityJob(parts.capability, parts.job);
+	if (parts.feature) return featureWorkflowName(featureOf(parts), parts.capability, parts.job);
 	return assertLength(`${head(parts.project, parts.env)}-${parts.capability}-${parts.job}`, MAX_WORKFLOW_NAME_BYTES);
 }
 /**
@@ -120,6 +134,7 @@ function workflowScriptName(parts) {
 */
 function workflowHostName(parts) {
 	assertSegment(parts.capability, "capability");
+	if (parts.feature) return featureWorkerName(featureOf(parts), parts.capability);
 	return assertLength(`${head(parts.project, parts.env)}-${parts.capability}`, MAX_WORKER_NAME_BYTES);
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/capability/capability.ts

@@ -483,6 +483,28 @@ export interface Capability<
    * question.
    */
   version?: string | null;
+  /**
+   * The npm **package** that supplies this capability, or `null` where there is none.
+   *
+   * The join key {@link Capability.version} is useless without. A version joins against a release feed
+   * by package name, and this manifest reported the version alone until #626 — so a client had to guess
+   * `@pithy-sh/${name}`, which is right for most capabilities and wrong for the one that matters:
+   * `controlplane` ships inside `@pithy-sh/core`, so the guess reaches a package that has never been
+   * published and the join comes back empty, which is indistinguishable from "up to date".
+   *
+   * **A capability name and a package name are different kinds of thing.** One is what a composition
+   * calls a concept; the other is how that concept is distributed. A package may ship more than one
+   * capability — `core` already ships `controlplane` — so no convention makes the second derivable from
+   * the first, and the relationship is a fact only the producing package knows. Which is why **the
+   * framework never fills this in from `name`**: deriving it here would re-create the bug inside the fix.
+   *
+   * Every `@pithy-sh/*` capability sets it from its generated `PACKAGE_NAME` constant
+   * (`scripts/stampVersions.ts`), beside the version off the same stamp. **Nullable for the same reason
+   * `version` is**, and null in the same breath: the adopter's own `app` capability has a name, no
+   * package and no version. Neither alone is a state worth having — a package with no version says
+   * nothing joinable, and a version with no package is the defect this field closes.
+   */
+  package?: string | null;
   /**
    * Optional startup hook, called once when {@link createBackend} assembles the backend, with every
    * composed capability. Runs after binding and `dependsOn` validation, before middleware and routes

package/src/controlPlane/capability.ts

@@ -7,7 +7,7 @@ import type { BindingSpecInput } from "../capability/bindings";
 import { type Capability, defineCapability, type PithyHonoEnv } from "../capability/capability";
 import type { DatabaseSpecMap } from "../data/databases";
 import type { KvNamespaceSpecMap, KvRegistry } from "../kv/namespaces";
-import { PACKAGE_VERSION } from "../version.generated";
+import { PACKAGE_NAME, PACKAGE_VERSION } from "../version.generated";
 import { ENVIRONMENT_VAR } from "../worker/identity";
 import { ControlPlaneConfig, type ControlPlaneConfigInput } from "./config/config";
 import { ControlPlaneConnection } from "./data/connection";
@@ -138,6 +138,12 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
     // package.json. The seam reports itself in the manifest beside every other composed capability, so a
     // client can see which core an adopter is on without a separate question.
     version: PACKAGE_VERSION,
+    // And the package that version belongs to — **the case no naming convention survives** (#626). This
+    // capability is called `controlplane` and ships inside `@pithy-sh/core`, so a client deriving
+    // `@pithy-sh/${name}` asks a release feed about a package that has never been published and is told
+    // nothing, which reads as up to date. Stamped from this package's own `package.json`, like the
+    // version above, because only the producing package knows which one it is.
+    package: PACKAGE_NAME,
     // No `dependsOn`. The seam must work in a Worker composing neither auth nor audit nor secrets: it
     // holds no secret, mints no session, and emits through a seam that is a no-op when absent.
     requiredBindings,
@@ -166,6 +172,10 @@ export function controlplane(options: ControlPlaneOptions = {}): ControlPlaneCap
         // `?? null`, never undefined: the adopter's own `app` capability has a name and no package
         // version, and that must render as an explicit null rather than vanish from the JSON.
         version: cap.version ?? null,
+        // The join key that version is worth nothing without (#626), **read off the capability and never
+        // derived from its name here**. `@pithy-sh/${cap.name}` would be right for most of them and
+        // wrong for the seam writing this line — which is the whole defect, rebuilt inside its fix.
+        package: cap.package ?? null,
         adminRoutes: [...(cap.adminRoutes ?? [])],
         // The vocabulary, always — a capability declaring a number this connection cannot see must be
         // visible as a withheld number rather than as silence.

package/src/controlPlane/discovery/adminRoute.ts

@@ -71,7 +71,17 @@ export const CapabilityDeclaration = z
       .string()
       .nullable()
       .describe(
-        "The npm version of the package supplying this capability, or null where there is none — the adopter's own `app` capability has a name and no package. Reported per capability and never aggregated: the package name is the join key against a release feed, and a project composes some capabilities and not others, so only the intersection of what it composes and what changed is worth reporting.",
+        "The npm version of the package supplying this capability, or null where there is none — the adopter's own `app` capability has a name and no package. Reported per capability and never aggregated: a project composes some capabilities and not others, so only the intersection of what it composes and what changed is worth reporting. Joined against a release feed on the `package` beside it, never on `name` — the two are different kinds of thing.",
+      ),
+    // **Defaulted, like every field added after the first manifest shipped**, and for the reason written
+    // out below against `healthKeys`: a Worker deployed before #626 sends no package, and a required
+    // field would cost that client the whole manifest rather than the one key it did not get.
+    package: z
+      .string()
+      .nullable()
+      .default(null)
+      .describe(
+        "The npm package supplying this capability — the join key against a release feed — or null where there is none, which is the adopter's own `app` capability and a Worker that predates this field. **Never derivable from `name`:** `controlplane` ships inside `@pithy-sh/core`, so a name-derived `@pithy-sh/<name>` reaches a package that has never been published and the join comes back empty, which reads exactly like up to date. Null together with `version`: a package with no version says nothing joinable, and a version with no package is the reason this field exists.",
       ),
     adminRoutes: z
       .array(AdminRoute)
@@ -103,7 +113,7 @@ export const CapabilityDeclaration = z
     ),
   })
   .describe(
-    "One capability this Worker composes, the version it is at, the admin surface it exposes, the summary it may report, and the configured facts a client must respect to call any of it.",
+    "One capability this Worker composes, the package and version it is at, the admin surface it exposes, the summary it may report, and the configured facts a client must respect to call any of it.",
   );
 export type CapabilityDeclaration = z.infer<typeof CapabilityDeclaration>;
 
@@ -163,8 +173,13 @@ export const CapabilityDescriptor = z
     // Both fields, from the one value, in the one place. A handler cannot write the numbers and forget
     // the flag, which is what makes `encode(decode(entry))` the entry again — the property the seam's
     // response contract test rests on.
-    encode: ({ health, healthKeys, configKeys, config, ...declaration }) => ({
+    encode: ({ health, healthKeys, configKeys, config, package: suppliedBy, ...declaration }) => ({
       ...declaration,
+      // The package, explicitly, for the same reason the two below are explicit: it is defaulted, so it
+      // is optional on the way in and required on the way out, and absence and null mean the one thing —
+      // this capability comes from no npm package, which is the adopter's own app capability. Renamed on
+      // the way past because `package` is a reserved word and cannot be a binding name.
+      package: suppliedBy ?? null,
       // Every defaulted field is optional on the way back out, and empty is the meaning absence already
       // had: a capability that declares no summary, and one that states no configured fact.
       //
@@ -198,6 +213,11 @@ export type CapabilityDescriptor = z.infer<typeof CapabilityDescriptor>;
  * now — so a capability that changed its paths or its scopes reports the change directly, and a schema
  * version would be a second source of truth to keep in sync with the first. That reasoning is unchanged.
  *
+ * **And `capabilities[].version` travels with the package it belongs to** (#626). A version is only
+ * actionable joined against a release feed, a feed is keyed by package name, and a capability name is
+ * not one — `controlplane` ships inside `@pithy-sh/core`. Reporting the version alone left every client
+ * guessing the key, and the guess failed silently on the most frequently released package there is.
+ *
  * What the manifest does carry is **identity**, not schema, and it carries two of them because they
  * answer questions neither can answer alone. `version` is Cloudflare's opaque per-deploy id: it says
  * *exactly which build* is running, which is what forensics needs, what reproduces a report, and what

package/src/naming/domains.ts

@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: MIT
 
 import { z } from "zod";
-import { ENVIRONMENTS } from "./environment";
+import { type AmbientEnv, ambientEnv } from "../env/ambient";
+import { BASE_URL_VAR } from "../worker/identity";
+import { ENVIRONMENTS, FEATURE_ENVIRONMENT } from "./environment";
 
 /**
  * Where a Worker answers, declared once per Worker per environment.
@@ -39,6 +41,18 @@ import { ENVIRONMENTS } from "./environment";
 /** A hostname a Worker answers on. No scheme, no path, no port — wrangler's `routes` pattern is a host. */
 const HOSTNAME_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/;
 
+/**
+ * Whether a string is a public hostname: dot-separated DNS labels, at least two, lowercase. No scheme, no
+ * port, no trailing dot, and nothing a URL parser decoded into one — `%2e%2e` is `..` once parsed, which is an
+ * empty label rather than a host (#643). `localhost` is not one: it has a single label, and it is this machine.
+ *
+ * The one test for "is this a host" that an origin read from a stamp and an origin typed on a command line
+ * both pass, so the two cannot accept different things.
+ */
+export function isPublicHostname(hostname: string): boolean {
+  return hostname.length <= 253 && HOSTNAME_PATTERN.test(hostname);
+}
+
 /** The environments a domain may be declared for — every managed one, never `dev`. */
 export const DOMAIN_ENVIRONMENTS = ENVIRONMENTS.filter((environment) => environment !== "dev");
 
@@ -135,10 +149,46 @@ export interface ResolvedOrigin {
   origin: string;
   /** The hostname alone: a route pattern, and what Turnstile binds a widget to. */
   hostname: string;
-  /** Whether `domains` declared it. `false` means {@link LOCAL_ORIGIN} was substituted. */
+  /**
+   * Whether `domains` declared it. `false` means {@link LOCAL_ORIGIN} was substituted, or — for a feature
+   * environment only — that the address is the `workers.dev` one provisioning stamped ({@link featureOrigin}).
+   */
   declared: boolean;
 }
 
+/**
+ * **A feature environment's origin: the `workers.dev` address provisioning stamped, or null (#643).**
+ *
+ * A feature Worker answers on `https://<script>.<account subdomain>.workers.dev`. Nothing can declare that —
+ * `domains` has no feature key, because a branch's hostname is composed from the branch — and the Worker cannot
+ * derive it either, because the subdomain is the account's and only the Cloudflare API knows it. So `pithy
+ * provision --feature` derives it, through the CLI's one address resolver, and stamps it as the feature
+ * stanza's {@link BASE_URL_VAR}. This is the one reader of that stamp.
+ *
+ * **Only a `workers.dev` https origin is accepted, and that is the guard rather than a tidiness check.** A
+ * feature stanza is generated from the Worker's top level, so a `BASE_URL` somebody set by hand up there
+ * arrives in the feature too — and it is another environment's origin, most likely production's. Honoring it
+ * would send a branch's magic links into production, which is the one thing {@link resolveOrigin} exists to
+ * make impossible. A feature's address is `workers.dev` by construction, so anything else is not one and
+ * resolves to nothing. No path, no port, no credentials: an origin, or null.
+ */
+export function featureOrigin(stamped: string | undefined): { origin: string; hostname: string } | null {
+  if (!stamped) return null;
+  let url: URL;
+  try {
+    url = new URL(stamped);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.port !== "" || url.username !== "" || url.password !== "") return null;
+  if (url.pathname !== "/" || url.search !== "" || url.hash !== "") return null;
+  // A script name and an account subdomain, at least: `workers.dev` alone, or `<sub>.workers.dev`, is not a Worker.
+  if (!url.hostname.endsWith(".workers.dev") || url.hostname.split(".").length < 4) return null;
+  // Every label a DNS label: the parser decodes `%2e%2e` into `..`, which ends in `.workers.dev` and is no host.
+  if (!isPublicHostname(url.hostname)) return null;
+  return { origin: url.origin, hostname: url.hostname };
+}
+
 /**
  * **Where is this Worker publicly reachable, in this environment?** — asked once, answered once.
  *
@@ -164,10 +214,21 @@ export interface ResolvedOrigin {
  * checks that stored value, so a per-environment issuer would make a connection minted in staging
  * unverifiable in production. That may be the better isolation, but it is a decision about trust rather
  * than about reachability, and a helper whose job is "where am I reachable" must not sweep it up.
+ *
+ * **`stamped` is a feature environment's `BASE_URL`, and is read for nothing else** — see {@link featureOrigin}.
  */
-export function resolveOrigin(environment: string | undefined, domains: WorkerDomains | undefined): ResolvedOrigin {
+export function resolveOrigin(
+  environment: string | undefined,
+  domains: WorkerDomains | undefined,
+  stamped?: string | undefined,
+): ResolvedOrigin {
   const domain = domainFor(domains, environment);
   if (domain) return { origin: baseUrlFor(domain), hostname: domain.pattern, declared: true };
+  // A feature environment, and only a feature environment, reads the address provisioning stamped. Every other
+  // environment ignores `stamped` outright: a declared one without a domain is unpublished, and `dev` resolves
+  // its address from the request.
+  const feature = environment === FEATURE_ENVIRONMENT ? featureOrigin(stamped) : null;
+  if (feature) return { ...feature, declared: false };
   return { origin: LOCAL_ORIGIN, hostname: "localhost", declared: false };
 }
 
@@ -188,7 +249,16 @@ export function resolveOrigin(environment: string | undefined, domains: WorkerDo
  * `AUTH_BASE_URL`, which is part of why `email` and `payments` were missed for days: the constant read
  * as auth's private business when it is the Worker's address, and every capability that needs an origin
  * needs this one.
+ *
+ * **A feature deployment is answered from its own vars (#643).** `env` is the ambient environment — inside a
+ * Worker, its own vars — and it is read for one thing: the `BASE_URL` a feature's provisioning stamped. So the
+ * same scaffolded line gives auth's base URL, email's links and payments' return URLs a feature's real
+ * `workers.dev` origin, rather than `http://localhost`, with nothing added to the adopter's config.
  */
-export function originFor(environment: string | undefined, domains: WorkerDomains | undefined): string {
-  return resolveOrigin(environment, domains).origin;
+export function originFor(
+  environment: string | undefined,
+  domains: WorkerDomains | undefined,
+  env: AmbientEnv = ambientEnv(),
+): string {
+  return resolveOrigin(environment, domains, env[BASE_URL_VAR]).origin;
 }