@pithy-sh/core 0.7.3 → 0.8.0

package/dist/naming/domains.d.ts

@@ -1,6 +1,16 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { z } from "zod";
+import { type AmbientEnv } from "../env/ambient";
+/**
+ * Whether a string is a public hostname: dot-separated DNS labels, at least two, lowercase. No scheme, no
+ * port, no trailing dot, and nothing a URL parser decoded into one — `%2e%2e` is `..` once parsed, which is an
+ * empty label rather than a host (#643). `localhost` is not one: it has a single label, and it is this machine.
+ *
+ * The one test for "is this a host" that an origin read from a stamp and an origin typed on a command line
+ * both pass, so the two cannot accept different things.
+ */
+export declare function isPublicHostname(hostname: string): boolean;
 /** The environments a domain may be declared for — every managed one, never `dev`. */
 export declare const DOMAIN_ENVIRONMENTS: ("prod" | "staging")[];
 /** One environment's public address for one Worker. */
@@ -58,9 +68,32 @@ export interface ResolvedOrigin {
     origin: string;
     /** The hostname alone: a route pattern, and what Turnstile binds a widget to. */
     hostname: string;
-    /** Whether `domains` declared it. `false` means {@link LOCAL_ORIGIN} was substituted. */
+    /**
+     * Whether `domains` declared it. `false` means {@link LOCAL_ORIGIN} was substituted, or — for a feature
+     * environment only — that the address is the `workers.dev` one provisioning stamped ({@link featureOrigin}).
+     */
     declared: boolean;
 }
+/**
+ * **A feature environment's origin: the `workers.dev` address provisioning stamped, or null (#643).**
+ *
+ * A feature Worker answers on `https://<script>.<account subdomain>.workers.dev`. Nothing can declare that —
+ * `domains` has no feature key, because a branch's hostname is composed from the branch — and the Worker cannot
+ * derive it either, because the subdomain is the account's and only the Cloudflare API knows it. So `pithy
+ * provision --feature` derives it, through the CLI's one address resolver, and stamps it as the feature
+ * stanza's {@link BASE_URL_VAR}. This is the one reader of that stamp.
+ *
+ * **Only a `workers.dev` https origin is accepted, and that is the guard rather than a tidiness check.** A
+ * feature stanza is generated from the Worker's top level, so a `BASE_URL` somebody set by hand up there
+ * arrives in the feature too — and it is another environment's origin, most likely production's. Honoring it
+ * would send a branch's magic links into production, which is the one thing {@link resolveOrigin} exists to
+ * make impossible. A feature's address is `workers.dev` by construction, so anything else is not one and
+ * resolves to nothing. No path, no port, no credentials: an origin, or null.
+ */
+export declare function featureOrigin(stamped: string | undefined): {
+    origin: string;
+    hostname: string;
+} | null;
 /**
  * **Where is this Worker publicly reachable, in this environment?** — asked once, answered once.
  *
@@ -86,8 +119,10 @@ export interface ResolvedOrigin {
  * checks that stored value, so a per-environment issuer would make a connection minted in staging
  * unverifiable in production. That may be the better isolation, but it is a decision about trust rather
  * than about reachability, and a helper whose job is "where am I reachable" must not sweep it up.
+ *
+ * **`stamped` is a feature environment's `BASE_URL`, and is read for nothing else** — see {@link featureOrigin}.
  */
-export declare function resolveOrigin(environment: string | undefined, domains: WorkerDomains | undefined): ResolvedOrigin;
+export declare function resolveOrigin(environment: string | undefined, domains: WorkerDomains | undefined, stamped?: string | undefined): ResolvedOrigin;
 /**
  * The one line an adopter writes: this Worker's public origin for the environment it is running in.
  *
@@ -105,6 +140,11 @@ export declare function resolveOrigin(environment: string | undefined, domains:
  * `AUTH_BASE_URL`, which is part of why `email` and `payments` were missed for days: the constant read
  * as auth's private business when it is the Worker's address, and every capability that needs an origin
  * needs this one.
+ *
+ * **A feature deployment is answered from its own vars (#643).** `env` is the ambient environment — inside a
+ * Worker, its own vars — and it is read for one thing: the `BASE_URL` a feature's provisioning stamped. So the
+ * same scaffolded line gives auth's base URL, email's links and payments' return URLs a feature's real
+ * `workers.dev` origin, rather than `http://localhost`, with nothing added to the adopter's config.
  */
-export declare function originFor(environment: string | undefined, domains: WorkerDomains | undefined): string;
+export declare function originFor(environment: string | undefined, domains: WorkerDomains | undefined, env?: AmbientEnv): string;
 //# sourceMappingURL=domains.d.ts.map

package/dist/naming/domains.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/naming/domains.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsCxB,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,wBAA8D,CAAC;AAE/F,uDAAuD;AACvD,eAAO,MAAM,YAAY;;;iBA+BrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAOvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAKlH;AAED,gHAAgH;AAChH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,cAAc,CAIjH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAErG"}
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/naming/domains.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,gBAAgB,CAAC;AAuC7D;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,wBAA8D,CAAC;AAE/F,uDAAuD;AACvD,eAAO,MAAM,YAAY;;;iBA+BrB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;iBAOvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAKlH;AAED,gHAAgH;AAChH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAetG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,GAC3B,cAAc,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CACvB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,GAAG,GAAE,UAAyB,GAC7B,MAAM,CAER"}

package/dist/naming/domains.js

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { ENVIRONMENTS } from "./environment.js";
+import { BASE_URL_VAR } from "../worker/identity.js";
+import { ambientEnv } from "../env/ambient.js";
 import { z } from "zod";
 //#region src/naming/domains.ts
 /**
@@ -36,6 +38,17 @@ import { z } from "zod";
 */
 /** A hostname a Worker answers on. No scheme, no path, no port — wrangler's `routes` pattern is a host. */
 const HOSTNAME_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/;
+/**
+* Whether a string is a public hostname: dot-separated DNS labels, at least two, lowercase. No scheme, no
+* port, no trailing dot, and nothing a URL parser decoded into one — `%2e%2e` is `..` once parsed, which is an
+* empty label rather than a host (#643). `localhost` is not one: it has a single label, and it is this machine.
+*
+* The one test for "is this a host" that an origin read from a stamp and an origin typed on a command line
+* both pass, so the two cannot accept different things.
+*/
+function isPublicHostname(hostname) {
+	return hostname.length <= 253 && HOSTNAME_PATTERN.test(hostname);
+}
 /** The environments a domain may be declared for — every managed one, never `dev`. */
 const DOMAIN_ENVIRONMENTS = ENVIRONMENTS.filter((environment) => environment !== "dev");
 /** One environment's public address for one Worker. */
@@ -95,6 +108,39 @@ function baseUrlFor(domain) {
 */
 const LOCAL_ORIGIN = "http://localhost";
 /**
+* **A feature environment's origin: the `workers.dev` address provisioning stamped, or null (#643).**
+*
+* A feature Worker answers on `https://<script>.<account subdomain>.workers.dev`. Nothing can declare that —
+* `domains` has no feature key, because a branch's hostname is composed from the branch — and the Worker cannot
+* derive it either, because the subdomain is the account's and only the Cloudflare API knows it. So `pithy
+* provision --feature` derives it, through the CLI's one address resolver, and stamps it as the feature
+* stanza's {@link BASE_URL_VAR}. This is the one reader of that stamp.
+*
+* **Only a `workers.dev` https origin is accepted, and that is the guard rather than a tidiness check.** A
+* feature stanza is generated from the Worker's top level, so a `BASE_URL` somebody set by hand up there
+* arrives in the feature too — and it is another environment's origin, most likely production's. Honoring it
+* would send a branch's magic links into production, which is the one thing {@link resolveOrigin} exists to
+* make impossible. A feature's address is `workers.dev` by construction, so anything else is not one and
+* resolves to nothing. No path, no port, no credentials: an origin, or null.
+*/
+function featureOrigin(stamped) {
+	if (!stamped) return null;
+	let url;
+	try {
+		url = new URL(stamped);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "https:" || url.port !== "" || url.username !== "" || url.password !== "") return null;
+	if (url.pathname !== "/" || url.search !== "" || url.hash !== "") return null;
+	if (!url.hostname.endsWith(".workers.dev") || url.hostname.split(".").length < 4) return null;
+	if (!isPublicHostname(url.hostname)) return null;
+	return {
+		origin: url.origin,
+		hostname: url.hostname
+	};
+}
+/**
 * **Where is this Worker publicly reachable, in this environment?** — asked once, answered once.
 *
 * The two halves already existed ({@link domainFor} and {@link baseUrlFor}) and nothing composed them,
@@ -119,14 +165,21 @@ const LOCAL_ORIGIN = "http://localhost";
 * checks that stored value, so a per-environment issuer would make a connection minted in staging
 * unverifiable in production. That may be the better isolation, but it is a decision about trust rather
 * than about reachability, and a helper whose job is "where am I reachable" must not sweep it up.
+*
+* **`stamped` is a feature environment's `BASE_URL`, and is read for nothing else** — see {@link featureOrigin}.
 */
-function resolveOrigin(environment, domains) {
+function resolveOrigin(environment, domains, stamped) {
 	const domain = domainFor(domains, environment);
 	if (domain) return {
 		origin: baseUrlFor(domain),
 		hostname: domain.pattern,
 		declared: true
 	};
+	const feature = environment === "feature" ? featureOrigin(stamped) : null;
+	if (feature) return {
+		...feature,
+		declared: false
+	};
 	return {
 		origin: LOCAL_ORIGIN,
 		hostname: "localhost",
@@ -150,9 +203,14 @@ function resolveOrigin(environment, domains) {
 * `AUTH_BASE_URL`, which is part of why `email` and `payments` were missed for days: the constant read
 * as auth's private business when it is the Worker's address, and every capability that needs an origin
 * needs this one.
+*
+* **A feature deployment is answered from its own vars (#643).** `env` is the ambient environment — inside a
+* Worker, its own vars — and it is read for one thing: the `BASE_URL` a feature's provisioning stamped. So the
+* same scaffolded line gives auth's base URL, email's links and payments' return URLs a feature's real
+* `workers.dev` origin, rather than `http://localhost`, with nothing added to the adopter's config.
 */
-function originFor(environment, domains) {
-	return resolveOrigin(environment, domains).origin;
+function originFor(environment, domains, env = ambientEnv()) {
+	return resolveOrigin(environment, domains, env[BASE_URL_VAR]).origin;
 }
 //#endregion
-export { DOMAIN_ENVIRONMENTS, LOCAL_ORIGIN, WorkerDomain, WorkerDomains, baseUrlFor, domainFor, originFor, resolveOrigin };
+export { DOMAIN_ENVIRONMENTS, LOCAL_ORIGIN, WorkerDomain, WorkerDomains, baseUrlFor, domainFor, featureOrigin, isPublicHostname, originFor, resolveOrigin };

package/dist/naming/feature.d.ts

@@ -1,8 +1,15 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 /**
- * The names a feature environment provisions under: `<project>-f<issue>-<slug>-<binding>-<kind>` for a
- * resource, `<project>-f<issue>-<slug>-<worker>` for a Worker script.
+ * The names a feature environment provisions under: `<project>-f<issue>-<slug>--<binding>-<kind>` for a
+ * resource, `<project>-f<issue>-<slug>--<worker>` for a Worker script.
+ *
+ * **Two hyphens after the slug, and a project with no `f<digits>` segment (#643).** Together they make every
+ * feature name parse back to exactly one (project, issue, slug): the double hyphen is something no other name
+ * Pithy composes can hold ({@link FEATURE_TAIL_SEPARATOR}), and the first `f<digits>` segment is the issue's,
+ * because the project may carry none ({@link assertFeatureProject}). Before them, project `acme-f12-x`'s `prod`
+ * and project `acme`'s branch `feature/12-x-prod` composed every name between them, and a branch whose slug
+ * was a hyphen-prefix of a sibling's could compose the sibling's database. See {@link parseFeatureName}.
  *
  * **No environment segment, and no Worker segment.** A feature *is* an environment, and two Workers that
  * declare the same binding are meant to share one resource — so the binding name, not the topology, is
@@ -10,9 +17,12 @@
  *
  * Every name here is **derived and recomputed**, never stored: `provision` and `destroy` both compute the
  * same string from `(identity, binding, kind)`, which is what lets teardown reconcile exactly rather than
- * scan a prefix a hyphenated sibling slug could ambiguously match. That is also why these names
- * **truncate** where a capability's Workflow refuses: a feature name addresses nothing that outlives the
- * feature, and failing a CI run because a branch slug was long would be the worse failure.
+ * scan a prefix a hyphenated sibling slug could ambiguously match.
+ *
+ * **Never truncated (#643).** These names used to fit a long slug with a hash, on the reasoning that a feature
+ * name addresses nothing that outlives the feature. But a short hash is a slug some sibling branch can have
+ * whole, so a fitted name was a name two features could compose. A slug that does not fit is refused instead,
+ * naming the maximum ({@link assertFeatureSlugFits}), and every feature name is exactly its feature's.
  *
  * It lives in `core`, beside the rest of the naming rule, so the CLI and the facade compose one
  * implementation rather than two that drift.
@@ -31,7 +41,92 @@ export interface FeatureIdentity {
     slug: string;
 }
 /**
- * The full Cloudflare resource name for a feature's binding — `<project>-f<issue>-<slug>-<binding>-<kind>`.
+ * **The issue as a name carries it: its digits, without leading zeros (#643).** `feature/0643-foo` and
+ * `feature/643-foo` are one issue, so they are one feature and compose one set of names. Read as strings they
+ * were two features, and their rate-limit namespaces collided every time. `0` stays `0`.
+ */
+export declare function canonicalIssue(issue: string): string;
+/**
+ * The `f<digits>` segment a project name carries, or `null` — the shape a feature's issue takes (#643).
+ *
+ * Read after kebabbing, because the kebab is what reaches an account.
+ */
+export declare function featureMarkerInProjectName(project: string): string | null;
+/**
+ * **Refuse features for a project whose name carries an `f<digits>` segment (#643).**
+ *
+ * A feature name is read left to right: the project, then the first `f<digits>` segment, which is the issue.
+ * A project named `acme-f12-x` puts that segment inside itself, and then its feature 3 on `y` and project `acme`'s
+ * feature 12 on `x-f3-y` are one string. Environment names already obey this rule ({@link isFeatureMarker}), so
+ * the project obeys it too, where the two shapes meet.
+ *
+ * **Refused here, not at `requireProjectName`.** Such a project's staging and prod are untouched: no name they
+ * compose holds {@link FEATURE_TAIL_SEPARATOR}, so no feature anywhere can compose one of theirs. Refusing the
+ * name everywhere would break every command of a project that is otherwise sound. `pithy init` refuses a new one,
+ * and `pithy doctor` names the segment an existing one carries. Nothing is renamed.
+ */
+export declare function assertFeatureProject(project: string): void;
+/** A feature name, read back: which project, issue and slug it belongs to, and what it names. */
+export interface ParsedFeatureName {
+    /** The project segment, kebabbed. */
+    project: string;
+    /** The issue, canonical. */
+    issue: string;
+    /** The slug segment: the whole slug, since no feature name is truncated. */
+    slug: string;
+    /** Everything after {@link FEATURE_TAIL_SEPARATOR}: the binding and kind, Worker, Workflow or entry. */
+    thing: string;
+}
+/**
+ * **Read a feature name back into its owner, or `null` when it is not one (#643).**
+ *
+ * Exact, because the shape leaves one reading: a feature name holds {@link FEATURE_TAIL_SEPARATOR} exactly once,
+ * everything before it is `<project>-f<issue>-<slug>`, and the first `f<digits>` segment there is the issue,
+ * since a project may carry none. Nothing else Pithy composes holds the separator at all.
+ */
+export declare function parseFeatureName(name: string): ParsedFeatureName | null;
+/**
+ * **Is this name one this feature composes?** The ownership check the isolation gates ask (#643).
+ *
+ * Parsed, never prefix-matched, and exact: the name's project, issue and slug are this feature's, character for
+ * character. `<project>-f<issue>-` is shared by every branch of one issue, so a prefix match reached siblings; and
+ * a fitted form of the slug, which this used to accept, is a short hash some sibling can have as its whole slug
+ * (`feature/12-login` owned `feature/12-c`). No feature name is fitted any more ({@link composeFeatureName}), so
+ * there is nothing but the slug itself to accept.
+ */
+export declare function isFeatureOwnedName(identity: FeatureIdentity, name: string): boolean;
+/** A feature's project and issue: everything its names are derived from but the slug. */
+export type FeatureHead = Pick<FeatureIdentity, "project" | "issue">;
+/**
+ * **The longest slug one feature name leaves room for** — `limit` less `<project>-f<issue>-`, the
+ * {@link FEATURE_TAIL_SEPARATOR}, and `thing`, which is everything after it. Zero or less when `thing` leaves none.
+ */
+export declare function featureSlugRoom(parts: FeatureHead, thing: string, limit: number): number;
+/** One kind of name a feature composes, as far as its slug budget reads it. */
+export interface FeatureNameShape {
+    /** How an error names the namespace, e.g. `a Workflow name`. */
+    label: string;
+    /** The longest name the namespace takes. */
+    limit: number;
+    /** Everything after {@link FEATURE_TAIL_SEPARATOR}, e.g. `email-suppressions-d1`. */
+    thing: string;
+}
+/** The longest slug every one of `shapes` leaves room for, for this project and issue, and the shape that sets it. */
+export declare function tightestFeatureShape(parts: FeatureHead, shapes: readonly FeatureNameShape[]): {
+    max: number;
+    shape: FeatureNameShape | null;
+};
+/** The longest slug a feature of this project and issue may have, across every name it composes. */
+export declare function maxFeatureSlug(parts: FeatureHead, shapes: readonly FeatureNameShape[]): number;
+/**
+ * **Refuse a branch whose slug cannot fit every name its feature composes (#643).** The one refusal
+ * `pithy feature create` and `pithy provision --feature` make, before a worktree or a resource exists, with the
+ * project's maximum in the message. {@link composeFeatureName} refuses the same slug one name at a time; this says
+ * it once, for all of them.
+ */
+export declare function assertFeatureSlugFits(identity: FeatureIdentity, shapes: readonly FeatureNameShape[]): void;
+/**
+ * The full Cloudflare resource name for a feature's binding — `<project>-f<issue>-<slug>--<binding>-<kind>`.
  *
  * Held to **R2's 63**, the strictest of the three kinds a feature provisions, so one shape is legal for
  * all of them: lowercase, hyphenated, alphanumeric at both ends. A D1 or KV name could be longer, but a
@@ -40,7 +135,7 @@ export interface FeatureIdentity {
 export declare function featureResourceName(identity: FeatureIdentity, binding: string, kind: FeatureResourceKind): string;
 /**
  * The CF Secrets Store entry name holding one of a feature's **environment-scoped** secrets —
- * `<project>-f<issue>-<slug>-<secret>`.
+ * `<project>-f<issue>-<slug>--<secret>`.
  *
  * A Cloudflare account has one Secrets Store, flat and unpartitionable, so the entry name is the only
  * partition there is. A feature therefore needs its own names for the same reason it needs its own
@@ -50,12 +145,12 @@ export declare function featureResourceName(identity: FeatureIdentity, binding:
  * no documented Cloudflare cap, and holding it to the strictest kind's would hash
  * `secrets-encryption-keys` down to nothing for no reason.
  *
- * A `global` secret is not named here at all: it is one account-level value every environment binds,
- * so a feature binds the project's `<project>-global-<secret>` rather than minting a second copy.
+ * A `global` secret is named here too since #643: a feature shares nothing with any other environment, so
+ * its entry for a global secret is its own rather than the project's `<project>-global-<secret>`.
  */
 export declare function featureSecretEntryName(identity: FeatureIdentity, secret: string): string;
 /**
- * The Worker **script name** for one of a feature's workers — `<project>-f<issue>-<slug>-<worker>`.
+ * The Worker **script name** for one of a feature's workers — `<project>-f<issue>-<slug>--<worker>`.
  *
  * This is the name the feature's Workers deploy under, and therefore the name a sibling's `service`
  * binding must target, so RPC inside a feature environment reaches that feature's deployment rather than
@@ -67,10 +162,30 @@ export declare function featureSecretEntryName(identity: FeatureIdentity, secret
  * has a charset rule and no length rule, so nothing upstream was going to stop it either.
  *
  * **`app` is the `apps/<app>` directory, never the deploy name.** A scaffolded Worker deploys as
- * `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>-<project>-<app>` — the
+ * `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>--<project>-<app>` — the
  * project twice, spent out of the budget above (#587). This function takes a string and cannot tell the
  * two apart, so the provisioning path reaches it only through `featureScope`, which is handed both names
  * and picks.
  */
 export declare function featureWorkerName(identity: FeatureIdentity, app: string): string;
+/**
+ * The deployed name of one of a feature's **Workflows** — `<project>-f<issue>-<slug>--<capability>-<job>` (#643).
+ *
+ * A Workflow name is account-wide, like a Worker's, so a feature's email host cannot run
+ * `<project>-feature-email-send`: every open branch would deploy the same Workflow over every other's. It takes
+ * the feature's head instead, exactly as its host Worker does ({@link featureWorkerName}), so the Worker and the
+ * Workflows it hosts are recognizably one feature's and teardown recomputes both from the identity.
+ *
+ * Held to the **Workflow** limit ({@link NAMESPACE_LIMITS.workflow}), and fitted the way every feature name is:
+ * the slug gives way first, then the `<capability>-<job>` tail, deterministically.
+ */
+export declare function featureWorkflowName(identity: FeatureIdentity, capability: string, job: string): string;
+/**
+ * The name of one of a feature's **Vectorize indexes** — `<project>-f<issue>-<slug>--<thing>` (#643).
+ *
+ * An index name is account-wide, so a feature's vector host cannot bind `<project>-feature-vector-<index>`: every
+ * open branch would read and write one index. Held to the Vectorize limit and fitted the way every feature name
+ * is, so teardown recomputes it from the identity.
+ */
+export declare function featureVectorizeIndexName(identity: FeatureIdentity, thing: string): string;
 //# sourceMappingURL=feature.d.ts.map

package/dist/naming/feature.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature.d.ts","sourceRoot":"","sources":["../../src/naming/feature.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AAEH,iHAAiH;AACjH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAAuB,CAAC;AAEzF,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAkED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAQjH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQxF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"feature.d.ts","sourceRoot":"","sources":["../../src/naming/feature.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,iHAAiH;AACjH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAAuB,CAAC;AAEzF,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAmBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAQ1D;AASD,iGAAiG;AACjG,MAAM,WAAW,iBAAiB;IAChC,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAcvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQnF;AAED,yFAAyF;AACzF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAErE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExF;AAsDD,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sHAAsH;AACtH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAClC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,CAWjD;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAE9F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,CAkB1G;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CASjH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CASxF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAShF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAStG;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS1F"}