@pithy-sh/core 0.7.3 → 0.8.0

package/dist/naming/feature.js

@@ -1,9 +1,9 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { ValidationError } from "../error/pithyError.js";
-import { featureMarker } from "./environment.js";
+import { featureMarker, isFeatureMarker } from "./environment.js";
 import { NAMESPACE_LIMITS } from "./limits.js";
-import { assertValidProjectName, fitSegment, kebab } from "./resource.js";
+import { assertValidProjectName, kebab } from "./resource.js";
 //#region src/naming/feature.ts
 /** Every feature resource kind, for tests and for callers that enumerate. */
 const FEATURE_RESOURCE_KINDS = [
@@ -11,8 +11,6 @@ const FEATURE_RESOURCE_KINDS = [
 	"kv",
 	"r2"
 ];
-/** Below this the slug segment isn't worth keeping legible; the trailing segment is truncated to give it room. */
-const MIN_SLUG_BUDGET = 3;
 /**
 * Refuse an issue number the budgets were not derived against.
 *
@@ -29,21 +27,106 @@ function assertIssue(issue) {
 		detail: `Feature resource names reserve 6 digits, and every project-name budget is derived against that.`
 	});
 }
+/**
+* **The issue as a name carries it: its digits, without leading zeros (#643).** `feature/0643-foo` and
+* `feature/643-foo` are one issue, so they are one feature and compose one set of names. Read as strings they
+* were two features, and their rate-limit namespaces collided every time. `0` stays `0`.
+*/
+function canonicalIssue(issue) {
+	assertIssue(issue);
+	return issue.replace(/^0+(?=[0-9])/, "");
+}
+/**
+* The `f<digits>` segment a project name carries, or `null` — the shape a feature's issue takes (#643).
+*
+* Read after kebabbing, because the kebab is what reaches an account.
+*/
+function featureMarkerInProjectName(project) {
+	return kebab(project).split("-").find(isFeatureMarker) ?? null;
+}
+/**
+* **Refuse features for a project whose name carries an `f<digits>` segment (#643).**
+*
+* A feature name is read left to right: the project, then the first `f<digits>` segment, which is the issue.
+* A project named `acme-f12-x` puts that segment inside itself, and then its feature 3 on `y` and project `acme`'s
+* feature 12 on `x-f3-y` are one string. Environment names already obey this rule ({@link isFeatureMarker}), so
+* the project obeys it too, where the two shapes meet.
+*
+* **Refused here, not at `requireProjectName`.** Such a project's staging and prod are untouched: no name they
+* compose holds {@link FEATURE_TAIL_SEPARATOR}, so no feature anywhere can compose one of theirs. Refusing the
+* name everywhere would break every command of a project that is otherwise sound. `pithy init` refuses a new one,
+* and `pithy doctor` names the segment an existing one carries. Nothing is renamed.
+*/
+function assertFeatureProject(project) {
+	const marker = featureMarkerInProjectName(project);
+	if (marker === null) return;
+	throw new ValidationError({
+		message: `"${project}" can't have feature environments. Its name carries ${marker}, the shape a feature's issue takes.`,
+		action: "Staging and prod are unaffected. Features need a project name with no f and a number as one segment.",
+		detail: `A feature name is <project>-f<issue>-<slug>--<thing>, read from the first f<digits> segment. With one inside "${kebab(project)}", another project's feature could compose this project's feature names.`
+	});
+}
 /** The `<project>-f<issue>` head both feature shapes share, with the project held to the one project rule. */
 function head(identity) {
 	assertValidProjectName(identity.project);
-	assertIssue(identity.issue);
-	return `${kebab(identity.project)}-${featureMarker(identity.issue)}`;
+	assertFeatureProject(identity.project);
+	return `${kebab(identity.project)}-${featureMarker(canonicalIssue(identity.issue))}`;
+}
+/**
+* **Read a feature name back into its owner, or `null` when it is not one (#643).**
+*
+* Exact, because the shape leaves one reading: a feature name holds {@link FEATURE_TAIL_SEPARATOR} exactly once,
+* everything before it is `<project>-f<issue>-<slug>`, and the first `f<digits>` segment there is the issue,
+* since a project may carry none. Nothing else Pithy composes holds the separator at all.
+*/
+function parseFeatureName(name) {
+	const at = name.indexOf("--");
+	if (at < 0 || name.indexOf("--", at + 1) >= 0) return null;
+	const thing = name.slice(at + 2);
+	const segments = name.slice(0, at).split("-");
+	const marker = segments.findIndex(isFeatureMarker);
+	if (thing === "" || marker < 1 || marker === segments.length - 1) return null;
+	if (segments.some((segment) => segment === "")) return null;
+	return {
+		project: segments.slice(0, marker).join("-"),
+		issue: segments[marker].slice(1).replace(/^0+(?=[0-9])/, ""),
+		slug: segments.slice(marker + 1).join("-"),
+		thing
+	};
+}
+/**
+* **Is this name one this feature composes?** The ownership check the isolation gates ask (#643).
+*
+* Parsed, never prefix-matched, and exact: the name's project, issue and slug are this feature's, character for
+* character. `<project>-f<issue>-` is shared by every branch of one issue, so a prefix match reached siblings; and
+* a fitted form of the slug, which this used to accept, is a short hash some sibling can have as its whole slug
+* (`feature/12-login` owned `feature/12-c`). No feature name is fitted any more ({@link composeFeatureName}), so
+* there is nothing but the slug itself to accept.
+*/
+function isFeatureOwnedName(identity, name) {
+	const parsed = parseFeatureName(name);
+	if (parsed === null) return false;
+	return parsed.project === kebab(identity.project) && parsed.issue === canonicalIssue(identity.issue) && parsed.slug === kebab(identity.slug);
 }
 /**
-* Fit `<head>-<slug>-<tail><fixed>` into `budget`, truncating the slug first and the tail only if the
-* tail is what is eating the name. `fixed` is never touched — it carries the kind suffix, which is the
-* only thing telling a `DB` bucket from a `DB` database.
+* **The longest slug one feature name leaves room for** — `limit` less `<project>-f<issue>-`, the
+* {@link FEATURE_TAIL_SEPARATOR}, and `thing`, which is everything after it. Zero or less when `thing` leaves none.
+*/
+function featureSlugRoom(parts, thing, limit) {
+	return limit - head(parts).length - 1 - 2 - thing.length;
+}
+/**
+* Compose `<head>-<slug>--<tail><fixed>` whole, or refuse (#643).
 *
-* Deterministic in its inputs and hash-disambiguated on both variable segments, so two long inputs
-* sharing a prefix still produce two different names.
+* **Never truncated.** A fitted slug was a short hash, and a hash is a slug some sibling branch can have: the
+* review of 4828e1fc found `feature/12-login` owning `feature/12-c`'s names, and two long slugs of one issue
+* composing one database. A name that does not fit is refused, naming the longest slug that does, and
+* `pithy feature create` and `pithy provision --feature` refuse the branch before anything exists
+* ({@link assertFeatureSlugFits}). This is the backstop behind them: no path composes a feature name that is not
+* exactly its feature's.
 */
-function composeFeatureName(headSegment, slug, tail, fixed, budget) {
+function composeFeatureName(parts, slug, tail, fixed, limit, label) {
+	const headSegment = head(parts);
 	for (const [role, value] of [["slug", slug], ["binding or worker", tail]]) {
 		if (value) continue;
 		throw new ValidationError({
@@ -52,29 +135,76 @@ function composeFeatureName(headSegment, slug, tail, fixed, budget) {
 			detail: `composeFeatureName received an empty ${role} segment for "${headSegment}".`
 		});
 	}
-	const inner = budget - fixed.length;
-	let tailSegment = tail;
-	let slugBudget = inner - headSegment.length - 1 - (1 + tailSegment.length);
-	if (slugBudget < MIN_SLUG_BUDGET) {
-		const tailBudget = inner - headSegment.length - 1 - MIN_SLUG_BUDGET - 1;
-		tailSegment = fitSegment(tailSegment, Math.max(1, tailBudget));
-		slugBudget = inner - headSegment.length - 1 - (1 + tailSegment.length);
+	const thing = `${tail}${fixed}`;
+	const room = featureSlugRoom(parts, thing, limit);
+	if (room < 1) throw new ValidationError({
+		message: `"${thing}" is too long for a feature's ${label.replace(/^an? /, "")}.`,
+		action: `Shorten it. ${label[0]?.toUpperCase()}${label.slice(1)} stops at ${limit}, and ${headSegment}-<slug>-- comes first.`,
+		detail: `${headSegment}-<slug>--${thing} leaves ${room} characters for a slug.`
+	});
+	if (slug.length > room) throw new ValidationError({
+		message: `Slug "${slug}" is ${slug.length} characters. ${label[0]?.toUpperCase()}${label.slice(1)} ${headSegment}-<slug>--${thing} leaves room for at most ${room}.`,
+		action: "Use a shorter branch slug.",
+		detail: `${headSegment}-${slug}--${thing} is ${headSegment.length + 1 + slug.length + 2 + thing.length} characters; the limit is ${limit}. Feature names are never truncated.`
+	});
+	return `${headSegment}-${slug}--${thing}`;
+}
+/** The longest slug every one of `shapes` leaves room for, for this project and issue, and the shape that sets it. */
+function tightestFeatureShape(parts, shapes) {
+	let max = Number.POSITIVE_INFINITY;
+	let shape = null;
+	for (const candidate of shapes) {
+		const room = featureSlugRoom(parts, candidate.thing, candidate.limit);
+		if (room < max) {
+			max = room;
+			shape = candidate;
+		}
 	}
-	return `${headSegment}-${fitSegment(slug, Math.max(1, slugBudget))}-${tailSegment}${fixed}`;
+	return {
+		max,
+		shape
+	};
+}
+/** The longest slug a feature of this project and issue may have, across every name it composes. */
+function maxFeatureSlug(parts, shapes) {
+	return tightestFeatureShape(parts, shapes).max;
+}
+/**
+* **Refuse a branch whose slug cannot fit every name its feature composes (#643).** The one refusal
+* `pithy feature create` and `pithy provision --feature` make, before a worktree or a resource exists, with the
+* project's maximum in the message. {@link composeFeatureName} refuses the same slug one name at a time; this says
+* it once, for all of them.
+*/
+function assertFeatureSlugFits(identity, shapes) {
+	const { max, shape } = tightestFeatureShape(identity, shapes);
+	const slug = kebab(identity.slug);
+	if (shape === null || slug.length <= max) return;
+	const issue = canonicalIssue(identity.issue);
+	const project = kebab(identity.project);
+	if (max < 1) throw new ValidationError({
+		message: `"${shape.thing}" leaves no room for a slug in ${project}'s features.`,
+		action: `Shorten it. ${shape.label[0]?.toUpperCase()}${shape.label.slice(1)} stops at ${shape.limit}.`,
+		detail: `${head(identity)}-<slug>--${shape.thing} leaves ${max} characters for a slug.`
+	});
+	throw new ValidationError({
+		message: `Slug "${slug}" is ${slug.length} characters. Feature slugs in ${project} stop at ${max} characters at issue ${issue}.`,
+		action: `Name the branch feature/${issue}-<slug of ${max} or fewer>. Feature names are never truncated.`,
+		detail: `${shape.label} ${head(identity)}-<slug>--${shape.thing} is held to ${shape.limit} characters.`
+	});
 }
 /**
-* The full Cloudflare resource name for a feature's binding — `<project>-f<issue>-<slug>-<binding>-<kind>`.
+* The full Cloudflare resource name for a feature's binding — `<project>-f<issue>-<slug>--<binding>-<kind>`.
 *
 * Held to **R2's 63**, the strictest of the three kinds a feature provisions, so one shape is legal for
 * all of them: lowercase, hyphenated, alphanumeric at both ends. A D1 or KV name could be longer, but a
 * feature that provisions a bucket and a database wants them recognizably the same name.
 */
 function featureResourceName(identity, binding, kind) {
-	return composeFeatureName(head(identity), kebab(identity.slug), kebab(binding), `-${kind}`, NAMESPACE_LIMITS.r2.maxLength);
+	return composeFeatureName(identity, kebab(identity.slug), kebab(binding), `-${kind}`, NAMESPACE_LIMITS.r2.maxLength, NAMESPACE_LIMITS.r2.label);
 }
 /**
 * The CF Secrets Store entry name holding one of a feature's **environment-scoped** secrets —
-* `<project>-f<issue>-<slug>-<secret>`.
+* `<project>-f<issue>-<slug>--<secret>`.
 *
 * A Cloudflare account has one Secrets Store, flat and unpartitionable, so the entry name is the only
 * partition there is. A feature therefore needs its own names for the same reason it needs its own
@@ -84,14 +214,14 @@ function featureResourceName(identity, binding, kind) {
 * no documented Cloudflare cap, and holding it to the strictest kind's would hash
 * `secrets-encryption-keys` down to nothing for no reason.
 *
-* A `global` secret is not named here at all: it is one account-level value every environment binds,
-* so a feature binds the project's `<project>-global-<secret>` rather than minting a second copy.
+* A `global` secret is named here too since #643: a feature shares nothing with any other environment, so
+* its entry for a global secret is its own rather than the project's `<project>-global-<secret>`.
 */
 function featureSecretEntryName(identity, secret) {
-	return composeFeatureName(head(identity), kebab(identity.slug), kebab(secret), "", NAMESPACE_LIMITS.secretEntry.maxLength);
+	return composeFeatureName(identity, kebab(identity.slug), kebab(secret), "", NAMESPACE_LIMITS.secretEntry.maxLength, NAMESPACE_LIMITS.secretEntry.label);
 }
 /**
-* The Worker **script name** for one of a feature's workers — `<project>-f<issue>-<slug>-<worker>`.
+* The Worker **script name** for one of a feature's workers — `<project>-f<issue>-<slug>--<worker>`.
 *
 * This is the name the feature's Workers deploy under, and therefore the name a sibling's `service`
 * binding must target, so RPC inside a feature environment reaches that feature's deployment rather than
@@ -103,13 +233,37 @@ function featureSecretEntryName(identity, secret) {
 * has a charset rule and no length rule, so nothing upstream was going to stop it either.
 *
 * **`app` is the `apps/<app>` directory, never the deploy name.** A scaffolded Worker deploys as
-* `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>-<project>-<app>` — the
+* `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>--<project>-<app>` — the
 * project twice, spent out of the budget above (#587). This function takes a string and cannot tell the
 * two apart, so the provisioning path reaches it only through `featureScope`, which is handed both names
 * and picks.
 */
 function featureWorkerName(identity, app) {
-	return composeFeatureName(head(identity), kebab(identity.slug), kebab(app), "", NAMESPACE_LIMITS.worker.maxLength);
+	return composeFeatureName(identity, kebab(identity.slug), kebab(app), "", NAMESPACE_LIMITS.worker.maxLength, NAMESPACE_LIMITS.worker.label);
+}
+/**
+* The deployed name of one of a feature's **Workflows** — `<project>-f<issue>-<slug>--<capability>-<job>` (#643).
+*
+* A Workflow name is account-wide, like a Worker's, so a feature's email host cannot run
+* `<project>-feature-email-send`: every open branch would deploy the same Workflow over every other's. It takes
+* the feature's head instead, exactly as its host Worker does ({@link featureWorkerName}), so the Worker and the
+* Workflows it hosts are recognizably one feature's and teardown recomputes both from the identity.
+*
+* Held to the **Workflow** limit ({@link NAMESPACE_LIMITS.workflow}), and fitted the way every feature name is:
+* the slug gives way first, then the `<capability>-<job>` tail, deterministically.
+*/
+function featureWorkflowName(identity, capability, job) {
+	return composeFeatureName(identity, kebab(identity.slug), `${kebab(capability)}-${kebab(job)}`, "", NAMESPACE_LIMITS.workflow.maxLength, NAMESPACE_LIMITS.workflow.label);
+}
+/**
+* The name of one of a feature's **Vectorize indexes** — `<project>-f<issue>-<slug>--<thing>` (#643).
+*
+* An index name is account-wide, so a feature's vector host cannot bind `<project>-feature-vector-<index>`: every
+* open branch would read and write one index. Held to the Vectorize limit and fitted the way every feature name
+* is, so teardown recomputes it from the identity.
+*/
+function featureVectorizeIndexName(identity, thing) {
+	return composeFeatureName(identity, kebab(identity.slug), kebab(thing), "", NAMESPACE_LIMITS.vectorizeIndex.maxLength, NAMESPACE_LIMITS.vectorizeIndex.label);
 }
 //#endregion
-export { FEATURE_RESOURCE_KINDS, featureResourceName, featureSecretEntryName, featureWorkerName };
+export { FEATURE_RESOURCE_KINDS, assertFeatureProject, assertFeatureSlugFits, canonicalIssue, featureMarkerInProjectName, featureResourceName, featureSecretEntryName, featureSlugRoom, featureVectorizeIndexName, featureWorkerName, featureWorkflowName, isFeatureOwnedName, maxFeatureSlug, parseFeatureName, tightestFeatureShape };

package/dist/naming/limits.d.ts

@@ -28,6 +28,9 @@ export type LimitSource = "cloudflare" | "pithy";
  * **`truncate`** where Pithy recomputes the name from the same inputs on every command — a D1
  * database, a KV namespace, a bucket, a secret entry, a token. Truncation is deterministic and
  * hash-disambiguated, so provision and teardown still agree, and a failed CI run is avoided.
+ *
+ * **A feature's names are refused in every namespace, whatever its policy here (#643).** A fitted slug is a
+ * short hash, and a hash is a slug another branch can have whole; see `composeFeatureName` in `./feature`.
  */
 export type OverflowPolicy = "refuse" | "truncate";
 /** One namespace's rule: how long a name may be, and what happens when it would be longer. */
@@ -180,11 +183,24 @@ export declare const MAX_ISSUE_DIGITS = 6;
 /**
  * The slug length a feature resource name keeps verbatim at the worst legal project name.
  *
- * Twelve, because that is where a feature slug stops being readable in a listing: below it,
- * `fitSegment` has to fall back to a short head plus a six-hex disambiguator, and
- * `acme-f95-medi-8f21c4-db-d1` tells a human nothing about which branch owns the database.
+ * Eleven — it was twelve until {@link FEATURE_TAIL_SEPARATOR} took a character of it (#643). About where a
+ * feature slug stops being readable in a listing. A slug past a feature's budget is refused, not fitted (#643),
+ * so this is the room the project-name cap guarantees every project's features at the worst legal input.
+ */
+export declare const MIN_LEGIBLE_SLUG = 11;
+/**
+ * **What stands between a feature's slug and whatever it names: two hyphens (#643).**
+ *
+ * `<project>-f<issue>-<slug>--<thing>`. Nothing else Pithy composes can contain it: every other segment is
+ * kebabbed, and a kebab never holds two hyphens in a row. So a name holding it is a feature's and a name without
+ * it is not — `acme`'s `staging` can never compose a feature's name, whatever its project or environment is
+ * called — and it ends the slug unambiguously, so `feature/12-x` binding `PROD_DB` and `feature/12-x-prod`
+ * binding `DB` no longer compose one database between them.
+ *
+ * It cost the slug a character: {@link MIN_LEGIBLE_SLUG} gave one up so {@link FEATURE_DERIVED_PROJECT_NAME},
+ * and with it every project name already accepted, stays where it was.
  */
-export declare const MIN_LEGIBLE_SLUG = 12;
+export declare const FEATURE_TAIL_SEPARATOR = "--";
 /**
  * The binding length a feature resource name keeps verbatim at the worst legal project name.
  *
@@ -212,7 +228,7 @@ export declare const MAX_FEATURE_KIND = 2;
  */
 export declare const WORKFLOW_DERIVED_PROJECT_NAME: number;
 /**
- * What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>-<binding>-<kind>`,
+ * What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>--<binding>-<kind>`,
  * against R2's 63 (the strictest of the three kinds a feature provisions, and the same number a
  * feature Worker script gets).
  *
@@ -220,8 +236,8 @@ export declare const WORKFLOW_DERIVED_PROJECT_NAME: number;
  *     63   an R2 bucket name (NAMESPACE_LIMITS.r2)
  *   -  2   `-f`
  *   -  6   the issue number, six digits — `f999999` (MAX_ISSUE_DIGITS)
- *   - 13   `-` + a legible slug (MIN_LEGIBLE_SLUG)
- *   - 13   `-` + a binding kept whole (MIN_VERBATIM_BINDING)
+ *   - 12   `-` + a legible slug (MIN_LEGIBLE_SLUG)
+ *   - 14   `--` + a binding kept whole (FEATURE_TAIL_SEPARATOR, MIN_VERBATIM_BINDING)
  *   -  3   `-` + the kind, `d1` | `kv` | `r2`
  *   ----
  *     26

package/dist/naming/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/naming/limits.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AAEH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;;OAGG;;iBACS,KAAK,EAAE,iBAAiB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IACzG;;;;;;OAMG;;iBACO,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IAC5G;;;OAGG;;iBACG,KAAK,EAAE,mBAAmB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IACvG;;;;OAIG;;iBAED,KAAK,EAAE,wBAAwB;iBAC/B,SAAS,EAAE,EAAE;iBACb,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,QAAQ;iBAChB,MAAM,EAAE,YAAY;;IAEtB;;;;;OAKG;;iBACG,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,GAAG;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IAC3G;;;OAGG;;iBACG,KAAK,EAAE,oBAAoB;iBAAE,SAAS;iBAAkB,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,OAAO;;IAC/G;;;OAGG;;iBAED,KAAK,EAAE,4BAA4B;iBACnC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;IAEjB;;;OAGG;;iBAED,KAAK,EAAE,6BAA6B;iBACpC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;CAEgC,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,QAC+C,CAAC;AAE1F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,QAMjB,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/naming/limits.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AAEH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEnD,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;;OAGG;;iBACS,KAAK,EAAE,iBAAiB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IACzG;;;;;;OAMG;;iBACO,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,QAAQ;iBAAE,MAAM,EAAE,YAAY;;IAC5G;;;OAGG;;iBACG,KAAK,EAAE,mBAAmB;iBAAE,SAAS,EAAE,EAAE;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IACvG;;;;OAIG;;iBAED,KAAK,EAAE,wBAAwB;iBAC/B,SAAS,EAAE,EAAE;iBACb,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,QAAQ;iBAChB,MAAM,EAAE,YAAY;;IAEtB;;;;;OAKG;;iBACG,KAAK,EAAE,sBAAsB;iBAAE,SAAS,EAAE,GAAG;iBAAE,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,YAAY;;IAC3G;;;OAGG;;iBACG,KAAK,EAAE,oBAAoB;iBAAE,SAAS;iBAAkB,SAAS,EAAE,CAAC;iBAAE,MAAM,EAAE,UAAU;iBAAE,MAAM,EAAE,OAAO;;IAC/G;;;OAGG;;iBAED,KAAK,EAAE,4BAA4B;iBACnC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;IAEjB;;;OAGG;;iBAED,KAAK,EAAE,6BAA6B;iBACpC,SAAS;iBACT,SAAS,EAAE,CAAC;iBACZ,MAAM,EAAE,UAAU;iBAClB,MAAM,EAAE,OAAO;;CAEgC,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,QAC+C,CAAC;AAE1F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,QAMjB,CAAC"}

package/dist/naming/limits.js

@@ -137,11 +137,24 @@ const MAX_ISSUE_DIGITS = 6;
 /**
 * The slug length a feature resource name keeps verbatim at the worst legal project name.
 *
-* Twelve, because that is where a feature slug stops being readable in a listing: below it,
-* `fitSegment` has to fall back to a short head plus a six-hex disambiguator, and
-* `acme-f95-medi-8f21c4-db-d1` tells a human nothing about which branch owns the database.
+* Eleven — it was twelve until {@link FEATURE_TAIL_SEPARATOR} took a character of it (#643). About where a
+* feature slug stops being readable in a listing. A slug past a feature's budget is refused, not fitted (#643),
+* so this is the room the project-name cap guarantees every project's features at the worst legal input.
 */
-const MIN_LEGIBLE_SLUG = 12;
+const MIN_LEGIBLE_SLUG = 11;
+/**
+* **What stands between a feature's slug and whatever it names: two hyphens (#643).**
+*
+* `<project>-f<issue>-<slug>--<thing>`. Nothing else Pithy composes can contain it: every other segment is
+* kebabbed, and a kebab never holds two hyphens in a row. So a name holding it is a feature's and a name without
+* it is not — `acme`'s `staging` can never compose a feature's name, whatever its project or environment is
+* called — and it ends the slug unambiguously, so `feature/12-x` binding `PROD_DB` and `feature/12-x-prod`
+* binding `DB` no longer compose one database between them.
+*
+* It cost the slug a character: {@link MIN_LEGIBLE_SLUG} gave one up so {@link FEATURE_DERIVED_PROJECT_NAME},
+* and with it every project name already accepted, stays where it was.
+*/
+const FEATURE_TAIL_SEPARATOR = "--";
 /**
 * The binding length a feature resource name keeps verbatim at the worst legal project name.
 *
@@ -169,7 +182,7 @@ const MAX_FEATURE_KIND = 2;
 */
 const WORKFLOW_DERIVED_PROJECT_NAME = NAMESPACE_LIMITS.workflow.maxLength - 1 - MAX_ENVIRONMENT_NAME - 1 - 22;
 /**
-* What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>-<binding>-<kind>`,
+* What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>--<binding>-<kind>`,
 * against R2's 63 (the strictest of the three kinds a feature provisions, and the same number a
 * feature Worker script gets).
 *
@@ -177,13 +190,13 @@ const WORKFLOW_DERIVED_PROJECT_NAME = NAMESPACE_LIMITS.workflow.maxLength - 1 -
 *     63   an R2 bucket name (NAMESPACE_LIMITS.r2)
 *   -  2   `-f`
 *   -  6   the issue number, six digits — `f999999` (MAX_ISSUE_DIGITS)
-*   - 13   `-` + a legible slug (MIN_LEGIBLE_SLUG)
-*   - 13   `-` + a binding kept whole (MIN_VERBATIM_BINDING)
+*   - 12   `-` + a legible slug (MIN_LEGIBLE_SLUG)
+*   - 14   `--` + a binding kept whole (FEATURE_TAIL_SEPARATOR, MIN_VERBATIM_BINDING)
 *   -  3   `-` + the kind, `d1` | `kv` | `r2`
 *   ----
 *     26
 * ```
 */
-const FEATURE_DERIVED_PROJECT_NAME = NAMESPACE_LIMITS.r2.maxLength - 2 - 6 - 13 - 13 - 3;
+const FEATURE_DERIVED_PROJECT_NAME = NAMESPACE_LIMITS.r2.maxLength - 2 - 6 - 12 - 14 - 3;
 //#endregion
-export { FEATURE_DERIVED_PROJECT_NAME, MAX_CAPABILITY_JOB, MAX_FEATURE_KIND, MAX_ISSUE_DIGITS, MAX_PITHY_NAME, MIN_LEGIBLE_SLUG, MIN_VERBATIM_BINDING, NAMESPACE_LIMITS, WORKFLOW_DERIVED_PROJECT_NAME };
+export { FEATURE_DERIVED_PROJECT_NAME, FEATURE_TAIL_SEPARATOR, MAX_CAPABILITY_JOB, MAX_FEATURE_KIND, MAX_ISSUE_DIGITS, MAX_PITHY_NAME, MIN_LEGIBLE_SLUG, MIN_VERBATIM_BINDING, NAMESPACE_LIMITS, WORKFLOW_DERIVED_PROJECT_NAME };

package/dist/naming/provisionScope.d.ts

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import type { WorkflowHostNameParts } from "../workflow/naming";
 import { type FeatureIdentity, type FeatureResourceKind } from "./feature";
 /**
  * **What a provisioning run names its resources, and which `env.<name>` stanza it writes them into —
@@ -154,11 +155,22 @@ export interface ProvisionScope {
     /**
      * This scope's CF Secrets Store entry name for a declared secret.
      *
-     * A `global` secret is the one name that does **not** take the scope's segment: it is a single
-     * account-level value every environment binds, so every scope resolves it to the project's
-     * `<project>-global-<secret>`. Scoping it would mint a second copy of a value defined as one.
+     * In a declared environment a `global` secret is the one name that does **not** take the scope's segment:
+     * it is a single account-level value every declared environment binds, so it resolves to the project's
+     * `<project>-global-<secret>`. A feature is the exception — it shares nothing with any other environment,
+     * so its entry for a `global` secret is its own (#643). See {@link featureScope}.
      */
     secretEntry(secret: string, secretScope: SecretNameScope): string;
+    /**
+     * What a capability's host Worker and its Workflows are named from in this scope — handed, with the
+     * capability, to `workflowHostName` and `workflowScriptName`. It is what an app Worker's cross-script
+     * `workflows` entry and the host's own config are both composed from (#643).
+     *
+     * On the scope for the reason every other name is: a declared environment composes
+     * `<project>-<env>-<capability>[-<job>]`, and a feature composes `<project>-f<issue>-<slug>-…`, because
+     * `<project>-feature-email-send` would be one Workflow every open branch deployed over every other's.
+     */
+    readonly workflowHost: Omit<WorkflowHostNameParts, "capability">;
 }
 /**
  * The same branch, one line down, for a provisioned resource: a `global` binding resolves to the
@@ -240,14 +252,16 @@ export declare function environmentScope(project: string, environment: string):
  * Its stanza is {@link FEATURE_ENVIRONMENT} and nothing else, which is what makes a feature's resources
  * in a declared environment's stanza unexpressible rather than merely discouraged.
  *
- * **A feature takes a binding's {@link BindingNaming} and ignores it — and that is the asymmetry against
- * `secretEntry` one line below, which honors `global` here as everywhere.** A global *secret* is a value
- * defined once for the project, so a feature binds the project's copy rather than minting a second: it is
- * **read**. A global *database* is a resource a feature would **migrate** — `provisionFeature` runs
- * `pithy migrate` against everything it names — so honoring `global` here would point one branch's
- * schema changes at the project's live suppression list, and point teardown at it afterwards. A feature
- * owns every resource it names, exactly so that destroying the feature destroys them all; there is no
- * shared name to match and nothing for teardown to spare.
+ * **A feature takes a binding's {@link BindingNaming} and ignores it, and a secret's `global` scope with it.**
+ * A global *database* is a resource a feature would **migrate** — `provisionFeature` runs `pithy migrate`
+ * against everything it names — so honoring `global` would point one branch's schema changes at the project's
+ * live suppression list, and point teardown at it afterwards. A global *secret* went the other way until #643:
+ * a feature bound the project's copy. It no longer does. **Nothing is shared between a feature and any other
+ * feature, staging or prod** — the account and its one Secrets Store are the only containers that cannot be
+ * split, and every entry inside the store is split. So a feature names its own entry for a `global` secret
+ * too: a mintable one is minted for it, and a supplied one is reported missing under the feature's name rather
+ * than bound to the value every environment reads. A feature owns everything it names, exactly so that
+ * destroying the feature destroys it all; there is no shared name to match and nothing for teardown to spare.
  *
  * `resource` is ignored for the same reason it is moot: a feature's `<thing>` segment is the binding plus
  * the kind, and the whole name is recomputed on teardown rather than looked up, so nothing outside the

package/dist/naming/provisionScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionScope.d.ts","sourceRoot":"","sources":["../../src/naming/provisionScope.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAIzB,MAAM,WAAW,CAAC;AAInB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,2GAA2G;IAC3G,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IACpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChE;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,MAAM,CAAC;CACnE;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAAC;AACV,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAChC,MAAM,CAAC;AAsBV;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CA6BrF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAetE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,EAAE,CAI1G"}
+{"version":3,"file":"provisionScope.d.ts","sourceRoot":"","sources":["../../src/naming/provisionScope.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAIzB,MAAM,WAAW,CAAC;AAInB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,2GAA2G;IAC3G,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IACpF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChE;;;;;;;OAOG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,GAAG,MAAM,CAAC;IAClE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;CAClE;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAAC;AACV,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAChC,MAAM,CAAC;AAsBV;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,CA8BrF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAiBtE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,EAAE,CAY1G"}

package/dist/naming/provisionScope.js

@@ -97,7 +97,11 @@ function environmentScope(project, environment) {
 			});
 			return name;
 		},
-		secretEntry: (secret, secretScope) => secretEntryName(project, secret, secretScope, () => names.secretEntry(secret))
+		secretEntry: (secret, secretScope) => secretEntryName(project, secret, secretScope, () => names.secretEntry(secret)),
+		workflowHost: {
+			project,
+			env: environment
+		}
 	};
 }
 /**
@@ -107,14 +111,16 @@ function environmentScope(project, environment) {
 * Its stanza is {@link FEATURE_ENVIRONMENT} and nothing else, which is what makes a feature's resources
 * in a declared environment's stanza unexpressible rather than merely discouraged.
 *
-* **A feature takes a binding's {@link BindingNaming} and ignores it — and that is the asymmetry against
-* `secretEntry` one line below, which honors `global` here as everywhere.** A global *secret* is a value
-* defined once for the project, so a feature binds the project's copy rather than minting a second: it is
-* **read**. A global *database* is a resource a feature would **migrate** — `provisionFeature` runs
-* `pithy migrate` against everything it names — so honoring `global` here would point one branch's
-* schema changes at the project's live suppression list, and point teardown at it afterwards. A feature
-* owns every resource it names, exactly so that destroying the feature destroys them all; there is no
-* shared name to match and nothing for teardown to spare.
+* **A feature takes a binding's {@link BindingNaming} and ignores it, and a secret's `global` scope with it.**
+* A global *database* is a resource a feature would **migrate** — `provisionFeature` runs `pithy migrate`
+* against everything it names — so honoring `global` would point one branch's schema changes at the project's
+* live suppression list, and point teardown at it afterwards. A global *secret* went the other way until #643:
+* a feature bound the project's copy. It no longer does. **Nothing is shared between a feature and any other
+* feature, staging or prod** — the account and its one Secrets Store are the only containers that cannot be
+* split, and every entry inside the store is split. So a feature names its own entry for a `global` secret
+* too: a mintable one is minted for it, and a supplied one is reported missing under the feature's name rather
+* than bound to the value every environment reads. A feature owns everything it names, exactly so that
+* destroying the feature destroys it all; there is no shared name to match and nothing for teardown to spare.
 *
 * `resource` is ignored for the same reason it is moot: a feature's `<thing>` segment is the binding plus
 * the kind, and the whole name is recomputed on teardown rather than looked up, so nothing outside the
@@ -133,7 +139,12 @@ function featureScope(identity) {
 		honorsGlobal: false,
 		resource: (binding, kind) => featureResourceName(identity, binding, kind),
 		worker: ({ app }) => featureWorkerName(identity, app),
-		secretEntry: (secret, secretScope) => secretEntryName(identity.project, secret, secretScope, () => featureSecretEntryName(identity, secret))
+		secretEntry: (secret) => featureSecretEntryName(identity, secret),
+		workflowHost: {
+			project: identity.project,
+			env: FEATURE_ENVIRONMENT,
+			feature: identity
+		}
 	};
 }
 /**
@@ -160,7 +171,13 @@ function featureScope(identity) {
 */
 function featureWorkerScriptNames(identity, worker) {
 	const current = featureScope(identity).worker(worker);
-	const beforeSingleProject = featureWorkerName(identity, worker.script);
+	let beforeSingleProject;
+	try {
+		beforeSingleProject = featureWorkerName(identity, worker.script);
+	} catch (error) {
+		if (error instanceof ValidationError) return [current];
+		throw error;
+	}
 	return current === beforeSingleProject ? [current] : [current, beforeSingleProject];
 }
 //#endregion

package/dist/seed/seed.d.ts

@@ -145,8 +145,10 @@ export interface SeedPrepareContext {
     /** The project name (the root `pithy.config.ts` `name`), for messages and per-project lookups. */
     project: string;
     /**
-     * Where this Worker answers locally — `http://localhost:8807` and the like. `null` outside `dev`, and
-     * `null` in a checkout that was never allocated a port block.
+     * Where this Worker answers — in `dev`, locally, `http://localhost:8807` and the like; off `dev`, its own
+     * address (#643): a declared environment's declared one, a feature's `https://<script>.<subdomain>.workers.dev`.
+     * `pithy seed --host` overrides it. `null` in a checkout that was never allocated a port block, and for a
+     * deployed Worker with no address at all.
      *
      * The one address a fixture cannot write down. A dev port is *allocated*, not configured: a checkout
      * reserves a block and pins one port per Worker into `.dev.config.json`, so `http://localhost:8787` is
@@ -163,17 +165,44 @@ export interface SeedPrepareContext {
      * moves. Identity must not.
      *
      * **`null` is an answer, never a guess.** A plain clone that has never run `pithy dev`, a Worker added
-     * after the block was pinned, or any environment but `dev` — a deployed environment's address is
-     * declared rather than allocated, and `pithy env` is what answers it. An invented origin would be
-     * indistinguishable from a real one, so a set that cannot work without one refuses and says so.
+     * after the block was pinned, or a deployed Worker that declares no address and has none to derive. An
+     * invented origin would be indistinguishable from a real one, so a set that cannot work without one
+     * refuses and says so.
      */
     origin: string | null;
     /**
      * Read one of this environment's secrets by name, or `undefined` when it is not set. Local dev resolves
-     * every secret from `.dev.vars`, so this answers there; a deployed environment's secrets are not on the
-     * operator's disk, and a set that needs one must therefore be `dev`-only.
+     * every secret from the dev secrets file, so this answers there; a deployed environment's secrets are not
+     * on the operator's disk, so there it refuses, and a set that needs one must be `dev`-only. A feature is a
+     * deployed environment here too (#643): its secrets exist only in its own Cloudflare stores, which the CLI
+     * can write and never read.
      */
     secret: (name: string) => Promise<string | undefined>;
+    /**
+     * The value **this run just minted** for a secret, or `undefined` — never what the environment holds.
+     *
+     * `pithy provision` creates a random value for every `cf-secrets-store` secret the registry declares
+     * mintable, writes it into the account's Secrets Store, and lets it go. The Secrets Store is write-only
+     * from the CLI, so that write is the only moment the value exists anywhere the toolchain can see it —
+     * and provisioning migrates and seeds in the same process, a few steps later. A fixture that must
+     * *seal* something at creation time (encrypt a private key under the environment's key-encryption
+     * secret, derive an id that the running app will re-derive) can only do it then. Afterwards the value
+     * is unrecoverable by design.
+     *
+     * **This is not {@link secret}, and the two are not interchangeable.** `secret` answers what the
+     * environment holds and refuses outside `dev`, absolutely (#159); that rule is untouched. This answers
+     * the strictly narrower question *did this run create one, a moment ago, in memory*. A set asking here
+     * for a secret this run did not mint gets `undefined` wherever it runs, in `dev` or anywhere else.
+     *
+     * **Synchronous, because it cannot fetch.** There is no file to open and no request to make; a promise
+     * in this signature would suggest otherwise.
+     *
+     * **Empty is ordinary.** A re-run mints nothing — absence is checked before anything is generated — and
+     * a standalone `pithy seed` mints nothing at all. Both answer `undefined` for every name, and neither
+     * is an error. A set that needs a minted value and is handed none says so itself; nothing is invented
+     * on its behalf.
+     */
+    mintedThisRun: (name: string) => string | undefined;
     /**
      * The developer's machine-local preferences for this project, read from the Pithy config directory
      * (`~/.config/pithy/<project>/dev.json`, or `%APPDATA%\pithy\<project>\dev.json` on Windows), parsed but