@pithy-sh/core 0.7.3 → 0.8.0

package/src/naming/feature.ts

@@ -2,13 +2,20 @@
 // SPDX-License-Identifier: MIT
 
 import { ValidationError } from "../error/pithyError";
-import { featureMarker } from "./environment";
-import { MAX_ISSUE_DIGITS, NAMESPACE_LIMITS } from "./limits";
-import { assertValidProjectName, fitSegment, kebab } from "./resource";
+import { featureMarker, isFeatureMarker } from "./environment";
+import { FEATURE_TAIL_SEPARATOR, MAX_ISSUE_DIGITS, NAMESPACE_LIMITS } from "./limits";
+import { assertValidProjectName, kebab } from "./resource";
 
 /**
- * The names a feature environment provisions under: `<project>-f<issue>-<slug>-<binding>-<kind>` for a
- * resource, `<project>-f<issue>-<slug>-<worker>` for a Worker script.
+ * The names a feature environment provisions under: `<project>-f<issue>-<slug>--<binding>-<kind>` for a
+ * resource, `<project>-f<issue>-<slug>--<worker>` for a Worker script.
+ *
+ * **Two hyphens after the slug, and a project with no `f<digits>` segment (#643).** Together they make every
+ * feature name parse back to exactly one (project, issue, slug): the double hyphen is something no other name
+ * Pithy composes can hold ({@link FEATURE_TAIL_SEPARATOR}), and the first `f<digits>` segment is the issue's,
+ * because the project may carry none ({@link assertFeatureProject}). Before them, project `acme-f12-x`'s `prod`
+ * and project `acme`'s branch `feature/12-x-prod` composed every name between them, and a branch whose slug
+ * was a hyphen-prefix of a sibling's could compose the sibling's database. See {@link parseFeatureName}.
  *
  * **No environment segment, and no Worker segment.** A feature *is* an environment, and two Workers that
  * declare the same binding are meant to share one resource — so the binding name, not the topology, is
@@ -16,9 +23,12 @@ import { assertValidProjectName, fitSegment, kebab } from "./resource";
  *
  * Every name here is **derived and recomputed**, never stored: `provision` and `destroy` both compute the
  * same string from `(identity, binding, kind)`, which is what lets teardown reconcile exactly rather than
- * scan a prefix a hyphenated sibling slug could ambiguously match. That is also why these names
- * **truncate** where a capability's Workflow refuses: a feature name addresses nothing that outlives the
- * feature, and failing a CI run because a branch slug was long would be the worse failure.
+ * scan a prefix a hyphenated sibling slug could ambiguously match.
+ *
+ * **Never truncated (#643).** These names used to fit a long slug with a hash, on the reasoning that a feature
+ * name addresses nothing that outlives the feature. But a short hash is a slug some sibling branch can have
+ * whole, so a fitted name was a name two features could compose. A slug that does not fit is refused instead,
+ * naming the maximum ({@link assertFeatureSlugFits}), and every feature name is exactly its feature's.
  *
  * It lives in `core`, beside the rest of the naming rule, so the CLI and the facade compose one
  * implementation rather than two that drift.
@@ -40,9 +50,6 @@ export interface FeatureIdentity {
   slug: string;
 }
 
-/** Below this the slug segment isn't worth keeping legible; the trailing segment is truncated to give it room. */
-const MIN_SLUG_BUDGET = 3;
-
 /**
  * Refuse an issue number the budgets were not derived against.
  *
@@ -60,22 +67,139 @@ function assertIssue(issue: string): void {
   });
 }
 
+/**
+ * **The issue as a name carries it: its digits, without leading zeros (#643).** `feature/0643-foo` and
+ * `feature/643-foo` are one issue, so they are one feature and compose one set of names. Read as strings they
+ * were two features, and their rate-limit namespaces collided every time. `0` stays `0`.
+ */
+export function canonicalIssue(issue: string): string {
+  assertIssue(issue);
+  return issue.replace(/^0+(?=[0-9])/, "");
+}
+
+/**
+ * The `f<digits>` segment a project name carries, or `null` — the shape a feature's issue takes (#643).
+ *
+ * Read after kebabbing, because the kebab is what reaches an account.
+ */
+export function featureMarkerInProjectName(project: string): string | null {
+  return kebab(project).split("-").find(isFeatureMarker) ?? null;
+}
+
+/**
+ * **Refuse features for a project whose name carries an `f<digits>` segment (#643).**
+ *
+ * A feature name is read left to right: the project, then the first `f<digits>` segment, which is the issue.
+ * A project named `acme-f12-x` puts that segment inside itself, and then its feature 3 on `y` and project `acme`'s
+ * feature 12 on `x-f3-y` are one string. Environment names already obey this rule ({@link isFeatureMarker}), so
+ * the project obeys it too, where the two shapes meet.
+ *
+ * **Refused here, not at `requireProjectName`.** Such a project's staging and prod are untouched: no name they
+ * compose holds {@link FEATURE_TAIL_SEPARATOR}, so no feature anywhere can compose one of theirs. Refusing the
+ * name everywhere would break every command of a project that is otherwise sound. `pithy init` refuses a new one,
+ * and `pithy doctor` names the segment an existing one carries. Nothing is renamed.
+ */
+export function assertFeatureProject(project: string): void {
+  const marker = featureMarkerInProjectName(project);
+  if (marker === null) return;
+  throw new ValidationError({
+    message: `"${project}" can't have feature environments. Its name carries ${marker}, the shape a feature's issue takes.`,
+    action: "Staging and prod are unaffected. Features need a project name with no f and a number as one segment.",
+    detail: `A feature name is <project>-f<issue>-<slug>--<thing>, read from the first f<digits> segment. With one inside "${kebab(project)}", another project's feature could compose this project's feature names.`,
+  });
+}
+
 /** The `<project>-f<issue>` head both feature shapes share, with the project held to the one project rule. */
-function head(identity: FeatureIdentity): string {
+function head(identity: FeatureHead): string {
   assertValidProjectName(identity.project);
-  assertIssue(identity.issue);
-  return `${kebab(identity.project)}-${featureMarker(identity.issue)}`;
+  assertFeatureProject(identity.project);
+  return `${kebab(identity.project)}-${featureMarker(canonicalIssue(identity.issue))}`;
+}
+
+/** A feature name, read back: which project, issue and slug it belongs to, and what it names. */
+export interface ParsedFeatureName {
+  /** The project segment, kebabbed. */
+  project: string;
+  /** The issue, canonical. */
+  issue: string;
+  /** The slug segment: the whole slug, since no feature name is truncated. */
+  slug: string;
+  /** Everything after {@link FEATURE_TAIL_SEPARATOR}: the binding and kind, Worker, Workflow or entry. */
+  thing: string;
 }
 
 /**
- * Fit `<head>-<slug>-<tail><fixed>` into `budget`, truncating the slug first and the tail only if the
- * tail is what is eating the name. `fixed` is never touched — it carries the kind suffix, which is the
- * only thing telling a `DB` bucket from a `DB` database.
+ * **Read a feature name back into its owner, or `null` when it is not one (#643).**
  *
- * Deterministic in its inputs and hash-disambiguated on both variable segments, so two long inputs
- * sharing a prefix still produce two different names.
+ * Exact, because the shape leaves one reading: a feature name holds {@link FEATURE_TAIL_SEPARATOR} exactly once,
+ * everything before it is `<project>-f<issue>-<slug>`, and the first `f<digits>` segment there is the issue,
+ * since a project may carry none. Nothing else Pithy composes holds the separator at all.
  */
-function composeFeatureName(headSegment: string, slug: string, tail: string, fixed: string, budget: number): string {
+export function parseFeatureName(name: string): ParsedFeatureName | null {
+  const at = name.indexOf(FEATURE_TAIL_SEPARATOR);
+  if (at < 0 || name.indexOf(FEATURE_TAIL_SEPARATOR, at + 1) >= 0) return null;
+  const thing = name.slice(at + FEATURE_TAIL_SEPARATOR.length);
+  const segments = name.slice(0, at).split("-");
+  const marker = segments.findIndex(isFeatureMarker);
+  if (thing === "" || marker < 1 || marker === segments.length - 1) return null;
+  if (segments.some((segment) => segment === "")) return null;
+  return {
+    project: segments.slice(0, marker).join("-"),
+    issue: (segments[marker] as string).slice(1).replace(/^0+(?=[0-9])/, ""),
+    slug: segments.slice(marker + 1).join("-"),
+    thing,
+  };
+}
+
+/**
+ * **Is this name one this feature composes?** The ownership check the isolation gates ask (#643).
+ *
+ * Parsed, never prefix-matched, and exact: the name's project, issue and slug are this feature's, character for
+ * character. `<project>-f<issue>-` is shared by every branch of one issue, so a prefix match reached siblings; and
+ * a fitted form of the slug, which this used to accept, is a short hash some sibling can have as its whole slug
+ * (`feature/12-login` owned `feature/12-c`). No feature name is fitted any more ({@link composeFeatureName}), so
+ * there is nothing but the slug itself to accept.
+ */
+export function isFeatureOwnedName(identity: FeatureIdentity, name: string): boolean {
+  const parsed = parseFeatureName(name);
+  if (parsed === null) return false;
+  return (
+    parsed.project === kebab(identity.project) &&
+    parsed.issue === canonicalIssue(identity.issue) &&
+    parsed.slug === kebab(identity.slug)
+  );
+}
+
+/** A feature's project and issue: everything its names are derived from but the slug. */
+export type FeatureHead = Pick<FeatureIdentity, "project" | "issue">;
+
+/**
+ * **The longest slug one feature name leaves room for** — `limit` less `<project>-f<issue>-`, the
+ * {@link FEATURE_TAIL_SEPARATOR}, and `thing`, which is everything after it. Zero or less when `thing` leaves none.
+ */
+export function featureSlugRoom(parts: FeatureHead, thing: string, limit: number): number {
+  return limit - head(parts).length - 1 - FEATURE_TAIL_SEPARATOR.length - thing.length;
+}
+
+/**
+ * Compose `<head>-<slug>--<tail><fixed>` whole, or refuse (#643).
+ *
+ * **Never truncated.** A fitted slug was a short hash, and a hash is a slug some sibling branch can have: the
+ * review of 4828e1fc found `feature/12-login` owning `feature/12-c`'s names, and two long slugs of one issue
+ * composing one database. A name that does not fit is refused, naming the longest slug that does, and
+ * `pithy feature create` and `pithy provision --feature` refuse the branch before anything exists
+ * ({@link assertFeatureSlugFits}). This is the backstop behind them: no path composes a feature name that is not
+ * exactly its feature's.
+ */
+function composeFeatureName(
+  parts: FeatureHead,
+  slug: string,
+  tail: string,
+  fixed: string,
+  limit: number,
+  label: string,
+): string {
+  const headSegment = head(parts);
   for (const [role, value] of [
     ["slug", slug],
     ["binding or worker", tail],
@@ -90,22 +214,85 @@ function composeFeatureName(headSegment: string, slug: string, tail: string, fix
     });
   }
 
-  const inner = budget - fixed.length;
-  let tailSegment = tail;
-  let slugBudget = inner - headSegment.length - 1 - (1 + tailSegment.length);
+  const thing = `${tail}${fixed}`;
+  const room = featureSlugRoom(parts, thing, limit);
+  if (room < 1) {
+    throw new ValidationError({
+      message: `"${thing}" is too long for a feature's ${label.replace(/^an? /, "")}.`,
+      action: `Shorten it. ${label[0]?.toUpperCase()}${label.slice(1)} stops at ${limit}, and ${headSegment}-<slug>-- comes first.`,
+      detail: `${headSegment}-<slug>--${thing} leaves ${room} characters for a slug.`,
+    });
+  }
+  if (slug.length > room) {
+    throw new ValidationError({
+      message: `Slug "${slug}" is ${slug.length} characters. ${label[0]?.toUpperCase()}${label.slice(1)} ${headSegment}-<slug>--${thing} leaves room for at most ${room}.`,
+      action: "Use a shorter branch slug.",
+      detail: `${headSegment}-${slug}--${thing} is ${headSegment.length + 1 + slug.length + FEATURE_TAIL_SEPARATOR.length + thing.length} characters; the limit is ${limit}. Feature names are never truncated.`,
+    });
+  }
+  return `${headSegment}-${slug}${FEATURE_TAIL_SEPARATOR}${thing}`;
+}
 
-  if (slugBudget < MIN_SLUG_BUDGET) {
-    // The tail is eating the name — truncate it too, reserving the slug its minimum.
-    const tailBudget = inner - headSegment.length - 1 - MIN_SLUG_BUDGET - 1;
-    tailSegment = fitSegment(tailSegment, Math.max(1, tailBudget));
-    slugBudget = inner - headSegment.length - 1 - (1 + tailSegment.length);
+/** One kind of name a feature composes, as far as its slug budget reads it. */
+export interface FeatureNameShape {
+  /** How an error names the namespace, e.g. `a Workflow name`. */
+  label: string;
+  /** The longest name the namespace takes. */
+  limit: number;
+  /** Everything after {@link FEATURE_TAIL_SEPARATOR}, e.g. `email-suppressions-d1`. */
+  thing: string;
+}
+
+/** The longest slug every one of `shapes` leaves room for, for this project and issue, and the shape that sets it. */
+export function tightestFeatureShape(
+  parts: FeatureHead,
+  shapes: readonly FeatureNameShape[],
+): { max: number; shape: FeatureNameShape | null } {
+  let max = Number.POSITIVE_INFINITY;
+  let shape: FeatureNameShape | null = null;
+  for (const candidate of shapes) {
+    const room = featureSlugRoom(parts, candidate.thing, candidate.limit);
+    if (room < max) {
+      max = room;
+      shape = candidate;
+    }
   }
+  return { max, shape };
+}
 
-  return `${headSegment}-${fitSegment(slug, Math.max(1, slugBudget))}-${tailSegment}${fixed}`;
+/** The longest slug a feature of this project and issue may have, across every name it composes. */
+export function maxFeatureSlug(parts: FeatureHead, shapes: readonly FeatureNameShape[]): number {
+  return tightestFeatureShape(parts, shapes).max;
 }
 
 /**
- * The full Cloudflare resource name for a feature's binding — `<project>-f<issue>-<slug>-<binding>-<kind>`.
+ * **Refuse a branch whose slug cannot fit every name its feature composes (#643).** The one refusal
+ * `pithy feature create` and `pithy provision --feature` make, before a worktree or a resource exists, with the
+ * project's maximum in the message. {@link composeFeatureName} refuses the same slug one name at a time; this says
+ * it once, for all of them.
+ */
+export function assertFeatureSlugFits(identity: FeatureIdentity, shapes: readonly FeatureNameShape[]): void {
+  const { max, shape } = tightestFeatureShape(identity, shapes);
+  const slug = kebab(identity.slug);
+  if (shape === null || slug.length <= max) return;
+  const issue = canonicalIssue(identity.issue);
+  const project = kebab(identity.project);
+  if (max < 1) {
+    throw new ValidationError({
+      message: `"${shape.thing}" leaves no room for a slug in ${project}'s features.`,
+      action: `Shorten it. ${shape.label[0]?.toUpperCase()}${shape.label.slice(1)} stops at ${shape.limit}.`,
+      detail: `${head(identity)}-<slug>--${shape.thing} leaves ${max} characters for a slug.`,
+    });
+  }
+  throw new ValidationError({
+    message: `Slug "${slug}" is ${slug.length} characters. Feature slugs in ${project} stop at ${max} characters at issue ${issue}.`,
+    action: `Name the branch feature/${issue}-<slug of ${max} or fewer>. Feature names are never truncated.`,
+    detail: `${shape.label} ${head(identity)}-<slug>--${shape.thing} is held to ${shape.limit} characters.`,
+  });
+}
+
+/**
+ * The full Cloudflare resource name for a feature's binding — `<project>-f<issue>-<slug>--<binding>-<kind>`.
  *
  * Held to **R2's 63**, the strictest of the three kinds a feature provisions, so one shape is legal for
  * all of them: lowercase, hyphenated, alphanumeric at both ends. A D1 or KV name could be longer, but a
@@ -113,17 +300,18 @@ function composeFeatureName(headSegment: string, slug: string, tail: string, fix
  */
 export function featureResourceName(identity: FeatureIdentity, binding: string, kind: FeatureResourceKind): string {
   return composeFeatureName(
-    head(identity),
+    identity,
     kebab(identity.slug),
     kebab(binding),
     `-${kind}`,
     NAMESPACE_LIMITS.r2.maxLength,
+    NAMESPACE_LIMITS.r2.label,
   );
 }
 
 /**
  * The CF Secrets Store entry name holding one of a feature's **environment-scoped** secrets —
- * `<project>-f<issue>-<slug>-<secret>`.
+ * `<project>-f<issue>-<slug>--<secret>`.
  *
  * A Cloudflare account has one Secrets Store, flat and unpartitionable, so the entry name is the only
  * partition there is. A feature therefore needs its own names for the same reason it needs its own
@@ -133,21 +321,22 @@ export function featureResourceName(identity: FeatureIdentity, binding: string,
  * no documented Cloudflare cap, and holding it to the strictest kind's would hash
  * `secrets-encryption-keys` down to nothing for no reason.
  *
- * A `global` secret is not named here at all: it is one account-level value every environment binds,
- * so a feature binds the project's `<project>-global-<secret>` rather than minting a second copy.
+ * A `global` secret is named here too since #643: a feature shares nothing with any other environment, so
+ * its entry for a global secret is its own rather than the project's `<project>-global-<secret>`.
  */
 export function featureSecretEntryName(identity: FeatureIdentity, secret: string): string {
   return composeFeatureName(
-    head(identity),
+    identity,
     kebab(identity.slug),
     kebab(secret),
     "",
     NAMESPACE_LIMITS.secretEntry.maxLength,
+    NAMESPACE_LIMITS.secretEntry.label,
   );
 }
 
 /**
- * The Worker **script name** for one of a feature's workers — `<project>-f<issue>-<slug>-<worker>`.
+ * The Worker **script name** for one of a feature's workers — `<project>-f<issue>-<slug>--<worker>`.
  *
  * This is the name the feature's Workers deploy under, and therefore the name a sibling's `service`
  * binding must target, so RPC inside a feature environment reaches that feature's deployment rather than
@@ -159,11 +348,58 @@ export function featureSecretEntryName(identity: FeatureIdentity, secret: string
  * has a charset rule and no length rule, so nothing upstream was going to stop it either.
  *
  * **`app` is the `apps/<app>` directory, never the deploy name.** A scaffolded Worker deploys as
- * `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>-<project>-<app>` — the
+ * `<project>-<app>`, and handing that here composed `<project>-f<issue>-<slug>--<project>-<app>` — the
  * project twice, spent out of the budget above (#587). This function takes a string and cannot tell the
  * two apart, so the provisioning path reaches it only through `featureScope`, which is handed both names
  * and picks.
  */
 export function featureWorkerName(identity: FeatureIdentity, app: string): string {
-  return composeFeatureName(head(identity), kebab(identity.slug), kebab(app), "", NAMESPACE_LIMITS.worker.maxLength);
+  return composeFeatureName(
+    identity,
+    kebab(identity.slug),
+    kebab(app),
+    "",
+    NAMESPACE_LIMITS.worker.maxLength,
+    NAMESPACE_LIMITS.worker.label,
+  );
+}
+
+/**
+ * The deployed name of one of a feature's **Workflows** — `<project>-f<issue>-<slug>--<capability>-<job>` (#643).
+ *
+ * A Workflow name is account-wide, like a Worker's, so a feature's email host cannot run
+ * `<project>-feature-email-send`: every open branch would deploy the same Workflow over every other's. It takes
+ * the feature's head instead, exactly as its host Worker does ({@link featureWorkerName}), so the Worker and the
+ * Workflows it hosts are recognizably one feature's and teardown recomputes both from the identity.
+ *
+ * Held to the **Workflow** limit ({@link NAMESPACE_LIMITS.workflow}), and fitted the way every feature name is:
+ * the slug gives way first, then the `<capability>-<job>` tail, deterministically.
+ */
+export function featureWorkflowName(identity: FeatureIdentity, capability: string, job: string): string {
+  return composeFeatureName(
+    identity,
+    kebab(identity.slug),
+    `${kebab(capability)}-${kebab(job)}`,
+    "",
+    NAMESPACE_LIMITS.workflow.maxLength,
+    NAMESPACE_LIMITS.workflow.label,
+  );
+}
+
+/**
+ * The name of one of a feature's **Vectorize indexes** — `<project>-f<issue>-<slug>--<thing>` (#643).
+ *
+ * An index name is account-wide, so a feature's vector host cannot bind `<project>-feature-vector-<index>`: every
+ * open branch would read and write one index. Held to the Vectorize limit and fitted the way every feature name
+ * is, so teardown recomputes it from the identity.
+ */
+export function featureVectorizeIndexName(identity: FeatureIdentity, thing: string): string {
+  return composeFeatureName(
+    identity,
+    kebab(identity.slug),
+    kebab(thing),
+    "",
+    NAMESPACE_LIMITS.vectorizeIndex.maxLength,
+    NAMESPACE_LIMITS.vectorizeIndex.label,
+  );
 }

package/src/naming/limits.ts

@@ -33,6 +33,9 @@ export type LimitSource = "cloudflare" | "pithy";
  * **`truncate`** where Pithy recomputes the name from the same inputs on every command — a D1
  * database, a KV namespace, a bucket, a secret entry, a token. Truncation is deterministic and
  * hash-disambiguated, so provision and teardown still agree, and a failed CI run is avoided.
+ *
+ * **A feature's names are refused in every namespace, whatever its policy here (#643).** A fitted slug is a
+ * short hash, and a hash is a slug another branch can have whole; see `composeFeatureName` in `./feature`.
  */
 export type OverflowPolicy = "refuse" | "truncate";
 
@@ -162,11 +165,25 @@ export const MAX_ISSUE_DIGITS = 6;
 /**
  * The slug length a feature resource name keeps verbatim at the worst legal project name.
  *
- * Twelve, because that is where a feature slug stops being readable in a listing: below it,
- * `fitSegment` has to fall back to a short head plus a six-hex disambiguator, and
- * `acme-f95-medi-8f21c4-db-d1` tells a human nothing about which branch owns the database.
+ * Eleven — it was twelve until {@link FEATURE_TAIL_SEPARATOR} took a character of it (#643). About where a
+ * feature slug stops being readable in a listing. A slug past a feature's budget is refused, not fitted (#643),
+ * so this is the room the project-name cap guarantees every project's features at the worst legal input.
+ */
+export const MIN_LEGIBLE_SLUG = 11;
+
+/**
+ * **What stands between a feature's slug and whatever it names: two hyphens (#643).**
+ *
+ * `<project>-f<issue>-<slug>--<thing>`. Nothing else Pithy composes can contain it: every other segment is
+ * kebabbed, and a kebab never holds two hyphens in a row. So a name holding it is a feature's and a name without
+ * it is not — `acme`'s `staging` can never compose a feature's name, whatever its project or environment is
+ * called — and it ends the slug unambiguously, so `feature/12-x` binding `PROD_DB` and `feature/12-x-prod`
+ * binding `DB` no longer compose one database between them.
+ *
+ * It cost the slug a character: {@link MIN_LEGIBLE_SLUG} gave one up so {@link FEATURE_DERIVED_PROJECT_NAME},
+ * and with it every project name already accepted, stays where it was.
  */
-export const MIN_LEGIBLE_SLUG = 12;
+export const FEATURE_TAIL_SEPARATOR = "--";
 
 /**
  * The binding length a feature resource name keeps verbatim at the worst legal project name.
@@ -199,7 +216,7 @@ export const WORKFLOW_DERIVED_PROJECT_NAME =
   NAMESPACE_LIMITS.workflow.maxLength - 1 - MAX_ENVIRONMENT_NAME - 1 - MAX_CAPABILITY_JOB;
 
 /**
- * What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>-<binding>-<kind>`,
+ * What the longest feature resource name leaves a project — `<project>-f<issue>-<slug>--<binding>-<kind>`,
  * against R2's 63 (the strictest of the three kinds a feature provisions, and the same number a
  * feature Worker script gets).
  *
@@ -207,8 +224,8 @@ export const WORKFLOW_DERIVED_PROJECT_NAME =
  *     63   an R2 bucket name (NAMESPACE_LIMITS.r2)
  *   -  2   `-f`
  *   -  6   the issue number, six digits — `f999999` (MAX_ISSUE_DIGITS)
- *   - 13   `-` + a legible slug (MIN_LEGIBLE_SLUG)
- *   - 13   `-` + a binding kept whole (MIN_VERBATIM_BINDING)
+ *   - 12   `-` + a legible slug (MIN_LEGIBLE_SLUG)
+ *   - 14   `--` + a binding kept whole (FEATURE_TAIL_SEPARATOR, MIN_VERBATIM_BINDING)
  *   -  3   `-` + the kind, `d1` | `kv` | `r2`
  *   ----
  *     26
@@ -219,5 +236,5 @@ export const FEATURE_DERIVED_PROJECT_NAME =
   2 -
   MAX_ISSUE_DIGITS -
   (1 + MIN_LEGIBLE_SLUG) -
-  (1 + MIN_VERBATIM_BINDING) -
+  (FEATURE_TAIL_SEPARATOR.length + MIN_VERBATIM_BINDING) -
   (1 + MAX_FEATURE_KIND);

package/src/naming/provisionScope.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 import { InternalError, ValidationError } from "../error/pithyError";
+import type { WorkflowHostNameParts } from "../workflow/naming";
 import { assertValidEnvironment, FEATURE_ENVIRONMENT, GLOBAL_SCOPE, isFeatureMarker } from "./environment";
 import {
   type FeatureIdentity,
@@ -171,11 +172,22 @@ export interface ProvisionScope {
   /**
    * This scope's CF Secrets Store entry name for a declared secret.
    *
-   * A `global` secret is the one name that does **not** take the scope's segment: it is a single
-   * account-level value every environment binds, so every scope resolves it to the project's
-   * `<project>-global-<secret>`. Scoping it would mint a second copy of a value defined as one.
+   * In a declared environment a `global` secret is the one name that does **not** take the scope's segment:
+   * it is a single account-level value every declared environment binds, so it resolves to the project's
+   * `<project>-global-<secret>`. A feature is the exception — it shares nothing with any other environment,
+   * so its entry for a `global` secret is its own (#643). See {@link featureScope}.
    */
   secretEntry(secret: string, secretScope: SecretNameScope): string;
+  /**
+   * What a capability's host Worker and its Workflows are named from in this scope — handed, with the
+   * capability, to `workflowHostName` and `workflowScriptName`. It is what an app Worker's cross-script
+   * `workflows` entry and the host's own config are both composed from (#643).
+   *
+   * On the scope for the reason every other name is: a declared environment composes
+   * `<project>-<env>-<capability>[-<job>]`, and a feature composes `<project>-f<issue>-<slug>-…`, because
+   * `<project>-feature-email-send` would be one Workflow every open branch deployed over every other's.
+   */
+  readonly workflowHost: Omit<WorkflowHostNameParts, "capability">;
 }
 
 /** The wrangler binding array a resource kind's name is composed for. */
@@ -331,6 +343,7 @@ export function environmentScope(project: string, environment: string): Provisio
     },
     secretEntry: (secret, secretScope) =>
       secretEntryName(project, secret, secretScope, () => names.secretEntry(secret)),
+    workflowHost: { project, env: environment },
   };
 }
 
@@ -341,14 +354,16 @@ export function environmentScope(project: string, environment: string): Provisio
  * Its stanza is {@link FEATURE_ENVIRONMENT} and nothing else, which is what makes a feature's resources
  * in a declared environment's stanza unexpressible rather than merely discouraged.
  *
- * **A feature takes a binding's {@link BindingNaming} and ignores it — and that is the asymmetry against
- * `secretEntry` one line below, which honors `global` here as everywhere.** A global *secret* is a value
- * defined once for the project, so a feature binds the project's copy rather than minting a second: it is
- * **read**. A global *database* is a resource a feature would **migrate** — `provisionFeature` runs
- * `pithy migrate` against everything it names — so honoring `global` here would point one branch's
- * schema changes at the project's live suppression list, and point teardown at it afterwards. A feature
- * owns every resource it names, exactly so that destroying the feature destroys them all; there is no
- * shared name to match and nothing for teardown to spare.
+ * **A feature takes a binding's {@link BindingNaming} and ignores it, and a secret's `global` scope with it.**
+ * A global *database* is a resource a feature would **migrate** — `provisionFeature` runs `pithy migrate`
+ * against everything it names — so honoring `global` would point one branch's schema changes at the project's
+ * live suppression list, and point teardown at it afterwards. A global *secret* went the other way until #643:
+ * a feature bound the project's copy. It no longer does. **Nothing is shared between a feature and any other
+ * feature, staging or prod** — the account and its one Secrets Store are the only containers that cannot be
+ * split, and every entry inside the store is split. So a feature names its own entry for a `global` secret
+ * too: a mintable one is minted for it, and a supplied one is reported missing under the feature's name rather
+ * than bound to the value every environment reads. A feature owns everything it names, exactly so that
+ * destroying the feature destroys it all; there is no shared name to match and nothing for teardown to spare.
  *
  * `resource` is ignored for the same reason it is moot: a feature's `<thing>` segment is the binding plus
  * the kind, and the whole name is recomputed on teardown rather than looked up, so nothing outside the
@@ -372,8 +387,10 @@ export function featureScope(identity: FeatureIdentity): ProvisionScope {
     // The directory, not the deploy name: the head already carries the project, and the deploy name
     // usually leads with it too, which composed `<project>-f<issue>-<slug>-<project>-<app>` (#587).
     worker: ({ app }) => featureWorkerName(identity, app),
-    secretEntry: (secret, secretScope) =>
-      secretEntryName(identity.project, secret, secretScope, () => featureSecretEntryName(identity, secret)),
+    // Every entry the feature's, `global` included: see the docstring above.
+    secretEntry: (secret) => featureSecretEntryName(identity, secret),
+    // `env` is the stanza — what the host's `ENVIRONMENT` var says — and `feature` is what its names take.
+    workflowHost: { project: identity.project, env: FEATURE_ENVIRONMENT, feature: identity },
   };
 }
 
@@ -401,6 +418,14 @@ export function featureScope(identity: FeatureIdentity): ProvisionScope {
  */
 export function featureWorkerScriptNames(identity: FeatureIdentity, worker: ProvisionWorkerNames): string[] {
   const current = featureScope(identity).worker(worker);
-  const beforeSingleProject = featureWorkerName(identity, worker.script);
+  let beforeSingleProject: string;
+  try {
+    beforeSingleProject = featureWorkerName(identity, worker.script);
+  } catch (error) {
+    // Too long to compose whole (#643). The release that deployed that shape fitted it with a hash instead, so no
+    // exact name here would reach it anyway; teardown reaches the current name, which always composes.
+    if (error instanceof ValidationError) return [current];
+    throw error;
+  }
   return current === beforeSingleProject ? [current] : [current, beforeSingleProject];
 }

package/src/seed/seed.ts

@@ -163,8 +163,10 @@ export interface SeedPrepareContext {
   /** The project name (the root `pithy.config.ts` `name`), for messages and per-project lookups. */
   project: string;
   /**
-   * Where this Worker answers locally — `http://localhost:8807` and the like. `null` outside `dev`, and
-   * `null` in a checkout that was never allocated a port block.
+   * Where this Worker answers — in `dev`, locally, `http://localhost:8807` and the like; off `dev`, its own
+   * address (#643): a declared environment's declared one, a feature's `https://<script>.<subdomain>.workers.dev`.
+   * `pithy seed --host` overrides it. `null` in a checkout that was never allocated a port block, and for a
+   * deployed Worker with no address at all.
    *
    * The one address a fixture cannot write down. A dev port is *allocated*, not configured: a checkout
    * reserves a block and pins one port per Worker into `.dev.config.json`, so `http://localhost:8787` is
@@ -181,17 +183,44 @@ export interface SeedPrepareContext {
    * moves. Identity must not.
    *
    * **`null` is an answer, never a guess.** A plain clone that has never run `pithy dev`, a Worker added
-   * after the block was pinned, or any environment but `dev` — a deployed environment's address is
-   * declared rather than allocated, and `pithy env` is what answers it. An invented origin would be
-   * indistinguishable from a real one, so a set that cannot work without one refuses and says so.
+   * after the block was pinned, or a deployed Worker that declares no address and has none to derive. An
+   * invented origin would be indistinguishable from a real one, so a set that cannot work without one
+   * refuses and says so.
    */
   origin: string | null;
   /**
    * Read one of this environment's secrets by name, or `undefined` when it is not set. Local dev resolves
-   * every secret from `.dev.vars`, so this answers there; a deployed environment's secrets are not on the
-   * operator's disk, and a set that needs one must therefore be `dev`-only.
+   * every secret from the dev secrets file, so this answers there; a deployed environment's secrets are not
+   * on the operator's disk, so there it refuses, and a set that needs one must be `dev`-only. A feature is a
+   * deployed environment here too (#643): its secrets exist only in its own Cloudflare stores, which the CLI
+   * can write and never read.
    */
   secret: (name: string) => Promise<string | undefined>;
+  /**
+   * The value **this run just minted** for a secret, or `undefined` — never what the environment holds.
+   *
+   * `pithy provision` creates a random value for every `cf-secrets-store` secret the registry declares
+   * mintable, writes it into the account's Secrets Store, and lets it go. The Secrets Store is write-only
+   * from the CLI, so that write is the only moment the value exists anywhere the toolchain can see it —
+   * and provisioning migrates and seeds in the same process, a few steps later. A fixture that must
+   * *seal* something at creation time (encrypt a private key under the environment's key-encryption
+   * secret, derive an id that the running app will re-derive) can only do it then. Afterwards the value
+   * is unrecoverable by design.
+   *
+   * **This is not {@link secret}, and the two are not interchangeable.** `secret` answers what the
+   * environment holds and refuses outside `dev`, absolutely (#159); that rule is untouched. This answers
+   * the strictly narrower question *did this run create one, a moment ago, in memory*. A set asking here
+   * for a secret this run did not mint gets `undefined` wherever it runs, in `dev` or anywhere else.
+   *
+   * **Synchronous, because it cannot fetch.** There is no file to open and no request to make; a promise
+   * in this signature would suggest otherwise.
+   *
+   * **Empty is ordinary.** A re-run mints nothing — absence is checked before anything is generated — and
+   * a standalone `pithy seed` mints nothing at all. Both answer `undefined` for every name, and neither
+   * is an error. A set that needs a minted value and is handed none says so itself; nothing is invented
+   * on its behalf.
+   */
+  mintedThisRun: (name: string) => string | undefined;
   /**
    * The developer's machine-local preferences for this project, read from the Pithy config directory
    * (`~/.config/pithy/<project>/dev.json`, or `%APPDATA%\pithy\<project>\dev.json` on Windows), parsed but

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.7.3";
+export const PACKAGE_VERSION = "0.8.0";