Align Spin secret validation with runtime naming and repeated references #341

Description

Align typed-secret validation with the Spin variable naming contract used by the selected runtime bridge, and allow repeated references to the same physical secret. Main’s default Spin runtime lowercases keys; its validator also lowercases them but rejects every repeated resulting variable. Downstream runtimes can encode (store, key) differently (for example a v_ prefix and escapes for uppercase/punctuation), which the current raw-key validator cannot represent.

The cross-adapter portion is already implemented: targeted push/diff validate only the selected adapter, while strict validation can check declared adapters. This issue remains for naming/identity parity and repeated-reference handling.

Steps to reproduce

Inspection-based reproduction (no validation command executed):

1. Inspect current Spin typed-secret validation.
2. Supply two typed fields referencing the identical (store, key); the second occurrence is treated as a collision.
3. Compare downstream encoded names with default Spin runtime lookup and the raw lowercase-only CLI rule.
4. Confirm the already-delivered scope behavior at implemented selected/all-adapter validation scopes.

Expected behavior

Validation and runtime lookup use one explicit naming contract. Identical physical references deduplicate; only distinct references that map to the same native variable collide, with safe source-path diagnostics.

Impact

Typed config can reject valid repeated or app-encoded references and disagree with the runtime actually resolving them. The former unrelated-adapter push blocking is no longer an outstanding mainline gap.

Proposed fix

Define a shared canonical encoder or an explicit application-native naming hook used by runtime and CLI validation. Validate the final variable name and deduplicate physical identities before detecting collisions. Preserve targeted validation and explicit all-adapters portability checks. PR #444 provides related naming/lookup primitives; verify its final consumer/runtime contract rather than assuming it completes every criterion.

Done when

• Runtime lookup and CLI validation share a documented (store, key) to native-variable contract.
• Supported uppercase/punctuation encoding validates when the selected runtime bridge resolves it.
• Identical repeated physical references validate successfully.
• Distinct references with the same final native variable fail, naming both source paths without exposing values.
• Targeted Fastly/Axum/Cloudflare push/diff is not blocked by unrelated Spin checks.
• Contract tests cover encoding, repeated references, true collisions and retained adapter-selection behavior.
• Document the downstream pin/bridge migration needed to adopt the naming contract.

Related

PR #379 and PR #381 delivered adapter selection; PR #444 is partial open follow-up. Trusted Server originally reported this against EdgeZero bb4411625856472b1279a3db49aeeac5e8b1507e.