@pithy-sh/support 0.2.6 → 0.2.8

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO9E,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AA4ED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,gBAAgB,CAAC;IAC3F,mCAAmC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,wGAAwG;IACxG,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,iBAAiB,CAmGvE;AAED,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAE3F"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO9E,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AA4ED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,gBAAgB,CAAC;IAC3F,mCAAmC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,wGAAwG;IACxG,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,iBAAiB,CAsGvE;AAED,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAE3F"}

package/dist/capability.js

@@ -12,7 +12,7 @@ import { registerSupportRoutes } from "./http/routes.js";
 import { createSupportEmailHandler } from "./inbound/handler.js";
 import { support_0001_threads } from "./migrations/0001_threads.js";
 import { supportExampleSeed } from "./seeds/example.js";
-import { PACKAGE_VERSION } from "./version.generated.js";
+import { PACKAGE_NAME, PACKAGE_VERSION } from "./version.generated.js";
 import { noopEmit } from "@pithy-sh/core/src/audit/recorder";
 import { defineCapability } from "@pithy-sh/core/src/capability/capability";
 import { workflowBindings } from "@pithy-sh/core/src/workflow/bindings";
@@ -141,6 +141,7 @@ function support(options = {}) {
 	const capability = defineCapability({
 		name: "support",
 		version: PACKAGE_VERSION,
+		package: PACKAGE_NAME,
 		dependsOn: ["secrets"],
 		secretRegistry: supportSecretsRegistry,
 		inapplicableSecrets: inapplicableAttachmentSecrets(resolved),

package/dist/provision/provisionSupport.d.ts

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import type { DeclaredEnvironments } from "@pithy-sh/core/src/naming/environment";
-import { type ManagedEnvironment } from "@pithy-sh/secrets/src/scope";
+import { type DeprovisionTarget, type ManagedEnvironment } from "@pithy-sh/secrets/src/scope";
 /**
  * The provisioning orchestration for the support capability — the live counterpart to
  * `pithy add support`'s config wiring.
@@ -131,9 +131,17 @@ export interface SupportProvisionResult {
 export declare function provisionSupport(provisioner: SupportProvisioner, environments: DeclaredEnvironments | readonly string[]): Promise<SupportProvisionResult>;
 /** The teardown seam — the inverse of {@link SupportProvisioner}. Every step idempotent. */
 export interface SupportDeprovisioner {
+    /**
+     * Whether the env's classification worker is deployed. Read-only. What a teardown asks of every *other*
+     * environment before it removes the bucket or the rule they share (#591).
+     */
+    hasWorker(env: ManagedEnvironment): Promise<boolean>;
     /** Delete the env's classification worker. Idempotent. */
     deleteWorker(env: ManagedEnvironment): Promise<void>;
-    /** Remove the inbound routing rule, so mail stops being delivered here. Idempotent. */
+    /**
+     * Remove the inbound routing rule, so mail stops being delivered here. Idempotent. Called only when the teardown
+     * was asked to remove it (`removeRouting`).
+     */
     removeRoutingRule(): Promise<{
         removed: boolean;
     }>;
@@ -145,20 +153,32 @@ export interface SupportDeprovisioner {
 }
 /** Teardown options. By default the bucket is **kept**: it holds correspondence, not cache. */
 export interface SupportDeprovisionOptions {
-    /** Also delete the R2 bucket and its contents. Off by default. */
+    /** Also delete the R2 bucket and its contents. Off by default, and only with the last environment. */
     deleteStorage?: boolean;
+    /** Also remove the inbound routing rule. Off by default, and only with the last environment. */
+    removeRouting?: boolean;
+}
+/** What a support teardown did. */
+export interface SupportDeprovisionResult {
+    /** The one environment torn down. */
+    env: ManagedEnvironment;
+    /** Whether this run removed the inbound routing rule. */
+    routingRuleRemoved: boolean;
 }
 /**
- * Tear down the support infrastructure, reversing {@link provisionSupport}.
+ * Tear down **one named environment's** support infrastructure, reversing {@link provisionSupport} for it.
  *
- * The routing rule goes **first**, and that ordering is the whole point: stop new mail arriving before
- * removing the workers that would have handled it, or messages land in a Worker with no classification
- * host during the teardown. Stored correspondence is preserved unless explicitly requested — losing an
- * adopter's support history to a teardown flag would be unrecoverable.
+ * In order, and the order is the contract:
  *
- * `environments` is the project's declaration from the root `pithy.config.ts` (#241). Every declared
- * environment is provisioned; an environment this skipped would be one the project deploys to with no
- * resources behind it — the silence the closed `ManagedEnvironment` enum used to produce.
+ * 1. Resolve the target (`@pithy-sh/secrets`' `deprovisionTarget`) — refused with nothing read when none was
+ *    named, or one the project does not declare. This used to walk every declared environment, so a run meant
+ *    for staging took production's classification worker with it (#591).
+ * 2. With `removeRouting` or `deleteStorage`: refuse while any other declared environment still runs a
+ *    classification worker (`assertSharedLeavesLast`). The rule and the bucket are one per project — the bucket
+ *    is every environment's support history — so they go with the last environment, never a staging teardown.
+ * 3. Remove the routing rule, when asked, **first**: stop new mail arriving before removing the worker that would
+ *    have handled it.
+ * 4. Delete the environment's worker, then — only when asked — the bucket and everything in it.
  */
-export declare function deprovisionSupport(deprovisioner: SupportDeprovisioner, environments: DeclaredEnvironments | readonly string[], options?: SupportDeprovisionOptions): Promise<void>;
+export declare function deprovisionSupport(deprovisioner: SupportDeprovisioner, target: DeprovisionTarget, options?: SupportDeprovisionOptions): Promise<SupportDeprovisionResult>;
 //# sourceMappingURL=provisionSupport.d.ts.map

package/dist/provision/provisionSupport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIlF,OAAO,EAAE,KAAK,kBAAkB,EAAuB,MAAM,6BAA6B,CAAC;AAG3F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;OAQG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,4FAA4F;IAC5F,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uFAAuF;IACvF,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,EACtD,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAMf"}
+{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIlF,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAExB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;OAQG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,4FAA4F;IAC5F,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,sGAAsG;IACtG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,GAAG,EAAE,kBAAkB,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAUnC"}

package/dist/provision/provisionSupport.js

@@ -4,7 +4,7 @@ import { SUPPORT_CAPABILITY } from "../workflows/specs.js";
 import { GLOBAL_SCOPE } from "@pithy-sh/core/src/naming/environment";
 import { resourceName } from "@pithy-sh/core/src/naming/resource";
 import { resourceNames } from "@pithy-sh/core/src/naming/resourceNames";
-import { managedEnvironments } from "@pithy-sh/secrets/src/scope";
+import { assertSharedLeavesLast, deprovisionTarget, managedEnvironments } from "@pithy-sh/secrets/src/scope";
 //#region src/provision/provisionSupport.ts
 /**
 * The provisioning orchestration for the support capability — the live counterpart to
@@ -99,21 +99,36 @@ async function provisionSupport(provisioner, environments) {
 	};
 }
 /**
-* Tear down the support infrastructure, reversing {@link provisionSupport}.
+* Tear down **one named environment's** support infrastructure, reversing {@link provisionSupport} for it.
 *
-* The routing rule goes **first**, and that ordering is the whole point: stop new mail arriving before
-* removing the workers that would have handled it, or messages land in a Worker with no classification
-* host during the teardown. Stored correspondence is preserved unless explicitly requested — losing an
-* adopter's support history to a teardown flag would be unrecoverable.
+* In order, and the order is the contract:
 *
-* `environments` is the project's declaration from the root `pithy.config.ts` (#241). Every declared
-* environment is provisioned; an environment this skipped would be one the project deploys to with no
-* resources behind it — the silence the closed `ManagedEnvironment` enum used to produce.
+* 1. Resolve the target (`@pithy-sh/secrets`' `deprovisionTarget`) — refused with nothing read when none was
+*    named, or one the project does not declare. This used to walk every declared environment, so a run meant
+*    for staging took production's classification worker with it (#591).
+* 2. With `removeRouting` or `deleteStorage`: refuse while any other declared environment still runs a
+*    classification worker (`assertSharedLeavesLast`). The rule and the bucket are one per project — the bucket
+*    is every environment's support history — so they go with the last environment, never a staging teardown.
+* 3. Remove the routing rule, when asked, **first**: stop new mail arriving before removing the worker that would
+*    have handled it.
+* 4. Delete the environment's worker, then — only when asked — the bucket and everything in it.
 */
-async function deprovisionSupport(deprovisioner, environments, options = {}) {
-	await deprovisioner.removeRoutingRule();
-	for (const env of managedEnvironments(environments)) await deprovisioner.deleteWorker(env);
+async function deprovisionSupport(deprovisioner, target, options = {}) {
+	const env = deprovisionTarget(target);
+	await assertSharedLeavesLast(env, target.declared, (other) => deprovisioner.hasWorker(other), [...options.deleteStorage ? [{
+		what: "the support bucket",
+		flag: "--storage"
+	}] : [], ...options.removeRouting ? [{
+		what: "the inbound routing rule",
+		flag: "--routing-zone"
+	}] : []]);
+	const routingRuleRemoved = options.removeRouting ? (await deprovisioner.removeRoutingRule()).removed : false;
+	await deprovisioner.deleteWorker(env);
 	if (options.deleteStorage) await deprovisioner.deleteBucket();
+	return {
+		env,
+		routingRuleRemoved
+	};
 }
 //#endregion
 export { deprovisionSupport, provisionSupport, supportRoutingRuleName, supportWorkerName };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.2.6";
+export declare const PACKAGE_VERSION = "0.2.8";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.2.6";
+const PACKAGE_VERSION = "0.2.8";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,12 +40,12 @@
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.6.1",
-    "@pithy-sh/core": "^0.6.1",
-    "@pithy-sh/email": "^0.3.3",
-    "@pithy-sh/payments": "^0.3.3",
-    "@pithy-sh/secrets": "^0.2.3",
-    "@pithy-sh/storage": "^0.2.3",
+    "@pithy-sh/auth": "^0.6.3",
+    "@pithy-sh/core": "^0.7.3",
+    "@pithy-sh/email": "^0.3.7",
+    "@pithy-sh/payments": "^0.3.5",
+    "@pithy-sh/secrets": "^0.2.6",
+    "@pithy-sh/storage": "^0.2.6",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"

package/src/capability.ts

@@ -28,7 +28,7 @@ import { support_0001_threads } from "./migrations/0001_threads";
 import { resolveReplies, type SupportReplySnippets } from "./reply/snippets";
 import { inapplicableAttachmentSecrets, SUPPORT_BUCKET_BINDING, supportSecretsRegistry } from "./secret/registry";
 import { supportExampleSeed } from "./seeds/example";
-import { PACKAGE_VERSION } from "./version.generated";
+import { PACKAGE_NAME, PACKAGE_VERSION } from "./version.generated";
 import { supportWorkflows } from "./workflows/specs";
 
 /**
@@ -235,9 +235,12 @@ export function support(options: SupportOptions = {}): SupportCapability {
 
   const capability = defineCapability({
     name: "support",
-    // The package version this capability ships at, stamped by `scripts/stampVersions.ts` — a Worker
-    // cannot read its own package.json. Reported per capability by the control-plane manifest.
+    // The package this capability ships in and the version it ships at, both stamped by
+    // `scripts/stampVersions.ts` — a Worker cannot read its own package.json. Reported per capability by
+    // the control-plane manifest, and reported together: a release feed is keyed by package name, so the
+    // version alone leaves a client guessing the key (#626).
     version: PACKAGE_VERSION,
+    package: PACKAGE_NAME,
     // Attachment presigning reads an R2 credential bundle through @pithy-sh/secrets.
     dependsOn: ["secrets"],
     secretRegistry: supportSecretsRegistry,

package/src/provision/provisionSupport.ts

@@ -5,7 +5,13 @@ import type { DeclaredEnvironments } from "@pithy-sh/core/src/naming/environment
 import { GLOBAL_SCOPE } from "@pithy-sh/core/src/naming/environment";
 import { resourceName } from "@pithy-sh/core/src/naming/resource";
 import { resourceNames } from "@pithy-sh/core/src/naming/resourceNames";
-import { type ManagedEnvironment, managedEnvironments } from "@pithy-sh/secrets/src/scope";
+import {
+  assertSharedLeavesLast,
+  type DeprovisionTarget,
+  deprovisionTarget,
+  type ManagedEnvironment,
+  managedEnvironments,
+} from "@pithy-sh/secrets/src/scope";
 import { SUPPORT_CAPABILITY } from "../workflows/specs";
 
 /**
@@ -146,9 +152,17 @@ export async function provisionSupport(
 
 /** The teardown seam — the inverse of {@link SupportProvisioner}. Every step idempotent. */
 export interface SupportDeprovisioner {
+  /**
+   * Whether the env's classification worker is deployed. Read-only. What a teardown asks of every *other*
+   * environment before it removes the bucket or the rule they share (#591).
+   */
+  hasWorker(env: ManagedEnvironment): Promise<boolean>;
   /** Delete the env's classification worker. Idempotent. */
   deleteWorker(env: ManagedEnvironment): Promise<void>;
-  /** Remove the inbound routing rule, so mail stops being delivered here. Idempotent. */
+  /**
+   * Remove the inbound routing rule, so mail stops being delivered here. Idempotent. Called only when the teardown
+   * was asked to remove it (`removeRouting`).
+   */
   removeRoutingRule(): Promise<{ removed: boolean }>;
   /**
    * Delete the R2 bucket **and everything in it** — every attachment and every raw message an adopter's
@@ -159,30 +173,47 @@ export interface SupportDeprovisioner {
 
 /** Teardown options. By default the bucket is **kept**: it holds correspondence, not cache. */
 export interface SupportDeprovisionOptions {
-  /** Also delete the R2 bucket and its contents. Off by default. */
+  /** Also delete the R2 bucket and its contents. Off by default, and only with the last environment. */
   deleteStorage?: boolean;
+  /** Also remove the inbound routing rule. Off by default, and only with the last environment. */
+  removeRouting?: boolean;
+}
+
+/** What a support teardown did. */
+export interface SupportDeprovisionResult {
+  /** The one environment torn down. */
+  env: ManagedEnvironment;
+  /** Whether this run removed the inbound routing rule. */
+  routingRuleRemoved: boolean;
 }
 
 /**
- * Tear down the support infrastructure, reversing {@link provisionSupport}.
+ * Tear down **one named environment's** support infrastructure, reversing {@link provisionSupport} for it.
  *
- * The routing rule goes **first**, and that ordering is the whole point: stop new mail arriving before
- * removing the workers that would have handled it, or messages land in a Worker with no classification
- * host during the teardown. Stored correspondence is preserved unless explicitly requested — losing an
- * adopter's support history to a teardown flag would be unrecoverable.
+ * In order, and the order is the contract:
  *
- * `environments` is the project's declaration from the root `pithy.config.ts` (#241). Every declared
- * environment is provisioned; an environment this skipped would be one the project deploys to with no
- * resources behind it — the silence the closed `ManagedEnvironment` enum used to produce.
+ * 1. Resolve the target (`@pithy-sh/secrets`' `deprovisionTarget`) — refused with nothing read when none was
+ *    named, or one the project does not declare. This used to walk every declared environment, so a run meant
+ *    for staging took production's classification worker with it (#591).
+ * 2. With `removeRouting` or `deleteStorage`: refuse while any other declared environment still runs a
+ *    classification worker (`assertSharedLeavesLast`). The rule and the bucket are one per project — the bucket
+ *    is every environment's support history — so they go with the last environment, never a staging teardown.
+ * 3. Remove the routing rule, when asked, **first**: stop new mail arriving before removing the worker that would
+ *    have handled it.
+ * 4. Delete the environment's worker, then — only when asked — the bucket and everything in it.
  */
 export async function deprovisionSupport(
   deprovisioner: SupportDeprovisioner,
-  environments: DeclaredEnvironments | readonly string[],
+  target: DeprovisionTarget,
   options: SupportDeprovisionOptions = {},
-): Promise<void> {
-  await deprovisioner.removeRoutingRule();
-  for (const env of managedEnvironments(environments)) {
-    await deprovisioner.deleteWorker(env);
-  }
+): Promise<SupportDeprovisionResult> {
+  const env = deprovisionTarget(target);
+  await assertSharedLeavesLast(env, target.declared, (other) => deprovisioner.hasWorker(other), [
+    ...(options.deleteStorage ? [{ what: "the support bucket", flag: "--storage" }] : []),
+    ...(options.removeRouting ? [{ what: "the inbound routing rule", flag: "--routing-zone" }] : []),
+  ]);
+  const routingRuleRemoved = options.removeRouting ? (await deprovisioner.removeRoutingRule()).removed : false;
+  await deprovisioner.deleteWorker(env);
   if (options.deleteStorage) await deprovisioner.deleteBucket();
+  return { env, routingRuleRemoved };
 }

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/support";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.2.6";
+export const PACKAGE_VERSION = "0.2.8";