@pithy-sh/support 0.4.0 → 0.5.0

package/dist/data/message.d.ts

@@ -51,13 +51,7 @@ export declare const SupportMessage: z.ZodObject<{
         email: "email";
     }>;
     submittedByUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    context: z.ZodOptional<z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        screen: z.ZodOptional<z.ZodString>;
-        appVersion: z.ZodOptional<z.ZodString>;
-        platform: z.ZodOptional<z.ZodString>;
-        environment: z.ZodOptional<z.ZodString>;
-        locale: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>, z.ZodObject<{
+    context: z.ZodOptional<z.ZodNullable<import("@pithy-sh/core/src/data/codecs").SqliteJson<z.ZodObject<{
         screen: z.ZodOptional<z.ZodString>;
         appVersion: z.ZodOptional<z.ZodString>;
         platform: z.ZodOptional<z.ZodString>;
@@ -66,7 +60,7 @@ export declare const SupportMessage: z.ZodObject<{
     }, z.core.$strict>>>>;
     mimeMessageId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     mimeInReplyTo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    mimeReferences: z.ZodOptional<z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodString>>>>;
+    mimeReferences: z.ZodOptional<z.ZodNullable<import("@pithy-sh/core/src/data/codecs").SqliteJson<z.ZodArray<z.ZodString>>>>;
     fromAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     fromName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     toAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/data/message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/data/message.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;kBA2DlC,CAAC;AACJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,yHAAyH;AACzH,eAAO,MAAM,mBAAmB,yBAEoF,CAAC;AACrH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwHvB,CAAC;AACL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/data/message.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;kBA2DlC,CAAC;AACJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,yHAAyH;AACzH,eAAO,MAAM,mBAAmB,yBAEoF,CAAC;AACrH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwHvB,CAAC;AACL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/data/tables.d.ts

@@ -82,13 +82,7 @@ export declare const supportTables: {
             email: "email";
         }>;
         submittedByUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        context: z.ZodOptional<z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-            screen: z.ZodOptional<z.ZodString>;
-            appVersion: z.ZodOptional<z.ZodString>;
-            platform: z.ZodOptional<z.ZodString>;
-            environment: z.ZodOptional<z.ZodString>;
-            locale: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>, z.ZodObject<{
+        context: z.ZodOptional<z.ZodNullable<import("@pithy-sh/core/src/data/codecs").SqliteJson<z.ZodObject<{
             screen: z.ZodOptional<z.ZodString>;
             appVersion: z.ZodOptional<z.ZodString>;
             platform: z.ZodOptional<z.ZodString>;
@@ -97,7 +91,7 @@ export declare const supportTables: {
         }, z.core.$strict>>>>;
         mimeMessageId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         mimeInReplyTo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        mimeReferences: z.ZodOptional<z.ZodNullable<z.ZodCodec<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodString>>>>;
+        mimeReferences: z.ZodOptional<z.ZodNullable<import("@pithy-sh/core/src/data/codecs").SqliteJson<z.ZodArray<z.ZodString>>>>;
         fromAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         fromName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         toAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/data/tables.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/data/tables.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAO7B;;;GAGG;AAEH,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAC7D,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AACnE,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAC3E,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMa,CAAC;AAExC,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC;AAEjD,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;AAEpE,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,EAAE,EAAE,UAAU,GAAG,eAAe,CAE/D"}
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/data/tables.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAO7B;;;GAGG;AAEH,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAC3D,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAC7D,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AACnE,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAC3E,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMa,CAAC;AAExC,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC;AAEjD,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;AAEpE,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,EAAE,EAAE,UAAU,GAAG,eAAe,CAE/D"}

package/dist/error/errors.d.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { PithyError } from "@pithy-sh/core/src/error/pithyError";
 import type { MessageParams } from "@pithy-sh/core/src/i18n/catalog";
+import type { UnmarkedString } from "@pithy-sh/core/src/privacy/types";
 /**
  * `@pithy-sh/support` throw sugar. The `support/*` codes live in core's closed `KitErrorPayload` union
  * (CLAUDE.md §Errors: capabilities add their codes to the one union); these subclasses are the
@@ -15,11 +16,11 @@ import type { MessageParams } from "@pithy-sh/core/src/i18n/catalog";
 /** Variable parts each subclass accepts; `code`/`status` are fixed by the subclass. */
 interface SupportErrorArgs {
     /** Override the public, safe-to-expose message. */
-    message?: string;
+    message?: UnmarkedString;
     /** A remediation hint (CLI action line). */
-    action?: string;
+    action?: UnmarkedString;
     /** Internal context for logs + audit. Never serialized to clients. */
-    detail?: string;
+    detail?: UnmarkedString;
     /**
      * Values a translating client interpolates into its own wording for this code. Client-facing, so —
      * unlike `action` and `detail` — these cross the boundary with `message`.

package/dist/error/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/error/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,UAAU,gBAAgB;IACxB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,iEAAiE;AACjE,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,0EAA0E;AAC1E,qBAAa,2BAA4B,SAAQ,UAAU;IACzD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,4FAA4F;AAC5F,qBAAa,8BAA+B,SAAQ,UAAU;IAC5D,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,gGAAgG;AAChG,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,4EAA4E;AAC5E,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,6FAA6F;AAC7F,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/error/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,UAAU,gBAAgB;IACxB,mDAAmD;IACnD,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,iEAAiE;AACjE,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,0EAA0E;AAC1E,qBAAa,2BAA4B,SAAQ,UAAU;IACzD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,4FAA4F;AAC5F,qBAAa,8BAA+B,SAAQ,UAAU;IAC5D,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,gGAAgG;AAChG,qBAAa,oBAAqB,SAAQ,UAAU;IAClD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,4EAA4E;AAC5E,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF;AAED,6FAA6F;AAC7F,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,YAAY,IAAI,GAAE,gBAAqB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAYrE;CACF"}

package/dist/http/routes.d.ts

@@ -76,7 +76,10 @@ import { type HandlerDeps } from "./handlers";
  * `createBackend` mounts **every** capability's middleware before **any** capability's routes, and the
  * adopter's `app` capability composes last — so their middleware runs after auth has resolved the
  * session and before this file's `requireAuth()`. `createBackend.workers.test.ts` pins that ordering,
- * because a paragraph asserting it is not the same as a test failing when it changes.
+ * because a paragraph asserting it is not the same as a test failing when it changes. Readiness guards
+ * (`Capability.readiness`) mount between the two, after every middleware and before every route, and
+ * skip the admin surface; `createBackend.readiness.workers.test.ts` pins that. A check like this one
+ * refuses a caller, not a broken Worker, so it stays in `middleware`.
  *
  * Two consequences worth stating rather than discovering. Their middleware sees `c.var.auth` as **null**
  * on an unauthenticated request, since it runs ahead of the route's own gate — so it should pass those

package/dist/http/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAM7E,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAEL,KAAK,WAAW,EAUjB,MAAM,YAAY,CAAC;AA+BpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE;AAuCD,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAoJtG"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAM7E,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAEL,KAAK,WAAW,EAUjB,MAAM,YAAY,CAAC;AA+BpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE;AAuCD,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAoJtG"}

package/dist/provision/provisionSupport.d.ts

@@ -48,6 +48,13 @@ export declare function supportRoutingRuleName(project: string): string;
  * audits and deletes under cannot drift from the name it deploys under.
  */
 export declare function supportWorkerName(project: string, env: ManagedEnvironment): string;
+/**
+ * The Workflows the classification worker is deployed with in one environment —
+ * `<project>-<env>-support-classify`. Derived by the call `resolveSupportConfig` deploys with, so teardown
+ * deletes the names provision created and no others (#789). Deleting a Worker does not delete the
+ * Workflows registered against it.
+ */
+export declare function supportWorkflowNames(project: string, env: ManagedEnvironment): string[];
 /** The live Cloudflare/wrangler seam. Each step must be idempotent. */
 export interface SupportProvisioner {
     /**
@@ -145,6 +152,11 @@ export interface SupportDeprovisioner {
      * environment before it removes the bucket or the rule they share (#591).
      */
     hasWorker(env: ManagedEnvironment): Promise<boolean>;
+    /**
+     * Delete the env's classification Workflows, by {@link supportWorkflowNames}. Idempotent (a Workflow already
+     * gone is a no-op). Deleting the worker leaves them registered, so they go first (#789).
+     */
+    deleteWorkflows(env: ManagedEnvironment): Promise<void>;
     /** Delete the env's classification worker. Idempotent. */
     deleteWorker(env: ManagedEnvironment): Promise<void>;
     /**
@@ -187,7 +199,7 @@ export interface SupportDeprovisionResult {
  *    is every environment's support history — so they go with the last environment, never a staging teardown.
  * 3. Remove the routing rule, when asked, **first**: stop new mail arriving before removing the worker that would
  *    have handled it.
- * 4. Delete the environment's worker, then — only when asked — the bucket and everything in it.
+ * 4. Delete the environment's Workflows, then its worker, then — only when asked — the bucket and everything in it.
  */
 export declare function deprovisionSupport(deprovisioner: SupportDeprovisioner, target: DeprovisionTarget, options?: SupportDeprovisionOptions): Promise<SupportDeprovisionResult>;
 //# sourceMappingURL=provisionSupport.d.ts.map

package/dist/provision/provisionSupport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIlF,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAExB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/G;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,sGAAsG;IACtG,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClG,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,sGAAsG;IACtG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,GAAG,EAAE,kBAAkB,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAUnC"}
+{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAKlF,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAExB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAIvF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/G;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,sGAAsG;IACtG,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClG,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,sGAAsG;IACtG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,GAAG,EAAE,kBAAkB,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAWnC"}

package/dist/provision/provisionSupport.js

@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
-import { SUPPORT_CAPABILITY } from "../workflows/specs.js";
+import { SUPPORT_CAPABILITY, supportWorkflowRegistry } from "../workflows/specs.js";
 import { GLOBAL_SCOPE } from "@pithy-sh/core/src/naming/environment";
 import { resourceName } from "@pithy-sh/core/src/naming/resource";
 import { resourceNames } from "@pithy-sh/core/src/naming/resourceNames";
+import { hostWorkflowsFor } from "@pithy-sh/core/src/workflow/host";
 import { assertSharedLeavesLast, deprovisionTarget, managedEnvironments } from "@pithy-sh/secrets/src/scope";
 //#region src/provision/provisionSupport.ts
 /**
@@ -61,6 +62,19 @@ function supportWorkerName(project, env) {
 	return resourceNames(project).env(env).worker(SUPPORT_CAPABILITY);
 }
 /**
+* The Workflows the classification worker is deployed with in one environment —
+* `<project>-<env>-support-classify`. Derived by the call `resolveSupportConfig` deploys with, so teardown
+* deletes the names provision created and no others (#789). Deleting a Worker does not delete the
+* Workflows registered against it.
+*/
+function supportWorkflowNames(project, env) {
+	return hostWorkflowsFor(supportWorkflowRegistry, {
+		project,
+		capability: SUPPORT_CAPABILITY,
+		env
+	}).workflows.map((workflow) => workflow.name);
+}
+/**
 * Provision the support infrastructure.
 *
 * The order matters and is the inverse of how it fails: the bucket exists before a worker that could
@@ -111,7 +125,7 @@ async function provisionSupport(provisioner, environments) {
 *    is every environment's support history — so they go with the last environment, never a staging teardown.
 * 3. Remove the routing rule, when asked, **first**: stop new mail arriving before removing the worker that would
 *    have handled it.
-* 4. Delete the environment's worker, then — only when asked — the bucket and everything in it.
+* 4. Delete the environment's Workflows, then its worker, then — only when asked — the bucket and everything in it.
 */
 async function deprovisionSupport(deprovisioner, target, options = {}) {
 	const env = deprovisionTarget(target);
@@ -123,6 +137,7 @@ async function deprovisionSupport(deprovisioner, target, options = {}) {
 		flag: "--routing-zone"
 	}] : []]);
 	const routingRuleRemoved = options.removeRouting ? (await deprovisioner.removeRoutingRule()).removed : false;
+	await deprovisioner.deleteWorkflows(env);
 	await deprovisioner.deleteWorker(env);
 	if (options.deleteStorage) await deprovisioner.deleteBucket();
 	return {
@@ -131,4 +146,4 @@ async function deprovisionSupport(deprovisioner, target, options = {}) {
 	};
 }
 //#endregion
-export { deprovisionSupport, provisionSupport, supportRoutingRuleName, supportWorkerName };
+export { deprovisionSupport, provisionSupport, supportRoutingRuleName, supportWorkerName, supportWorkflowNames };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.4.0";
+export declare const PACKAGE_VERSION = "0.5.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.4.0";
+const PACKAGE_VERSION = "0.5.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -26,7 +26,7 @@
   },
   "scripts": {
     "build": "tsdown && tsc -p tsconfig.build.json && bun ../../tooling/build/src/stampDeclarations.ts",
-    "typecheck": "tsc -p tsconfig.json",
+    "typecheck": "bun check -p tsconfig.json",
     "test": "vitest run",
     "test:node": "vitest run --project=node",
     "test:workers": "vitest run --project=workers",
@@ -40,12 +40,12 @@
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.8.0",
-    "@pithy-sh/core": "^0.10.0",
-    "@pithy-sh/email": "^0.4.0",
-    "@pithy-sh/payments": "^0.4.0",
-    "@pithy-sh/secrets": "^0.4.0",
-    "@pithy-sh/storage": "^0.3.0",
+    "@pithy-sh/auth": "^0.10.0",
+    "@pithy-sh/core": "^0.12.0",
+    "@pithy-sh/email": "^0.6.0",
+    "@pithy-sh/payments": "^0.6.0",
+    "@pithy-sh/secrets": "^0.6.0",
+    "@pithy-sh/storage": "^0.5.0",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"

package/src/error/errors.ts

@@ -3,6 +3,7 @@
 
 import { PithyError } from "@pithy-sh/core/src/error/pithyError";
 import type { MessageParams } from "@pithy-sh/core/src/i18n/catalog";
+import type { UnmarkedString } from "@pithy-sh/core/src/privacy/types";
 
 /**
  * `@pithy-sh/support` throw sugar. The `support/*` codes live in core's closed `KitErrorPayload` union
@@ -18,11 +19,11 @@ import type { MessageParams } from "@pithy-sh/core/src/i18n/catalog";
 /** Variable parts each subclass accepts; `code`/`status` are fixed by the subclass. */
 interface SupportErrorArgs {
   /** Override the public, safe-to-expose message. */
-  message?: string;
+  message?: UnmarkedString;
   /** A remediation hint (CLI action line). */
-  action?: string;
+  action?: UnmarkedString;
   /** Internal context for logs + audit. Never serialized to clients. */
-  detail?: string;
+  detail?: UnmarkedString;
   /**
    * Values a translating client interpolates into its own wording for this code. Client-facing, so —
    * unlike `action` and `detail` — these cross the boundary with `message`.

package/src/http/routes.ts

@@ -125,7 +125,10 @@ import {
  * `createBackend` mounts **every** capability's middleware before **any** capability's routes, and the
  * adopter's `app` capability composes last — so their middleware runs after auth has resolved the
  * session and before this file's `requireAuth()`. `createBackend.workers.test.ts` pins that ordering,
- * because a paragraph asserting it is not the same as a test failing when it changes.
+ * because a paragraph asserting it is not the same as a test failing when it changes. Readiness guards
+ * (`Capability.readiness`) mount between the two, after every middleware and before every route, and
+ * skip the admin surface; `createBackend.readiness.workers.test.ts` pins that. A check like this one
+ * refuses a caller, not a broken Worker, so it stays in `middleware`.
  *
  * Two consequences worth stating rather than discovering. Their middleware sees `c.var.auth` as **null**
  * on an unauthenticated request, since it runs ahead of the route's own gate — so it should pass those

package/src/provision/provisionSupport.ts

@@ -5,6 +5,7 @@ import type { DeclaredEnvironments } from "@pithy-sh/core/src/naming/environment
 import { GLOBAL_SCOPE } from "@pithy-sh/core/src/naming/environment";
 import { resourceName } from "@pithy-sh/core/src/naming/resource";
 import { resourceNames } from "@pithy-sh/core/src/naming/resourceNames";
+import { hostWorkflowsFor } from "@pithy-sh/core/src/workflow/host";
 import {
   assertSharedLeavesLast,
   type DeprovisionTarget,
@@ -12,7 +13,7 @@ import {
   type ManagedEnvironment,
   managedEnvironments,
 } from "@pithy-sh/secrets/src/scope";
-import { SUPPORT_CAPABILITY } from "../workflows/specs";
+import { SUPPORT_CAPABILITY, supportWorkflowRegistry } from "../workflows/specs";
 
 /**
  * The provisioning orchestration for the support capability — the live counterpart to
@@ -67,6 +68,18 @@ export function supportWorkerName(project: string, env: ManagedEnvironment): str
   return resourceNames(project).env(env).worker(SUPPORT_CAPABILITY);
 }
 
+/**
+ * The Workflows the classification worker is deployed with in one environment —
+ * `<project>-<env>-support-classify`. Derived by the call `resolveSupportConfig` deploys with, so teardown
+ * deletes the names provision created and no others (#789). Deleting a Worker does not delete the
+ * Workflows registered against it.
+ */
+export function supportWorkflowNames(project: string, env: ManagedEnvironment): string[] {
+  return hostWorkflowsFor(supportWorkflowRegistry, { project, capability: SUPPORT_CAPABILITY, env }).workflows.map(
+    (workflow) => workflow.name,
+  );
+}
+
 /** The live Cloudflare/wrangler seam. Each step must be idempotent. */
 export interface SupportProvisioner {
   /**
@@ -164,6 +177,11 @@ export interface SupportDeprovisioner {
    * environment before it removes the bucket or the rule they share (#591).
    */
   hasWorker(env: ManagedEnvironment): Promise<boolean>;
+  /**
+   * Delete the env's classification Workflows, by {@link supportWorkflowNames}. Idempotent (a Workflow already
+   * gone is a no-op). Deleting the worker leaves them registered, so they go first (#789).
+   */
+  deleteWorkflows(env: ManagedEnvironment): Promise<void>;
   /** Delete the env's classification worker. Idempotent. */
   deleteWorker(env: ManagedEnvironment): Promise<void>;
   /**
@@ -207,7 +225,7 @@ export interface SupportDeprovisionResult {
  *    is every environment's support history — so they go with the last environment, never a staging teardown.
  * 3. Remove the routing rule, when asked, **first**: stop new mail arriving before removing the worker that would
  *    have handled it.
- * 4. Delete the environment's worker, then — only when asked — the bucket and everything in it.
+ * 4. Delete the environment's Workflows, then its worker, then — only when asked — the bucket and everything in it.
  */
 export async function deprovisionSupport(
   deprovisioner: SupportDeprovisioner,
@@ -220,6 +238,7 @@ export async function deprovisionSupport(
     ...(options.removeRouting ? [{ what: "the inbound routing rule", flag: "--routing-zone" }] : []),
   ]);
   const routingRuleRemoved = options.removeRouting ? (await deprovisioner.removeRoutingRule()).removed : false;
+  await deprovisioner.deleteWorkflows(env);
   await deprovisioner.deleteWorker(env);
   if (options.deleteStorage) await deprovisioner.deleteBucket();
   return { env, routingRuleRemoved };

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/support";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.4.0";
+export const PACKAGE_VERSION = "0.5.0";