@pithy-sh/support 0.1.5 → 0.2.0

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO9E,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AA4ED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,gBAAgB,CAAC;IAC3F,mCAAmC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,wGAAwG;IACxG,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,iBAAiB,CA+FvE;AAED,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAE3F"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO9E,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AA4ED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,gBAAgB,CAAC;IAC3F,mCAAmC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,wGAAwG;IACxG,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,iBAAiB,CAmGvE;AAED,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAE3F"}

package/dist/capability.js

@@ -4,7 +4,7 @@ import { resolveReplies } from "./reply/snippets.js";
 import { SupportConfig, supportNeedsBucket } from "./config/config.js";
 import { resolveCategories } from "./data/categories.js";
 import { supportTables } from "./data/tables.js";
-import { supportSecretsRegistry } from "./secret/registry.js";
+import { SUPPORT_BUCKET_BINDING, inapplicableAttachmentSecrets, supportSecretsRegistry } from "./secret/registry.js";
 import { supportWorkflows } from "./workflows/specs.js";
 import { makeResolveDeps } from "./http/resolve.js";
 import { supportAdminRoutes } from "./http/scopes.js";
@@ -133,7 +133,7 @@ function support(options = {}) {
 		},
 		...supportNeedsBucket(resolved) ? [{
 			type: "r2",
-			name: "SUPPORT_BUCKET",
+			name: SUPPORT_BUCKET_BINDING,
 			optional: true
 		}] : [],
 		...workflowBindings(supportWorkflows)
@@ -143,6 +143,7 @@ function support(options = {}) {
 		version: PACKAGE_VERSION,
 		dependsOn: ["secrets"],
 		secretRegistry: supportSecretsRegistry,
+		inapplicableSecrets: inapplicableAttachmentSecrets(resolved),
 		workflows: supportWorkflows,
 		requiredBindings,
 		ciPermissions: ["email:routing"],

package/dist/provision/provisionSupport.d.ts

@@ -120,9 +120,13 @@ export interface SupportProvisionResult {
  * Worker whose classification host is not deployed yet, which is a window where real customer
  * messages arrive and stay `uncategorized` with nothing to say why.
  *
- * `environments` is the project's declaration from the root `pithy.config.ts` (#241). Every declared
- * environment is provisioned; an environment this skipped would be one the project deploys to with no
- * resources behind it — the silence the closed `ManagedEnvironment` enum used to produce.
+ * `environments` is **what the caller determined it can act on**, which the CLI narrows from the project's
+ * declaration (#241) to the environments whose app database exists (pithy-sh/pithy#512). Nothing is
+ * skipped here and nothing decides here: an environment reaching this list is provisioned, and one that
+ * did not was already reported to the operator by name, with why and with the command that fixes it.
+ *
+ * The bucket is created **whatever the list holds, including nothing** — it is one per project, and making
+ * it wait for the last environment to be provisioned is the ordering this change exists to undo.
  */
 export declare function provisionSupport(provisioner: SupportProvisioner, environments: DeclaredEnvironments | readonly string[]): Promise<SupportProvisionResult>;
 /** The teardown seam — the inverse of {@link SupportProvisioner}. Every step idempotent. */

package/dist/provision/provisionSupport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIlF,OAAO,EAAE,KAAK,kBAAkB,EAAuB,MAAM,6BAA6B,CAAC;AAG3F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;OAQG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,4FAA4F;IAC5F,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAYjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uFAAuF;IACvF,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,EACtD,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAMf"}
+{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIlF,OAAO,EAAE,KAAK,kBAAkB,EAAuB,MAAM,6BAA6B,CAAC;AAG3F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;OAQG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,4FAA4F;IAC5F,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,uFAAuF;IACvF,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,EACtD,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/provision/provisionSupport.js

@@ -68,26 +68,33 @@ function supportWorkerName(project, env) {
 * Worker whose classification host is not deployed yet, which is a window where real customer
 * messages arrive and stay `uncategorized` with nothing to say why.
 *
-* `environments` is the project's declaration from the root `pithy.config.ts` (#241). Every declared
-* environment is provisioned; an environment this skipped would be one the project deploys to with no
-* resources behind it — the silence the closed `ManagedEnvironment` enum used to produce.
+* `environments` is **what the caller determined it can act on**, which the CLI narrows from the project's
+* declaration (#241) to the environments whose app database exists (pithy-sh/pithy#512). Nothing is
+* skipped here and nothing decides here: an environment reaching this list is provisioned, and one that
+* did not was already reported to the operator by name, with why and with the command that fixes it.
+*
+* The bucket is created **whatever the list holds, including nothing** — it is one per project, and making
+* it wait for the last environment to be provisioned is the ordering this change exists to undo.
 */
 async function provisionSupport(provisioner, environments) {
 	await provisioner.preflight();
 	const bucket = await provisioner.ensureBucket();
 	const search = [];
-	for (const env of managedEnvironments(environments)) {
+	const deployed = managedEnvironments(environments);
+	for (const env of deployed) {
 		await provisioner.deployWorker(env);
 		search.push({
 			env,
 			...await provisioner.ensureSearchIndex(env)
 		});
 	}
-	const routing = await provisioner.ensureRoutingRule();
 	return {
 		bucket,
-		environments: managedEnvironments(environments),
-		routing,
+		environments: deployed,
+		routing: deployed.length > 0 ? await provisioner.ensureRoutingRule() : {
+			created: false,
+			skipped: true
+		},
 		search
 	};
 }

package/dist/secret/registry.d.ts

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { type SupportConfig } from "../config/config";
 /**
  * The secrets support reads — exactly one, and it is not support's own shape.
  *
@@ -15,6 +16,35 @@
  */
 /** The name support's R2 credential bundle is stored and resolved under, per environment. */
 export declare const SUPPORT_R2_SECRET = "support-r2-credentials";
+/**
+ * The bucket binding it presigns — support's one optional binding, and the one an adopter declines when
+ * attachments are off.
+ *
+ * **Declared, because the relation was prose and a command cannot read prose (#541).** With attachments
+ * declined, `pithy doctor` printed `SUPPORT_BUCKET (r2) declined in pithy.config.ts` and then asked for
+ * `support-r2-credentials` in the same run. The binding is stated on the entry now, so the secrets side
+ * reads the decline the bindings side already reports.
+ */
+export declare const SUPPORT_BUCKET_BINDING = "SUPPORT_BUCKET";
 /** The support capability's secret-registry slice — aggregated into the shared accessor at startup. */
 export declare const supportSecretsRegistry: Record<"support-r2-credentials", import("@pithy-sh/storage/src/secret/registry").R2CredentialsEntry>;
+/**
+ * **The credential this composition cannot reach**, as the `inapplicableSecrets` contribution (#541).
+ *
+ * The headline case of that issue, and the one the binding field alone does not close. Joining a
+ * credential to a **declined** binding only answers for a project that wrote a `declinedBindings` entry;
+ * a project that simply turned attachments off never wrote one, because the binding was never declared
+ * to decline — {@link supportNeedsBucket} suppresses it at composition. So `pithy doctor` kept asking
+ * for `support-r2-credentials` on exactly the configuration the issue opens with.
+ *
+ * **The predicate already existed.** Support has answered *would this configuration ever put a byte in
+ * `SUPPORT_BUCKET`* since #440, in one place, for the binding and the provisioner both. This is the
+ * third caller of the same answer rather than a fourth reading of the three settings behind it — which
+ * is the arrangement #440 landed precisely so that two callers could not disagree.
+ *
+ * The reason names the settings an operator would edit, all three of them, because any one of them
+ * turns the bucket back on and a sentence naming only `attachments.enabled` would send a reader to the
+ * wrong line.
+ */
+export declare function inapplicableAttachmentSecrets(config: SupportConfig): Record<string, string>;
 //# sourceMappingURL=registry.d.ts.map

package/dist/secret/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/secret/registry.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;GAYG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,sGAA2C,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/secret/registry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AAE1E;;;;;;;;;;;;GAYG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,sGAAmE,CAAC;AAEvG;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F"}

package/dist/secret/registry.js

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { supportNeedsBucket } from "../config/config.js";
 import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
 //#region src/secret/registry.ts
 /**
@@ -17,7 +18,39 @@ import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
 */
 /** The name support's R2 credential bundle is stored and resolved under, per environment. */
 const SUPPORT_R2_SECRET = "support-r2-credentials";
+/**
+* The bucket binding it presigns — support's one optional binding, and the one an adopter declines when
+* attachments are off.
+*
+* **Declared, because the relation was prose and a command cannot read prose (#541).** With attachments
+* declined, `pithy doctor` printed `SUPPORT_BUCKET (r2) declined in pithy.config.ts` and then asked for
+* `support-r2-credentials` in the same run. The binding is stated on the entry now, so the secrets side
+* reads the decline the bindings side already reports.
+*/
+const SUPPORT_BUCKET_BINDING = "SUPPORT_BUCKET";
 /** The support capability's secret-registry slice — aggregated into the shared accessor at startup. */
-const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET);
+const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET, SUPPORT_BUCKET_BINDING);
+/**
+* **The credential this composition cannot reach**, as the `inapplicableSecrets` contribution (#541).
+*
+* The headline case of that issue, and the one the binding field alone does not close. Joining a
+* credential to a **declined** binding only answers for a project that wrote a `declinedBindings` entry;
+* a project that simply turned attachments off never wrote one, because the binding was never declared
+* to decline — {@link supportNeedsBucket} suppresses it at composition. So `pithy doctor` kept asking
+* for `support-r2-credentials` on exactly the configuration the issue opens with.
+*
+* **The predicate already existed.** Support has answered *would this configuration ever put a byte in
+* `SUPPORT_BUCKET`* since #440, in one place, for the binding and the provisioner both. This is the
+* third caller of the same answer rather than a fourth reading of the three settings behind it — which
+* is the arrangement #440 landed precisely so that two callers could not disagree.
+*
+* The reason names the settings an operator would edit, all three of them, because any one of them
+* turns the bucket back on and a sentence naming only `attachments.enabled` would send a reader to the
+* wrong line.
+*/
+function inapplicableAttachmentSecrets(config) {
+	if (supportNeedsBucket(config)) return {};
+	return { [SUPPORT_R2_SECRET]: "support() stores no attachments — attachments.enabled, attachments.retainRaw and submission.attachments.enabled are all off" };
+}
 //#endregion
-export { SUPPORT_R2_SECRET, supportSecretsRegistry };
+export { SUPPORT_BUCKET_BINDING, SUPPORT_R2_SECRET, inapplicableAttachmentSecrets, supportSecretsRegistry };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.1.5";
+export declare const PACKAGE_VERSION = "0.2.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.1.5";
+const PACKAGE_VERSION = "0.2.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -36,16 +36,16 @@
   "dependencies": {
     "@cloudflare/workers-types": "^5.20260729.1",
     "@hono/zod-validator": "^0.9.0",
-    "@pithy-sh/core": "^0.2.0",
-    "@pithy-sh/email": "^0.1.5",
-    "@pithy-sh/secrets": "^0.1.5",
-    "@pithy-sh/storage": "^0.1.5",
     "postal-mime": "^3.0.0",
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.1.5",
-    "@pithy-sh/payments": "^0.2.0",
+    "@pithy-sh/auth": "^0.2.0",
+    "@pithy-sh/core": "^0.4.0",
+    "@pithy-sh/email": "^0.2.0",
+    "@pithy-sh/payments": "^0.3.0",
+    "@pithy-sh/secrets": "^0.2.0",
+    "@pithy-sh/storage": "^0.2.0",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"
@@ -61,7 +61,11 @@
   "devDependencies": {
     "@cloudflare/vitest-plugin": "^1.0.0",
     "@pithy-sh/auth": "workspace:*",
+    "@pithy-sh/core": "workspace:*",
+    "@pithy-sh/email": "workspace:*",
     "@pithy-sh/payments": "workspace:*",
+    "@pithy-sh/secrets": "workspace:*",
+    "@pithy-sh/storage": "workspace:*",
     "@pithy-sh/tsconfig": "workspace:*",
     "@types/node": "^22.15.0",
     "@vitest/coverage-v8": "^4.1.0",

package/pithy.manifest.json

@@ -3,7 +3,7 @@
   "package": "@pithy-sh/support",
   "requiredBindings": [
     { "type": "d1", "name": "DB" },
-    { "type": "r2", "name": "SUPPORT_BUCKET", "optional": true },
+    { "type": "r2", "name": "SUPPORT_BUCKET", "optional": true, "scope": "global", "resource": "support" },
     {
       "type": "workflow",
       "name": "SUPPORT_CLASSIFY",

package/src/capability.ts

@@ -26,7 +26,7 @@ import { supportAdminRoutes } from "./http/scopes";
 import { createSupportEmailHandler } from "./inbound/handler";
 import { support_0001_threads } from "./migrations/0001_threads";
 import { resolveReplies, type SupportReplySnippets } from "./reply/snippets";
-import { supportSecretsRegistry } from "./secret/registry";
+import { inapplicableAttachmentSecrets, SUPPORT_BUCKET_BINDING, supportSecretsRegistry } from "./secret/registry";
 import { supportExampleSeed } from "./seeds/example";
 import { PACKAGE_VERSION } from "./version.generated";
 import { supportWorkflows } from "./workflows/specs";
@@ -227,7 +227,7 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // three environments for an inbox with attachments off, and `pithy doctor` call them missing
     // forever once they were deleted by hand (#440). The three settings behind `supportNeedsBucket`
     // all default `true`, so nothing changes for a project that has not turned one off.
-    ...(supportNeedsBucket(resolved) ? [{ type: "r2" as const, name: "SUPPORT_BUCKET", optional: true }] : []),
+    ...(supportNeedsBucket(resolved) ? [{ type: "r2" as const, name: SUPPORT_BUCKET_BINDING, optional: true }] : []),
     // The classification Workflow the inbound handler dispatches to, derived from the spec rather
     // than listed again — one declaration, so a binding rename cannot leave the two disagreeing.
     ...workflowBindings(supportWorkflows),
@@ -241,6 +241,10 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // Attachment presigning reads an R2 credential bundle through @pithy-sh/secrets.
     dependsOn: ["secrets"],
     secretRegistry: supportSecretsRegistry,
+    // And whether this composition can reach it at all (#541). The binding is suppressed when nothing
+    // would ever write to the bucket, so there is no decline for the CLI to join against — the
+    // capability is the only thing that knows, and it already computed the answer for the binding.
+    inapplicableSecrets: inapplicableAttachmentSecrets(resolved),
     workflows: supportWorkflows,
     requiredBindings,
     // Provisioning creates the routing rule that delivers mail to this Worker.

package/src/provision/provisionSupport.ts

@@ -114,9 +114,13 @@ export interface SupportProvisionResult {
  * Worker whose classification host is not deployed yet, which is a window where real customer
  * messages arrive and stay `uncategorized` with nothing to say why.
  *
- * `environments` is the project's declaration from the root `pithy.config.ts` (#241). Every declared
- * environment is provisioned; an environment this skipped would be one the project deploys to with no
- * resources behind it — the silence the closed `ManagedEnvironment` enum used to produce.
+ * `environments` is **what the caller determined it can act on**, which the CLI narrows from the project's
+ * declaration (#241) to the environments whose app database exists (pithy-sh/pithy#512). Nothing is
+ * skipped here and nothing decides here: an environment reaching this list is provisioned, and one that
+ * did not was already reported to the operator by name, with why and with the command that fixes it.
+ *
+ * The bucket is created **whatever the list holds, including nothing** — it is one per project, and making
+ * it wait for the last environment to be provisioned is the ordering this change exists to undo.
  */
 export async function provisionSupport(
   provisioner: SupportProvisioner,
@@ -125,14 +129,19 @@ export async function provisionSupport(
   await provisioner.preflight();
   const bucket = await provisioner.ensureBucket();
   const search: SupportProvisionResult["search"] = [];
-  for (const env of managedEnvironments(environments)) {
+  const deployed = managedEnvironments(environments);
+  for (const env of deployed) {
     await provisioner.deployWorker(env);
     // Per environment, because each has its own app database — and after the worker, so a database
     // that gains the index always has something able to write to it.
     search.push({ env, ...(await provisioner.ensureSearchIndex(env)) });
   }
-  const routing = await provisioner.ensureRoutingRule();
-  return { bucket, environments: managedEnvironments(environments), routing, search };
+  // Only when at least one classification host is up. The rule is what starts delivering real customer
+  // mail, so making it over a run that deployed nothing is the same window the ordering above closes,
+  // widened to the whole project.
+  const routing =
+    deployed.length > 0 ? await provisioner.ensureRoutingRule() : { created: false, skipped: true as const };
+  return { bucket, environments: deployed, routing, search };
 }
 
 /** The teardown seam — the inverse of {@link SupportProvisioner}. Every step idempotent. */

package/src/secret/registry.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
+import { type SupportConfig, supportNeedsBucket } from "../config/config";
 
 /**
  * The secrets support reads — exactly one, and it is not support's own shape.
@@ -20,5 +21,42 @@ import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
 /** The name support's R2 credential bundle is stored and resolved under, per environment. */
 export const SUPPORT_R2_SECRET = "support-r2-credentials";
 
+/**
+ * The bucket binding it presigns — support's one optional binding, and the one an adopter declines when
+ * attachments are off.
+ *
+ * **Declared, because the relation was prose and a command cannot read prose (#541).** With attachments
+ * declined, `pithy doctor` printed `SUPPORT_BUCKET (r2) declined in pithy.config.ts` and then asked for
+ * `support-r2-credentials` in the same run. The binding is stated on the entry now, so the secrets side
+ * reads the decline the bindings side already reports.
+ */
+export const SUPPORT_BUCKET_BINDING = "SUPPORT_BUCKET";
+
 /** The support capability's secret-registry slice — aggregated into the shared accessor at startup. */
-export const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET);
+export const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET, SUPPORT_BUCKET_BINDING);
+
+/**
+ * **The credential this composition cannot reach**, as the `inapplicableSecrets` contribution (#541).
+ *
+ * The headline case of that issue, and the one the binding field alone does not close. Joining a
+ * credential to a **declined** binding only answers for a project that wrote a `declinedBindings` entry;
+ * a project that simply turned attachments off never wrote one, because the binding was never declared
+ * to decline — {@link supportNeedsBucket} suppresses it at composition. So `pithy doctor` kept asking
+ * for `support-r2-credentials` on exactly the configuration the issue opens with.
+ *
+ * **The predicate already existed.** Support has answered *would this configuration ever put a byte in
+ * `SUPPORT_BUCKET`* since #440, in one place, for the binding and the provisioner both. This is the
+ * third caller of the same answer rather than a fourth reading of the three settings behind it — which
+ * is the arrangement #440 landed precisely so that two callers could not disagree.
+ *
+ * The reason names the settings an operator would edit, all three of them, because any one of them
+ * turns the bucket back on and a sentence naming only `attachments.enabled` would send a reader to the
+ * wrong line.
+ */
+export function inapplicableAttachmentSecrets(config: SupportConfig): Record<string, string> {
+  if (supportNeedsBucket(config)) return {};
+  return {
+    [SUPPORT_R2_SECRET]:
+      "support() stores no attachments — attachments.enabled, attachments.retainRaw and submission.attachments.enabled are all off",
+  };
+}

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/support";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.1.5";
+export const PACKAGE_VERSION = "0.2.0";