@pithy-sh/support 0.1.6 → 0.2.0

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO9E,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AA4ED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,gBAAgB,CAAC;IAC3F,mCAAmC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,wGAAwG;IACxG,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,iBAAiB,CA+FvE;AAED,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAE3F"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0CAA0C,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EAGxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO9E,OAAO,EAAkB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,8BAA8B;IAC9B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,IAAI,EAAE,SAAS,CAAC;CACjB;AA4ED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,UAAU,CAAC,eAAe,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,gBAAgB,CAAC;IAC3F,mCAAmC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,wGAAwG;IACxG,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,iBAAiB,CAmGvE;AAED,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,iBAAiB,CAE3F"}

package/dist/capability.js

@@ -4,7 +4,7 @@ import { resolveReplies } from "./reply/snippets.js";
 import { SupportConfig, supportNeedsBucket } from "./config/config.js";
 import { resolveCategories } from "./data/categories.js";
 import { supportTables } from "./data/tables.js";
-import { supportSecretsRegistry } from "./secret/registry.js";
+import { SUPPORT_BUCKET_BINDING, inapplicableAttachmentSecrets, supportSecretsRegistry } from "./secret/registry.js";
 import { supportWorkflows } from "./workflows/specs.js";
 import { makeResolveDeps } from "./http/resolve.js";
 import { supportAdminRoutes } from "./http/scopes.js";
@@ -133,7 +133,7 @@ function support(options = {}) {
 		},
 		...supportNeedsBucket(resolved) ? [{
 			type: "r2",
-			name: "SUPPORT_BUCKET",
+			name: SUPPORT_BUCKET_BINDING,
 			optional: true
 		}] : [],
 		...workflowBindings(supportWorkflows)
@@ -143,6 +143,7 @@ function support(options = {}) {
 		version: PACKAGE_VERSION,
 		dependsOn: ["secrets"],
 		secretRegistry: supportSecretsRegistry,
+		inapplicableSecrets: inapplicableAttachmentSecrets(resolved),
 		workflows: supportWorkflows,
 		requiredBindings,
 		ciPermissions: ["email:routing"],

package/dist/secret/registry.d.ts

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { type SupportConfig } from "../config/config";
 /**
  * The secrets support reads — exactly one, and it is not support's own shape.
  *
@@ -15,6 +16,35 @@
  */
 /** The name support's R2 credential bundle is stored and resolved under, per environment. */
 export declare const SUPPORT_R2_SECRET = "support-r2-credentials";
+/**
+ * The bucket binding it presigns — support's one optional binding, and the one an adopter declines when
+ * attachments are off.
+ *
+ * **Declared, because the relation was prose and a command cannot read prose (#541).** With attachments
+ * declined, `pithy doctor` printed `SUPPORT_BUCKET (r2) declined in pithy.config.ts` and then asked for
+ * `support-r2-credentials` in the same run. The binding is stated on the entry now, so the secrets side
+ * reads the decline the bindings side already reports.
+ */
+export declare const SUPPORT_BUCKET_BINDING = "SUPPORT_BUCKET";
 /** The support capability's secret-registry slice — aggregated into the shared accessor at startup. */
 export declare const supportSecretsRegistry: Record<"support-r2-credentials", import("@pithy-sh/storage/src/secret/registry").R2CredentialsEntry>;
+/**
+ * **The credential this composition cannot reach**, as the `inapplicableSecrets` contribution (#541).
+ *
+ * The headline case of that issue, and the one the binding field alone does not close. Joining a
+ * credential to a **declined** binding only answers for a project that wrote a `declinedBindings` entry;
+ * a project that simply turned attachments off never wrote one, because the binding was never declared
+ * to decline — {@link supportNeedsBucket} suppresses it at composition. So `pithy doctor` kept asking
+ * for `support-r2-credentials` on exactly the configuration the issue opens with.
+ *
+ * **The predicate already existed.** Support has answered *would this configuration ever put a byte in
+ * `SUPPORT_BUCKET`* since #440, in one place, for the binding and the provisioner both. This is the
+ * third caller of the same answer rather than a fourth reading of the three settings behind it — which
+ * is the arrangement #440 landed precisely so that two callers could not disagree.
+ *
+ * The reason names the settings an operator would edit, all three of them, because any one of them
+ * turns the bucket back on and a sentence naming only `attachments.enabled` would send a reader to the
+ * wrong line.
+ */
+export declare function inapplicableAttachmentSecrets(config: SupportConfig): Record<string, string>;
 //# sourceMappingURL=registry.d.ts.map

package/dist/secret/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/secret/registry.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;GAYG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,sGAA2C,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/secret/registry.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AAE1E;;;;;;;;;;;;GAYG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,sGAAmE,CAAC;AAEvG;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F"}

package/dist/secret/registry.js

@@ -1,5 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { supportNeedsBucket } from "../config/config.js";
 import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
 //#region src/secret/registry.ts
 /**
@@ -17,7 +18,39 @@ import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
 */
 /** The name support's R2 credential bundle is stored and resolved under, per environment. */
 const SUPPORT_R2_SECRET = "support-r2-credentials";
+/**
+* The bucket binding it presigns — support's one optional binding, and the one an adopter declines when
+* attachments are off.
+*
+* **Declared, because the relation was prose and a command cannot read prose (#541).** With attachments
+* declined, `pithy doctor` printed `SUPPORT_BUCKET (r2) declined in pithy.config.ts` and then asked for
+* `support-r2-credentials` in the same run. The binding is stated on the entry now, so the secrets side
+* reads the decline the bindings side already reports.
+*/
+const SUPPORT_BUCKET_BINDING = "SUPPORT_BUCKET";
 /** The support capability's secret-registry slice — aggregated into the shared accessor at startup. */
-const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET);
+const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET, SUPPORT_BUCKET_BINDING);
+/**
+* **The credential this composition cannot reach**, as the `inapplicableSecrets` contribution (#541).
+*
+* The headline case of that issue, and the one the binding field alone does not close. Joining a
+* credential to a **declined** binding only answers for a project that wrote a `declinedBindings` entry;
+* a project that simply turned attachments off never wrote one, because the binding was never declared
+* to decline — {@link supportNeedsBucket} suppresses it at composition. So `pithy doctor` kept asking
+* for `support-r2-credentials` on exactly the configuration the issue opens with.
+*
+* **The predicate already existed.** Support has answered *would this configuration ever put a byte in
+* `SUPPORT_BUCKET`* since #440, in one place, for the binding and the provisioner both. This is the
+* third caller of the same answer rather than a fourth reading of the three settings behind it — which
+* is the arrangement #440 landed precisely so that two callers could not disagree.
+*
+* The reason names the settings an operator would edit, all three of them, because any one of them
+* turns the bucket back on and a sentence naming only `attachments.enabled` would send a reader to the
+* wrong line.
+*/
+function inapplicableAttachmentSecrets(config) {
+	if (supportNeedsBucket(config)) return {};
+	return { [SUPPORT_R2_SECRET]: "support() stores no attachments — attachments.enabled, attachments.retainRaw and submission.attachments.enabled are all off" };
+}
 //#endregion
-export { SUPPORT_R2_SECRET, supportSecretsRegistry };
+export { SUPPORT_BUCKET_BINDING, SUPPORT_R2_SECRET, inapplicableAttachmentSecrets, supportSecretsRegistry };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.1.6";
+export declare const PACKAGE_VERSION = "0.2.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.1.6";
+const PACKAGE_VERSION = "0.2.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -36,16 +36,16 @@
   "dependencies": {
     "@cloudflare/workers-types": "^5.20260729.1",
     "@hono/zod-validator": "^0.9.0",
-    "@pithy-sh/core": "^0.3.0",
-    "@pithy-sh/email": "^0.1.7",
-    "@pithy-sh/secrets": "^0.1.6",
-    "@pithy-sh/storage": "^0.1.6",
     "postal-mime": "^3.0.0",
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.1.6",
-    "@pithy-sh/payments": "^0.2.1",
+    "@pithy-sh/auth": "^0.2.0",
+    "@pithy-sh/core": "^0.4.0",
+    "@pithy-sh/email": "^0.2.0",
+    "@pithy-sh/payments": "^0.3.0",
+    "@pithy-sh/secrets": "^0.2.0",
+    "@pithy-sh/storage": "^0.2.0",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"
@@ -61,7 +61,11 @@
   "devDependencies": {
     "@cloudflare/vitest-plugin": "^1.0.0",
     "@pithy-sh/auth": "workspace:*",
+    "@pithy-sh/core": "workspace:*",
+    "@pithy-sh/email": "workspace:*",
     "@pithy-sh/payments": "workspace:*",
+    "@pithy-sh/secrets": "workspace:*",
+    "@pithy-sh/storage": "workspace:*",
     "@pithy-sh/tsconfig": "workspace:*",
     "@types/node": "^22.15.0",
     "@vitest/coverage-v8": "^4.1.0",

package/src/capability.ts

@@ -26,7 +26,7 @@ import { supportAdminRoutes } from "./http/scopes";
 import { createSupportEmailHandler } from "./inbound/handler";
 import { support_0001_threads } from "./migrations/0001_threads";
 import { resolveReplies, type SupportReplySnippets } from "./reply/snippets";
-import { supportSecretsRegistry } from "./secret/registry";
+import { inapplicableAttachmentSecrets, SUPPORT_BUCKET_BINDING, supportSecretsRegistry } from "./secret/registry";
 import { supportExampleSeed } from "./seeds/example";
 import { PACKAGE_VERSION } from "./version.generated";
 import { supportWorkflows } from "./workflows/specs";
@@ -227,7 +227,7 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // three environments for an inbox with attachments off, and `pithy doctor` call them missing
     // forever once they were deleted by hand (#440). The three settings behind `supportNeedsBucket`
     // all default `true`, so nothing changes for a project that has not turned one off.
-    ...(supportNeedsBucket(resolved) ? [{ type: "r2" as const, name: "SUPPORT_BUCKET", optional: true }] : []),
+    ...(supportNeedsBucket(resolved) ? [{ type: "r2" as const, name: SUPPORT_BUCKET_BINDING, optional: true }] : []),
     // The classification Workflow the inbound handler dispatches to, derived from the spec rather
     // than listed again — one declaration, so a binding rename cannot leave the two disagreeing.
     ...workflowBindings(supportWorkflows),
@@ -241,6 +241,10 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // Attachment presigning reads an R2 credential bundle through @pithy-sh/secrets.
     dependsOn: ["secrets"],
     secretRegistry: supportSecretsRegistry,
+    // And whether this composition can reach it at all (#541). The binding is suppressed when nothing
+    // would ever write to the bucket, so there is no decline for the CLI to join against — the
+    // capability is the only thing that knows, and it already computed the answer for the binding.
+    inapplicableSecrets: inapplicableAttachmentSecrets(resolved),
     workflows: supportWorkflows,
     requiredBindings,
     // Provisioning creates the routing rule that delivers mail to this Worker.

package/src/secret/registry.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
+import { type SupportConfig, supportNeedsBucket } from "../config/config";
 
 /**
  * The secrets support reads — exactly one, and it is not support's own shape.
@@ -20,5 +21,42 @@ import { r2CredentialsRegistry } from "@pithy-sh/storage/src/secret/registry";
 /** The name support's R2 credential bundle is stored and resolved under, per environment. */
 export const SUPPORT_R2_SECRET = "support-r2-credentials";
 
+/**
+ * The bucket binding it presigns — support's one optional binding, and the one an adopter declines when
+ * attachments are off.
+ *
+ * **Declared, because the relation was prose and a command cannot read prose (#541).** With attachments
+ * declined, `pithy doctor` printed `SUPPORT_BUCKET (r2) declined in pithy.config.ts` and then asked for
+ * `support-r2-credentials` in the same run. The binding is stated on the entry now, so the secrets side
+ * reads the decline the bindings side already reports.
+ */
+export const SUPPORT_BUCKET_BINDING = "SUPPORT_BUCKET";
+
 /** The support capability's secret-registry slice — aggregated into the shared accessor at startup. */
-export const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET);
+export const supportSecretsRegistry = r2CredentialsRegistry(SUPPORT_R2_SECRET, SUPPORT_BUCKET_BINDING);
+
+/**
+ * **The credential this composition cannot reach**, as the `inapplicableSecrets` contribution (#541).
+ *
+ * The headline case of that issue, and the one the binding field alone does not close. Joining a
+ * credential to a **declined** binding only answers for a project that wrote a `declinedBindings` entry;
+ * a project that simply turned attachments off never wrote one, because the binding was never declared
+ * to decline — {@link supportNeedsBucket} suppresses it at composition. So `pithy doctor` kept asking
+ * for `support-r2-credentials` on exactly the configuration the issue opens with.
+ *
+ * **The predicate already existed.** Support has answered *would this configuration ever put a byte in
+ * `SUPPORT_BUCKET`* since #440, in one place, for the binding and the provisioner both. This is the
+ * third caller of the same answer rather than a fourth reading of the three settings behind it — which
+ * is the arrangement #440 landed precisely so that two callers could not disagree.
+ *
+ * The reason names the settings an operator would edit, all three of them, because any one of them
+ * turns the bucket back on and a sentence naming only `attachments.enabled` would send a reader to the
+ * wrong line.
+ */
+export function inapplicableAttachmentSecrets(config: SupportConfig): Record<string, string> {
+  if (supportNeedsBucket(config)) return {};
+  return {
+    [SUPPORT_R2_SECRET]:
+      "support() stores no attachments — attachments.enabled, attachments.retainRaw and submission.attachments.enabled are all off",
+  };
+}

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/support";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.1.6";
+export const PACKAGE_VERSION = "0.2.0";