@pithy-sh/support 0.6.1 → 0.7.0

package/dist/reply/send.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/reply/send.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAiD,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,0BAA0B;IAC1B,EAAE,EAAE,eAAe,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,+FAA+F;QAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,sBAAsB;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,WAAW;IACX,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,0FAA0F;IAC1F,OAAO,EAAE,KAAK,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,gCAAgC;AAChC,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAkLxF"}
+{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/reply/send.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAiD,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,0BAA0B;IAC1B,EAAE,EAAE,eAAe,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,+FAA+F;QAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,sBAAsB;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,WAAW;IACX,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,iHAAiH;IACjH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,0FAA0F;IAC1F,OAAO,EAAE,KAAK,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,gCAAgC;AAChC,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsMxF"}

package/dist/reply/send.js

@@ -5,6 +5,8 @@ import { SupportMessage } from "../data/message.js";
 import { SUPPORT_MESSAGES_TABLE, SUPPORT_THREADS_TABLE } from "../data/tables.js";
 import { SupportAuditActions } from "../audit/actions.js";
 import { buildReferencesHeader, replySubject } from "../mime/threading.js";
+import { claimedSenders, replyFromName } from "./fromName.js";
+import { normalizeAddress } from "@pithy-sh/core/src/address/address";
 import { commandName } from "@pithy-sh/core/src/cli/command";
 //#region src/reply/send.ts
 /** Send a reply on a thread. */
@@ -53,6 +55,9 @@ async function sendReply(deps, input) {
 	const subject = replySubject(thread.subject);
 	const now = deps.now();
 	const replyTo = deps.config.reply.replyToAddress ?? thread.inboxAddress;
+	const claimed = claimedSenders(deps.config);
+	const fromAddress = typeof thread.inboxAddress === "string" && claimed.includes(normalizeAddress(thread.inboxAddress)) ? thread.inboxAddress : deps.config.reply.replyToAddress ?? thread.inboxAddress ?? null;
+	const fromName = replyFromName(deps.config.reply.fromName, input.agentName);
 	const enqueue = deps.enqueue;
 	const deliverable = enqueue !== void 0 && replyTo !== null && replyTo !== void 0;
 	const inApp = thread.channel === "app" && (deps.config.reply.deliverInApp || !deliverable);
@@ -68,6 +73,11 @@ async function sendReply(deps, input) {
 			action: "Set `inboundAddresses` or `reply.replyToAddress` on the support capability, then retry.",
 			detail: `thread ${input.threadId} has no inboxAddress and no reply.replyToAddress is configured`
 		});
+		if (fromAddress && !claimed.includes(normalizeAddress(fromAddress))) throw new SupportReplyFailedError({
+			message: `This thread's inbox, ${fromAddress}, is no longer an address support claims, so it cannot be answered from it.`,
+			action: `Add ${fromAddress} back to \`inboundAddresses\`, or set \`reply.replyToAddress\` to an address support claims, then retry.`,
+			detail: `thread ${input.threadId} arrived at ${fromAddress}, which is not among the claimed senders`
+		});
 		try {
 			jobId = (await enqueue({
 				to: thread.fromAddress,
@@ -78,6 +88,10 @@ async function sendReply(deps, input) {
 					...input.agentName ? { agentName: input.agentName } : {}
 				},
 				replyTo,
+				...fromAddress ? { from: {
+					address: fromAddress,
+					...fromName ? { name: fromName } : {}
+				} } : {},
 				locale: replyLocale,
 				inReplyTo: parent?.mimeMessageId ? `<${parent.mimeMessageId}>` : void 0,
 				references: references.length > 0 ? references : void 0
@@ -97,8 +111,8 @@ async function sendReply(deps, input) {
 		mimeMessageId: null,
 		mimeInReplyTo: parent?.mimeMessageId ?? null,
 		mimeReferences: chain.length > 0 ? chain : null,
-		fromAddress: inApp ? null : replyTo,
-		fromName: null,
+		fromAddress: inApp ? null : fromAddress ?? replyTo,
+		fromName: inApp ? null : fromName ?? null,
 		toAddress: inApp ? null : thread.fromAddress,
 		subject,
 		textBody: input.body,

package/dist/reply/sender.d.ts

@@ -0,0 +1,16 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
+import type { EmailCapability } from "@pithy-sh/email/src/capability";
+import type { SupportConfig } from "../config/config";
+/** The `@pithy-sh/email` range whose capability carries `enqueueAs`. */
+export declare const EMAIL_WITH_ENQUEUE_AS = "^0.9.0";
+/**
+ * The enqueue a reply is sent through: the composed email capability's `enqueueAs`, bound to the addresses
+ * support claims. Undefined when no email capability is composed, which degrades the reply route alone.
+ *
+ * An email capability with no `enqueueAs` is a release older than the seam, and is refused here, at compose,
+ * rather than failing every reply.
+ */
+export declare function replySender(capabilities: readonly Capability[], config: SupportConfig): EmailCapability["enqueue"] | undefined;
+//# sourceMappingURL=sender.d.ts.map

package/dist/reply/sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender.d.ts","sourceRoot":"","sources":["../../src/reply/sender.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,YAAY,EAAE,SAAS,UAAU,EAAE,EACnC,MAAM,EAAE,aAAa,GACpB,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAWxC"}

package/dist/reply/sender.js

@@ -0,0 +1,27 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { claimedSenders } from "./fromName.js";
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import { isEmailCapability } from "@pithy-sh/email/src/capability";
+//#region src/reply/sender.ts
+/** The `@pithy-sh/email` range whose capability carries `enqueueAs`. */
+const EMAIL_WITH_ENQUEUE_AS = "^0.9.0";
+/**
+* The enqueue a reply is sent through: the composed email capability's `enqueueAs`, bound to the addresses
+* support claims. Undefined when no email capability is composed, which degrades the reply route alone.
+*
+* An email capability with no `enqueueAs` is a release older than the seam, and is refused here, at compose,
+* rather than failing every reply.
+*/
+function replySender(capabilities, config) {
+	const email = capabilities.find(isEmailCapability);
+	if (!email) return void 0;
+	if (typeof email.enqueueAs !== "function") throw new InternalError({
+		message: "The composed email capability is too old to send support replies.",
+		action: `Upgrade @pithy-sh/email to ${EMAIL_WITH_ENQUEUE_AS}, the release that carries enqueueAs, then redeploy.`,
+		detail: "email capability composed without enqueueAs"
+	});
+	return email.enqueueAs(claimedSenders(config));
+}
+//#endregion
+export { EMAIL_WITH_ENQUEUE_AS, replySender };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.6.1";
+export declare const PACKAGE_VERSION = "0.7.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.6.1";
+const PACKAGE_VERSION = "0.7.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,13 +40,13 @@
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.12.1",
-    "@pithy-sh/core": "^0.15.0",
-    "@pithy-sh/email": "^0.8.1",
-    "@pithy-sh/payments": "^0.7.1",
-    "@pithy-sh/secrets": "^0.6.3",
-    "@pithy-sh/storage": "^0.7.1",
-    "@pithy-sh/vector": "^0.5.3",
+    "@pithy-sh/auth": "^0.13.0",
+    "@pithy-sh/core": "^0.17.0",
+    "@pithy-sh/email": "^0.9.0",
+    "@pithy-sh/payments": "^0.8.0",
+    "@pithy-sh/secrets": "^0.6.5",
+    "@pithy-sh/storage": "^0.7.3",
+    "@pithy-sh/vector": "^0.5.5",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"

package/pithy.manifest.json

@@ -35,7 +35,7 @@
   "scaffold": [
     "Pick the address this inbox will answer on, and put it in `inboundAddresses`. **Use a subdomain, never your apex.** Enabling Email Routing on a zone points its MX at Cloudflare, so `support@yourdomain.com` would move all of your real inbound mail off your current provider. `support@help.yourdomain.com` costs you a subdomain zone and nothing else. Until this is set the inbox is inert and ignores every message.",
     "Ensure the secrets capability is provisioned (`pithy add secrets` then `pithy secrets provision`) — the R2 credentials attachment URLs are signed with are stored and read through @pithy-sh/secrets.",
-    "Run `pithy support provision --routing-zone <zone-id> --inbound-address <addr> --app-worker <name>`. It creates the `SUPPORT_BUCKET` R2 bucket, deploys the prebuilt classification worker for each environment, and creates the Email Routing rule that delivers mail to your app worker. Idempotent; re-run it freely.",
+    "Turn on Email Routing for the address's domain in the Cloudflare dashboard (a subdomain is set up on its parent zone), then run `pithy support provision`. It creates the `SUPPORT_BUCKET` R2 bucket, deploys the prebuilt classification worker for each environment, and routes each environment's `inboundAddresses` to that environment's app worker, finding the zone from the address. It never turns Email Routing on. Idempotent; re-run it freely.",
     "Add the `DB` (D1) binding to each wrangler.jsonc env. `SUPPORT_BUCKET` (R2) is written for you when your config keeps attachments, the raw MIME copy, or in-app uploads, and left out entirely when it keeps none of them. Add the `SUPPORT_CLASSIFY` Workflow binding your app dispatches to after storing a message — `pithy support provision` writes it.",
     "Add the controlplane capability (`pithy add controlplane`) and run `pithy dashboard connect`. Every management route is control-plane and default-denied, except to your own staff through `support({ staff })`: without a registered connection the admin surface answers 403, which is the correct posture for an inbox holding other people's private correspondence. Grant the six scopes deliberately — `support:threads:reply` sends mail to real people under your domain and is not the same permission as reading, and `support:threads:assign` decides who answers whom.",
     "Add the email capability (`pithy add email`) if you want to answer from the dashboard. Without it the inbox still receives, threads, and classifies; the reply route returns `support/reply_failed` naming what is missing.",

package/src/capability.ts

@@ -9,7 +9,6 @@ import type { DatabaseSpecMap } from "@pithy-sh/core/src/data/databases";
 import type { KvNamespaceSpecMap } from "@pithy-sh/core/src/kv/namespaces";
 import { workflowBindings } from "@pithy-sh/core/src/workflow/bindings";
 import type { EmailCapability } from "@pithy-sh/email/src/capability";
-import { isEmailCapability } from "@pithy-sh/email/src/capability";
 import type { Migration } from "kysely/migration";
 import type { SupportClientProjection } from "./client/projection";
 import {
@@ -28,7 +27,9 @@ import { senderPeers } from "./link/peers";
 import type { SenderPeers } from "./link/sender";
 import { SUPPORT_MIGRATIONS } from "./migrations/set";
 import { supportPresence } from "./presence/room";
+import { supportSendingSettings } from "./provision/sendingCheck";
 import { supportUserPurge } from "./purge/contribution";
+import { replySender } from "./reply/sender";
 import { resolveReplies, type SupportReplySnippets } from "./reply/snippets";
 import { inapplicableAttachmentSecrets, SUPPORT_BUCKET_BINDING, supportSecretsRegistry } from "./secret/registry";
 import { supportExampleSeed } from "./seeds/example";
@@ -80,7 +81,7 @@ export interface SupportWiring {
   enqueueEmail: EmailCapability["enqueue"] | undefined;
   /**
    * The optional peers the sender link reads through — `auth()`'s and `payments()`'s surfaces, set by
-   * `compose` when each is composed. Found, never imported (#645): see `link/sender.ts`.
+   * `compose` when each is composed. Found, never imported: see `link/sender.ts`.
    */
   peers: SenderPeers;
   /**
@@ -241,10 +242,10 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // **Declared only when this configuration would ever write to it.** A manifest is one static file
     // and cannot vary with config, so the manifest says `optional` and the composed instance decides
     // — which is exactly what the CLI's `effectiveBindings` reads, and what `controlplane` has always
-    // done for its KV. Declaring it unconditionally made `pithy upgrade` write six R2 stanzas across
-    // three environments for an inbox with attachments off, and `pithy doctor` call them missing
-    // forever once they were deleted by hand (#440). The three settings behind `supportNeedsBucket`
-    // all default `true`, so nothing changes for a project that has not turned one off.
+    // done for its KV. Declared unconditionally, `pithy upgrade` would write six R2 stanzas across
+    // three environments for an inbox with attachments off, and `pithy doctor` would call them missing
+    // once they were deleted by hand. The three settings behind `supportNeedsBucket` all default
+    // `true`, so a project that has not turned one off declares the bucket.
     ...(supportNeedsBucket(resolved) ? [{ type: "r2" as const, name: SUPPORT_BUCKET_BINDING, optional: true }] : []),
     // The classification Workflow the inbound handler dispatches to, derived from the spec rather
     // than listed again — one declaration, so a binding rename cannot leave the two disagreeing.
@@ -267,20 +268,23 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // The package this capability ships in and the version it ships at, both stamped by
     // `scripts/stampVersions.ts` — a Worker cannot read its own package.json. Reported per capability by
     // the control-plane manifest, and reported together: a release feed is keyed by package name, so the
-    // version alone leaves a client guessing the key (#626).
+    // version alone leaves a client guessing the key.
     version: PACKAGE_VERSION,
     package: PACKAGE_NAME,
     // Attachment presigning reads an R2 credential bundle through @pithy-sh/secrets.
     dependsOn: ["secrets"],
     secretRegistry: supportSecretsRegistry,
-    // And whether this composition can reach it at all (#541). The binding is suppressed when nothing
+    // And whether this composition can reach it at all. The binding is suppressed when nothing
     // would ever write to the bucket, so there is no decline for the CLI to join against — the
     // capability is the only thing that knows, and it already computed the answer for the binding.
     inapplicableSecrets: inapplicableAttachmentSecrets(resolved),
     workflows: supportWorkflows,
     requiredBindings,
-    // Provisioning creates the routing rule that delivers mail to this Worker.
-    ciPermissions: ["email:routing"],
+    // Provisioning finds the zone each inbound address lives in, checks Email Routing is enabled for it, and routes
+    // the address to this Worker; the CI token is granted that on those zones.
+    inboundRouting: { addresses: resolved.inboundAddresses },
+    // `pithy doctor` asks whether each inbound address's domain can send, since a reply is sent from it.
+    settings: supportSendingSettings(resolved),
     databases: {
       app: {
         binding: "DB",
@@ -303,9 +307,8 @@ export function support(options: SupportOptions = {}): SupportCapability {
     compose: ({ capabilities }) => {
       // A staff block no request could be served by safely is refused here, at boot. See `staff/staff.ts`.
       assertStaffComposition(resolved.staff, capabilities);
-      const email = capabilities.find(isEmailCapability);
-      wiring.enqueueEmail = email?.enqueue;
-      // Auth and payments, found rather than imported (#645), and refused here when this Worker's config needs
+      wiring.enqueueEmail = replySender(capabilities, resolved);
+      // Auth and payments, found rather than imported, and refused here when this Worker's config needs
       // one it cannot reach. See `link/peers.ts`.
       wiring.peers = senderPeers(capabilities, resolved);
     },
@@ -319,7 +322,7 @@ export function support(options: SupportOptions = {}): SupportCapability {
     ...(supportMessageIndex(resolved.search)
       ? { vectorIndexes: [{ name: SUPPORT_MESSAGES_INDEX, reprocessJob: "reprocess" }] }
       : {}),
-    // Who else has a thread open (#816): one `support.thread` room per thread, on core's presence seam.
+    // Who else has a thread open: one `support.thread` room per thread, on core's presence seam.
     // Declaring it is the whole of the wiring — core adds the room's binding, socket and ticket routes.
     presence: supportPresence(mountPath, wiring),
     routes: registerSupportRoutes({
@@ -332,7 +335,7 @@ export function support(options: SupportOptions = {}): SupportCapability {
     seeds: [supportExampleSeed],
     // A person's threads — linked to their account, or sent from their address and linked to no other — with every
     // message, attachment and raw mail in them: exported on an access request and erased by their purge, as its own
-    // step (#814).
+    // step.
     purge: [supportUserPurge("DB", { semantic: supportMessageIndex(resolved.search) !== undefined })],
   });
 

package/src/config/config.ts

@@ -306,6 +306,14 @@ export const SupportReplyConfig = z
       .describe(
         "The `Reply-To` a reply carries — the address the customer's answer comes back to, which must be one of `inboundAddresses` or the conversation ends there. Defaults to the inbox address the thread arrived on, which is almost always what you want.",
       ),
+    fromName: z
+      .string()
+      .min(1)
+      .max(120)
+      .default("{agent}")
+      .describe(
+        "The display name a mailed reply is sent under, with `{agent}` replaced by the answering agent's name: `{agent} at Acme` sends `\"Jim Scott at Acme\" <support@help.example.com>`. The address is the inbox the thread arrived at, or `reply.replyToAddress` for a thread whose inbox is not in `inboundAddresses` or that arrived at none. With no agent name the email capability's `fromName` is used instead; a name with no `{agent}`, such as `Acme Support`, is used for every reply.",
+      ),
     deliverInApp: z
       .boolean()
       .default(false)
@@ -403,7 +411,7 @@ export function supportSemantic(search: SupportSearchConfig): SupportSemanticCon
 
 /** The full support configuration. */
 /**
- * **Who of the app's own signed-in users works the inbox (#816).** Off until named.
+ * **Who of the app's own signed-in users works the inbox.** Off until named.
  *
  * The inbox holds every customer's correspondence, so a signed-in user reaches it only through a power the
  * adopter names in their own role catalog, held in the organization the request acts for — the same seam
@@ -489,10 +497,10 @@ export type SupportConfigInput = z.input<typeof SupportConfig>;
  * All three default `true`, so the ordinary project is unaffected by this predicate existing.
  *
  * Two callers, and they must agree: `capability.ts` declares the binding only when this is true, and
- * `pithy support provision` creates the bucket only when this is true. They disagreed before #440 —
- * the provisioner asked about `enabled` and `retainRaw` and never about submissions, so a project that
- * wanted uploads but no mail attachments got a binding pointing at a bucket nothing had created, and
- * every submitted file was dropped with a warning. One predicate is what makes that unrepresentable.
+ * `pithy support provision` creates the bucket only when this is true. Were they to ask different
+ * questions, a project that wanted uploads but no mail attachments would get a binding pointing at a
+ * bucket nothing had created, and every submitted file would be dropped with a warning. One predicate is
+ * what makes that unrepresentable.
  */
 export function supportNeedsBucket(config: SupportConfig): boolean {
   return config.attachments.enabled || config.attachments.retainRaw || config.submission.attachments.enabled;

package/src/http/handlers.ts

@@ -208,6 +208,7 @@ async function presentAttachments(
         sha256: attachment.sha256,
         inline: attachment.inline,
         url,
+        messageId: attachment.messageId,
       };
     }),
   );

package/src/http/responses.ts

@@ -214,6 +214,12 @@ export const SupportAttachmentView = z
       .describe(
         "A signed URL valid for a few minutes, or null when no credentials were available to sign one. The `storageKey` is never here: it is server-derived precisely so a client cannot name an object or guess the one beside it.",
       ),
+    messageId: z
+      .string()
+      .optional()
+      .describe(
+        "The id of the message it arrived on, so a client can show each file under the message that carried it. Absent from a Worker that predates it.",
+      ),
   })
   .describe("One attachment as a client receives it — metadata and a signed URL, never the storage key.");
 export type SupportAttachmentView = z.output<typeof SupportAttachmentView>;
@@ -407,7 +413,9 @@ export const SupportThreadResponse = z
   .object({
     thread: SupportThreadView.describe("The conversation."),
     messages: z.array(SupportMessageView).describe("Its messages, oldest first — a conversation reads downward."),
-    attachments: z.array(SupportAttachmentView).describe("Its attachments, across every message."),
+    attachments: z
+      .array(SupportAttachmentView)
+      .describe("Its attachments, across every message, each naming the message it arrived on in `messageId`."),
     sender: SenderContextView.describe("What the app already knows about the sender."),
     replies: z.array(SupportReplyView).describe("The canned replies, ordered for this thread's category."),
     // Optional (#450): absent from a Worker that predates assignment.

package/src/http/schemas.ts

@@ -200,8 +200,11 @@ export const ReplyInput = z
       .string()
       .min(1)
       .max(80)
+      .regex(/^[^@<>"]*$/, "A name may not contain @, <, > or a double quote.")
       .optional()
-      .describe("Who is answering, signed at the bottom. Omitted rather than guessed."),
+      .describe(
+        "Who is answering, signed at the bottom and written into the reply's From line. Omitted rather than guessed. May not contain `@`, `<`, `>` or `\"`, so the display name cannot pass for an address.",
+      ),
   })
   .describe("An answer to send to the customer.");
 export type ReplyInput = z.infer<typeof ReplyInput>;

package/src/provision/provisionSupport.ts

@@ -28,34 +28,31 @@ import { SUPPORT_CAPABILITY, supportWorkflowRegistry } from "../workflows/specs"
  * orchestration (order, idempotency, per-env fan-out) is unit-tested without touching Cloudflare.
  * Every step is idempotent; re-running is a no-op.
  *
- * ## The routing rule is opt-in, and that is a safety decision
+ * ## The routing rule never enables Email Routing
  *
- * `ensureRoutingRule` returns `skipped: true` when no routing config is supplied, exactly as
- * `@pithy-sh/email`'s does — because **enabling Email Routing on a zone points its MX at Cloudflare.**
- * Creating a rule on the wrong zone would move an adopter's real inbound mail off their existing
- * provider, which is not a mistake a provisioning command gets to make on their behalf. So the zone,
- * the address, and the target worker are all explicit flags, and a project that has not decided yet
- * provisions everything else and adds the rule later.
+ * **Enabling Email Routing for a domain points its MX at Cloudflare**, so it stays the adopter's act. The CLI's
+ * routing step finds the zone that holds each environment's inbound address, refuses a domain Email Routing is
+ * not enabled for, and only then creates or updates the exact-address rule that sends it to that environment's
+ * app worker. It never enables routing and never touches DNS.
  *
- * The rule name is `<project>-global-support-inbound`, deliberately distinct from `@pithy-sh/email`'s
- * `<project>-global-email-bounce`. Idempotency in `ensureWorkerRoute` keys on the rule *name*, so
- * sharing one would make whichever capability provisioned second silently believe its rule already
- * existed — and the project segment is what stops two Pithy projects on one zone doing the same to
- * each other, with the loser's customer mail delivered to the winner's Worker.
+ * A rule is per environment, named `<project>-<env>-support-inbound`: each environment's address goes to its own
+ * app worker. The project-global `<project>-global-support-inbound` is what the explicit `--routing-zone`,
+ * `--inbound-address` and `--app-worker` override creates, distinct from `@pithy-sh/email`'s
+ * `<project>-global-email-bounce`, because that path keys idempotency on the rule's name.
  */
 
 /**
- * The name of the Email Routing rule this capability creates, for one project. Distinct from the
- * bounce handler's, and `global` in the environment slot because there is one rule per zone: the
- * environments are separated by which app Worker the rule is pointed at, not by the rule.
+ * The name of an Email Routing rule this capability creates, for one project: `<project>-<env>-support-inbound`
+ * for one environment's address, or `<project>-global-support-inbound` for the override that routes one address
+ * for the whole project. Distinct from the bounce handler's either way.
  *
  * **Still on the generic composer**, and deliberately: an Email Routing rule is not a namespace
  * `@pithy-sh/core/src/naming/limits` carries a verified Cloudflare cap for, and the facade exists so a
  * kind of thing brings its own number rather than borrowing one. It takes the conservative default
  * until that namespace lands — the same call `@pithy-sh/email`'s bounce rule makes.
  */
-export function supportRoutingRuleName(project: string): string {
-  return resourceName({ project, env: GLOBAL_SCOPE, thing: `${SUPPORT_CAPABILITY}-inbound` });
+export function supportRoutingRuleName(project: string, env?: ManagedEnvironment): string {
+  return resourceName({ project, env: env ?? GLOBAL_SCOPE, thing: `${SUPPORT_CAPABILITY}-inbound` });
 }
 
 /**
@@ -132,8 +129,9 @@ export interface SupportProvisioner {
    */
   settleSemanticIndex(env: ManagedEnvironment, created: boolean): Promise<{ dropped: boolean; backfilled: boolean }>;
   /**
-   * Ensure the inbound Email Routing rule that delivers the support address to the app worker.
-   * Idempotent, keyed on the rule name. Returns `skipped: true` when no routing config was supplied.
+   * Ensure the inbound Email Routing rules that deliver the support addresses to the app worker: each provisioned
+   * environment's own, or the one the override names. Idempotent. Returns `skipped: true` when there was nothing
+   * to route.
    */
   ensureRoutingRule(): Promise<{ created: boolean; skipped: boolean }>;
 }
@@ -217,8 +215,9 @@ export interface SupportDeprovisioner {
   /** Delete the env's classification worker. Idempotent. */
   deleteWorker(env: ManagedEnvironment): Promise<void>;
   /**
-   * Remove the inbound routing rule, so mail stops being delivered here. Idempotent. Called only when the teardown
-   * was asked to remove it (`removeRouting`).
+   * Remove the project-global inbound routing rule the override created, so mail stops being delivered here.
+   * Idempotent. Called only when the teardown was asked to remove it (`removeRouting`). An environment's own rule
+   * is the CLI's to remove, with that environment.
    */
   removeRoutingRule(): Promise<{ removed: boolean }>;
   /**

package/src/provision/sendingCheck.ts

@@ -0,0 +1,69 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { CapabilitySettings, SettingsFinding } from "@pithy-sh/core/src/capability/settings";
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import type { SupportConfig } from "../config/config";
+
+/**
+ * Whether each address a reply is sent from can send, as `pithy doctor` asks it.
+ *
+ * A mailed reply is sent from the inbox the thread arrived at, so an inbox on a domain Email Service cannot send
+ * from receives mail and cannot answer it: every reply fails at send with the domain named. Asked once per domain,
+ * only while replies are on. Nothing here writes.
+ */
+
+/** The domain half of an address, lowercased, or `null` where it carries none. */
+function domainOf(address: string): string | null {
+  const at = address.lastIndexOf("@");
+  if (at < 0 || at === address.length - 1) return null;
+  return address
+    .slice(at + 1)
+    .trim()
+    .toLowerCase();
+}
+
+/** Support's sending check, built from one composition's resolved config. */
+export function supportSendingSettings(config: SupportConfig): CapabilitySettings {
+  return {
+    local: () => [],
+    account: async (context) => {
+      if (!config.reply.enabled) return [];
+      // Every address a reply is sent from, under the setting that names it: the inbox a thread arrived at, and
+      // `reply.replyToAddress` for a thread that arrived at none.
+      const senders = [
+        ...config.inboundAddresses.map((address) => ({ address, setting: "inboundAddresses" })),
+        ...(config.reply.replyToAddress
+          ? [{ address: config.reply.replyToAddress, setting: "reply.replyToAddress" }]
+          : []),
+      ];
+      const byDomain = new Map<string, { setting: string; addresses: string[] }>();
+      for (const { address, setting } of senders) {
+        const domain = domainOf(address);
+        if (domain === null) continue;
+        const entry = byDomain.get(domain) ?? { setting, addresses: [] };
+        if (!entry.addresses.includes(address)) entry.addresses.push(address);
+        byDomain.set(domain, entry);
+      }
+      if (byDomain.size === 0) return [];
+      const ask = context.account.sendingDomain;
+      if (!ask) {
+        throw new InternalError({
+          message: "This doctor cannot ask whether a domain can send.",
+          detail: "SettingsAccountReader.sendingDomain is absent.",
+        });
+      }
+      const findings: SettingsFinding[] = [];
+      for (const [domain, { setting, addresses }] of byDomain) {
+        if (await ask.call(context.account, domain)) continue;
+        findings.push({
+          setting,
+          environment: null,
+          problem: `${domain} cannot send on Email Service, so a reply from ${addresses.join(", ")} fails.`,
+          action: `Onboard ${domain} for sending in the Cloudflare dashboard under Email Service, then rerun doctor.`,
+        });
+      }
+      return findings;
+    },
+  };
+}

package/src/reply/fromName.ts

@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { SupportConfig } from "../config/config";
+
+/** The placeholder `reply.fromName` writes the answering agent's name into. */
+export const AGENT_PLACEHOLDER = "{agent}";
+
+/**
+ * The display name a reply is sent under: `reply.fromName` with the agent's name written in.
+ *
+ * A pattern with no placeholder is a fixed name, used whoever answered. A pattern with one is undefined when no
+ * agent name is given, so the email capability's own `fromName` is used. Line breaks and control characters are
+ * folded to spaces, because the result is a header value.
+ */
+export function replyFromName(pattern: string, agentName: string | undefined): string | undefined {
+  const agent = agentName?.trim() ?? "";
+  if (pattern.includes(AGENT_PLACEHOLDER) && !agent) return undefined;
+  const name = pattern
+    .split(AGENT_PLACEHOLDER)
+    .join(agent)
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: control characters are what this removes.
+    .replace(/[\u0000-\u001f\u007f]+/g, " ")
+    .replace(/ {2,}/g, " ")
+    .trim();
+  return name === "" ? undefined : name;
+}
+
+/**
+ * Every address support may send a reply as: its `inboundAddresses` and `reply.replyToAddress`, normalized and
+ * once each. `compose` binds the email capability's `enqueueAs` to exactly these, so a reply cannot be sent as
+ * an address this inbox does not claim.
+ */
+export function claimedSenders(config: SupportConfig): string[] {
+  const addresses = [...config.inboundAddresses, ...(config.reply.replyToAddress ? [config.reply.replyToAddress] : [])];
+  return [...new Set(addresses)];
+}