@pithy-sh/support 0.6.2 → 0.8.0

package/dist/provision/provisionSupport.d.ts

@@ -15,32 +15,29 @@ import { type DeprovisionTarget, type ManagedEnvironment } from "@pithy-sh/secre
  * orchestration (order, idempotency, per-env fan-out) is unit-tested without touching Cloudflare.
  * Every step is idempotent; re-running is a no-op.
  *
- * ## The routing rule is opt-in, and that is a safety decision
+ * ## The routing rule never enables Email Routing
  *
- * `ensureRoutingRule` returns `skipped: true` when no routing config is supplied, exactly as
- * `@pithy-sh/email`'s does — because **enabling Email Routing on a zone points its MX at Cloudflare.**
- * Creating a rule on the wrong zone would move an adopter's real inbound mail off their existing
- * provider, which is not a mistake a provisioning command gets to make on their behalf. So the zone,
- * the address, and the target worker are all explicit flags, and a project that has not decided yet
- * provisions everything else and adds the rule later.
+ * **Enabling Email Routing for a domain points its MX at Cloudflare**, so it stays the adopter's act. The CLI's
+ * routing step finds the zone that holds each environment's inbound address, refuses a domain Email Routing is
+ * not enabled for, and only then creates or updates the exact-address rule that sends it to that environment's
+ * app worker. It never enables routing and never touches DNS.
  *
- * The rule name is `<project>-global-support-inbound`, deliberately distinct from `@pithy-sh/email`'s
- * `<project>-global-email-bounce`. Idempotency in `ensureWorkerRoute` keys on the rule *name*, so
- * sharing one would make whichever capability provisioned second silently believe its rule already
- * existed — and the project segment is what stops two Pithy projects on one zone doing the same to
- * each other, with the loser's customer mail delivered to the winner's Worker.
+ * A rule is per environment, named `<project>-<env>-support-inbound`: each environment's address goes to its own
+ * app worker. The project-global `<project>-global-support-inbound` is what the explicit `--routing-zone`,
+ * `--inbound-address` and `--app-worker` override creates, distinct from `@pithy-sh/email`'s
+ * `<project>-global-email-bounce`, because that path keys idempotency on the rule's name.
  */
 /**
- * The name of the Email Routing rule this capability creates, for one project. Distinct from the
- * bounce handler's, and `global` in the environment slot because there is one rule per zone: the
- * environments are separated by which app Worker the rule is pointed at, not by the rule.
+ * The name of an Email Routing rule this capability creates, for one project: `<project>-<env>-support-inbound`
+ * for one environment's address, or `<project>-global-support-inbound` for the override that routes one address
+ * for the whole project. Distinct from the bounce handler's either way.
  *
  * **Still on the generic composer**, and deliberately: an Email Routing rule is not a namespace
  * `@pithy-sh/core/src/naming/limits` carries a verified Cloudflare cap for, and the facade exists so a
  * kind of thing brings its own number rather than borrowing one. It takes the conservative default
  * until that namespace lands — the same call `@pithy-sh/email`'s bounce rule makes.
  */
-export declare function supportRoutingRuleName(project: string): string;
+export declare function supportRoutingRuleName(project: string, env?: ManagedEnvironment): string;
 /**
  * The deployed Worker name for a project's environment — also its resolved config basename. Composed
  * through core's naming facade under the **`worker`** namespace, so it is measured against a Worker
@@ -121,8 +118,9 @@ export interface SupportProvisioner {
         backfilled: boolean;
     }>;
     /**
-     * Ensure the inbound Email Routing rule that delivers the support address to the app worker.
-     * Idempotent, keyed on the rule name. Returns `skipped: true` when no routing config was supplied.
+     * Ensure the inbound Email Routing rules that deliver the support addresses to the app worker: each provisioned
+     * environment's own, or the one the override names. Idempotent. Returns `skipped: true` when there was nothing
+     * to route.
      */
     ensureRoutingRule(): Promise<{
         created: boolean;
@@ -192,8 +190,9 @@ export interface SupportDeprovisioner {
     /** Delete the env's classification worker. Idempotent. */
     deleteWorker(env: ManagedEnvironment): Promise<void>;
     /**
-     * Remove the inbound routing rule, so mail stops being delivered here. Idempotent. Called only when the teardown
-     * was asked to remove it (`removeRouting`).
+     * Remove the project-global inbound routing rule the override created, so mail stops being delivered here.
+     * Idempotent. Called only when the teardown was asked to remove it (`removeRouting`). An environment's own rule
+     * is the CLI's to remove, with that environment.
      */
     removeRoutingRule(): Promise<{
         removed: boolean;

package/dist/provision/provisionSupport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAKlF,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAExB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAIvF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/G;;;;;OAKG;IACH,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/F;;;;;;;;;OASG;IACH,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnH;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,sGAAsG;IACtG,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClG,4GAA4G;IAC5G,QAAQ,EAAE,KAAK,CAAC;QACd,GAAG,EAAE,kBAAkB,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;OAGG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,sGAAsG;IACtG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,GAAG,EAAE,kBAAkB,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAWnC"}
+{"version":3,"file":"provisionSupport.d.ts","sourceRoot":"","sources":["../../src/provision/provisionSupport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAKlF,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAExB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAIvF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChF,sEAAsE;IACtE,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/G;;;;;OAKG;IACH,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/F;;;;;;;;;OASG;IACH,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnH;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,kCAAkC;AAClC,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,iEAAiE;IACjE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,sGAAsG;IACtG,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,kBAAkB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClG,4GAA4G;IAC5G,QAAQ,EAAE,KAAK,CAAC;QACd,GAAG,EAAE,kBAAkB,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,iFAAiF;IACjF,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,oBAAoB,GAAG,SAAS,MAAM,EAAE,GACrD,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,0DAA0D;IAC1D,YAAY,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,+FAA+F;AAC/F,MAAM,WAAW,yBAAyB;IACxC,sGAAsG;IACtG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,GAAG,EAAE,kBAAkB,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,oBAAoB,EACnC,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAWnC"}

package/dist/provision/provisionSupport.js

@@ -20,35 +20,32 @@ import { assertSharedLeavesLast, deprovisionTarget, managedEnvironments } from "
 * orchestration (order, idempotency, per-env fan-out) is unit-tested without touching Cloudflare.
 * Every step is idempotent; re-running is a no-op.
 *
-* ## The routing rule is opt-in, and that is a safety decision
+* ## The routing rule never enables Email Routing
 *
-* `ensureRoutingRule` returns `skipped: true` when no routing config is supplied, exactly as
-* `@pithy-sh/email`'s does — because **enabling Email Routing on a zone points its MX at Cloudflare.**
-* Creating a rule on the wrong zone would move an adopter's real inbound mail off their existing
-* provider, which is not a mistake a provisioning command gets to make on their behalf. So the zone,
-* the address, and the target worker are all explicit flags, and a project that has not decided yet
-* provisions everything else and adds the rule later.
+* **Enabling Email Routing for a domain points its MX at Cloudflare**, so it stays the adopter's act. The CLI's
+* routing step finds the zone that holds each environment's inbound address, refuses a domain Email Routing is
+* not enabled for, and only then creates or updates the exact-address rule that sends it to that environment's
+* app worker. It never enables routing and never touches DNS.
 *
-* The rule name is `<project>-global-support-inbound`, deliberately distinct from `@pithy-sh/email`'s
-* `<project>-global-email-bounce`. Idempotency in `ensureWorkerRoute` keys on the rule *name*, so
-* sharing one would make whichever capability provisioned second silently believe its rule already
-* existed — and the project segment is what stops two Pithy projects on one zone doing the same to
-* each other, with the loser's customer mail delivered to the winner's Worker.
+* A rule is per environment, named `<project>-<env>-support-inbound`: each environment's address goes to its own
+* app worker. The project-global `<project>-global-support-inbound` is what the explicit `--routing-zone`,
+* `--inbound-address` and `--app-worker` override creates, distinct from `@pithy-sh/email`'s
+* `<project>-global-email-bounce`, because that path keys idempotency on the rule's name.
 */
 /**
-* The name of the Email Routing rule this capability creates, for one project. Distinct from the
-* bounce handler's, and `global` in the environment slot because there is one rule per zone: the
-* environments are separated by which app Worker the rule is pointed at, not by the rule.
+* The name of an Email Routing rule this capability creates, for one project: `<project>-<env>-support-inbound`
+* for one environment's address, or `<project>-global-support-inbound` for the override that routes one address
+* for the whole project. Distinct from the bounce handler's either way.
 *
 * **Still on the generic composer**, and deliberately: an Email Routing rule is not a namespace
 * `@pithy-sh/core/src/naming/limits` carries a verified Cloudflare cap for, and the facade exists so a
 * kind of thing brings its own number rather than borrowing one. It takes the conservative default
 * until that namespace lands — the same call `@pithy-sh/email`'s bounce rule makes.
 */
-function supportRoutingRuleName(project) {
+function supportRoutingRuleName(project, env) {
 	return resourceName({
 		project,
-		env: GLOBAL_SCOPE,
+		env: env ?? GLOBAL_SCOPE,
 		thing: `${SUPPORT_CAPABILITY}-inbound`
 	});
 }

package/dist/provision/sendingCheck.d.ts

@@ -0,0 +1,7 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { CapabilitySettings } from "@pithy-sh/core/src/capability/settings";
+import type { SupportConfig } from "../config/config";
+/** Support's sending check, built from one composition's resolved config. */
+export declare function supportSendingSettings(config: SupportConfig): CapabilitySettings;
+//# sourceMappingURL=sendingCheck.d.ts.map

package/dist/provision/sendingCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sendingCheck.d.ts","sourceRoot":"","sources":["../../src/provision/sendingCheck.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAmB,MAAM,wCAAwC,CAAC;AAElG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAoBtD,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,kBAAkB,CA0ChF"}

package/dist/provision/sendingCheck.js

@@ -0,0 +1,63 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+//#region src/provision/sendingCheck.ts
+/**
+* Whether each address a reply is sent from can send, as `pithy doctor` asks it.
+*
+* A mailed reply is sent from the inbox the thread arrived at, so an inbox on a domain Email Service cannot send
+* from receives mail and cannot answer it: every reply fails at send with the domain named. Asked once per domain,
+* only while replies are on. Nothing here writes.
+*/
+/** The domain half of an address, lowercased, or `null` where it carries none. */
+function domainOf(address) {
+	const at = address.lastIndexOf("@");
+	if (at < 0 || at === address.length - 1) return null;
+	return address.slice(at + 1).trim().toLowerCase();
+}
+/** Support's sending check, built from one composition's resolved config. */
+function supportSendingSettings(config) {
+	return {
+		local: () => [],
+		account: async (context) => {
+			if (!config.reply.enabled) return [];
+			const senders = [...config.inboundAddresses.map((address) => ({
+				address,
+				setting: "inboundAddresses"
+			})), ...config.reply.replyToAddress ? [{
+				address: config.reply.replyToAddress,
+				setting: "reply.replyToAddress"
+			}] : []];
+			const byDomain = /* @__PURE__ */ new Map();
+			for (const { address, setting } of senders) {
+				const domain = domainOf(address);
+				if (domain === null) continue;
+				const entry = byDomain.get(domain) ?? {
+					setting,
+					addresses: []
+				};
+				if (!entry.addresses.includes(address)) entry.addresses.push(address);
+				byDomain.set(domain, entry);
+			}
+			if (byDomain.size === 0) return [];
+			const ask = context.account.sendingDomain;
+			if (!ask) throw new InternalError({
+				message: "This doctor cannot ask whether a domain can send.",
+				detail: "SettingsAccountReader.sendingDomain is absent."
+			});
+			const findings = [];
+			for (const [domain, { setting, addresses }] of byDomain) {
+				if (await ask.call(context.account, domain)) continue;
+				findings.push({
+					setting,
+					environment: null,
+					problem: `${domain} cannot send on Email Service, so a reply from ${addresses.join(", ")} fails.`,
+					action: `Onboard ${domain} for sending in the Cloudflare dashboard under Email Service, then rerun doctor.`
+				});
+			}
+			return findings;
+		}
+	};
+}
+//#endregion
+export { supportSendingSettings };

package/dist/reply/fromName.d.ts

@@ -0,0 +1,20 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { SupportConfig } from "../config/config";
+/** The placeholder `reply.fromName` writes the answering agent's name into. */
+export declare const AGENT_PLACEHOLDER = "{agent}";
+/**
+ * The display name a reply is sent under: `reply.fromName` with the agent's name written in.
+ *
+ * A pattern with no placeholder is a fixed name, used whoever answered. A pattern with one is undefined when no
+ * agent name is given, so the email capability's own `fromName` is used. Line breaks and control characters are
+ * folded to spaces, because the result is a header value.
+ */
+export declare function replyFromName(pattern: string, agentName: string | undefined): string | undefined;
+/**
+ * Every address support may send a reply as: its `inboundAddresses` and `reply.replyToAddress`, normalized and
+ * once each. `compose` binds the email capability's `enqueueAs` to exactly these, so a reply cannot be sent as
+ * an address this inbox does not claim.
+ */
+export declare function claimedSenders(config: SupportConfig): string[];
+//# sourceMappingURL=fromName.d.ts.map

package/dist/reply/fromName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fromName.d.ts","sourceRoot":"","sources":["../../src/reply/fromName.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAWhG;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAG9D"}

package/dist/reply/fromName.js

@@ -0,0 +1,29 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/reply/fromName.ts
+/** The placeholder `reply.fromName` writes the answering agent's name into. */
+const AGENT_PLACEHOLDER = "{agent}";
+/**
+* The display name a reply is sent under: `reply.fromName` with the agent's name written in.
+*
+* A pattern with no placeholder is a fixed name, used whoever answered. A pattern with one is undefined when no
+* agent name is given, so the email capability's own `fromName` is used. Line breaks and control characters are
+* folded to spaces, because the result is a header value.
+*/
+function replyFromName(pattern, agentName) {
+	const agent = agentName?.trim() ?? "";
+	if (pattern.includes("{agent}") && !agent) return void 0;
+	const name = pattern.split(AGENT_PLACEHOLDER).join(agent).replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/ {2,}/g, " ").trim();
+	return name === "" ? void 0 : name;
+}
+/**
+* Every address support may send a reply as: its `inboundAddresses` and `reply.replyToAddress`, normalized and
+* once each. `compose` binds the email capability's `enqueueAs` to exactly these, so a reply cannot be sent as
+* an address this inbox does not claim.
+*/
+function claimedSenders(config) {
+	const addresses = [...config.inboundAddresses, ...config.reply.replyToAddress ? [config.reply.replyToAddress] : []];
+	return [...new Set(addresses)];
+}
+//#endregion
+export { AGENT_PLACEHOLDER, claimedSenders, replyFromName };

package/dist/reply/send.d.ts

@@ -71,6 +71,15 @@ export interface ReplyDeps {
         template: string;
         payload: unknown;
         replyTo?: string;
+        /**
+         * Who the reply is sent as: the thread's inbox, under `reply.fromName` with the agent's name written in.
+         * `name` is absent when no agent name was given, and the email capability's `fromName` is used. The seam
+         * `compose` binds refuses an address support does not claim.
+         */
+        from?: {
+            address: string;
+            name?: string;
+        };
         /** The language to write the shell in — the reporter's, taken off their submission context. */
         locale?: string;
         inReplyTo?: string;
@@ -93,7 +102,7 @@ export interface ReplyInput {
     threadId: string;
     /** The reply text, as a human wrote and edited it. */
     body: string;
-    /** Who is answering, signed at the bottom. Optional. */
+    /** Who is answering: signed at the bottom, and written into the From line through `reply.fromName`. Optional. */
     agentName?: string;
     /** The verified control-plane subject sending it — the audit actor. */
     viewer: string;

package/dist/reply/send.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/reply/send.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAiD,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,0BAA0B;IAC1B,EAAE,EAAE,eAAe,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,+FAA+F;QAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,sBAAsB;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,WAAW;IACX,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,0FAA0F;IAC1F,OAAO,EAAE,KAAK,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,gCAAgC;AAChC,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAkLxF"}
+{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/reply/send.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAiD,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,0BAA0B;IAC1B,EAAE,EAAE,eAAe,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,+FAA+F;QAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,sBAAsB;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,WAAW;IACX,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,iHAAiH;IACjH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,0FAA0F;IAC1F,OAAO,EAAE,KAAK,CAAC;IACf,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,gCAAgC;AAChC,wBAAsB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsMxF"}

package/dist/reply/send.js

@@ -5,6 +5,8 @@ import { SupportMessage } from "../data/message.js";
 import { SUPPORT_MESSAGES_TABLE, SUPPORT_THREADS_TABLE } from "../data/tables.js";
 import { SupportAuditActions } from "../audit/actions.js";
 import { buildReferencesHeader, replySubject } from "../mime/threading.js";
+import { claimedSenders, replyFromName } from "./fromName.js";
+import { normalizeAddress } from "@pithy-sh/core/src/address/address";
 import { commandName } from "@pithy-sh/core/src/cli/command";
 //#region src/reply/send.ts
 /** Send a reply on a thread. */
@@ -53,6 +55,9 @@ async function sendReply(deps, input) {
 	const subject = replySubject(thread.subject);
 	const now = deps.now();
 	const replyTo = deps.config.reply.replyToAddress ?? thread.inboxAddress;
+	const claimed = claimedSenders(deps.config);
+	const fromAddress = typeof thread.inboxAddress === "string" && claimed.includes(normalizeAddress(thread.inboxAddress)) ? thread.inboxAddress : deps.config.reply.replyToAddress ?? thread.inboxAddress ?? null;
+	const fromName = replyFromName(deps.config.reply.fromName, input.agentName);
 	const enqueue = deps.enqueue;
 	const deliverable = enqueue !== void 0 && replyTo !== null && replyTo !== void 0;
 	const inApp = thread.channel === "app" && (deps.config.reply.deliverInApp || !deliverable);
@@ -68,6 +73,11 @@ async function sendReply(deps, input) {
 			action: "Set `inboundAddresses` or `reply.replyToAddress` on the support capability, then retry.",
 			detail: `thread ${input.threadId} has no inboxAddress and no reply.replyToAddress is configured`
 		});
+		if (fromAddress && !claimed.includes(normalizeAddress(fromAddress))) throw new SupportReplyFailedError({
+			message: `This thread's inbox, ${fromAddress}, is no longer an address support claims, so it cannot be answered from it.`,
+			action: `Add ${fromAddress} back to \`inboundAddresses\`, or set \`reply.replyToAddress\` to an address support claims, then retry.`,
+			detail: `thread ${input.threadId} arrived at ${fromAddress}, which is not among the claimed senders`
+		});
 		try {
 			jobId = (await enqueue({
 				to: thread.fromAddress,
@@ -78,6 +88,10 @@ async function sendReply(deps, input) {
 					...input.agentName ? { agentName: input.agentName } : {}
 				},
 				replyTo,
+				...fromAddress ? { from: {
+					address: fromAddress,
+					...fromName ? { name: fromName } : {}
+				} } : {},
 				locale: replyLocale,
 				inReplyTo: parent?.mimeMessageId ? `<${parent.mimeMessageId}>` : void 0,
 				references: references.length > 0 ? references : void 0
@@ -97,8 +111,8 @@ async function sendReply(deps, input) {
 		mimeMessageId: null,
 		mimeInReplyTo: parent?.mimeMessageId ?? null,
 		mimeReferences: chain.length > 0 ? chain : null,
-		fromAddress: inApp ? null : replyTo,
-		fromName: null,
+		fromAddress: inApp ? null : fromAddress ?? replyTo,
+		fromName: inApp ? null : fromName ?? null,
 		toAddress: inApp ? null : thread.fromAddress,
 		subject,
 		textBody: input.body,

package/dist/reply/sender.d.ts

@@ -0,0 +1,16 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
+import type { EmailCapability } from "@pithy-sh/email/src/capability";
+import type { SupportConfig } from "../config/config";
+/** The `@pithy-sh/email` range whose capability carries `enqueueAs`. */
+export declare const EMAIL_WITH_ENQUEUE_AS = "^0.9.0";
+/**
+ * The enqueue a reply is sent through: the composed email capability's `enqueueAs`, bound to the addresses
+ * support claims. Undefined when no email capability is composed, which degrades the reply route alone.
+ *
+ * An email capability with no `enqueueAs` is a release older than the seam, and is refused here, at compose,
+ * rather than failing every reply.
+ */
+export declare function replySender(capabilities: readonly Capability[], config: SupportConfig): EmailCapability["enqueue"] | undefined;
+//# sourceMappingURL=sender.d.ts.map

package/dist/reply/sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender.d.ts","sourceRoot":"","sources":["../../src/reply/sender.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,YAAY,EAAE,SAAS,UAAU,EAAE,EACnC,MAAM,EAAE,aAAa,GACpB,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,CAWxC"}

package/dist/reply/sender.js

@@ -0,0 +1,27 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { claimedSenders } from "./fromName.js";
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import { isEmailCapability } from "@pithy-sh/email/src/capability";
+//#region src/reply/sender.ts
+/** The `@pithy-sh/email` range whose capability carries `enqueueAs`. */
+const EMAIL_WITH_ENQUEUE_AS = "^0.9.0";
+/**
+* The enqueue a reply is sent through: the composed email capability's `enqueueAs`, bound to the addresses
+* support claims. Undefined when no email capability is composed, which degrades the reply route alone.
+*
+* An email capability with no `enqueueAs` is a release older than the seam, and is refused here, at compose,
+* rather than failing every reply.
+*/
+function replySender(capabilities, config) {
+	const email = capabilities.find(isEmailCapability);
+	if (!email) return void 0;
+	if (typeof email.enqueueAs !== "function") throw new InternalError({
+		message: "The composed email capability is too old to send support replies.",
+		action: `Upgrade @pithy-sh/email to ${EMAIL_WITH_ENQUEUE_AS}, the release that carries enqueueAs, then redeploy.`,
+		detail: "email capability composed without enqueueAs"
+	});
+	return email.enqueueAs(claimedSenders(config));
+}
+//#endregion
+export { EMAIL_WITH_ENQUEUE_AS, replySender };

package/dist/store/threads.d.ts

@@ -66,7 +66,7 @@ export interface ThreadFilters {
 /**
  * What a caller may filter the inbox by, and where to resume.
  *
- * **No free text.** Listing lists; `GET {basePath}/threads/search` searches, ranked, with a limit and no
+ * **No free text.** Listing lists; `POST {basePath}/threads/search` searches, ranked, with a limit and no
  * cursor. A `q` here could say whether a thread matched, never how well.
  */
 export interface ListThreadsQuery extends ThreadFilters {

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.6.2";
+export declare const PACKAGE_VERSION = "0.8.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.6.2";
+const PACKAGE_VERSION = "0.8.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.6.2",
+  "version": "0.8.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,13 +40,13 @@
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.12.2",
-    "@pithy-sh/core": "^0.16.0",
-    "@pithy-sh/email": "^0.8.2",
-    "@pithy-sh/payments": "^0.7.2",
-    "@pithy-sh/secrets": "^0.6.4",
-    "@pithy-sh/storage": "^0.7.2",
-    "@pithy-sh/vector": "^0.5.4",
+    "@pithy-sh/auth": "^0.14.0",
+    "@pithy-sh/core": "^0.18.0",
+    "@pithy-sh/email": "^0.10.0",
+    "@pithy-sh/payments": "^0.8.1",
+    "@pithy-sh/secrets": "^0.6.6",
+    "@pithy-sh/storage": "^0.7.4",
+    "@pithy-sh/vector": "^0.5.6",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"

package/pithy.manifest.json

@@ -35,7 +35,7 @@
   "scaffold": [
     "Pick the address this inbox will answer on, and put it in `inboundAddresses`. **Use a subdomain, never your apex.** Enabling Email Routing on a zone points its MX at Cloudflare, so `support@yourdomain.com` would move all of your real inbound mail off your current provider. `support@help.yourdomain.com` costs you a subdomain zone and nothing else. Until this is set the inbox is inert and ignores every message.",
     "Ensure the secrets capability is provisioned (`pithy add secrets` then `pithy secrets provision`) — the R2 credentials attachment URLs are signed with are stored and read through @pithy-sh/secrets.",
-    "Run `pithy support provision --routing-zone <zone-id> --inbound-address <addr> --app-worker <name>`. It creates the `SUPPORT_BUCKET` R2 bucket, deploys the prebuilt classification worker for each environment, and creates the Email Routing rule that delivers mail to your app worker. Idempotent; re-run it freely.",
+    "Turn on Email Routing for the address's domain in the Cloudflare dashboard (a subdomain is set up on its parent zone), then run `pithy support provision`. It creates the `SUPPORT_BUCKET` R2 bucket, deploys the prebuilt classification worker for each environment, and routes each environment's `inboundAddresses` to that environment's app worker, finding the zone from the address. It never turns Email Routing on. Idempotent; re-run it freely.",
     "Add the `DB` (D1) binding to each wrangler.jsonc env. `SUPPORT_BUCKET` (R2) is written for you when your config keeps attachments, the raw MIME copy, or in-app uploads, and left out entirely when it keeps none of them. Add the `SUPPORT_CLASSIFY` Workflow binding your app dispatches to after storing a message — `pithy support provision` writes it.",
     "Add the controlplane capability (`pithy add controlplane`) and run `pithy dashboard connect`. Every management route is control-plane and default-denied, except to your own staff through `support({ staff })`: without a registered connection the admin surface answers 403, which is the correct posture for an inbox holding other people's private correspondence. Grant the six scopes deliberately — `support:threads:reply` sends mail to real people under your domain and is not the same permission as reading, and `support:threads:assign` decides who answers whom.",
     "Add the email capability (`pithy add email`) if you want to answer from the dashboard. Without it the inbox still receives, threads, and classifies; the reply route returns `support/reply_failed` naming what is missing.",
@@ -45,7 +45,7 @@
     "If your feedback screen offers a chooser, send its answer as `declaredCategory`. It lands in its own column beside `category` and is never overwritten by the classifier — one is a claim by the person writing, the other a judgement about them, and an operator triaging an inbox needs to tell them apart. `GET /support/threads` filters on either. A key outside your taxonomy is refused rather than stored, and a category sent with a `threadId` is refused too: a chooser belongs on the form that opens a request.",
     "`POST /support/feedback` is gated on a session and same-origin and never on a role — a general intake that is role-gated is not one. If your own account model makes some submissions act-on-behalf-of, put that check in your `app` capability's `middleware` over your own `basePath`: every capability's middleware mounts before any capability's routes, so yours runs after auth has resolved the session and before this capability's `requireAuth()`.",
     "If your own signed-in users work the inbox, name two powers in `support({ staff: { readPower, assignPower } })` and give them to a role in your organization catalog's `unassignable` list that `organization({ ownership })` does not confer, so only an operator can confer them — anybody may found an organization and take its ownership role, so `support()` refuses a staff power there. `readPower` lets a staff member join a thread's presence room; `assignPower` lets them assign it at `POST /support/staff/threads/:id/assign`. Without `staff`, both answer to management clients only.",
-    "Search the inbox at `GET /support/threads/search` — keyword by default, ranked; the inbox list takes no `q`. Turn on `search: { semantic: true }` to find a paraphrase as well as an exact word: it embeds every inbound message on your own Workers AI binding, a second inference per message on top of classification, so it is off until you choose it. Then run `pithy support provision`, which creates the Vectorize index, binds it, and backfills it once; `pithy vector reprocess --index support-messages` re-embeds after a model change.",
+    "Search the inbox at `POST /support/threads/search`, with the words and the filters in a JSON body, so a customer's address typed into the box never lands in a request log — keyword by default, ranked; the inbox list takes no `q`. Turn on `search: { semantic: true }` to find a paraphrase as well as an exact word: it embeds every inbound message on your own Workers AI binding, a second inference per message on top of classification, so it is off until you choose it. Then run `pithy support provision`, which creates the Vectorize index, binds it, and backfills it once; `pithy vector reprocess --index support-messages` re-embeds after a model change.",
     "Run `pithy support provision` after adding support or upgrading it: `search.fts` is on by default, and the FTS5 index and its triggers are provisioned rather than migrated. Until then search falls back to a `LIKE` scan and `pithy doctor` names the environment. Back the database up with `pithy backup`, which skips the index, and restore it with `pithy restore`, which rebuilds it — a plain `wrangler d1 export` fails on any database holding an FTS5 table."
   ],
   "configOptions": [

package/src/capability.ts

@@ -9,7 +9,6 @@ import type { DatabaseSpecMap } from "@pithy-sh/core/src/data/databases";
 import type { KvNamespaceSpecMap } from "@pithy-sh/core/src/kv/namespaces";
 import { workflowBindings } from "@pithy-sh/core/src/workflow/bindings";
 import type { EmailCapability } from "@pithy-sh/email/src/capability";
-import { isEmailCapability } from "@pithy-sh/email/src/capability";
 import type { Migration } from "kysely/migration";
 import type { SupportClientProjection } from "./client/projection";
 import {
@@ -28,7 +27,9 @@ import { senderPeers } from "./link/peers";
 import type { SenderPeers } from "./link/sender";
 import { SUPPORT_MIGRATIONS } from "./migrations/set";
 import { supportPresence } from "./presence/room";
+import { supportSendingSettings } from "./provision/sendingCheck";
 import { supportUserPurge } from "./purge/contribution";
+import { replySender } from "./reply/sender";
 import { resolveReplies, type SupportReplySnippets } from "./reply/snippets";
 import { inapplicableAttachmentSecrets, SUPPORT_BUCKET_BINDING, supportSecretsRegistry } from "./secret/registry";
 import { supportExampleSeed } from "./seeds/example";
@@ -80,7 +81,7 @@ export interface SupportWiring {
   enqueueEmail: EmailCapability["enqueue"] | undefined;
   /**
    * The optional peers the sender link reads through — `auth()`'s and `payments()`'s surfaces, set by
-   * `compose` when each is composed. Found, never imported (#645): see `link/sender.ts`.
+   * `compose` when each is composed. Found, never imported: see `link/sender.ts`.
    */
   peers: SenderPeers;
   /**
@@ -241,10 +242,10 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // **Declared only when this configuration would ever write to it.** A manifest is one static file
     // and cannot vary with config, so the manifest says `optional` and the composed instance decides
     // — which is exactly what the CLI's `effectiveBindings` reads, and what `controlplane` has always
-    // done for its KV. Declaring it unconditionally made `pithy upgrade` write six R2 stanzas across
-    // three environments for an inbox with attachments off, and `pithy doctor` call them missing
-    // forever once they were deleted by hand (#440). The three settings behind `supportNeedsBucket`
-    // all default `true`, so nothing changes for a project that has not turned one off.
+    // done for its KV. Declared unconditionally, `pithy upgrade` would write six R2 stanzas across
+    // three environments for an inbox with attachments off, and `pithy doctor` would call them missing
+    // once they were deleted by hand. The three settings behind `supportNeedsBucket` all default
+    // `true`, so a project that has not turned one off declares the bucket.
     ...(supportNeedsBucket(resolved) ? [{ type: "r2" as const, name: SUPPORT_BUCKET_BINDING, optional: true }] : []),
     // The classification Workflow the inbound handler dispatches to, derived from the spec rather
     // than listed again — one declaration, so a binding rename cannot leave the two disagreeing.
@@ -267,20 +268,23 @@ export function support(options: SupportOptions = {}): SupportCapability {
     // The package this capability ships in and the version it ships at, both stamped by
     // `scripts/stampVersions.ts` — a Worker cannot read its own package.json. Reported per capability by
     // the control-plane manifest, and reported together: a release feed is keyed by package name, so the
-    // version alone leaves a client guessing the key (#626).
+    // version alone leaves a client guessing the key.
     version: PACKAGE_VERSION,
     package: PACKAGE_NAME,
     // Attachment presigning reads an R2 credential bundle through @pithy-sh/secrets.
     dependsOn: ["secrets"],
     secretRegistry: supportSecretsRegistry,
-    // And whether this composition can reach it at all (#541). The binding is suppressed when nothing
+    // And whether this composition can reach it at all. The binding is suppressed when nothing
     // would ever write to the bucket, so there is no decline for the CLI to join against — the
     // capability is the only thing that knows, and it already computed the answer for the binding.
     inapplicableSecrets: inapplicableAttachmentSecrets(resolved),
     workflows: supportWorkflows,
     requiredBindings,
-    // Provisioning creates the routing rule that delivers mail to this Worker.
-    ciPermissions: ["email:routing"],
+    // Provisioning finds the zone each inbound address lives in, checks Email Routing is enabled for it, and routes
+    // the address to this Worker; the CI token is granted that on those zones.
+    inboundRouting: { addresses: resolved.inboundAddresses },
+    // `pithy doctor` asks whether each inbound address's domain can send, since a reply is sent from it.
+    settings: supportSendingSettings(resolved),
     databases: {
       app: {
         binding: "DB",
@@ -303,9 +307,8 @@ export function support(options: SupportOptions = {}): SupportCapability {
     compose: ({ capabilities }) => {
       // A staff block no request could be served by safely is refused here, at boot. See `staff/staff.ts`.
       assertStaffComposition(resolved.staff, capabilities);
-      const email = capabilities.find(isEmailCapability);
-      wiring.enqueueEmail = email?.enqueue;
-      // Auth and payments, found rather than imported (#645), and refused here when this Worker's config needs
+      wiring.enqueueEmail = replySender(capabilities, resolved);
+      // Auth and payments, found rather than imported, and refused here when this Worker's config needs
       // one it cannot reach. See `link/peers.ts`.
       wiring.peers = senderPeers(capabilities, resolved);
     },
@@ -319,7 +322,7 @@ export function support(options: SupportOptions = {}): SupportCapability {
     ...(supportMessageIndex(resolved.search)
       ? { vectorIndexes: [{ name: SUPPORT_MESSAGES_INDEX, reprocessJob: "reprocess" }] }
       : {}),
-    // Who else has a thread open (#816): one `support.thread` room per thread, on core's presence seam.
+    // Who else has a thread open: one `support.thread` room per thread, on core's presence seam.
     // Declaring it is the whole of the wiring — core adds the room's binding, socket and ticket routes.
     presence: supportPresence(mountPath, wiring),
     routes: registerSupportRoutes({
@@ -332,7 +335,7 @@ export function support(options: SupportOptions = {}): SupportCapability {
     seeds: [supportExampleSeed],
     // A person's threads — linked to their account, or sent from their address and linked to no other — with every
     // message, attachment and raw mail in them: exported on an access request and erased by their purge, as its own
-    // step (#814).
+    // step.
     purge: [supportUserPurge("DB", { semantic: supportMessageIndex(resolved.search) !== undefined })],
   });