@pithy-sh/support 0.6.2 → 0.8.0

package/src/config/config.ts

@@ -306,6 +306,14 @@ export const SupportReplyConfig = z
       .describe(
         "The `Reply-To` a reply carries — the address the customer's answer comes back to, which must be one of `inboundAddresses` or the conversation ends there. Defaults to the inbox address the thread arrived on, which is almost always what you want.",
       ),
+    fromName: z
+      .string()
+      .min(1)
+      .max(120)
+      .default("{agent}")
+      .describe(
+        "The display name a mailed reply is sent under, with `{agent}` replaced by the answering agent's name: `{agent} at Acme` sends `\"Jim Scott at Acme\" <support@help.example.com>`. The address is the inbox the thread arrived at, or `reply.replyToAddress` for a thread whose inbox is not in `inboundAddresses` or that arrived at none. With no agent name the email capability's `fromName` is used instead; a name with no `{agent}`, such as `Acme Support`, is used for every reply.",
+      ),
     deliverInApp: z
       .boolean()
       .default(false)
@@ -403,7 +411,7 @@ export function supportSemantic(search: SupportSearchConfig): SupportSemanticCon
 
 /** The full support configuration. */
 /**
- * **Who of the app's own signed-in users works the inbox (#816).** Off until named.
+ * **Who of the app's own signed-in users works the inbox.** Off until named.
  *
  * The inbox holds every customer's correspondence, so a signed-in user reaches it only through a power the
  * adopter names in their own role catalog, held in the organization the request acts for — the same seam
@@ -489,10 +497,10 @@ export type SupportConfigInput = z.input<typeof SupportConfig>;
  * All three default `true`, so the ordinary project is unaffected by this predicate existing.
  *
  * Two callers, and they must agree: `capability.ts` declares the binding only when this is true, and
- * `pithy support provision` creates the bucket only when this is true. They disagreed before #440 —
- * the provisioner asked about `enabled` and `retainRaw` and never about submissions, so a project that
- * wanted uploads but no mail attachments got a binding pointing at a bucket nothing had created, and
- * every submitted file was dropped with a warning. One predicate is what makes that unrepresentable.
+ * `pithy support provision` creates the bucket only when this is true. Were they to ask different
+ * questions, a project that wanted uploads but no mail attachments would get a binding pointing at a
+ * bucket nothing had created, and every submitted file would be dropped with a warning. One predicate is
+ * what makes that unrepresentable.
  */
 export function supportNeedsBucket(config: SupportConfig): boolean {
   return config.attachments.enabled || config.attachments.retainRaw || config.submission.attachments.enabled;

package/src/http/handlers.ts

@@ -56,7 +56,7 @@ import type {
   MyThreadsQuery,
   RepliesQuery,
   ReplyInput,
-  SearchThreadsQuery,
+  SearchThreadsBody,
   SubmitFeedbackInput,
 } from "./schemas";
 import {
@@ -148,7 +148,7 @@ export async function listInbox(
  */
 export async function searchInbox(
   deps: HandlerDeps,
-  query: SearchThreadsQuery,
+  query: SearchThreadsBody,
   viewer: string,
 ): Promise<SupportSearchResponse> {
   const outcome = await searchThreads(
@@ -165,7 +165,7 @@ export async function searchInbox(
       q: query.q,
       ...(query.mode !== undefined ? { mode: query.mode } : {}),
       ...(query.limit !== undefined ? { limit: query.limit } : {}),
-      archived: query.archived === "true",
+      archived: query.archived === true,
       category: query.category,
       declaredCategory: query.declaredCategory,
       priority: query.priority,
@@ -208,6 +208,7 @@ async function presentAttachments(
         sha256: attachment.sha256,
         inline: attachment.inline,
         url,
+        messageId: attachment.messageId,
       };
     }),
   );

package/src/http/responses.ts

@@ -34,16 +34,14 @@ import { SupportSubmissionContext } from "../data/message";
  *
  * **A browser imports this file, so it reaches no module that needs the Workers runtime.** That is not
  * a preference about bundle size; it is what "a client validates what comes back" means once the client
- * is a Vite program with the DOM lib and no Workers types. This file imported `SUPPORT_BILLING_SCOPE`
- * from `link/sender.ts` for one release and brought D1, Kysely and two capabilities' table maps with it,
- * which took `pithy-sh/dashboard`'s client build down on an error in `@pithy-sh/auth` (#419). The rule is
- * held by `tooling/browser-scopes`, which compiles this module with `types: []` and asks the compiler
+ * is a Vite program with the DOM lib and no Workers types: an import of `link/sender.ts` would bring D1,
+ * Kysely and two capabilities' table maps into that build. The rule is held by `tooling/browser-scopes`, which compiles this module with `types: []` and asks the compiler
  * which files that program included.
  *
  * **A field added here later is `.optional()`, not merely `.nullable()`.** This module is read across a
  * version boundary — a management client validates a response with this schema against a customer's
  * Worker at whatever kit version it is on — so an additive required key fails `safeParse` for everyone
- * below that release and takes the whole pane with it (#450). Absent then means *this Worker cannot
+ * below that release and takes the whole pane with it. Absent then means *this Worker cannot
  * say*, which is a different fact from `null`.
  */
 
@@ -110,7 +108,7 @@ export const SupportThreadView = z
       .describe(
         "The control-plane subject that archived it, for convenience only — the answer to 'who marked this done' comes from the audit trail.",
       ),
-    // Optional as well as nullable (#450, #816): absent says *this Worker predates assignment*, which a client
+    // Optional as well as nullable: absent says *this Worker predates assignment*, which a client
     // must not read as *nobody has it*.
     assigneeRef: z
       .string()
@@ -214,6 +212,12 @@ export const SupportAttachmentView = z
       .describe(
         "A signed URL valid for a few minutes, or null when no credentials were available to sign one. The `storageKey` is never here: it is server-derived precisely so a client cannot name an object or guess the one beside it.",
       ),
+    messageId: z
+      .string()
+      .optional()
+      .describe(
+        "The id of the message it arrived on, so a client can show each file under the message that carried it. Absent from a Worker that predates it.",
+      ),
   })
   .describe("One attachment as a client receives it — metadata and a signed URL, never the storage key.");
 export type SupportAttachmentView = z.output<typeof SupportAttachmentView>;
@@ -340,7 +344,7 @@ export const SupportSearchResultView = z
   .describe("One thread a search found, named by its best-matching message, with that message's raw scores.");
 export type SupportSearchResultView = z.output<typeof SupportSearchResultView>;
 
-/** `GET {base}/threads/search`. */
+/** `POST {base}/threads/search`. */
 export const SupportSearchResponse = z
   .object({
     mode: z
@@ -407,10 +411,12 @@ export const SupportThreadResponse = z
   .object({
     thread: SupportThreadView.describe("The conversation."),
     messages: z.array(SupportMessageView).describe("Its messages, oldest first — a conversation reads downward."),
-    attachments: z.array(SupportAttachmentView).describe("Its attachments, across every message."),
+    attachments: z
+      .array(SupportAttachmentView)
+      .describe("Its attachments, across every message, each naming the message it arrived on in `messageId`."),
     sender: SenderContextView.describe("What the app already knows about the sender."),
     replies: z.array(SupportReplyView).describe("The canned replies, ordered for this thread's category."),
-    // Optional (#450): absent from a Worker that predates assignment.
+    // Optional: absent from a Worker that predates assignment.
     assignments: z
       .array(SupportAssignmentView)
       .optional()
@@ -510,9 +516,8 @@ export type SupportFlagsResponse = z.output<typeof SupportFlagsResponse>;
  * Below is the same projection for the other consumer: a management client reading a Worker **it does
  * not control**. That client is crossing a trust boundary — a fork, a bug, a half-finished deploy, or a
  * hostile Worker each put a member here that no enum of ours declares — and under the strict schema one
- * such token costs it the entire response. It cost `pithy-sh/dashboard#15` exactly that: one
- * unrecognized `channel` and the support pane rendered zero of twenty-five conversations. The client
- * then had to widen our shape locally, which is the hand-held mirror `#113` exists to forbid.
+ * such token costs it the entire response: one unrecognized `channel` and a support pane renders none of
+ * its conversations, and the client is left widening our shape locally, the hand-held mirror the kit forbids.
  *
  * So the tolerance is published rather than reimplemented, by the one pattern
  * `@pithy-sh/core/src/projection/asRead` states for the whole kit: same objects, every enum read as a
@@ -545,7 +550,7 @@ export type SupportMessageViewAsRead = z.output<typeof SupportMessageViewAsRead>
 export const SupportThreadsResponseAsRead = asRead(SupportThreadsResponse);
 export type SupportThreadsResponseAsRead = z.output<typeof SupportThreadsResponseAsRead>;
 
-/** `GET {base}/threads/search`, as a client that does not control the Worker must read it. */
+/** `POST {base}/threads/search`, as a client that does not control the Worker must read it. */
 export const SupportSearchResponseAsRead = asRead(SupportSearchResponse);
 export type SupportSearchResponseAsRead = z.output<typeof SupportSearchResponseAsRead>;
 

package/src/http/routes.ts

@@ -47,7 +47,7 @@ import {
   MyThreadsQuery,
   RepliesQuery,
   ReplyInput,
-  SearchThreadsQuery,
+  SearchThreadsBody,
   SubmitFeedbackInput,
   ThreadIdParam,
 } from "./schemas";
@@ -64,7 +64,7 @@ import {
  * The support routes, their verification strategies, and what each accepts:
  *
  *   GET  /support/threads               → the inbox     (control-plane: support:threads:read)       query: ListThreadsQuery
- *   GET  /support/threads/search        → search        (control-plane: support:threads:read)       query: SearchThreadsQuery
+ *   POST /support/threads/search        → search        (control-plane: support:threads:read)       json:  SearchThreadsBody
  *   GET  /support/threads/:id           → one thread    (control-plane: support:threads:read)       param: ThreadIdParam
  *   POST /support/threads/:id/archive   → done/reopen   (control-plane: support:threads:archive)    param + json
  *   POST /support/threads/:id/assign    → who has it    (control-plane: support:threads:assign)     param + json
@@ -114,8 +114,8 @@ import {
  * person who most needs to reach support is often the one whose access is broken, and a role the kit
  * invented would make one adopter's account model a condition on everybody's ability to report a bug.
  *
- * But an adopter whose *own* model makes some submissions act-on-behalf-of — `pithy-sh/dashboard#10`'s
- * discount application is made for an organization, and a member may not make one — needs somewhere to
+ * But an adopter whose *own* model makes some submissions act-on-behalf-of — a discount application made
+ * for an organization, which a member may not make — needs somewhere to
  * put that check, and it must not be the client. **The seam for it already exists, in the composition
  * contract rather than in this capability's config**, and it is documented here because it was not
  * discoverable rather than because it was missing:
@@ -238,18 +238,19 @@ export function registerSupportRoutes(options: SupportRoutesOptions): (app: Hono
       async (c) => c.json(await listInbox(await resolve(c), c.req.valid("query"), viewer(c))),
     );
 
-    // Before `/threads/:id`, so `search` is never read as a thread id.
-    app.get(
+    app.post(
       `${base}/threads/search`,
       describeRoute({
         summary: "Search the inbox, by words and by meaning, ranked as one.",
+        description:
+          "The words travel in the body, because they are often a customer's address or order number and a query string is written to every request log between the client and the Worker. Read-only.",
         verification: "control-plane",
         scopes: [SUPPORT_THREADS_READ_SCOPE],
         responses: { 200: SupportSearchResponse },
       }),
       requireControlPlane(SUPPORT_THREADS_READ_SCOPE),
-      validate("query", SearchThreadsQuery),
-      async (c) => c.json(await searchInbox(await resolve(c), c.req.valid("query"), viewer(c))),
+      validate("json", SearchThreadsBody),
+      async (c) => c.json(await searchInbox(await resolve(c), c.req.valid("json"), viewer(c))),
     );
 
     app.get(

package/src/http/schemas.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 
+import { freeText } from "@pithy-sh/core/src/http/freeText";
 import { PresenceParticipantName, PresenceParticipantRef } from "@pithy-sh/core/src/presence/frames";
 import { z } from "zod";
 import { MAX_SUBMISSION_ATTACHMENTS, MAX_SUBMISSION_BODY_CHARS, MAX_SUBMISSION_SUBJECT_CHARS } from "../config/config";
@@ -82,7 +83,7 @@ const threadFilterFields = {
 /**
  * The inbox listing query.
  *
- * **Strict, and there is no `q`.** Listing lists; `GET {basePath}/threads/search` searches. An unknown
+ * **Strict, and there is no `q`.** Listing lists; `POST {basePath}/threads/search` searches. An unknown
  * key is refused as `validation/invalid_input` rather than ignored, so a client sending `q` is told so
  * instead of getting the unfiltered inbox back as though it were the answer.
  */
@@ -114,19 +115,22 @@ export const SupportSearchMode = z
   );
 export type SupportSearchMode = z.infer<typeof SupportSearchMode>;
 
-/** The search query. */
-export const SearchThreadsQuery = z
+/**
+ * The body of `POST {basePath}/threads/search`: the words, the mode, how many, and the inbox listing's filters.
+ * A body, not a query string, because the words are often a customer's address or order number and a URL is
+ * written to every request log between the client and the Worker. Strict, so a misspelled filter is refused
+ * rather than silently widening the search.
+ */
+export const SearchThreadsBody = z
   .object({
-    q: z
-      .string()
-      .trim()
-      .min(1)
-      .max(MAX_SEARCH_TERM)
-      .describe("What to search for, in the customer's words or yours. An order number, an error, or a description."),
+    ...threadFilterFields,
+    q: freeText(z.string().trim().min(1).max(MAX_SEARCH_TERM)).describe(
+      "What to search for, in the customer's words or yours. An order number, an error, or a description.",
+    ),
     mode: SupportSearchMode.optional().describe(
       "Which backends to run. Absent runs every one that is on, as `hybrid`. `semantic` or `hybrid` while `search.semantic` is off is refused, naming the flag.",
     ),
-    limit: z.coerce
+    limit: z
       .number()
       .int()
       .min(1)
@@ -135,11 +139,14 @@ export const SearchThreadsQuery = z
       .describe(
         `How many threads to return, best first. Default ${DEFAULT_SEARCH_LIMIT}, at most ${MAX_SEARCH_LIMIT}. No cursor: a ranked list has a top, not pages.`,
       ),
-    ...threadFilterFields,
+    archived: z
+      .boolean()
+      .optional()
+      .describe("`true` for the done pile, `false` or absent for the open inbox — which is the default on purpose."),
   })
   .strict()
   .describe("A search over the inbox: the words, the mode, how many, and the same filters the inbox listing takes.");
-export type SearchThreadsQuery = z.infer<typeof SearchThreadsQuery>;
+export type SearchThreadsBody = z.infer<typeof SearchThreadsBody>;
 
 /** The archive/unarchive body. */
 export const ArchiveThreadInput = z
@@ -200,8 +207,11 @@ export const ReplyInput = z
       .string()
       .min(1)
       .max(80)
+      .regex(/^[^@<>"]*$/, "A name may not contain @, <, > or a double quote.")
       .optional()
-      .describe("Who is answering, signed at the bottom. Omitted rather than guessed."),
+      .describe(
+        "Who is answering, signed at the bottom and written into the reply's From line. Omitted rather than guessed. May not contain `@`, `<`, `>` or `\"`, so the display name cannot pass for an address.",
+      ),
   })
   .describe("An answer to send to the customer.");
 export type ReplyInput = z.infer<typeof ReplyInput>;

package/src/http/scopes.ts

@@ -87,11 +87,12 @@ export function supportAdminRoutes(basePath: string): AdminRouteDeclaration[] {
       summary: "List the inbox, newest first, filtered by category, priority, assignee, and archived.",
     },
     {
-      method: "GET",
+      method: "POST",
       operation: "threads.search",
       path: `${basePath}/threads/search`,
       scope: SUPPORT_THREADS_READ_SCOPE,
       kind: "reads",
+      readInBody: true,
       summary: "Search the inbox by words and by meaning, ranked as one, with the same filters as the list.",
     },
     {

package/src/provision/provisionSupport.ts

@@ -28,34 +28,31 @@ import { SUPPORT_CAPABILITY, supportWorkflowRegistry } from "../workflows/specs"
  * orchestration (order, idempotency, per-env fan-out) is unit-tested without touching Cloudflare.
  * Every step is idempotent; re-running is a no-op.
  *
- * ## The routing rule is opt-in, and that is a safety decision
+ * ## The routing rule never enables Email Routing
  *
- * `ensureRoutingRule` returns `skipped: true` when no routing config is supplied, exactly as
- * `@pithy-sh/email`'s does — because **enabling Email Routing on a zone points its MX at Cloudflare.**
- * Creating a rule on the wrong zone would move an adopter's real inbound mail off their existing
- * provider, which is not a mistake a provisioning command gets to make on their behalf. So the zone,
- * the address, and the target worker are all explicit flags, and a project that has not decided yet
- * provisions everything else and adds the rule later.
+ * **Enabling Email Routing for a domain points its MX at Cloudflare**, so it stays the adopter's act. The CLI's
+ * routing step finds the zone that holds each environment's inbound address, refuses a domain Email Routing is
+ * not enabled for, and only then creates or updates the exact-address rule that sends it to that environment's
+ * app worker. It never enables routing and never touches DNS.
  *
- * The rule name is `<project>-global-support-inbound`, deliberately distinct from `@pithy-sh/email`'s
- * `<project>-global-email-bounce`. Idempotency in `ensureWorkerRoute` keys on the rule *name*, so
- * sharing one would make whichever capability provisioned second silently believe its rule already
- * existed — and the project segment is what stops two Pithy projects on one zone doing the same to
- * each other, with the loser's customer mail delivered to the winner's Worker.
+ * A rule is per environment, named `<project>-<env>-support-inbound`: each environment's address goes to its own
+ * app worker. The project-global `<project>-global-support-inbound` is what the explicit `--routing-zone`,
+ * `--inbound-address` and `--app-worker` override creates, distinct from `@pithy-sh/email`'s
+ * `<project>-global-email-bounce`, because that path keys idempotency on the rule's name.
  */
 
 /**
- * The name of the Email Routing rule this capability creates, for one project. Distinct from the
- * bounce handler's, and `global` in the environment slot because there is one rule per zone: the
- * environments are separated by which app Worker the rule is pointed at, not by the rule.
+ * The name of an Email Routing rule this capability creates, for one project: `<project>-<env>-support-inbound`
+ * for one environment's address, or `<project>-global-support-inbound` for the override that routes one address
+ * for the whole project. Distinct from the bounce handler's either way.
  *
  * **Still on the generic composer**, and deliberately: an Email Routing rule is not a namespace
  * `@pithy-sh/core/src/naming/limits` carries a verified Cloudflare cap for, and the facade exists so a
  * kind of thing brings its own number rather than borrowing one. It takes the conservative default
  * until that namespace lands — the same call `@pithy-sh/email`'s bounce rule makes.
  */
-export function supportRoutingRuleName(project: string): string {
-  return resourceName({ project, env: GLOBAL_SCOPE, thing: `${SUPPORT_CAPABILITY}-inbound` });
+export function supportRoutingRuleName(project: string, env?: ManagedEnvironment): string {
+  return resourceName({ project, env: env ?? GLOBAL_SCOPE, thing: `${SUPPORT_CAPABILITY}-inbound` });
 }
 
 /**
@@ -132,8 +129,9 @@ export interface SupportProvisioner {
    */
   settleSemanticIndex(env: ManagedEnvironment, created: boolean): Promise<{ dropped: boolean; backfilled: boolean }>;
   /**
-   * Ensure the inbound Email Routing rule that delivers the support address to the app worker.
-   * Idempotent, keyed on the rule name. Returns `skipped: true` when no routing config was supplied.
+   * Ensure the inbound Email Routing rules that deliver the support addresses to the app worker: each provisioned
+   * environment's own, or the one the override names. Idempotent. Returns `skipped: true` when there was nothing
+   * to route.
    */
   ensureRoutingRule(): Promise<{ created: boolean; skipped: boolean }>;
 }
@@ -217,8 +215,9 @@ export interface SupportDeprovisioner {
   /** Delete the env's classification worker. Idempotent. */
   deleteWorker(env: ManagedEnvironment): Promise<void>;
   /**
-   * Remove the inbound routing rule, so mail stops being delivered here. Idempotent. Called only when the teardown
-   * was asked to remove it (`removeRouting`).
+   * Remove the project-global inbound routing rule the override created, so mail stops being delivered here.
+   * Idempotent. Called only when the teardown was asked to remove it (`removeRouting`). An environment's own rule
+   * is the CLI's to remove, with that environment.
    */
   removeRoutingRule(): Promise<{ removed: boolean }>;
   /**

package/src/provision/sendingCheck.ts

@@ -0,0 +1,69 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { CapabilitySettings, SettingsFinding } from "@pithy-sh/core/src/capability/settings";
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import type { SupportConfig } from "../config/config";
+
+/**
+ * Whether each address a reply is sent from can send, as `pithy doctor` asks it.
+ *
+ * A mailed reply is sent from the inbox the thread arrived at, so an inbox on a domain Email Service cannot send
+ * from receives mail and cannot answer it: every reply fails at send with the domain named. Asked once per domain,
+ * only while replies are on. Nothing here writes.
+ */
+
+/** The domain half of an address, lowercased, or `null` where it carries none. */
+function domainOf(address: string): string | null {
+  const at = address.lastIndexOf("@");
+  if (at < 0 || at === address.length - 1) return null;
+  return address
+    .slice(at + 1)
+    .trim()
+    .toLowerCase();
+}
+
+/** Support's sending check, built from one composition's resolved config. */
+export function supportSendingSettings(config: SupportConfig): CapabilitySettings {
+  return {
+    local: () => [],
+    account: async (context) => {
+      if (!config.reply.enabled) return [];
+      // Every address a reply is sent from, under the setting that names it: the inbox a thread arrived at, and
+      // `reply.replyToAddress` for a thread that arrived at none.
+      const senders = [
+        ...config.inboundAddresses.map((address) => ({ address, setting: "inboundAddresses" })),
+        ...(config.reply.replyToAddress
+          ? [{ address: config.reply.replyToAddress, setting: "reply.replyToAddress" }]
+          : []),
+      ];
+      const byDomain = new Map<string, { setting: string; addresses: string[] }>();
+      for (const { address, setting } of senders) {
+        const domain = domainOf(address);
+        if (domain === null) continue;
+        const entry = byDomain.get(domain) ?? { setting, addresses: [] };
+        if (!entry.addresses.includes(address)) entry.addresses.push(address);
+        byDomain.set(domain, entry);
+      }
+      if (byDomain.size === 0) return [];
+      const ask = context.account.sendingDomain;
+      if (!ask) {
+        throw new InternalError({
+          message: "This doctor cannot ask whether a domain can send.",
+          detail: "SettingsAccountReader.sendingDomain is absent.",
+        });
+      }
+      const findings: SettingsFinding[] = [];
+      for (const [domain, { setting, addresses }] of byDomain) {
+        if (await ask.call(context.account, domain)) continue;
+        findings.push({
+          setting,
+          environment: null,
+          problem: `${domain} cannot send on Email Service, so a reply from ${addresses.join(", ")} fails.`,
+          action: `Onboard ${domain} for sending in the Cloudflare dashboard under Email Service, then rerun doctor.`,
+        });
+      }
+      return findings;
+    },
+  };
+}

package/src/reply/fromName.ts

@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { SupportConfig } from "../config/config";
+
+/** The placeholder `reply.fromName` writes the answering agent's name into. */
+export const AGENT_PLACEHOLDER = "{agent}";
+
+/**
+ * The display name a reply is sent under: `reply.fromName` with the agent's name written in.
+ *
+ * A pattern with no placeholder is a fixed name, used whoever answered. A pattern with one is undefined when no
+ * agent name is given, so the email capability's own `fromName` is used. Line breaks and control characters are
+ * folded to spaces, because the result is a header value.
+ */
+export function replyFromName(pattern: string, agentName: string | undefined): string | undefined {
+  const agent = agentName?.trim() ?? "";
+  if (pattern.includes(AGENT_PLACEHOLDER) && !agent) return undefined;
+  const name = pattern
+    .split(AGENT_PLACEHOLDER)
+    .join(agent)
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: control characters are what this removes.
+    .replace(/[\u0000-\u001f\u007f]+/g, " ")
+    .replace(/ {2,}/g, " ")
+    .trim();
+  return name === "" ? undefined : name;
+}
+
+/**
+ * Every address support may send a reply as: its `inboundAddresses` and `reply.replyToAddress`, normalized and
+ * once each. `compose` binds the email capability's `enqueueAs` to exactly these, so a reply cannot be sent as
+ * an address this inbox does not claim.
+ */
+export function claimedSenders(config: SupportConfig): string[] {
+  const addresses = [...config.inboundAddresses, ...(config.reply.replyToAddress ? [config.reply.replyToAddress] : [])];
+  return [...new Set(addresses)];
+}

package/src/reply/send.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 
+import { normalizeAddress } from "@pithy-sh/core/src/address/address";
 import type { AuditEmit } from "@pithy-sh/core/src/audit/recorder";
 import { commandName } from "@pithy-sh/core/src/cli/command";
 import type { Logger } from "@pithy-sh/core/src/logger/logger";
@@ -10,6 +11,7 @@ import { SupportMessage } from "../data/message";
 import { SUPPORT_MESSAGES_TABLE, SUPPORT_THREADS_TABLE, type SupportDatabase } from "../data/tables";
 import { SupportNotFoundError, SupportReplyFailedError } from "../error/errors";
 import { buildReferencesHeader, replySubject } from "../mime/threading";
+import { claimedSenders, replyFromName } from "./fromName";
 
 /**
  * Sending a reply — through `@pithy-sh/email`'s durable send path, never directly.
@@ -79,6 +81,12 @@ export interface ReplyDeps {
     template: string;
     payload: unknown;
     replyTo?: string;
+    /**
+     * Who the reply is sent as: the thread's inbox, under `reply.fromName` with the agent's name written in.
+     * `name` is absent when no agent name was given, and the email capability's `fromName` is used. The seam
+     * `compose` binds refuses an address support does not claim.
+     */
+    from?: { address: string; name?: string };
     /** The language to write the shell in — the reporter's, taken off their submission context. */
     locale?: string;
     inReplyTo?: string;
@@ -100,7 +108,7 @@ export interface ReplyInput {
   threadId: string;
   /** The reply text, as a human wrote and edited it. */
   body: string;
-  /** Who is answering, signed at the bottom. Optional. */
+  /** Who is answering: signed at the bottom, and written into the From line through `reply.fromName`. Optional. */
   agentName?: string;
   /** The verified control-plane subject sending it — the audit actor. */
   viewer: string;
@@ -194,6 +202,16 @@ export async function sendReply(deps: ReplyDeps, input: ReplyInput): Promise<Rep
   // **Both can be absent, and only on an `app` thread**: a project collecting in-app feedback with no
   // mail configured has no address a thread arrived at and none to answer from.
   const replyTo = deps.config.reply.replyToAddress ?? thread.inboxAddress;
+  // The reply leaves from the inbox the customer wrote to, under the name of whoever answered — or from
+  // `reply.replyToAddress` when that inbox is not one support claims, or there is none. A domain that cannot send
+  // fails the job naming it; nothing falls back to another sender then.
+  const claimed = claimedSenders(deps.config);
+  const inboxClaimed =
+    typeof thread.inboxAddress === "string" && claimed.includes(normalizeAddress(thread.inboxAddress));
+  const fromAddress = inboxClaimed
+    ? thread.inboxAddress
+    : (deps.config.reply.replyToAddress ?? thread.inboxAddress ?? null);
+  const fromName = replyFromName(deps.config.reply.fromName, input.agentName);
   const enqueue = deps.enqueue;
 
   // The one decision in this function. An `app` thread has a second destination — the submitter's own
@@ -225,12 +243,22 @@ export async function sendReply(deps: ReplyDeps, input: ReplyInput): Promise<Rep
         detail: `thread ${input.threadId} has no inboxAddress and no reply.replyToAddress is configured`,
       });
     }
+    if (fromAddress && !claimed.includes(normalizeAddress(fromAddress))) {
+      // The seam would refuse it too. Said here, because only support knows why: the thread arrived at an inbox
+      // this configuration no longer claims.
+      throw new SupportReplyFailedError({
+        message: `This thread's inbox, ${fromAddress}, is no longer an address support claims, so it cannot be answered from it.`,
+        action: `Add ${fromAddress} back to \`inboundAddresses\`, or set \`reply.replyToAddress\` to an address support claims, then retry.`,
+        detail: `thread ${input.threadId} arrived at ${fromAddress}, which is not among the claimed senders`,
+      });
+    }
     try {
       const enqueued = await enqueue({
         to: thread.fromAddress,
         template: "supportReply",
         payload: { subject, body: input.body, ...(input.agentName ? { agentName: input.agentName } : {}) },
         replyTo,
+        ...(fromAddress ? { from: { address: fromAddress, ...(fromName ? { name: fromName } : {}) } } : {}),
         locale: replyLocale,
         inReplyTo: parent?.mimeMessageId ? `<${parent.mimeMessageId}>` : undefined,
         references: references.length > 0 ? references : undefined,
@@ -260,8 +288,8 @@ export async function sendReply(deps: ReplyDeps, input: ReplyInput): Promise<Rep
     // No envelope on an in-app answer. `replyTo` may even be set — a project that chose in-app
     // delivery can have perfectly good mail — but writing it here would claim a send that did not
     // happen.
-    fromAddress: inApp ? null : replyTo,
-    fromName: null,
+    fromAddress: inApp ? null : (fromAddress ?? replyTo),
+    fromName: inApp ? null : (fromName ?? null),
     toAddress: inApp ? null : thread.fromAddress,
     subject,
     textBody: input.body,

package/src/reply/sender.ts

@@ -0,0 +1,35 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import type { Capability } from "@pithy-sh/core/src/capability/capability";
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import type { EmailCapability } from "@pithy-sh/email/src/capability";
+import { isEmailCapability } from "@pithy-sh/email/src/capability";
+import type { SupportConfig } from "../config/config";
+import { claimedSenders } from "./fromName";
+
+/** The `@pithy-sh/email` range whose capability carries `enqueueAs`. */
+export const EMAIL_WITH_ENQUEUE_AS = "^0.9.0";
+
+/**
+ * The enqueue a reply is sent through: the composed email capability's `enqueueAs`, bound to the addresses
+ * support claims. Undefined when no email capability is composed, which degrades the reply route alone.
+ *
+ * An email capability with no `enqueueAs` is a release older than the seam, and is refused here, at compose,
+ * rather than failing every reply.
+ */
+export function replySender(
+  capabilities: readonly Capability[],
+  config: SupportConfig,
+): EmailCapability["enqueue"] | undefined {
+  const email = capabilities.find(isEmailCapability);
+  if (!email) return undefined;
+  if (typeof email.enqueueAs !== "function") {
+    throw new InternalError({
+      message: "The composed email capability is too old to send support replies.",
+      action: `Upgrade @pithy-sh/email to ${EMAIL_WITH_ENQUEUE_AS}, the release that carries enqueueAs, then redeploy.`,
+      detail: "email capability composed without enqueueAs",
+    });
+  }
+  return email.enqueueAs(claimedSenders(config));
+}

package/src/store/threads.ts

@@ -97,7 +97,7 @@ export interface ThreadFilters {
 /**
  * What a caller may filter the inbox by, and where to resume.
  *
- * **No free text.** Listing lists; `GET {basePath}/threads/search` searches, ranked, with a limit and no
+ * **No free text.** Listing lists; `POST {basePath}/threads/search` searches, ranked, with a limit and no
  * cursor. A `q` here could say whether a thread matched, never how well.
  */
 export interface ListThreadsQuery extends ThreadFilters {

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/support";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.6.2";
+export const PACKAGE_VERSION = "0.8.0";