@pithy-sh/support 0.1.2 → 0.1.4

package/dist/http/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/http/responses.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkDxB,mEAAmE;AACnE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8D0C,CAAC;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGkE,CAAC;AACvG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE/E,qCAAqC;AACrC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCoD,CAAC;AACpF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB;;;;;;;;iBAeuE,CAAC;AAC1G,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E,kFAAkF;AAClF,eAAO,MAAM,kBAAkB;;;;;;;;;iBAWiF,CAAC;AACjH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE,kFAAkF;AAClF,eAAO,MAAM,qBAAqB;;;;;iBAOiF,CAAC;AACpH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,sBAI5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;iBAU2E,CAAC;AAC1G,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEnE,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB;;;;;iBAO8B,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEjE,4BAA4B;AAC5B,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKuB,CAAC;AAC3D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE7E,gCAAgC;AAChC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQkE,CAAC;AACrG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA0E,CAAC;AAC9G,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB;;;;;;;8BAoBsD,CAAC;AAC5F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,4CAA4C;AAC5C,eAAO,MAAM,2BAA2B;;iBAIwB,CAAC;AACjE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;iBAEgC,CAAC;AAClE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AACjE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE/E,kGAAkG;AAClG,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAkC,CAAC;AAC7E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE3F,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAA6B,CAAC;AACnE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,uFAAuF;AACvF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAiC,CAAC;AAC3E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEzF,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAgC,CAAC;AACzE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEvF,oGAAoG;AACpG,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;iBAAiC,CAAC;AAC3E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AAEH,gDAAgD;AAChD,eAAO,MAAM,mBAAmB;;;;;;;iBAayE,CAAC;AAC1G,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,uDAAuD;AACvD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;iBAiBgE,CAAC;AAClG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEzE,8BAA8B;AAC9B,eAAO,MAAM,yBAAyB;;;;;iBAgBiB,CAAC;AACxD,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEnF,6BAA6B;AAC7B,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAK2B,CAAC;AACjE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,iCAAiC;AACjC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK0B,CAAC;AAC/D,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE/E,4BAA4B;AAC5B,eAAO,MAAM,sBAAsB;;;;;;;iBAEK,CAAC;AACzC,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/http/responses.js

@@ -0,0 +1,305 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { SupportAccountLinkSource, SupportChannel, SupportMessageDirection, SupportPriority, SupportSentiment } from "../data/enums.js";
+import { SupportSubmissionContext } from "../data/message.js";
+import { SUPPORT_BILLING_SCOPE } from "../data/billingScope.js";
+import { z } from "zod";
+import { asRead } from "@pithy-sh/core/src/projection/asRead";
+//#region src/http/responses.ts
+/**
+* What the support routes return, as Zod objects a management client can validate against.
+*
+* `schemas.ts` bounds what a caller may send; this file states what it gets back. Both halves are
+* runtime values for the same reason: a management client reading a customer's Worker is crossing a
+* trust boundary and must validate what comes back, and a TypeScript interface is erased before it
+* can help — so every client that had only an interface hand-wrote a mirror, and the mirror drifted
+* the first time a field landed here.
+*
+* **Dates are ISO-8601 strings, and that is not a change.** These handlers used to hand `Date` objects
+* to `c.json`, which serializes them as ISO strings anyway — so the bytes on the wire were always
+* this, while the type said otherwise and no schema could describe it. `views.ts` now converts
+* explicitly, which is what makes the shape statable at all.
+*
+* **No codecs, and no transform anywhere in this file.** These describe JSON on the wire, so parsing
+* one hands back exactly what went in — which is what lets `responses.test.ts` compare a parsed value
+* with the projection's output and fail on a field either side forgot.
+*
+* **A browser imports this file, so it reaches no module that needs the Workers runtime.** That is not
+* a preference about bundle size; it is what "a client validates what comes back" means once the client
+* is a Vite program with the DOM lib and no Workers types. This file imported `SUPPORT_BILLING_SCOPE`
+* from `link/sender.ts` for one release and brought D1, Kysely and two capabilities' table maps with it,
+* which took `pithy-sh/dashboard`'s client build down on an error in `@pithy-sh/auth` (#419). The rule is
+* held by `tooling/browser-scopes`, which compiles this module with `types: []` and asks the compiler
+* which files that program included.
+*
+* **A field added here later is `.optional()`, not merely `.nullable()`.** This module is read across a
+* version boundary — a management client validates a response with this schema against a customer's
+* Worker at whatever kit version it is on — so an additive required key fails `safeParse` for everyone
+* below that release and takes the whole pane with it (#450). Absent then means *this Worker cannot
+* say*, which is a different fact from `null`.
+*/
+/** Where a page resumes, or the end of the list. */
+const NextCursor = z.string().nullable().describe("Where the next page resumes. Null at the end of the list. Opaque — pass it back verbatim.");
+/** One conversation, as the inbox and the reading pane show it. */
+const SupportThreadView = z.object({
+	id: z.string().describe("The thread's UUID — what every other route on this surface takes."),
+	channel: SupportChannel.describe("How this conversation started — `email` at an inbound address, or `app` from a signed-in user of the adopter's own app."),
+	inboxAddress: z.string().nullable().describe("The support address this thread arrived on, lowercased, and the address a reply comes back to. Null only on an `app` thread in a project with no inbound address configured."),
+	subject: z.string().describe("The subject of the message that opened the thread. Later replies never rewrite it."),
+	fromAddress: z.string().describe("The sender's address, lowercased."),
+	fromName: z.string().nullable().describe("The sender's display name, or null. Untrusted text; render it escaped."),
+	senderAuthenticated: z.boolean().describe("Whether the sender was proved to be who they claim. On `email` that means the `From:` header was proved, and false means unproven rather than forged — it is what withholds the customer link. Always true on `app`, where a session proved it before the request arrived."),
+	userId: z.string().nullable().describe("The user this sender resolves to, or null when nobody or unproven."),
+	accountLinkSource: SupportAccountLinkSource.nullable().describe("How `userId` was established, or null when there is no link. **Render these differently.** `session` means an authenticated request proved it and the account *is* the caller; `email_address` means it was matched against an address in a header nobody proved. The same operator action — a refund, a reset — follows from very different evidence."),
+	declaredCategory: z.string().nullable().describe("**What the submitter said this is about**, or null when nobody said — every mail thread, and every app thread filed without a chooser. **Render this and `category` differently, and never fold one into the other.** They are two facts with two authors: this is a claim by the person writing, `category` is a machine's judgment about them, and an operator deciding what to do needs to know which is on screen. Where they disagree, that disagreement is the most useful thing on the row. Where `classifiedAt` is null this is the only category anybody stated."),
+	category: z.string().describe("**What the classifier made of it** — the current category key, from this project's own federated taxonomy. `uncategorized` until a classification lands, and forever on a project with `ai.enabled: false`."),
+	priority: SupportPriority.describe("How fast this thread needs a human."),
+	sentiment: SupportSentiment.describe("How the sender sounds — the churn signal."),
+	confidence: z.number().min(0).max(1).nullable().describe("The model's confidence in the current classification, or null until one lands."),
+	model: z.string().nullable().describe("The Workers AI model that produced the classification, or null."),
+	classifiedAt: z.iso.datetime().nullable().describe("When the classification was written, ISO-8601; null until it is."),
+	archived: z.boolean().describe("Done. One shared boolean, not per viewer."),
+	archivedAt: z.iso.datetime().nullable().describe("When it was last archived, ISO-8601; null while open."),
+	archivedBy: z.string().nullable().describe("The control-plane subject that archived it, for convenience only — the answer to 'who marked this done' comes from the audit trail."),
+	messageCount: z.number().int().describe("How many messages the thread holds, inbound and outbound together."),
+	firstMessageAt: z.iso.datetime().describe("When the thread opened, ISO-8601."),
+	lastMessageAt: z.iso.datetime().describe("When the thread last moved, ISO-8601. The inbox sorts on this."),
+	createdAt: z.iso.datetime().describe("When the thread row was created, ISO-8601."),
+	updatedAt: z.iso.datetime().describe("When the thread row was last written, ISO-8601.")
+}).describe("One support conversation, as a management client sees it.");
+/**
+* A thread in the inbox listing — the thread plus this viewer's own private state.
+*
+* Re-described after `.extend()`: extending builds a new schema, and a description does not follow it.
+*/
+const SupportListedThreadView = SupportThreadView.extend({
+	read: z.boolean().describe("Whether this viewer has read it. False when they have no flag row, the common case."),
+	snoozedUntil: z.iso.datetime().nullable().describe("When this viewer's snooze expires, ISO-8601, or null.")
+}).describe("One conversation in the inbox, carrying the calling viewer's own read and snooze state.");
+/** One message in a conversation. */
+const SupportMessageView = z.object({
+	id: z.string().describe("The message's UUID — Pithy's id, not the sender's."),
+	direction: SupportMessageDirection.describe("`inbound` from the customer, `outbound` from this Worker."),
+	channel: SupportChannel.describe("How this message traveled, which on an outbound row says how the answer was delivered: `email` means it went out, `app` means it is waiting for the submitter to read it and no mail was sent."),
+	context: SupportSubmissionContext.nullable().describe("The bounded context an app submission carried — screen, build, platform, environment, locale. Null on every mail-path message."),
+	fromAddress: z.string().nullable().describe("The address this message was sent from, lowercased. Null on an answer delivered in the app, which left no envelope."),
+	fromName: z.string().nullable().describe("The sender's display name, or null. Untrusted text."),
+	toAddress: z.string().nullable().describe("The address this message was addressed to, lowercased. Null on an app submission with no envelope."),
+	subject: z.string().describe("This message's own subject, which may differ from the thread's."),
+	textBody: z.string().describe("The plain-text body."),
+	htmlBody: z.string().nullable().describe("The sanitized HTML body, or null. Sanitized at ingest; the raw original stays in R2 and is never served."),
+	emailJobId: z.string().nullable().describe("The email job this message was enqueued as. Present exactly when `direction` is `outbound` and `channel` is `email`; read `channel` to ask whether an answer went out, never the absence of this."),
+	receivedAt: z.iso.datetime().describe("When the message arrived or was sent, ISO-8601.")
+}).describe("One message in a conversation, with the threading internals dropped.");
+/** One attachment — metadata plus a short-lived URL, never the storage key. */
+const SupportAttachmentView = z.object({
+	id: z.string().describe("The attachment's UUID."),
+	filename: z.string().describe("The filename as it arrived, sanitized."),
+	contentType: z.string().describe("The declared content type."),
+	size: z.number().int().describe("The size in bytes."),
+	sha256: z.string().describe("The content digest, so a client can tell two identical attachments apart from one."),
+	inline: z.boolean().describe("Whether it was referenced inline in the HTML body rather than attached."),
+	url: z.string().nullable().describe("A signed URL valid for a few minutes, or null when no credentials were available to sign one. The `storageKey` is never here: it is server-derived precisely so a client cannot name an object or guess the one beside it.")
+}).describe("One attachment as a client receives it — metadata and a signed URL, never the storage key.");
+/** One of the sender's purchases, flattened to what a support console renders. */
+const SenderPurchaseView = z.object({
+	id: z.string().describe("The purchase row id."),
+	rail: z.string().describe("Which rail it went through — `apple`, `google`, or `stripe`."),
+	productId: z.string().describe("The Pithy product key."),
+	status: z.string().describe("Its lifecycle state — `active`, `refunded`, `expired`, and so on."),
+	environment: z.string().describe("Whether it happened in the store's sandbox rather than production."),
+	purchasedAt: z.iso.datetime().describe("When it was bought, ISO-8601."),
+	expiresAt: z.iso.datetime().nullable().describe("When it runs out, ISO-8601; null for something owned forever."),
+	revokedAt: z.iso.datetime().nullable().describe("When it was refunded or revoked, ISO-8601; null while it stands.")
+}).describe("One purchase beside the sender, so an operator answering a billing question need not go and look.");
+/** One of the sender's entitlements, lapsed ones included and marked inactive. */
+const SenderEntitlementView = z.object({
+	key: z.string().describe("The entitlement key."),
+	active: z.boolean().describe("Whether it granted when the projection last wrote it."),
+	expiresAt: z.iso.datetime().nullable().describe("When the grant lapses, ISO-8601; null when it never does."),
+	source: z.string().nullable().describe("Opaque provenance — a purchase id, or a support grant.")
+}).describe("One entitlement beside the sender. Lapsed ones are here too — a paywall wants to say when Pro ended.");
+/**
+* Which billing subject the purchase and entitlement lists cover — always `user`, and said out loud.
+*
+* `@pithy-sh/payments` keys a purchase on a **subject pair**, a user or an organization. Support starts
+* from a `From:` header and resolves a *person*; at thread-read time it holds no Hono `Context`, so it
+* cannot ask the adopter's subject seam which organization this caller is acting for. It therefore reads
+* `user`-subject rows and nothing else.
+*
+* **A field rather than a footnote, because empty already means too many things.** The purchase and
+* entitlement lookups are guarded dynamic imports whose `catch` returns `[]`, so an empty panel is
+* indistinguishable between "bought nothing", "`@pithy-sh/payments` is not installed" and "billed to an
+* organization this seam cannot see" — and an operator looking at a customer with a live subscription
+* reads it as the first. That is the actual hazard, and it is a wrong refund decision away from costing
+* something. Declaring the scope on the wire lets a console say *why* the panel is thin.
+*
+* **A closed literal, not a string.** Widening it is then a compile error at every consumer, which is
+* correct: the day support can resolve an organization, every panel has to decide what to render.
+*/
+const SenderBillingScope = z.literal(SUPPORT_BILLING_SCOPE).describe("Which billing subject the purchase and entitlement lists cover. Always `user`: support resolves a person from an address and cannot reach the adopter's subject seam, so an organization-billed customer's purchases are not shown here.");
+/**
+* What the app already knows about the sender. Derived at read time, so it is always current.
+*
+* **Everything but `authenticated` and `billingScope` is empty when the sender is unproven.** The whole
+* value of the panel is that an operator trusts it, so it must not be populated from an address anybody
+* could have written — that is what turns a spoofed message into support-driven account takeover. The
+* scope is declared either way: it describes what this seam *can* see, not what it found.
+*/
+const SenderContextView = z.object({
+	authenticated: z.boolean().describe("Whether the `From:` header was proved to belong to the sender."),
+	userId: z.string().nullable().describe("The linked user id, or null when this address belongs to nobody."),
+	name: z.string().optional().describe("The account's display name, when auth is composed and the sender is known."),
+	emailVerified: z.boolean().optional().describe("Whether the account has verified this address."),
+	billingScope: SenderBillingScope,
+	purchases: z.array(SenderPurchaseView).describe("Their purchase history, newest first, bounded. Empty when none."),
+	entitlements: z.array(SenderEntitlementView).describe("Their entitlements, lapsed ones marked inactive.")
+}).describe("The customer context beside a conversation, withheld entirely when the sender is unproven.");
+/** One canned reply, ordered for this thread's category. */
+const SupportReplyView = z.object({
+	key: z.string().describe("The snippet's key in the catalog."),
+	label: z.string().describe("What the picker shows, e.g. `Refund issued`."),
+	category: z.string().optional().describe("The category it is offered first for. Absent means always offered."),
+	body: z.string().describe("The reply text, ready to edit.")
+}).describe("One canned reply from the effective catalog.");
+/** `GET {base}/threads`. */
+const SupportThreadsResponse = z.object({
+	threads: z.array(SupportListedThreadView).describe("The page, newest first."),
+	nextCursor: NextCursor
+}).describe("A page of the inbox, as one viewer sees it.");
+/** `GET {base}/threads/:id`. */
+const SupportThreadResponse = z.object({
+	thread: SupportThreadView.describe("The conversation."),
+	messages: z.array(SupportMessageView).describe("Its messages, oldest first — a conversation reads downward."),
+	attachments: z.array(SupportAttachmentView).describe("Its attachments, across every message."),
+	sender: SenderContextView.describe("What the app already knows about the sender."),
+	replies: z.array(SupportReplyView).describe("The canned replies, ordered for this thread's category.")
+}).describe("A whole conversation, with the customer context and the replies worth offering on it.");
+/**
+* `POST {base}/threads/:id/archive`.
+*
+* The thread itself rather than an envelope around it: archiving is a write whose entire result is the
+* new state of the row, and a pane re-renders from it.
+*/
+const SupportArchiveResponse = SupportThreadView.describe("The conversation, as the archive left it.");
+/**
+* `POST {base}/threads/:id/reply`.
+*
+* **A union on `channel`, not an object with an optional `jobId`.** A reply either left by mail or was
+* stored for the submitter to read in the app, and those are different promises about when somebody
+* sees the answer. An optional field is exactly what lets a console render "sent" over both of them,
+* so the two arms are structurally different and a client has to branch to read either one.
+*/
+const SupportReplySentResponse = z.discriminatedUnion("channel", [z.object({
+	channel: z.literal("email").describe("The reply was handed to the durable send path. It is on its way."),
+	messageId: z.string().describe("The outbound message row this reply created."),
+	jobId: z.string().describe("The email job it was enqueued as. The send itself is a Workflow's job.")
+}).describe("A reply that was queued for sending, by message and by mail job."), z.object({
+	channel: z.literal("app").describe("The reply was stored, and no mail was sent. The submitter reads it next time they open the conversation — which means nobody has told them yet, and telling them is the application's call."),
+	messageId: z.string().describe("The outbound message row this reply created.")
+}).describe("A reply that is waiting in the app. There is no mail job, because there was no send.")]).describe("The reply that was filed, and which of the two ways it reaches the customer.");
+/** `POST {base}/threads/:id/reclassify`. */
+const SupportReclassifiedResponse = z.object({ messageId: z.string().describe("The latest inbound message the classifier was started against.") }).describe("Which message a reclassification was started for.");
+/**
+* `POST {base}/threads/:id/flags`.
+*
+* `ok` and nothing else. A private read flag is not audited and carries no state a client did not
+* just send, so echoing the thread back would only invite somebody to render it.
+*/
+const SupportFlagsResponse = z.object({ ok: z.literal(true).describe("Always true. The write either happened or the request failed.") }).describe("The acknowledgement of one viewer's private flags.");
+/**
+* ## The reader's contracts, beside the producers above
+*
+* Everything above this line is stated for a Worker checking its own projection, and it is strict on
+* purpose: `SupportChannel` and `SupportAccountLinkSource` are what `inbound/` branches on and what D1
+* holds, and a tolerated-unknown member there would license this capability to *store* a channel it
+* cannot handle. Nothing below changes any of that. The enums are untouched, and so is every schema
+* above.
+*
+* Below is the same projection for the other consumer: a management client reading a Worker **it does
+* not control**. That client is crossing a trust boundary — a fork, a bug, a half-finished deploy, or a
+* hostile Worker each put a member here that no enum of ours declares — and under the strict schema one
+* such token costs it the entire response. It cost `pithy-sh/dashboard#15` exactly that: one
+* unrecognized `channel` and the support pane rendered zero of twenty-five conversations. The client
+* then had to widen our shape locally, which is the hand-held mirror `#113` exists to forbid.
+*
+* So the tolerance is published rather than reimplemented, by the one pattern
+* `@pithy-sh/core/src/projection/asRead` states for the whole kit: same objects, every enum read as a
+* string, every other field the identical schema instance.
+*
+* **What a client does with a widened value is ask the enum.** `SupportChannel.safeParse(value).success`
+* answers *does this capability declare it*, and a value it does not declare is **marked, never mapped**
+* — rendering an unknown provenance as the nearest one you know is a lie about evidence on the screen
+* where somebody decides whether to act on a stranger's request.
+*
+* **Only the management surface.** The submitter's own views stay strict: an app reading its own
+* Worker's `/feedback` is not reading a stranger, and `SupportReplySentResponse` is a union discriminated
+* on a literal the client itself sent, where tolerating an unknown arm would mean tolerating a response
+* with no shape at all.
+*/
+/** {@link SupportThreadView}, as a client that does not control the Worker must read it. */
+const SupportThreadViewAsRead = asRead(SupportThreadView);
+/** {@link SupportListedThreadView}, as a client that does not control the Worker must read it. */
+const SupportListedThreadViewAsRead = asRead(SupportListedThreadView);
+/** {@link SupportMessageView}, as a client that does not control the Worker must read it. */
+const SupportMessageViewAsRead = asRead(SupportMessageView);
+/** `GET {base}/threads`, as a client that does not control the Worker must read it. */
+const SupportThreadsResponseAsRead = asRead(SupportThreadsResponse);
+/** `GET {base}/threads/:id`, as a client that does not control the Worker must read it. */
+const SupportThreadResponseAsRead = asRead(SupportThreadResponse);
+/** `POST {base}/threads/:id/archive`, as a client that does not control the Worker must read it. */
+const SupportArchiveResponseAsRead = asRead(SupportArchiveResponse);
+/**
+* ## The submitter's own view, and what it deliberately omits
+*
+* Everything above this line is written for a **management client**: an operator triaging an inbox,
+* who needs the classification to sort by and the sender's purchase history to act on. Everything
+* below is written for the **person who wrote the message**, and it is a different object rather than
+* the same one with fields nulled — because a projection that starts from the operator's shape leaks
+* the first time somebody adds a column and forgets which of the two callers is reading.
+*
+* A submitter is shown their own words, the answers to them, and whether the thread is done. They are
+* never shown the classification (a machine's judgment about them, and a filter on it is the inbox's
+* business), the priority or sentiment (the same, and `angry` rendered back to the person it describes
+* is its own kind of disaster), the per-viewer flags (private to an operator), the account link or its
+* provenance (they know who they are), or anything at all about another account.
+*/
+/** One of the submitter's own conversations. */
+const SupportMyThreadView = z.object({
+	id: z.string().describe("The conversation's id — what the read-back and a follow-up submission take."),
+	subject: z.string().describe("What they called it when they opened it. Later messages never rewrite it."),
+	resolved: z.boolean().describe("Whether support has marked this done. Named for the reader rather than mirroring the column: `archived` is an inbox's word for a thread it has finished with, and to the person waiting on an answer the fact is that it was resolved. Writing again reopens it."),
+	messageCount: z.number().int().describe("How many messages the conversation holds, theirs and the answers."),
+	lastMessageAt: z.iso.datetime().describe("When the conversation last moved, ISO-8601. The list sorts on this."),
+	createdAt: z.iso.datetime().describe("When they opened it, ISO-8601.")
+}).describe("One of the caller's own in-app support conversations, as the person who opened it sees it.");
+/** One message in the submitter's own conversation. */
+const SupportMyMessageView = z.object({
+	id: z.string().describe("The message's id."),
+	direction: SupportMessageDirection.describe("`inbound` is theirs, `outbound` is the answer. The only identity on this view: who answered is a person's name in the body if they signed it, and never an operator's account."),
+	body: z.string().describe("The message text. Plain text on both sides — what they sent, and what was sent back. Never HTML, so a client renders it escaped and there is nothing here to sanitize."),
+	context: SupportSubmissionContext.nullable().describe("The context their app attached to this message, so a client can show what was sent on their behalf. Null on an answer."),
+	attachments: z.array(SupportAttachmentView).describe("What they attached to this message. Empty on an answer."),
+	sentAt: z.iso.datetime().describe("When it was sent, ISO-8601.")
+}).describe("One message in the caller's own conversation — their words, or the answer to them.");
+/** `POST {base}/feedback`. */
+const SupportSubmissionResponse = z.object({
+	threadId: z.string().describe("The conversation it landed in — a new one, or the one it continued."),
+	messageId: z.string().describe("The message that was stored."),
+	opened: z.boolean().describe("True when this opened a conversation, false when it continued one. A client that sent no `threadId` and gets false has hit nothing surprising — it cannot happen — so this is here for the client that sent one and wants to confirm which."),
+	attachments: z.number().int().describe("How many attachments were stored. Reported rather than assumed: a deployment with no bucket bound stores the report and none of its files, and a client that showed a paperclip should be able to say so.")
+}).describe("What an in-app support request produced.");
+/** `GET {base}/feedback`. */
+const SupportMyThreadsResponse = z.object({
+	threads: z.array(SupportMyThreadView).describe("The caller's own conversations, newest first."),
+	nextCursor: NextCursor
+}).describe("A page of the caller's own support conversations.");
+/** `GET {base}/feedback/:id`. */
+const SupportMyThreadResponse = z.object({
+	thread: SupportMyThreadView.describe("The conversation."),
+	messages: z.array(SupportMyMessageView).describe("Its messages, oldest first — a conversation reads downward.")
+}).describe("One of the caller's own conversations, in full.");
+/** `GET {base}/replies`. */
+const SupportRepliesResponse = z.object({ replies: z.array(SupportReplyView).describe("The catalog, ordered for the requested category.") }).describe("The canned reply catalog.");
+//#endregion
+export { SenderBillingScope, SenderContextView, SenderEntitlementView, SenderPurchaseView, SupportArchiveResponse, SupportArchiveResponseAsRead, SupportAttachmentView, SupportFlagsResponse, SupportListedThreadView, SupportListedThreadViewAsRead, SupportMessageView, SupportMessageViewAsRead, SupportMyMessageView, SupportMyThreadResponse, SupportMyThreadView, SupportMyThreadsResponse, SupportReclassifiedResponse, SupportRepliesResponse, SupportReplySentResponse, SupportReplyView, SupportSubmissionResponse, SupportThreadResponse, SupportThreadResponseAsRead, SupportThreadView, SupportThreadViewAsRead, SupportThreadsResponse, SupportThreadsResponseAsRead };

package/dist/http/routes.d.ts

@@ -0,0 +1,111 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { PithyHonoEnv } from "@pithy-sh/core/src/capability/capability";
+import type { Context, Hono } from "hono";
+import { type HandlerDeps } from "./handlers";
+/**
+ * The support routes, their verification strategies, and what each accepts:
+ *
+ *   GET  /support/threads               → the inbox     (control-plane: support:threads:read)       query: ListThreadsQuery
+ *   GET  /support/threads/:id           → one thread    (control-plane: support:threads:read)       param: ThreadIdParam
+ *   POST /support/threads/:id/archive   → done/reopen   (control-plane: support:threads:archive)    param + json
+ *   POST /support/threads/:id/reply     → answer        (control-plane: support:threads:reply)      param + json
+ *   POST /support/threads/:id/reclassify→ re-run model  (control-plane: support:threads:reclassify) param
+ *   POST /support/threads/:id/flags     → read/snooze   (control-plane: support:threads:flag)       param + json
+ *   GET  /support/replies               → canned copy   (control-plane: support:threads:read)       query: RepliesQuery
+ *
+ *   POST /support/feedback              → write in      (bearer/session + same-origin)              json: SubmitFeedbackInput
+ *   GET  /support/feedback              → my requests   (bearer/session)                            query: MyThreadsQuery
+ *   GET  /support/feedback/:id          → one of mine   (bearer/session)                            param: ThreadIdParam
+ *
+ * **Two surfaces, two gates, and they never stack.** The management routes answer to a control-plane
+ * credential the adopter issued, and with the seam uncomposed every one denies with
+ * `controlplane/not_connected` — the correct failure for an inbox holding other people's private
+ * correspondence. The `feedback` routes answer to the adopter's own signed-in user, and with no auth
+ * capability composed `c.var.auth` is null and every one denies. A control-plane caller holds no
+ * session by design and can never satisfy `requireAuth()`; a user's session confers no scope. See
+ * `guards.ts`.
+ *
+ * **`requireSameOrigin()` is on the submission route and on neither read.** Cookie-mode sessions make a
+ * mutating route CSRF-reachable, and this one writes into a support inbox under a real customer's name
+ * — a forged submission is somebody else's words attributed to them, in the one place an operator
+ * treats attribution as proven. The reads are GETs and carry no such risk. A bearer caller is
+ * CSRF-exempt, and that exemption belongs to the gate `@pithy-sh/auth` publishes rather than to
+ * anything decided here.
+ *
+ * **Every response has an exported schema**, in `responses.ts`. Each handler's return type is
+ * `z.output` of its envelope, so `c.json(await handler(...))` carries the contract without a cast — and
+ * a management client imports the same object and validates with it rather than hand-writing a mirror
+ * that drifts.
+ *
+ * The validators sit **after** the gate on every line. A validator ahead of it turns a 401 into a
+ * 400 and tells an unverified caller which requests were well-formed — and on this surface that is a
+ * live oracle for the shape of an adopter's support tooling.
+ *
+ * ## An adopter's own authorization on the submission route
+ *
+ * **This capability gates `POST {base}/feedback` on a session and same-origin, and on nothing else,
+ * permanently.** Writing to support must not be role-gated or it stops being a general intake: the
+ * person who most needs to reach support is often the one whose access is broken, and a role the kit
+ * invented would make one adopter's account model a condition on everybody's ability to report a bug.
+ *
+ * But an adopter whose *own* model makes some submissions act-on-behalf-of — `pithy-sh/dashboard#10`'s
+ * discount application is made for an organization, and a member may not make one — needs somewhere to
+ * put that check, and it must not be the client. **The seam for it already exists, in the composition
+ * contract rather than in this capability's config**, and it is documented here because it was not
+ * discoverable rather than because it was missing:
+ *
+ * ```ts
+ * // the adopter's own `app` capability
+ * defineCapability({
+ *   name: "app",
+ *   middleware: [
+ *     (app) => {
+ *       app.use("/support/feedback", async (c, next) => {
+ *         // c.var.auth is already populated — @pithy-sh/auth's session middleware is a library's, and
+ *         // every capability's middleware mounts before any capability's routes.
+ *         if (c.var.auth && !(await mayWriteOnBehalfOfTheOrganization(c))) throw new ForbiddenError({ … });
+ *         await next();
+ *       });
+ *     },
+ *   ],
+ *   …
+ * });
+ * ```
+ *
+ * `createBackend` mounts **every** capability's middleware before **any** capability's routes, and the
+ * adopter's `app` capability composes last — so their middleware runs after auth has resolved the
+ * session and before this file's `requireAuth()`. `createBackend.workers.test.ts` pins that ordering,
+ * because a paragraph asserting it is not the same as a test failing when it changes.
+ *
+ * Two consequences worth stating rather than discovering. Their middleware sees `c.var.auth` as **null**
+ * on an unauthenticated request, since it runs ahead of the route's own gate — so it should pass those
+ * through and let `requireAuth()` answer 401, rather than 403 a caller who was never signed in. And the
+ * path is theirs to write, from the `basePath` they configured; a mount point they changed and a
+ * middleware path they did not is a gate that silently stops covering anything.
+ *
+ * **A `beforeSubmit` callback in `SupportConfig` was the tempting alternative and is the wrong shape.**
+ * The need is not support's — every capability with a write route has it — so solving it once per
+ * capability would give an adopter a different mechanism per package, each with its own signature and
+ * its own answer to "what is in scope here". A config file is also the wrong home for an authorization
+ * decision that wants `c.var`, and a second place to look for the gates on a route is how a Worker ends
+ * up with two of them, free to disagree.
+ */
+/** How the support sub-router is built. */
+export interface SupportRoutesOptions {
+    /** The path the routes mount under. Defaults to `/support`. */
+    basePath?: string;
+    /**
+     * Whether to mount the in-app submission routes. Defaults to true, matching `submission.enabled`.
+     *
+     * Not mounting is deliberate rather than a guard inside the handlers: a route that is not served
+     * answers 404, and 404 is the honest answer. A 403 would say "this exists and you may not use it" to
+     * a caller asking about a feature this deployment does not have.
+     */
+    submission?: boolean;
+    /** Resolve handler deps from the request context. */
+    resolveDeps: (c: Context<PithyHonoEnv>) => Promise<HandlerDeps>;
+}
+/** Register the support sub-router. Returned as the capability's `routes` hook. */
+export declare function registerSupportRoutes(options: SupportRoutesOptions): (app: Hono<PithyHonoEnv>) => void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/http/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/http/routes.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAK7E,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAEL,KAAK,WAAW,EAUjB,MAAM,YAAY,CAAC;AAoBpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACjE;AAuCD,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAqFtG"}

package/dist/http/routes.js

@@ -0,0 +1,64 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { requireAuth } from "./guards.js";
+import { archiveConversation, listInbox, listMyThreads, listReplies, readConversation, readMyThread, reclassifyConversation, replyToConversation, submitFeedbackRequest, updateFlags } from "./handlers.js";
+import { ArchiveThreadInput, FlagsInput, ListThreadsQuery, MyThreadsQuery, RepliesQuery, ReplyInput, SubmitFeedbackInput, ThreadIdParam } from "./schemas.js";
+import { SUPPORT_THREADS_ARCHIVE_SCOPE, SUPPORT_THREADS_FLAG_SCOPE, SUPPORT_THREADS_READ_SCOPE, SUPPORT_THREADS_RECLASSIFY_SCOPE, SUPPORT_THREADS_REPLY_SCOPE } from "./scopes.js";
+import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import { zValidator } from "@hono/zod-validator";
+import { requireControlPlane } from "@pithy-sh/core/src/controlPlane/http/guard";
+import { requireSameOrigin } from "@pithy-sh/core/src/http/sameOrigin";
+import { validationHook } from "@pithy-sh/core/src/http/validation";
+//#region src/http/routes.ts
+/**
+* The verified management client behind a control-plane call.
+*
+* `requireControlPlane()` has run on every route, so `c.var.controlPlane` is populated by the time a
+* handler reads it. The throw is a programming-error guard, not a runtime path: reaching it would
+* mean a route was mounted without its gate, which is the one mistake this whole file is arranged to
+* make impossible.
+*/
+function viewer(c) {
+	const subject = c.var.controlPlane?.subject;
+	if (!subject) throw new InternalError({
+		message: "Support could not identify the management caller.",
+		detail: "requireControlPlane() must run before a support handler reads the caller."
+	});
+	return subject;
+}
+/**
+* The signed-in user behind an in-app submission.
+*
+* `requireAuth()` has run on every route that calls this, so `c.var.auth` is populated by the time a
+* handler reads it. The throw is a programming-error guard rather than a runtime path — the mirror of
+* {@link viewer}, and the reason neither handler ever has to think about an absent caller.
+*/
+function submitter(c) {
+	const auth = c.var.auth;
+	if (!auth) throw new InternalError({
+		message: "Support could not identify the signed-in caller.",
+		detail: "requireAuth() must run before a support submission handler reads the submitter."
+	});
+	return auth.userId;
+}
+/** Register the support sub-router. Returned as the capability's `routes` hook. */
+function registerSupportRoutes(options) {
+	const base = options.basePath ?? "/support";
+	const resolve = options.resolveDeps;
+	const submission = options.submission ?? true;
+	return (app) => {
+		app.get(`${base}/threads`, requireControlPlane(SUPPORT_THREADS_READ_SCOPE), zValidator("query", ListThreadsQuery, validationHook), async (c) => c.json(await listInbox(await resolve(c), c.req.valid("query"), viewer(c))));
+		app.get(`${base}/replies`, requireControlPlane(SUPPORT_THREADS_READ_SCOPE), zValidator("query", RepliesQuery, validationHook), async (c) => c.json({ replies: listReplies(await resolve(c), c.req.valid("query")) }));
+		app.get(`${base}/threads/:id`, requireControlPlane(SUPPORT_THREADS_READ_SCOPE), zValidator("param", ThreadIdParam, validationHook), async (c) => c.json(await readConversation(await resolve(c), c.req.valid("param").id)));
+		app.post(`${base}/threads/:id/archive`, requireControlPlane(SUPPORT_THREADS_ARCHIVE_SCOPE), zValidator("param", ThreadIdParam, validationHook), zValidator("json", ArchiveThreadInput, validationHook), async (c) => c.json(await archiveConversation(await resolve(c), c.req.valid("param").id, c.req.valid("json"), viewer(c))));
+		app.post(`${base}/threads/:id/reply`, requireControlPlane(SUPPORT_THREADS_REPLY_SCOPE), zValidator("param", ThreadIdParam, validationHook), zValidator("json", ReplyInput, validationHook), async (c) => c.json(await replyToConversation(await resolve(c), c.req.valid("param").id, c.req.valid("json"), viewer(c)), 201));
+		app.post(`${base}/threads/:id/reclassify`, requireControlPlane(SUPPORT_THREADS_RECLASSIFY_SCOPE), zValidator("param", ThreadIdParam, validationHook), async (c) => c.json(await reclassifyConversation(await resolve(c), c.req.valid("param").id, viewer(c))));
+		app.post(`${base}/threads/:id/flags`, requireControlPlane(SUPPORT_THREADS_FLAG_SCOPE), zValidator("param", ThreadIdParam, validationHook), zValidator("json", FlagsInput, validationHook), async (c) => c.json(await updateFlags(await resolve(c), c.req.valid("param").id, c.req.valid("json"), viewer(c))));
+		if (!submission) return;
+		app.post(`${base}/feedback`, requireAuth(), requireSameOrigin(), zValidator("json", SubmitFeedbackInput, validationHook), async (c) => c.json(await submitFeedbackRequest(await resolve(c), c.req.valid("json"), submitter(c)), 201));
+		app.get(`${base}/feedback`, requireAuth(), zValidator("query", MyThreadsQuery, validationHook), async (c) => c.json(await listMyThreads(await resolve(c), c.req.valid("query"), submitter(c))));
+		app.get(`${base}/feedback/:id`, requireAuth(), zValidator("param", ThreadIdParam, validationHook), async (c) => c.json(await readMyThread(await resolve(c), c.req.valid("param").id, submitter(c))));
+	};
+}
+//#endregion
+export { registerSupportRoutes };

package/dist/http/schemas.d.ts

@@ -0,0 +1,123 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { z } from "zod";
+/**
+ * The request contracts every support route declares (CLAUDE.md §HTTP).
+ *
+ * Every one of these is a **bound on something a caller chose**, which is the whole job: a control-
+ * plane credential is verified, but verified is not the same as trusted, and a management client with
+ * a bug can ask for a million rows as easily as a hostile one can.
+ *
+ * The category filter is a bounded string rather than an enum, and that is deliberate: the taxonomy
+ * is federated, so the valid set is not known here — and building the schema from the configured set
+ * would make a filter for a category an adopter just removed a 400 instead of an empty list, which is
+ * a worse answer to the same question. The value is only ever compared, never interpreted.
+ */
+/** A thread id in the path. */
+export declare const ThreadIdParam: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export type ThreadIdParam = z.infer<typeof ThreadIdParam>;
+/** The inbox listing query. */
+export declare const ListThreadsQuery: z.ZodObject<{
+    archived: z.ZodOptional<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>;
+    category: z.ZodOptional<z.ZodString>;
+    declaredCategory: z.ZodOptional<z.ZodString>;
+    priority: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        normal: "normal";
+        urgent: "urgent";
+    }>>;
+    sentiment: z.ZodOptional<z.ZodEnum<{
+        angry: "angry";
+        frustrated: "frustrated";
+        neutral: "neutral";
+        positive: "positive";
+    }>>;
+    channel: z.ZodOptional<z.ZodEnum<{
+        app: "app";
+        email: "email";
+    }>>;
+    inbox: z.ZodOptional<z.ZodString>;
+    q: z.ZodOptional<z.ZodString>;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type ListThreadsQuery = z.infer<typeof ListThreadsQuery>;
+/** The archive/unarchive body. */
+export declare const ArchiveThreadInput: z.ZodObject<{
+    archived: z.ZodBoolean;
+}, z.core.$strip>;
+export type ArchiveThreadInput = z.infer<typeof ArchiveThreadInput>;
+/** The reply body. */
+export declare const ReplyInput: z.ZodObject<{
+    body: z.ZodString;
+    agentName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ReplyInput = z.infer<typeof ReplyInput>;
+/** The per-viewer flags body. */
+export declare const FlagsInput: z.ZodObject<{
+    read: z.ZodOptional<z.ZodBoolean>;
+    snoozedUntil: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type FlagsInput = z.infer<typeof FlagsInput>;
+/**
+ * One file on an in-app submission.
+ *
+ * The bytes arrive base64-encoded in JSON so the whole request stays one Zod object on the route line,
+ * like every other route in this capability. **The size and type bounds are not here**: they are the
+ * adopter's `submission.attachments` config, resolved in the handler, because a request schema is built
+ * once at module load and cannot know them. What this bounds is the shape — a filename that renders, a
+ * MIME type that looks like one, and a payload that is base64 at all.
+ */
+export declare const SubmittedAttachmentInput: z.ZodObject<{
+    filename: z.ZodString;
+    contentType: z.ZodString;
+    data: z.ZodUnion<readonly [z.ZodBase64, z.ZodBase64URL]>;
+}, z.core.$strip>;
+export type SubmittedAttachmentInput = z.infer<typeof SubmittedAttachmentInput>;
+/**
+ * The in-app submission body.
+ *
+ * **Nothing here names an account, and nothing here could.** The submitter is `c.var.auth.userId`,
+ * proved before this schema ran — a `userId` field would be a client-supplied identity on the one
+ * surface whose whole argument is that it does not need one.
+ *
+ * The lengths are the hard ceilings from `config/config.ts`, not the adopter's configured bounds: this
+ * schema is built once at module load, and the configured numbers are applied in the handler where the
+ * resolved config lives. A body over the ceiling never reaches a handler at all.
+ */
+export declare const SubmitFeedbackInput: z.ZodObject<{
+    subject: z.ZodString;
+    body: z.ZodString;
+    declaredCategory: z.ZodOptional<z.ZodString>;
+    threadId: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodObject<{
+        screen: z.ZodOptional<z.ZodString>;
+        appVersion: z.ZodOptional<z.ZodString>;
+        platform: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodString>;
+        locale: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    attachments: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        filename: z.ZodString;
+        contentType: z.ZodString;
+        data: z.ZodUnion<readonly [z.ZodBase64, z.ZodBase64URL]>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SubmitFeedbackInput = z.infer<typeof SubmitFeedbackInput>;
+/** The submitter's own thread list. */
+export declare const MyThreadsQuery: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type MyThreadsQuery = z.infer<typeof MyThreadsQuery>;
+/** The canned-reply catalog query. */
+export declare const RepliesQuery: z.ZodObject<{
+    category: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RepliesQuery = z.infer<typeof RepliesQuery>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/http/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/http/schemas.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;;GAWG;AAEH,+BAA+B;AAC/B,eAAO,MAAM,aAAa;;iBAOsC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAY1D,+BAA+B;AAC/B,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwC8D,CAAC;AAC5F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;iBAQuB,CAAC;AACvD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,sBAAsB;AACtB,eAAO,MAAM,UAAU;;;iBAgB0B,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,iCAAiC;AACjC,eAAO,MAAM,UAAU;;;iBAWmC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;iBA4B8D,CAAC;AACpG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAiCqF,CAAC;AACtH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,cAAc;;;iBAiBxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,sCAAsC;AACtC,eAAO,MAAM,YAAY;;iBAM4B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}