@pithy-sh/support 0.3.3 → 0.4.0

package/dist/store/searchIndex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"searchIndex.d.ts","sourceRoot":"","sources":["../../src/store/searchIndex.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,iHAAiH;AACjH,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5F;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F"}
+{"version":3,"file":"searchIndex.d.ts","sourceRoot":"","sources":["../../src/store/searchIndex.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,iHAAiH;AACjH,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,YAC1B,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,CACjB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAuC,CAAC;AAEpF,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAO3E;AAED,iEAAiE;AACjE,MAAM,MAAM,iBAAiB;AAC3B,kDAAkD;AAChD,MAAM;AACR,qEAAqE;GACnE,QAAQ;AACV,gGAAgG;GAC9F,QAAQ;AACV,mFAAmF;GACjF,MAAM,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAI7F;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAgBlD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1F"}

package/dist/store/searchIndex.js

@@ -3,8 +3,8 @@
 import { sql } from "kysely";
 //#region src/store/searchIndex.ts
 /**
-* The FTS5 index's lifecycle — created and dropped by `pithy support provision`, **not by a
-* migration**.
+* The FTS5 index's lifecycle — the virtual table **and the three triggers that keep it in step**,
+* created and dropped by `pithy support provision`, **not by a migration**.
 *
 * ## Why this is not a migration
 *
@@ -26,13 +26,142 @@ import { sql } from "kysely";
 * config flag, fixable only by knowing to roll back first. Out of the ledger, there is nothing to
 * corrupt and toggling either way is just a re-provision.
 *
-* Both statements are idempotent, so provisioning stays safe to re-run — the property every other
+* **The triggers inherit that constraint exactly.** They exist only where the table exists, so they
+* are provisioning and not schema — a `CREATE TRIGGER` composed conditionally on `search.fts` would
+* corrupt the ledger for exactly the same reason the table's own statement did. `migrations.workers.test.ts`
+* keeps proving the migration set carries none.
+*
+* ## Why triggers at all
+*
+* The index used to be written by hand at every message write — three call sites, each best-effort —
+* and correctness depended on every future author remembering. There is no shared message-write
+* helper, so a fourth path that forgot produced a thread nobody could search, with nothing failing,
+* nothing logging and no test catching it.
+*
+* `CREATE TRIGGER` was in an undocumented middle on D1 when that was decided: D1 runs an authorizer
+* that rejects SQLite constructs workerd permits (`fts5vocab` is refused where plain FTS5 succeeds),
+* so a trigger passing under Miniflare proved nothing about the deployment that matters. That is
+* settled — the Leed CMS ships a `BEFORE UPDATE … BEGIN SELECT RAISE(ABORT, …); END` trigger in a
+* production migration, so the authorizer permits both the statement and a body that aborts.
+*
+* **The durability contract inverts, deliberately.** A trigger runs inside the message's own
+* statement, so a failure in its body takes the message write down with it — where the old call sites
+* logged and carried on. That swallow existed because a second round trip to a separate table can
+* fail on its own; inside one statement it cannot. The body is a `DELETE` plus an `INSERT` of values
+* already present in `NEW.*`, with no conversion, no constraint and no foreign key, so what remains is
+* the FTS table being absent — which is what {@link SEARCH_TRIGGERS} cannot outlive, since
+* {@link dropSearchIndex} drops the pair together — or disk and corruption, which would have failed the
+* message insert anyway.
+*
+* The one gap the kit cannot close from here is an adopter who upgrades and deploys without re-running
+* `pithy support provision`: the calls are gone, the triggers were never created, and messages
+* silently stop being indexed. `pithy doctor` reports a provisioned table with no triggers as drift
+* and names that command, per environment.
+*
+* Every statement here is idempotent, so provisioning stays safe to re-run — the property every other
 * step of `pithy support provision` already has.
 */
 /** The virtual table's name. Snake_case because nothing translates it — every statement here is hand-written. */
 const SEARCH_TABLE = "pithy_support_search";
 /**
-* Create the full-text index if it is not already there.
+* The three triggers, in create order — `_ai`, `_au`, `_ad` after SQLite's own FTS5 naming for the
+* insert, update and delete hooks.
+*
+* Exported because two other places need the exact names and may not re-derive them: `pithy doctor`
+* asks a deployed database whether they are there, and {@link dropSearchIndex} drops them. They carry
+* the `pithy_support_` prefix every table in this capability does, for the same reason — `sqlite_master`
+* is one flat namespace per database and the prefix is the only partition.
+*/
+const SEARCH_TRIGGERS = [
+	"pithy_support_search_ai",
+	"pithy_support_search_au",
+	"pithy_support_search_ad"
+];
+/**
+* Every name a provisioner or `pithy doctor` asks `sqlite_master` about — the table and its triggers.
+*
+* One list, read by both, because the two have to agree about what "provisioned" means. A doctor that
+* looked for two triggers while the provisioner created three would report drift nothing could clear.
+*/
+const SEARCH_OBJECTS = [SEARCH_TABLE, ...SEARCH_TRIGGERS];
+/**
+* Read a `sqlite_master` name listing into the two facts anything acts on.
+*
+* **The trigger count is three-valued, and `"some"` is why.** A partial set means one `CREATE TRIGGER`
+* failed or one was dropped by hand, and the consequence is per statement kind — two of three leaves
+* updates or deletes going unindexed while inserts look fine, which is the worst way round. Folding it
+* into `"none"` would also hide it from a teardown: `search.fts: false` has to clear a stray trigger,
+* because a trigger whose table is gone fails every write to `pithy_support_messages`.
+*/
+function searchIndexState(names) {
+	const found = new Set(names);
+	const present = SEARCH_TRIGGERS.filter((name) => found.has(name)).length;
+	return {
+		table: found.has(SEARCH_TABLE),
+		triggers: present === SEARCH_TRIGGERS.length ? "all" : present === 0 ? "none" : "some"
+	};
+}
+/**
+* Decide what `pithy support provision` does to one environment's index.
+*
+* **`repair` is the member this release exists for.** A run used to compare one boolean against one
+* boolean — table present against flag set — and return early when they matched. That is exactly the
+* state an adopter is in after upgrading and deploying: the table is present, the flag is set, the
+* `indexMessage` calls are gone from every write path, and the triggers were never created. The old
+* comparison read that as nothing to do, so the command `pithy doctor` names would not have been the
+* command that fixes it.
+*
+* A repair backfills as a create does, because the gap is real: messages written between the deploy
+* and the re-provision had no trigger to fire for them and no application call either.
+*
+* `drop` fires on triggers alone as well as on the table. A trigger body resolves its table at run
+* time, so a trigger outlives a hand-dropped table — and while it does, every write to
+* `pithy_support_messages` fails. Turning the flag off has to clear that rather than read it as a
+* database with no index.
+*/
+function searchIndexAction(state, wanted) {
+	if (!wanted) return state.table || state.triggers !== "none" ? "drop" : "none";
+	if (!state.table) return "create";
+	return state.triggers === "all" ? "none" : "repair";
+}
+/**
+* The `CREATE TRIGGER` statements, one per {@link SEARCH_TRIGGERS} entry and in that order.
+*
+* **`BEGIN` and `END` are uppercase, and that is load-bearing.** Miniflare accepts a lowercase
+* compound-statement body; remote D1 rejects it as `incomplete input [code: 7500]`, so a lowercased
+* body passes every local test in this repository and fails on deploy. `searchIndex.test.ts` fails on
+* the lowercase form, because no Workers test can.
+*
+* **Every column is the physical snake_case name.** `CamelCasePlugin` snake-cases the identifiers the
+* query builder emits and never touches a string inside a `sql` template, so this is the one place in
+* the package that has to spell them itself: `NEW.id`, `NEW.thread_id`, `NEW.subject`, `NEW.text_body`
+* — never the camelCase keys `data/tables.ts` declares.
+*
+* **Insert and update both delete first.** An FTS5 table has no primary key and no unique constraint
+* to lean on, so a bare insert on a second write for the same message would add a second copy and the
+* thread would start appearing twice in its own search results — the same reason `indexMessage` is
+* remove-then-insert. The update body keys its delete on `OLD.id`, so a row whose id changed takes its
+* old index entry with it.
+*/
+function searchTriggerStatements() {
+	const insert = "INSERT INTO pithy_support_search(thread_id, message_id, subject, body)";
+	const values = "VALUES (NEW.thread_id, NEW.id, NEW.subject, NEW.text_body)";
+	return [
+		`CREATE TRIGGER ${SEARCH_TRIGGERS[0]} AFTER INSERT ON pithy_support_messages BEGIN
+       DELETE FROM pithy_support_search WHERE message_id = NEW.id;
+       ${insert} ${values};
+     END`,
+		`CREATE TRIGGER ${SEARCH_TRIGGERS[1]} AFTER UPDATE ON pithy_support_messages BEGIN
+       DELETE FROM pithy_support_search WHERE message_id = OLD.id;
+       ${insert} ${values};
+     END`,
+		`CREATE TRIGGER ${SEARCH_TRIGGERS[2]} AFTER DELETE ON pithy_support_messages BEGIN
+       DELETE FROM pithy_support_search WHERE message_id = OLD.id;
+     END`
+	];
+}
+/**
+* Create the full-text index and its triggers if they are not already there.
 *
 * A standalone (not external-content) FTS5 table. External content would store the text once rather
 * than twice, but it requires the indexed column names to exist verbatim on the content table, and
@@ -42,6 +171,13 @@ const SEARCH_TABLE = "pithy_support_search";
 * `thread_id` and `message_id` are UNINDEXED: they are carried so a match resolves straight to a
 * conversation and so one message's rows can be replaced, and tokenizing a UUID would only add noise
 * to every query.
+*
+* **The triggers are dropped and recreated rather than guarded with `IF NOT EXISTS`**, which is what
+* makes re-provisioning after a kit upgrade actually converge. `IF NOT EXISTS` is idempotent in the
+* weak sense — it leaves a trigger whose body this release has changed exactly as it was, so a fixed
+* body would reach nobody who already had the old one, and the command `pithy doctor` names would not
+* be the command that fixes it. The pair is ordered so the table is always there before a body refers
+* to it.
 */
 async function createSearchIndex(db) {
 	await sql`
@@ -53,16 +189,25 @@ async function createSearchIndex(db) {
       tokenize = 'unicode61 remove_diacritics 2'
     )
   `.execute(db);
+	for (const [index, statement] of searchTriggerStatements().entries()) {
+		await sql.raw(`drop trigger if exists ${SEARCH_TRIGGERS[index]}`).execute(db);
+		await sql.raw(statement).execute(db);
+	}
 }
 /**
-* Drop the full-text index if it is there.
+* Drop the full-text index and its triggers if they are there.
 *
 * Safe by construction: the index is derived, so this costs a rebuild rather than a restore. It is
 * what `pithy support provision` runs when `search.fts` goes back to false — and the reason turning
 * the feature off is now a one-command operation instead of a migration rollback.
+*
+* **The triggers go first, and the order is the whole point.** A trigger whose body inserts into a
+* table that is gone fails every write to `pithy_support_messages`, so dropping the table out from
+* under them would turn a feature flag into an outage on the capability's main write path.
 */
 async function dropSearchIndex(db) {
+	for (const trigger of SEARCH_TRIGGERS) await sql.raw(`drop trigger if exists ${trigger}`).execute(db);
 	await sql`drop table if exists pithy_support_search`.execute(db);
 }
 //#endregion
-export { SEARCH_TABLE, createSearchIndex, dropSearchIndex };
+export { SEARCH_OBJECTS, SEARCH_TABLE, SEARCH_TRIGGERS, createSearchIndex, dropSearchIndex, searchIndexAction, searchIndexState, searchTriggerStatements };

package/dist/store/threads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threads.d.ts","sourceRoot":"","sources":["../../src/store/threads.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK/C;;;;;;;;;;;;;;GAcG;AAEH,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEzD;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAYhF;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB;IACpB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,qBAAqB;IACrB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,mGAAmG;IACnG,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAqGD,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,sBAAsB;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,kEAAkE;IAClE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,kFAAkF;AAClF,wBAAsB,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA+BlE;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BhH;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,eAAe,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,GAAG,EAAE,IAAI,CAAC;CACX,GACA,OAAO,CAAC,IAAI,CAAC,CAsCf"}
+{"version":3,"file":"threads.d.ts","sourceRoot":"","sources":["../../src/store/threads.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK/C;;;;;;;;;;;;;;GAcG;AAEH,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEzD;AAED,2GAA2G;AAC3G,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAYhF;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB;IACpB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,qBAAqB;IACrB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,mGAAmG;IACnG,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,iCAAiC;IACjC,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAqGD,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,sBAAsB;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,kEAAkE;IAClE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,kFAAkF;AAClF,wBAAsB,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA+BlE;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BhH;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,eAAe,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,GAAG,EAAE,IAAI,CAAC;CACX,GACA,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/store/threads.js

@@ -5,8 +5,9 @@ import { SupportAttachment } from "../data/attachment.js";
 import { SupportMessage } from "../data/message.js";
 import { SupportThread } from "../data/thread.js";
 import { SUPPORT_ATTACHMENTS_TABLE, SUPPORT_FLAGS_TABLE, SUPPORT_MESSAGES_TABLE, SUPPORT_THREADS_TABLE } from "../data/tables.js";
-import { isSearchable, searchPredicate } from "./search.js";
 import "./paging.js";
+import { isSearchable, searchPredicate } from "./search.js";
+import { pithyCommandOf } from "@pithy-sh/core/src/cli/command";
 import { sql } from "kysely";
 //#region src/store/threads.ts
 /**
@@ -50,7 +51,7 @@ async function listThreads(db, query, options) {
 		return await runListThreads(db, query, options);
 	} catch (error) {
 		if (options.fts && isMissingSearchTable(error)) {
-			options.log?.warn("support FTS index is configured but absent — falling back to a LIKE scan", { action: "Run `pithy support provision` to create and backfill it, or set `search.fts: false`." });
+			options.log?.warn("support FTS index is configured but absent — falling back to a LIKE scan", { action: `Run \`${pithyCommandOf("support provision", {}, { runtime: true })}\` to create and backfill it, or set \`search.fts: false\`.` });
 			return runListThreads(db, query, {
 				...options,
 				fts: false

package/dist/submission/submit.d.ts

@@ -90,8 +90,6 @@ export interface SubmitDeps {
     categories: SupportCategories;
     /** The R2 bucket attachments are written to. Absent means none are stored. */
     bucket?: R2Bucket;
-    /** Whether the FTS5 index is composed. */
-    fts: boolean;
     /**
      * The submitter's account, by id. Returns null when `@pithy-sh/auth` is absent or the row is gone —
      * both of which contradict the session that got here, so the caller treats it as a fault rather than

package/dist/submission/submit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submit.d.ts","sourceRoot":"","sources":["../../src/submission/submit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAkB,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAOxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,0FAA0F;AAC1F,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,EAAE,EAAE,eAAe,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;OAOG;IACH,UAAU,EAAE,iBAAiB,CAAC;IAC9B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,OAAO,CAAC;IACb;;;;OAIG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrF,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,sBAAsB;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,WAAW;IACX,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,sGAAsG;AACtG,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2CAA2C;IAC3C,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC7C;AA0MD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG7G;AAED,kCAAkC;AAClC,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAmKjG"}
+{"version":3,"file":"submit.d.ts","sourceRoot":"","sources":["../../src/submission/submit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAG/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAkB,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAMxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,0FAA0F;AAC1F,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,EAAE,EAAE,eAAe,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;OAOG;IACH,UAAU,EAAE,iBAAiB,CAAC;IAC9B,8EAA8E;IAC9E,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB;;;;OAIG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrF,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,sBAAsB;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,KAAK,EAAE,MAAM,MAAM,CAAC;IACpB,WAAW;IACX,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,sGAAsG;AACtG,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2CAA2C;IAC3C,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC7C;AA0MD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG7G;AAED,kCAAkC;AAClC,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA2JjG"}

package/dist/submission/submit.js

@@ -8,7 +8,6 @@ import { SupportThread, UNCLASSIFIED } from "../data/thread.js";
 import { SUPPORT_ATTACHMENTS_TABLE, SUPPORT_MESSAGES_TABLE, SUPPORT_THREADS_TABLE } from "../data/tables.js";
 import { attachmentKey, putAttachment, sha256Hex } from "../attachment/store.js";
 import { SupportAuditActions } from "../audit/actions.js";
-import { indexMessage } from "../store/search.js";
 import { safeFilename } from "../mime/parse.js";
 import { checkAccountRate, checkAttachment } from "./guard.js";
 import { InternalError, ValidationError } from "@pithy-sh/core/src/error/pithyError";
@@ -278,19 +277,6 @@ async function submitFeedback(deps, input) {
 		});
 		throw error;
 	}
-	if (deps.fts) try {
-		await indexMessage(deps.db, {
-			threadId,
-			messageId,
-			subject: input.subject,
-			body: input.body
-		});
-	} catch (error) {
-		deps.log.warn("support submission not indexed", {
-			messageId,
-			error
-		});
-	}
 	let attachments = 0;
 	try {
 		attachments = await storeAttachments(deps, input.attachments, threadId, messageId, now);

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.3.3";
+export declare const PACKAGE_VERSION = "0.4.0";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/support";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.3.3";
+const PACKAGE_VERSION = "0.4.0";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/support",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,12 +40,12 @@
     "tldts": "^7.4.10"
   },
   "peerDependencies": {
-    "@pithy-sh/auth": "^0.7.0",
-    "@pithy-sh/core": "^0.9.0",
-    "@pithy-sh/email": "^0.3.11",
-    "@pithy-sh/payments": "^0.3.10",
-    "@pithy-sh/secrets": "^0.3.2",
-    "@pithy-sh/storage": "^0.2.10",
+    "@pithy-sh/auth": "^0.8.0",
+    "@pithy-sh/core": "^0.10.0",
+    "@pithy-sh/email": "^0.4.0",
+    "@pithy-sh/payments": "^0.4.0",
+    "@pithy-sh/secrets": "^0.4.0",
+    "@pithy-sh/storage": "^0.3.0",
     "hono": "^4.13.2",
     "kysely": "^0.29.0",
     "zod": "^4.4.0"
@@ -59,7 +59,7 @@
     }
   },
   "devDependencies": {
-    "@cloudflare/vitest-plugin": "^1.0.0",
+    "@cloudflare/vitest-plugin": "^1.4.2",
     "@pithy-sh/auth": "workspace:*",
     "@pithy-sh/core": "workspace:*",
     "@pithy-sh/email": "workspace:*",
@@ -75,7 +75,7 @@
     "tsdown": "^0.23.0",
     "typescript": "^7.0.2",
     "vitest": "^4.1.0",
-    "wrangler": "^4.115.0",
+    "wrangler": "^4.151.0",
     "zod": "^4.4.0"
   }
 }

package/src/ai/classify.ts

@@ -177,8 +177,12 @@ export async function classifyMessage(
   // would have called an outage and the step would have re-driven five times against an env that is
   // not going to grow a binding. This is the deployment error `support/classification_failed` names,
   // and it is terminal.
-  const run = (ai as Partial<SupportAi> | undefined)?.run;
-  if (typeof run !== "function") {
+  //
+  // The presence test reads `run`; the call below goes through the binding itself. A Workers binding
+  // can be an RPC stub, where a property read is another stub and `.call` on it is a remote call to a
+  // method named `call` — the fault that broke `classifiedSteps().sleep` on a live `WorkflowStep`.
+  const binding = ai as Partial<SupportAi> | undefined;
+  if (typeof binding?.run !== "function") {
     throw new SupportClassificationError({
       detail: "the AI binding is absent from this worker's env; classification cannot run",
     });
@@ -186,7 +190,7 @@ export async function classifyMessage(
 
   let raw: unknown;
   try {
-    raw = await run.call(ai, options.model, {
+    raw = await binding.run(options.model, {
       messages: [
         { role: "system", content: classificationPrompt(options.categories) },
         { role: "user", content: classificationInput(options.subject, options.body, options.maxChars) },

package/src/http/handlers.ts

@@ -3,6 +3,7 @@
 
 import type { D1Database, R2Bucket } from "@cloudflare/workers-types";
 import type { AuditEmit } from "@pithy-sh/core/src/audit/recorder";
+import { pithyCommandOf } from "@pithy-sh/core/src/cli/command";
 import { ValidationError } from "@pithy-sh/core/src/error/pithyError";
 import type { Logger } from "@pithy-sh/core/src/logger/logger";
 import type { ObjectStore } from "@pithy-sh/storage/src/object/store";
@@ -221,7 +222,6 @@ export async function replyToConversation(
       db: deps.db,
       config: deps.config,
       enqueue: deps.enqueue,
-      fts: deps.fts,
       emit: deps.emit,
       log: deps.log,
       newId: deps.newId,
@@ -252,7 +252,7 @@ export async function reclassifyConversation(
     // ran — forever, and with a success event in the audit trail to corroborate it.
     throw new SupportClassificationError({
       message: "Classification is not available on this deployment.",
-      action: "Run `pithy support provision` to deploy the classification worker, then retry.",
+      action: `Run \`${pithyCommandOf("support provision", {}, { runtime: true })}\` to deploy the classification worker, then retry.`,
       detail: `the ${"SUPPORT_CLASSIFY"} workflow binding is absent, so no instance was started`,
     });
   }
@@ -353,7 +353,6 @@ export async function submitFeedbackRequest(
       // *stored* belongs with the write, so it holds for every caller and not only for HTTP.
       categories: deps.categories,
       bucket: deps.bucket,
-      fts: deps.fts,
       resolveAccount: (id) => resolveSubmitterAccount(deps.d1, id, deps.peers),
       dispatchClassify: deps.dispatchClassify,
       emit: deps.emit,

package/src/http/routes.ts

@@ -1,12 +1,12 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 
-import { zValidator } from "@hono/zod-validator";
 import type { PithyHonoEnv } from "@pithy-sh/core/src/capability/capability";
 import { requireControlPlane } from "@pithy-sh/core/src/controlPlane/http/guard";
 import { InternalError } from "@pithy-sh/core/src/error/pithyError";
+import { describeRoute } from "@pithy-sh/core/src/http/routeSpec";
 import { requireSameOrigin } from "@pithy-sh/core/src/http/sameOrigin";
-import { validationHook } from "@pithy-sh/core/src/http/validation";
+import { validate } from "@pithy-sh/core/src/http/validation";
 import type { Context, Hono } from "hono";
 import { requireAuth } from "./guards";
 import {
@@ -22,7 +22,18 @@ import {
   submitFeedbackRequest,
   updateFlags,
 } from "./handlers";
-import type { SupportRepliesResponse } from "./responses";
+import {
+  SupportArchiveResponse,
+  SupportFlagsResponse,
+  SupportMyThreadResponse,
+  SupportMyThreadsResponse,
+  SupportReclassifiedResponse,
+  SupportRepliesResponse,
+  SupportReplySentResponse,
+  SupportSubmissionResponse,
+  SupportThreadResponse,
+  SupportThreadsResponse,
+} from "./responses";
 import {
   ArchiveThreadInput,
   FlagsInput,
@@ -192,40 +203,70 @@ export function registerSupportRoutes(options: SupportRoutesOptions): (app: Hono
   return (app) => {
     app.get(
       `${base}/threads`,
+      describeRoute({
+        summary: "List the support inbox.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_READ_SCOPE],
+        responses: { 200: SupportThreadsResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_READ_SCOPE),
-      zValidator("query", ListThreadsQuery, validationHook),
+      validate("query", ListThreadsQuery),
       async (c) => c.json(await listInbox(await resolve(c), c.req.valid("query"), viewer(c))),
     );
 
     app.get(
       `${base}/replies`,
+      describeRoute({
+        summary: "List the canned replies.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_READ_SCOPE],
+        responses: { 200: SupportRepliesResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_READ_SCOPE),
-      zValidator("query", RepliesQuery, validationHook),
+      validate("query", RepliesQuery),
       async (c) =>
         c.json({ replies: listReplies(await resolve(c), c.req.valid("query")) } satisfies SupportRepliesResponse),
     );
 
     app.get(
       `${base}/threads/:id`,
+      describeRoute({
+        summary: "Read one conversation and its messages.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_READ_SCOPE],
+        responses: { 200: SupportThreadResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_READ_SCOPE),
-      zValidator("param", ThreadIdParam, validationHook),
+      validate("param", ThreadIdParam),
       async (c) => c.json(await readConversation(await resolve(c), c.req.valid("param").id)),
     );
 
     app.post(
       `${base}/threads/:id/archive`,
+      describeRoute({
+        summary: "Mark a conversation done, or reopen it.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_ARCHIVE_SCOPE],
+        responses: { 200: SupportArchiveResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_ARCHIVE_SCOPE),
-      zValidator("param", ThreadIdParam, validationHook),
-      zValidator("json", ArchiveThreadInput, validationHook),
+      validate("param", ThreadIdParam),
+      validate("json", ArchiveThreadInput),
       async (c) =>
         c.json(await archiveConversation(await resolve(c), c.req.valid("param").id, c.req.valid("json"), viewer(c))),
     );
 
     app.post(
       `${base}/threads/:id/reply`,
+      describeRoute({
+        summary: "Answer the customer.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_REPLY_SCOPE],
+        responses: { 201: SupportReplySentResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_REPLY_SCOPE),
-      zValidator("param", ThreadIdParam, validationHook),
-      zValidator("json", ReplyInput, validationHook),
+      validate("param", ThreadIdParam),
+      validate("json", ReplyInput),
       async (c) =>
         c.json(
           await replyToConversation(await resolve(c), c.req.valid("param").id, c.req.valid("json"), viewer(c)),
@@ -235,16 +276,28 @@ export function registerSupportRoutes(options: SupportRoutesOptions): (app: Hono
 
     app.post(
       `${base}/threads/:id/reclassify`,
+      describeRoute({
+        summary: "Run the classifier again on the latest inbound message.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_RECLASSIFY_SCOPE],
+        responses: { 200: SupportReclassifiedResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_RECLASSIFY_SCOPE),
-      zValidator("param", ThreadIdParam, validationHook),
+      validate("param", ThreadIdParam),
       async (c) => c.json(await reclassifyConversation(await resolve(c), c.req.valid("param").id, viewer(c))),
     );
 
     app.post(
       `${base}/threads/:id/flags`,
+      describeRoute({
+        summary: "Set the caller's private read and snooze flags.",
+        verification: "control-plane",
+        scopes: [SUPPORT_THREADS_FLAG_SCOPE],
+        responses: { 200: SupportFlagsResponse },
+      }),
       requireControlPlane(SUPPORT_THREADS_FLAG_SCOPE),
-      zValidator("param", ThreadIdParam, validationHook),
-      zValidator("json", FlagsInput, validationHook),
+      validate("param", ThreadIdParam),
+      validate("json", FlagsInput),
       async (c) => c.json(await updateFlags(await resolve(c), c.req.valid("param").id, c.req.valid("json"), viewer(c))),
     );
 
@@ -255,18 +308,39 @@ export function registerSupportRoutes(options: SupportRoutesOptions): (app: Hono
     // unauthenticated caller which submissions were well-formed.
     app.post(
       `${base}/feedback`,
+      describeRoute({
+        summary: "Write in to support from the app.",
+        verification: ["bearer", "session"],
+        responses: { 201: SupportSubmissionResponse },
+      }),
       requireAuth(),
       requireSameOrigin(),
-      zValidator("json", SubmitFeedbackInput, validationHook),
+      validate("json", SubmitFeedbackInput),
       async (c) => c.json(await submitFeedbackRequest(await resolve(c), c.req.valid("json"), submitter(c)), 201),
     );
 
-    app.get(`${base}/feedback`, requireAuth(), zValidator("query", MyThreadsQuery, validationHook), async (c) =>
-      c.json(await listMyThreads(await resolve(c), c.req.valid("query"), submitter(c))),
+    app.get(
+      `${base}/feedback`,
+      describeRoute({
+        summary: "List the caller's own support requests.",
+        verification: ["bearer", "session"],
+        responses: { 200: SupportMyThreadsResponse },
+      }),
+      requireAuth(),
+      validate("query", MyThreadsQuery),
+      async (c) => c.json(await listMyThreads(await resolve(c), c.req.valid("query"), submitter(c))),
     );
 
-    app.get(`${base}/feedback/:id`, requireAuth(), zValidator("param", ThreadIdParam, validationHook), async (c) =>
-      c.json(await readMyThread(await resolve(c), c.req.valid("param").id, submitter(c))),
+    app.get(
+      `${base}/feedback/:id`,
+      describeRoute({
+        summary: "Read one of the caller's own support requests.",
+        verification: ["bearer", "session"],
+        responses: { 200: SupportMyThreadResponse },
+      }),
+      requireAuth(),
+      validate("param", ThreadIdParam),
+      async (c) => c.json(await readMyThread(await resolve(c), c.req.valid("param").id, submitter(c))),
     );
   };
 }

package/src/inbound/handler.ts

@@ -74,7 +74,6 @@ export function createSupportEmailHandler(wiring: SupportWiring): CapabilityEmai
           db: supportDatabase(d1),
           config: wiring.config,
           bucket: bindings.SUPPORT_BUCKET,
-          fts: wiring.config.search.fts,
           dispatchClassify: makeClassifyDispatcher(env, log),
           linkSender: (address) => resolveSenderUserId(d1, address, wiring.peers),
           emit: wiring.emit,

package/src/inbound/ingest.ts

@@ -21,7 +21,6 @@ import { MAX_TEXT_BODY, type ParsedInboundMessage, parseInbound } from "../mime/
 import { htmlToText, sanitizeHtml } from "../mime/sanitize";
 import { parentCandidates } from "../mime/threading";
 import { truncateToBytes } from "../mime/truncate";
-import { indexMessage } from "../store/search";
 import { senderAuthenticity } from "./authenticity";
 import { checkRates, checkSize } from "./guard";
 import { resolveInbox } from "./recipient";
@@ -83,8 +82,6 @@ export interface IngestDeps {
   config: SupportConfig;
   /** The R2 bucket raw messages and attachments are written to. Absent means neither is kept. */
   bucket?: R2Bucket;
-  /** Whether the FTS5 index is composed. False means search runs as a `LIKE` scan and nothing is indexed. */
-  fts: boolean;
   /**
    * Start the classification Workflow for a stored message. Allowed to fail and allowed to decline —
    * an unprovisioned project has no binding, and a thread that stays `uncategorized` is a legitimate
@@ -504,17 +501,6 @@ export async function ingestInbound(deps: IngestDeps, input: IngestInput): Promi
     throw error;
   }
 
-  // The full-text index, when it is composed. Best-effort by contract: a failed index write must
-  // never lose a customer's message, so it is logged and the ingest continues. The row is stored,
-  // readable, and repairable by `reindexThread` — it is only missing from one search box.
-  if (deps.fts) {
-    try {
-      await indexMessage(deps.db, { threadId, messageId, subject, body: text });
-    } catch (error) {
-      deps.log.warn("support message not indexed", { messageId, error });
-    }
-  }
-
   // Guarded for the same reason the index write and the dispatch are, and the consequence here is
   // the worst of the three. This runs *after* the message and thread rows are committed but *before*
   // the classification dispatch — so a transient `bucket.put` failure throws out of ingest, the