@pithy-sh/support 0.5.1 → 0.6.0

package/src/data/assignment.ts

@@ -0,0 +1,55 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { SQLiteDate } from "@pithy-sh/core/src/data/codecs";
+import { z } from "zod";
+
+/**
+ * The `assignee` filter value meaning *nobody has it*. Reserved: an assignment to a ref spelled this way is
+ * refused at the boundary (`http/schemas.ts`), so the filter can never mean two things.
+ */
+export const UNASSIGNED = "none";
+
+/**
+ * Who assigned a thread: a management client through the control plane, or a signed-in user of the app
+ * through support's staff power. Recorded per change, because the two are different evidence about who
+ * acted, exactly as the audit trail's `actorType` is.
+ */
+export const SupportAssignmentActorType = z
+  .enum(["control-plane", "user"])
+  .describe(
+    "How the assigner was verified: `control-plane` for a management client's scoped credential, `user` for a signed-in user of the app holding support's staff power.",
+  );
+export type SupportAssignmentActorType = z.output<typeof SupportAssignmentActorType>;
+
+/**
+ * One change of a thread's assignee in `pithy_support_assignments` — append-only, one row per change.
+ *
+ * The thread carries the **current** assignee because that is what the inbox filters on; this carries
+ * **every** change, the same split the classification table has with the thread. Nothing here is updated
+ * and nothing is deleted while the thread stands. A change that changed nothing — the current assignee
+ * assigned again — writes no row, so every row here is a real handover.
+ */
+export const SupportAssignment = z
+  .object({
+    id: z.string().describe("UUID primary key."),
+    threadId: z.string().describe("The `pithy_support_threads.id` whose assignee changed."),
+    assigneeRef: z
+      .string()
+      .nullish()
+      .describe("Who has the thread after this change, as an opaque reference, or null when it was unassigned."),
+    assigneeName: z.string().nullish().describe("How that assignee was shown at the time, or null when unassigned."),
+    previousRef: z.string().nullish().describe("Who had the thread before this change, or null when nobody did."),
+    previousName: z.string().nullish().describe("How the previous assignee was shown, or null when nobody had it."),
+    actorType: SupportAssignmentActorType.describe("How the person or client making the change was verified."),
+    assignedBy: z.string().describe("Who made the change — the control-plane subject, or the signed-in user's id."),
+    note: z
+      .string()
+      .nullish()
+      .describe(
+        "Why, in the assigner's own words, when they gave a reason. Staff-written, never customer text, and shown to anybody who can read the thread.",
+      ),
+    createdAt: SQLiteDate.describe("When the change was made."),
+  })
+  .describe("One append-only change of a support thread's assignee in `pithy_support_assignments`.");
+export type SupportAssignment = z.output<typeof SupportAssignment>;

package/src/data/embedding.ts

@@ -0,0 +1,27 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+
+import { SQLiteDate } from "@pithy-sh/core/src/data/codecs";
+import { z } from "zod";
+
+/**
+ * Which model embedded a message into the semantic index, in `pithy_support_embeddings`.
+ *
+ * **Its own table, not a column on the message**, for two reasons. A released migration is never edited, and
+ * a stamp belongs to a derived index rather than to the mail: drop the index and every stamp is a lie, so they
+ * go together, and nothing about a message changes. It is what `pithy vector reprocess --index
+ * support-messages` reads to re-embed exactly the rows whose model differs from the configured one — the same
+ * job `pithy_vector_documents.model` does for an index `vector()` owns.
+ *
+ * A message with no row was never embedded, which is the set a backfill and a repair both pick up.
+ */
+export const SupportEmbedding = z
+  .object({
+    messageId: z
+      .string()
+      .describe("The `pithy_support_messages.id` this stamp is for — also the vector's id in the index."),
+    model: z.string().describe("The Workers AI embedding model that produced the vector now in the index."),
+    embeddedAt: SQLiteDate.describe("When the vector was written."),
+  })
+  .describe("The model stamp for one message's vector in the semantic index.");
+export type SupportEmbedding = z.output<typeof SupportEmbedding>;

package/src/data/tables.ts

@@ -5,8 +5,10 @@ import type { D1Database } from "@cloudflare/workers-types";
 import { createDatabase, type DatabaseSchema } from "@pithy-sh/core/src/data/db";
 import type { Kysely } from "kysely";
 import type { z } from "zod";
+import { SupportAssignment } from "./assignment";
 import { SupportAttachment } from "./attachment";
 import { SupportClassification } from "./classification";
+import { SupportEmbedding } from "./embedding";
 import { SupportThreadFlag } from "./flag";
 import { SupportMessage } from "./message";
 import { SupportThread } from "./thread";
@@ -26,6 +28,10 @@ export const SUPPORT_ATTACHMENTS_TABLE = "pithySupportAttachments";
 export const SUPPORT_CLASSIFICATIONS_TABLE = "pithySupportClassifications";
 /** Per-viewer read/snooze state. `pithy_support_thread_flags`. */
 export const SUPPORT_FLAGS_TABLE = "pithySupportThreadFlags";
+/** Append-only assignee history. `pithy_support_assignments`. */
+export const SUPPORT_ASSIGNMENTS_TABLE = "pithySupportAssignments";
+/** The semantic index's per-message model stamps. `pithy_support_embeddings`. */
+export const SUPPORT_EMBEDDINGS_TABLE = "pithySupportEmbeddings";
 
 /**
  * The FTS5 full-text index. Not a Kysely table and deliberately not in {@link supportTables}: it is a
@@ -44,6 +50,8 @@ export const supportTables = {
   [SUPPORT_ATTACHMENTS_TABLE]: SupportAttachment,
   [SUPPORT_CLASSIFICATIONS_TABLE]: SupportClassification,
   [SUPPORT_FLAGS_TABLE]: SupportThreadFlag,
+  [SUPPORT_ASSIGNMENTS_TABLE]: SupportAssignment,
+  [SUPPORT_EMBEDDINGS_TABLE]: SupportEmbedding,
 } satisfies Record<string, z.ZodObject>;
 
 /** The support tables, as a type. */

package/src/data/thread.ts

@@ -10,10 +10,11 @@ import { SupportAccountLinkSource, SupportChannel, SupportPriority, SupportSenti
  *
  * **Everything on it is derived from immutable inbound mail.** The classification is recomputed, never
  * repaired; the user link is a lookup, not a decision; the counters are facts about the messages
- * below. There is no assignee and no status, because a status field is a state machine and a state
- * machine attracts SLAs, escalation, and reporting — which is a ticketing product and explicitly not
- * this. The two exceptions are deliberate and named: `archived` (one shared boolean meaning done) and
- * the per-viewer flags, which live in their own table because nobody coordinates around them.
+ * below. There is no status, because a status field is a state machine and a state machine attracts
+ * SLAs, escalation, and reporting — which is a ticketing product and explicitly not this. The
+ * exceptions are deliberate and named: `archived` (one shared boolean meaning done), the assignee (one
+ * fact, who has this, with its history in `pithy_support_assignments` — #816), and the per-viewer
+ * flags, which live in their own table because nobody coordinates around them.
  *
  * The classification axes are **denormalized onto the thread** rather than joined from
  * `pithy_support_classifications`. The whole dashboard interaction is "newest first, filtered by
@@ -105,6 +106,27 @@ export const SupportThread = z
       .describe(
         "The control-plane subject that archived it. Recorded for the dashboard's convenience only — the answer to 'who marked this done' comes from the audit trail, which is why this is not an ownership column.",
       ),
+    assigneeRef: z
+      .string()
+      .nullish()
+      .describe(
+        "**Who has this thread** — an opaque reference to the person or agent it is assigned to, or null when nobody has it. Opaque on purpose: a dashboard member, a user of the app and an agent are all assignable, and support never needs to know which. Not a status: there are no transitions to get wrong, and unassigning is one write. Every change is kept in `pithy_support_assignments`. Added by `0002_assignment`, so a row written before it reads null.",
+      ),
+    assigneeName: z
+      .string()
+      .nullish()
+      .describe(
+        "How the assignee is shown, as the assigner named them. Null exactly when `assigneeRef` is. Display text, never an identity: two refs may share a name, and the ref is what a filter matches.",
+      ),
+    assignedAt: SQLiteDate.nullish().describe(
+      "When the current assignment was made; null while the thread has no assignee.",
+    ),
+    assignedBy: z
+      .string()
+      .nullish()
+      .describe(
+        "Who made the current assignment — the control-plane subject, or the signed-in user's id. Null while the thread has no assignee. The full answer, with every earlier change, is the history table and the audit trail.",
+      ),
     messageCount: z.number().int().describe("How many messages the thread holds, inbound and outbound together."),
     firstMessageAt: SQLiteDate.describe("When the thread opened — the receive time of its first message."),
     lastMessageAt: SQLiteDate.describe(

package/src/http/guards.ts

@@ -2,38 +2,47 @@
 // SPDX-License-Identifier: MIT
 
 import type { PithyHonoEnv } from "@pithy-sh/core/src/capability/capability";
-import { UnauthorizedError } from "@pithy-sh/core/src/error/pithyError";
+import { ForbiddenError, UnauthorizedError } from "@pithy-sh/core/src/error/pithyError";
 import type { MiddlewareHandler } from "hono";
+import type { SupportStaffConfig } from "../config/config";
+import { staffMay } from "../staff/staff";
 
 /**
- * Support's identity gates: the copied `requireAuth()` its in-app submission routes wear, and the
- * control-plane gate its management routes take from core's seam.
+ * Support's identity gates: the copied `requireAuth()` its in-app routes wear, the control-plane gate its
+ * management routes take from core's seam, and `requireStaff()`, which lets the adopter's own staff onto a
+ * slice of the management side through their session (#816).
  *
  * **The scope constants moved to `./scopes`** (#315). A management client reads them to render what a
  * connection may do, and it reads them in a browser — so they cannot live in a module that imports
  * Hono middleware and `PithyHonoEnv`. The gates stayed here; the names they demand are next door, and
  * the routes import both.
  *
- * ## Two surfaces, and the split is the whole shape of this file
+ * ## Three doors, and the split is the whole shape of this file
  *
  * **The management surface is `control-plane` and default-denied.** It reads and acts on every
- * customer's private correspondence, so it answers to a credential the adopter issued and to nothing
- * else. The seam's gate is imported from core rather than copied — core is a hard dependency of every
- * capability, so importing its gate cannot leave a deployment without one, and with the seam
- * uncomposed `requireControlPlane` raises `controlplane/not_connected` rather than passing.
+ * customer's private correspondence, so it answers to a credential the adopter issued. The seam's gate is
+ * imported from core rather than copied — core is a hard dependency of every capability, so importing its
+ * gate cannot leave a deployment without one, and with the seam uncomposed `requireControlPlane` raises
+ * `controlplane/not_connected` rather than passing.
  *
  * **The submission surface is `bearer`/`session` and is the adopter's own signed-in user.** It exists
  * because a product with a logged-in user, a session, and a support console should not have to ask
  * that user to open their mail client — and because the hardest problem on the mail path, proving a
  * `From:` header, does not exist on a request whose session was already proved.
  *
- * **`requireAuth()` never appears on a management route, and `requireControlPlane` never appears on a
- * submission route.** They are not two strengths of the same gate. A management client holds no
- * session and owns no account row — core leaves `c.var.auth` null for one deliberately — so stacking
- * them would deny every legitimate call on both surfaces, permanently, with no credential able to fix
- * it. What each route may *see* follows from which gate it wears: an operator reads a thread with its
- * classification and its sender's purchases, and a submitter reads their own words back and nothing
- * else.
+ * **The staff door is a session, and it reaches management work.** `requireAuth()` then `requireStaff()`
+ * admit a signed-in user whose role, in the organization the request acts for, holds one of the powers
+ * `support({ staff })` names — and nobody at all when `staff` is absent. It opens two things and no more:
+ * assigning a thread, at its own `/staff/` path, and joining a thread's presence room. Everything else on
+ * the management side still answers to the control plane alone.
+ *
+ * **`requireAuth()` never appears on a control-plane route, and `requireControlPlane` never appears on a
+ * session route.** They are not two strengths of the same gate. A management client holds no session and
+ * owns no account row — core leaves `c.var.auth` null for one deliberately — so stacking them would deny
+ * every legitimate call on both, permanently, with no credential able to fix it. That is why staff
+ * assignment is a second route beside the control-plane one rather than a second gate on it. What each
+ * route may *see* follows from which gate it wears: an operator reads a thread with its classification and
+ * its sender's purchases, and a submitter reads their own words back and nothing else.
  */
 
 /**
@@ -57,3 +66,31 @@ export function requireAuth(): MiddlewareHandler<PithyHonoEnv> {
     await next();
   };
 }
+
+/**
+ * Require one of support's staff powers in the organization this request acts for (#816) — the gate on
+ * the staff session routes, after `requireAuth()`.
+ *
+ * With no `staff` configured, or no organization composed, or no organization in force, every caller is
+ * refused: the inbox is every customer's correspondence, and the absence of a policy is never an open one.
+ * The refusal names no power and no organization, because which power reaches the inbox is the adopter's
+ * internal arrangement and a caller who does not hold it has no use for the name.
+ */
+export function requireStaff(
+  staff: SupportStaffConfig | undefined,
+  power: keyof SupportStaffConfig,
+): MiddlewareHandler<PithyHonoEnv> {
+  return async (c, next) => {
+    const acting = await c.var.actingOrganization();
+    if (!staffMay(acting, staff, power)) {
+      throw new ForbiddenError({
+        message: "You do not work this support inbox.",
+        action: staff
+          ? `Give the user an unassignable role holding \`${staff[power]}\`, through the control plane.`
+          : "Name staff powers in support({ staff }) to let signed-in users work the inbox.",
+        detail: `user ${c.var.auth?.userId ?? "unknown"} holds no ${power} for support in ${acting?.organizationId ?? "no organization"}`,
+      });
+    }
+    await next();
+  };
+}

package/src/http/handlers.ts

@@ -7,9 +7,13 @@ import { pithyCommandOf } from "@pithy-sh/core/src/cli/command";
 import { ValidationError } from "@pithy-sh/core/src/error/pithyError";
 import type { Logger } from "@pithy-sh/core/src/logger/logger";
 import type { ObjectStore } from "@pithy-sh/storage/src/object/store";
+import type { VectorIndexConfig } from "@pithy-sh/vector/src/config/config";
+import type { VectorAi } from "@pithy-sh/vector/src/embed/embed";
+import type { VectorStore } from "@pithy-sh/vector/src/index/index";
 import { attachmentUrl } from "../attachment/store";
 import { SupportAuditActions } from "../audit/actions";
 import type { SupportConfig } from "../config/config";
+import type { SupportAssignmentActorType } from "../data/assignment";
 import type { SupportAttachment } from "../data/attachment";
 import type { SupportCategories } from "../data/categories";
 import type { SupportDatabase } from "../data/tables";
@@ -23,11 +27,14 @@ import {
 import { sendReply } from "../reply/send";
 import type { SupportReplySnippets } from "../reply/snippets";
 import { repliesForCategory } from "../reply/snippets";
+import { assignThread, listAssignments } from "../store/assignment";
+import { searchThreads } from "../store/hybrid";
 import { listOwnThreads, listThreads, readOwnThread, readThread, setArchived, setFlags } from "../store/threads";
 import { decodeBase64 } from "../submission/encoding";
 import { submitFeedback } from "../submission/submit";
 import { latestInboundMessageId } from "../workflows/classify";
 import type {
+  SupportAssignResponse,
   SupportAttachmentView,
   SupportFlagsResponse,
   SupportMyThreadResponse,
@@ -35,6 +42,7 @@ import type {
   SupportReclassifiedResponse,
   SupportReplySentResponse,
   SupportReplyView,
+  SupportSearchResponse,
   SupportSubmissionResponse,
   SupportThreadResponse,
   SupportThreadsResponse,
@@ -42,14 +50,25 @@ import type {
 } from "./responses";
 import type {
   ArchiveThreadInput,
+  AssignThreadInput,
   FlagsInput,
   ListThreadsQuery,
   MyThreadsQuery,
   RepliesQuery,
   ReplyInput,
+  SearchThreadsQuery,
   SubmitFeedbackInput,
 } from "./schemas";
-import { listedThreadView, messageView, myMessageView, myThreadView, senderView, threadView } from "./views";
+import {
+  assignmentView,
+  listedThreadView,
+  messageView,
+  myMessageView,
+  myThreadView,
+  searchView,
+  senderView,
+  threadView,
+} from "./views";
 
 /**
  * The support handlers — every one of them behind the `control-plane` gate, and every one of them
@@ -73,6 +92,11 @@ export interface HandlerDeps {
   snippets: SupportReplySnippets;
   /** Whether the FTS5 index is composed. */
   fts: boolean;
+  /**
+   * The semantic message index and the bindings it runs on. `index` is absent when `search.semantic` is
+   * off; `ai` and `store` are absent when this Worker was not given them — until `pithy support provision`.
+   */
+  semantic: { index?: VectorIndexConfig; ai?: VectorAi; store?: VectorStore };
   /** The attachment bucket, when one is bound. */
   bucket?: R2Bucket;
   /** The object store attachment URLs are signed through, when credentials are available. */
@@ -109,15 +133,51 @@ export async function listInbox(
       sentiment: query.sentiment,
       channel: query.channel,
       inbox: query.inbox,
-      q: query.q,
+      assignee: query.assignee,
       cursor: query.cursor,
       limit: query.limit,
     },
-    { fts: deps.fts, viewer, now: deps.now(), log: deps.log },
+    { viewer, now: deps.now() },
   );
   return { threads: page.threads.map(listedThreadView), nextCursor: page.nextCursor };
 }
 
+/**
+ * Search the inbox: keyword and semantic, ranked as one. The semantic seams are whatever this Worker
+ * was given — absent bindings skip that backend and say so, rather than failing the search.
+ */
+export async function searchInbox(
+  deps: HandlerDeps,
+  query: SearchThreadsQuery,
+  viewer: string,
+): Promise<SupportSearchResponse> {
+  const outcome = await searchThreads(
+    {
+      db: deps.db,
+      fts: deps.fts,
+      ...(deps.semantic.index ? { index: deps.semantic.index } : {}),
+      ...(deps.semantic.ai ? { ai: deps.semantic.ai } : {}),
+      ...(deps.semantic.store ? { store: deps.semantic.store } : {}),
+      viewer,
+      log: deps.log,
+    },
+    {
+      q: query.q,
+      ...(query.mode !== undefined ? { mode: query.mode } : {}),
+      ...(query.limit !== undefined ? { limit: query.limit } : {}),
+      archived: query.archived === "true",
+      category: query.category,
+      declaredCategory: query.declaredCategory,
+      priority: query.priority,
+      sentiment: query.sentiment,
+      channel: query.channel,
+      inbox: query.inbox,
+      assignee: query.assignee,
+    },
+  );
+  return searchView(outcome);
+}
+
 /**
  * Present an attachment.
  *
@@ -156,7 +216,7 @@ async function presentAttachments(
 /** Read one conversation in full. */
 export async function readConversation(deps: HandlerDeps, threadId: string): Promise<SupportThreadResponse> {
   const detail = await readThread(deps.db, threadId);
-  const [attachments, sender] = await Promise.all([
+  const [attachments, sender, assignments] = await Promise.all([
     presentAttachments(deps, detail.attachments),
     // A session-proven thread already holds the id its session established, so the context is resolved
     // from that rather than re-derived from an address. Not a shortcut: `resolveSenderUserId` matches
@@ -171,6 +231,7 @@ export async function readConversation(deps: HandlerDeps, threadId: string): Pro
           { authenticated: detail.thread.senderAuthenticated },
           deps.peers,
         ),
+    listAssignments(deps.db, threadId),
   ]);
 
   return {
@@ -179,6 +240,7 @@ export async function readConversation(deps: HandlerDeps, threadId: string): Pro
     attachments,
     sender: senderView(sender),
     replies: repliesForCategory(deps.snippets, detail.thread.category),
+    assignments: assignments.map(assignmentView),
   };
 }
 
@@ -206,6 +268,56 @@ export async function archiveConversation(
   return threadView(thread);
 }
 
+/** Who is assigning: how they were verified, and their id under it. */
+export interface Assigner {
+  /** `control-plane` for a management client, `user` for a signed-in user holding support's staff power. */
+  type: SupportAssignmentActorType;
+  /** The control-plane subject, or the user's id. */
+  id: string;
+}
+
+/**
+ * Assign a conversation to somebody, or to nobody — the one handler behind both doors.
+ *
+ * The audit event is emitted **only when something changed**. The current assignee again, or unassigning
+ * a thread nobody has, wrote nothing to the thread or its history, so an event would record a handover
+ * that did not happen.
+ */
+export async function assignConversation(
+  deps: HandlerDeps,
+  threadId: string,
+  input: AssignThreadInput,
+  assigner: Assigner,
+): Promise<SupportAssignResponse> {
+  const result = await assignThread(deps.d1, {
+    threadId,
+    assignee: input.assignee,
+    actorType: assigner.type,
+    assignedBy: assigner.id,
+    note: input.note,
+    newId: deps.newId,
+    now: deps.now(),
+  });
+
+  if (result.changed) {
+    await deps.emit({
+      action: input.assignee ? SupportAuditActions.threadAssigned : SupportAuditActions.threadUnassigned,
+      outcome: "success",
+      actorType: assigner.type,
+      actorId: assigner.id,
+      resourceType: "support_thread",
+      resourceId: threadId,
+      metadata: {
+        previousAssignee: result.previous,
+        assignee: input.assignee,
+        note: input.note ?? null,
+      },
+    });
+  }
+
+  return { thread: threadView(result.thread), changed: result.changed };
+}
+
 /** Answer the customer. */
 export async function replyToConversation(
   deps: HandlerDeps,
@@ -237,6 +349,15 @@ export async function reclassifyConversation(
   threadId: string,
   viewer: string,
 ): Promise<SupportReclassifiedResponse> {
+  // The worker classifies only with `ai.enabled` on. Dispatching anyway would start a run that classifies
+  // nothing, and the 200 and the audit event below would both say it had.
+  if (!deps.config.ai.enabled) {
+    throw new SupportClassificationError({
+      message: "Classification is off for this project.",
+      action: `Turn on \`ai.enabled\` in the support config, run \`${pithyCommandOf("support provision", {}, { runtime: true })}\`, then retry.`,
+      detail: `ai.enabled is false, so no instance was started for thread ${threadId}`,
+    });
+  }
   const messageId = await latestInboundMessageId(deps.db, threadId);
   if (!messageId) {
     throw new SupportNotFoundError({

package/src/http/resolve.ts

@@ -7,10 +7,14 @@ import { InternalError } from "@pithy-sh/core/src/error/pithyError";
 import type { Logger } from "@pithy-sh/core/src/logger/logger";
 import type { SecretsStoreEnv } from "@pithy-sh/secrets/src/env/bindings";
 import { objectStore } from "@pithy-sh/storage/src/object/store";
+import type { VectorAi } from "@pithy-sh/vector/src/embed/embed";
+import type { VectorStore } from "@pithy-sh/vector/src/index/index";
 import type { Context } from "hono";
 import type { SupportWiring } from "../capability";
+import type { SupportConfig } from "../config/config";
 import { supportDatabase } from "../data/tables";
 import { SUPPORT_R2_SECRET } from "../secret/registry";
+import { SUPPORT_AI_BINDING, SUPPORT_VECTORIZE_BINDING, supportMessageIndex } from "../semantic/messageIndex";
 import { supportWorkflowRegistry, supportWorkflows } from "../workflows/specs";
 import type { HandlerDeps } from "./handlers";
 
@@ -78,6 +82,20 @@ export function resolveStore(env: SupportEnv): ReturnType<typeof objectStore> |
   return objectStore({ bucket: env.SUPPORT_BUCKET, env, secretName: SUPPORT_R2_SECRET });
 }
 
+/**
+ * The semantic index and the two bindings it runs on, as this Worker has them.
+ *
+ * Absent rather than refused: a project that turned `search.semantic` on and has not provisioned yet still
+ * serves every route, and the search route names the backend it skipped.
+ */
+export function resolveSemantic(env: Record<string, unknown>, config: SupportConfig): HandlerDeps["semantic"] {
+  const index = supportMessageIndex(config.search);
+  if (!index) return {};
+  const ai = env[SUPPORT_AI_BINDING] as VectorAi | undefined;
+  const store = env[SUPPORT_VECTORIZE_BINDING] as VectorStore | undefined;
+  return { index, ...(ai ? { ai } : {}), ...(store ? { store } : {}) };
+}
+
 /** Build the per-request handler dependencies. */
 export function makeResolveDeps(wiring: SupportWiring): (c: Context<PithyHonoEnv>) => Promise<HandlerDeps> {
   return async (c) => {
@@ -92,6 +110,7 @@ export function makeResolveDeps(wiring: SupportWiring): (c: Context<PithyHonoEnv
       categories: wiring.categories,
       snippets: wiring.snippets,
       fts: wiring.config.search.fts,
+      semantic: resolveSemantic(env as unknown as Record<string, unknown>, wiring.config),
       bucket: env.SUPPORT_BUCKET,
       store: resolveStore(env),
       // Bound at compose time when `email()` is composed; undefined otherwise, which the reply