@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/assistant-event.ts

@@ -1,22 +1,96 @@
 /**
- * Assistant Events -- thin re-export layer.
+ * Assistant Events -- shared envelope type, SSE framing helpers, and the
+ * daemon-side specialization.
  *
- * The shared types and SSE framing helpers live in the neutral
- * `@vellumai/skill-host-contracts` package so isolated skill processes
- * can consume them without pulling in the daemon. This file pins the
- * generic payload to the daemon-side `ServerMessage` union so existing
- * callers continue to get full discriminated-union narrowing.
+ * The generic `BaseAssistantEvent<TMessage>` envelope and its framing
+ * helpers carry no daemon imports. This file pins the generic payload to
+ * the daemon-side `ServerMessage` union so existing callers continue to get
+ * full discriminated-union narrowing.
  */
 
-import type { AssistantEvent as BaseAssistantEvent } from "@vellumai/skill-host-contracts";
-import { buildAssistantEvent as baseBuildAssistantEvent } from "@vellumai/skill-host-contracts";
+import { randomUUID } from "node:crypto";
 
 import type { ServerMessage } from "../daemon/message-protocol.js";
 
-export {
-  formatSseFrame,
-  formatSseHeartbeat,
-} from "@vellumai/skill-host-contracts";
+// -- Generic base --------------------------------------------------------------
+
+/**
+ * A single assistant event wrapping an outbound message payload.
+ *
+ * Generic over the payload type. The `TMessage` default of `unknown` keeps
+ * the envelope nameable without a type argument when the caller does not
+ * care about message narrowing.
+ */
+interface BaseAssistantEvent<TMessage = unknown> {
+  /** Globally unique event identifier (UUID). */
+  id: string;
+  /** Resolved conversation id when available. */
+  conversationId?: string;
+  /**
+   * Monotonic per-conversation sequence number. Assigned by the daemon at
+   * publish time for conversation-scoped events; absent for unscoped
+   * broadcasts. Clients track the highest observed `seq` per conversation
+   * and pass it back on reconnect to request replay of missed events.
+   */
+  seq?: number;
+  /** ISO-8601 timestamp of when the event was emitted. */
+  emittedAt: string;
+  /** Outbound message payload. */
+  message: TMessage;
+}
+
+/**
+ * Construct a `BaseAssistantEvent` envelope around a message payload.
+ *
+ * @param message         The outbound message payload.
+ * @param conversationId  Optional conversation id -- pass when known.
+ */
+function baseBuildAssistantEvent<TMessage>(
+  message: TMessage,
+  conversationId?: string,
+): BaseAssistantEvent<TMessage> {
+  return {
+    id: randomUUID(),
+    conversationId,
+    emittedAt: new Date().toISOString(),
+    message,
+  };
+}
+
+// -- SSE framing ---------------------------------------------------------------
+
+/**
+ * Format an AssistantEvent as a Server-Sent Events frame.
+ *
+ * The SSE spec (https://html.spec.whatwg.org/multipage/server-sent-events.html)
+ * requires each field on its own line with a trailing blank line.
+ *
+ * ```
+ * event: assistant_event\n
+ * id: <event.id>\n
+ * data: <JSON>\n
+ * \n
+ * ```
+ *
+ * The SSE `id:` line is the per-event UUID and is intentionally decoupled
+ * from any replay cursor. Replay-aware consumers read `seq` from the JSON
+ * payload of the envelope itself.
+ */
+export function formatSseFrame(event: BaseAssistantEvent): string {
+  const sanitizedId = event.id.replace(/[\n\r]/g, "");
+  const data = JSON.stringify(event);
+  return `event: assistant_event\nid: ${sanitizedId}\ndata: ${data}\n\n`;
+}
+
+/**
+ * Format a keep-alive SSE comment.
+ * Clients should ignore comment lines (`:`) per the SSE spec.
+ */
+export function formatSseHeartbeat(): string {
+  return ": heartbeat\n\n";
+}
+
+// -- Daemon-side specialization ------------------------------------------------
 
 /** Daemon-side specialization of the generic event envelope. */
 export type AssistantEvent = BaseAssistantEvent<ServerMessage>;

package/src/runtime/auth/__tests__/route-policy.test.ts

@@ -242,6 +242,37 @@ describe("ROUTES policy declarations", () => {
     expect(route!.policy!.allowedPrincipalTypes).toContain("local");
   });
 
+  test("contacts/invites/:id/call is gateway-only", async () => {
+    // The handler dials whatever number the body supplies — the invite
+    // validation lives in the gateway's triggerInviteCallNative, so an
+    // actor-reachable policy would be an arbitrary-outbound-call primitive.
+    const { ROUTES } = await import("../../routes/index.js");
+    const route = ROUTES.find((r) => r.operationId === "invites_trigger_call");
+    expect(route).toBeDefined();
+    expect(route!.policy).not.toBeNull();
+    expect(route!.policy!.allowedPrincipalTypes).toEqual(["svc_gateway"]);
+    expect(route!.policy!.requiredScopes).toContain("internal.write");
+
+    // An actor principal with settings.write is denied.
+    authDisabled = false;
+    const actorCtx = buildTestContext({
+      principalType: "actor",
+      scopes: ["settings.write"],
+    });
+    const denied = enforcePolicy(route!.endpoint, route!.policy!, actorCtx);
+    expect(denied).not.toBeNull();
+    expect(denied!.status).toBe(403);
+
+    // The gateway service principal with internal.write is allowed.
+    const gatewayCtx = buildTestContext({
+      principalType: "svc_gateway",
+      scopes: ["internal.write"],
+    });
+    expect(
+      enforcePolicy(route!.endpoint, route!.policy!, gatewayCtx),
+    ).toBeNull();
+  });
+
   test("internal/oauth/connect/start is gateway-only", async () => {
     const { ROUTES } = await import("../../routes/index.js");
     const route = ROUTES.find(

package/src/runtime/channel-approval-types.ts

@@ -27,8 +27,58 @@ export {
 // Approval actions (daemon-internal)
 // ---------------------------------------------------------------------------
 
-/** The set of actions a user can take on an approval prompt. */
-export type ApprovalAction = "approve_once" | "reject";
+/**
+ * The set of actions a user can take on an approval prompt.
+ *
+ * `approve_once` / `reject` are the generic decision pair used by every
+ * request kind. `trust` / `verify_code` / `leave_unverified` / `block` are the
+ * introduction-card actions, valid only for `access_request` requests — the
+ * canonical decision primitive rejects them for any other kind.
+ */
+export const APPROVAL_ACTION_IDS = [
+  "approve_once",
+  "reject",
+  "trust",
+  "verify_code",
+  "leave_unverified",
+  "block",
+] as const;
+
+export type ApprovalAction = (typeof APPROVAL_ACTION_IDS)[number];
+
+/** All valid approval action ids, for wire-input validation. */
+export const APPROVAL_ACTION_SET: ReadonlySet<string> = new Set(
+  APPROVAL_ACTION_IDS,
+);
+
+/**
+ * Type predicate tying the runtime membership check to the `ApprovalAction`
+ * type, so wire-input validation sites never need an `as` cast.
+ */
+export function isApprovalAction(value: string): value is ApprovalAction {
+  return APPROVAL_ACTION_SET.has(value);
+}
+
+/**
+ * Introduction-card actions. Only meaningful for `access_request` requests:
+ * the guardian sets the contact's trust level directly on the card.
+ */
+export const INTRODUCTION_ACTION_SET: ReadonlySet<string> = new Set([
+  "trust",
+  "verify_code",
+  "leave_unverified",
+  "block",
+]);
+
+/**
+ * Actions that resolve a request to the `denied` terminal status. Everything
+ * else resolves to `approved`.
+ */
+export const DENYING_ACTION_SET: ReadonlySet<string> = new Set([
+  "reject",
+  "leave_unverified",
+  "block",
+]);
 
 /**
  * Map `GuardianDecisionAction[]` to `ApprovalActionOption[]` so channel

package/src/runtime/channel-approvals.ts

@@ -18,7 +18,10 @@ import type {
   ApprovalUIMetadata,
   ChannelApprovalPrompt,
 } from "./channel-approval-types.js";
-import { toApprovalActionOptions } from "./channel-approval-types.js";
+import {
+  DENYING_ACTION_SET,
+  toApprovalActionOptions,
+} from "./channel-approval-types.js";
 import {
   buildOneTimeDecisionActions,
   buildPlainTextFallback,
@@ -47,7 +50,9 @@ export function getChannelApprovalPrompt(
   conversationId: string,
 ): ChannelApprovalPrompt | null {
   const pending = getApprovalInfoByConversation(conversationId);
-  if (pending.length === 0) return null;
+  if (pending.length === 0) {
+    return null;
+  }
 
   // Use the first pending interaction — channel UIs show one prompt at a time.
   const info = pending[0];
@@ -126,10 +131,12 @@ export function buildApprovalUIMetadata(
 
 /**
  * Map a channel-level `ApprovalAction` to the permission system's
- * `UserDecision` type.
+ * `UserDecision` type. Every deny-intent action (reject, leave_unverified,
+ * block) maps to `deny` — a deny-flavored callback must never resolve a
+ * pending tool confirmation as an approval.
  */
 function mapApprovalActionToUserDecision(action: ApprovalAction): UserDecision {
-  return action === "reject" ? "deny" : "allow";
+  return DENYING_ACTION_SET.has(action) ? "deny" : "allow";
 }
 
 // ---------------------------------------------------------------------------
@@ -151,24 +158,32 @@ export function handleChannelDecision(
   decisionContext?: string,
 ): HandleDecisionResult {
   const pending = getApprovalInfoByConversation(conversationId);
-  if (pending.length === 0) return { applied: false };
+  if (pending.length === 0) {
+    return { applied: false };
+  }
 
   // Callback-based decisions include a request ID and must resolve to that exact
   // pending confirmation. Plain-text decisions still apply to the first prompt.
   const info = decision.requestId
     ? pending.find((candidate) => candidate.requestId === decision.requestId)
     : pending[0];
-  if (!info) return { applied: false };
+  if (!info) {
+    return { applied: false };
+  }
 
   // Peek (not consume) — resolveConfirmation() owns deregistration and
   // must fire the promptResolve callback stored in the interaction.
   const resolved = pendingInteractions.get(info.requestId);
-  if (!resolved) return { applied: false };
+  if (!resolved) {
+    return { applied: false };
+  }
 
   // Map channel-level action to the permission system's UserDecision type.
   const userDecision = mapApprovalActionToUserDecision(decision.action);
   const conversation = findConversation(resolved.conversationId);
-  if (!conversation) return { applied: false };
+  if (!conversation) {
+    return { applied: false };
+  }
 
   conversation.handleConfirmationResponse(info.requestId, userDecision, {
     decisionContext,

package/src/runtime/channel-invite-transport.ts

@@ -8,8 +8,8 @@
  * channel.
  *
  * All methods are optional — the adapter layer is intentionally thin.
- * Redemption logic lives in `invite-redemption-service.ts` and invite
- * instruction generation lives in `invite-instruction-generator.ts`.
+ * Redemption is gateway-native (gateway/src/verification/invite-redemption.ts)
+ * and invite instruction generation lives in `invite-instruction-generator.ts`.
  */
 
 import type { ChannelId } from "../channels/types.js";

package/src/runtime/channel-invite-transports/voice.ts

@@ -45,7 +45,7 @@ export const voiceInviteAdapter: ChannelInviteAdapter = {
     sourceMetadata?: import("@vellumai/gateway-client").SourceMetadata;
   }): string | undefined {
     // Voice invite redemption bypasses generic token extraction — it uses
-    // the identity-bound voice-code flow in invite-redemption-service.ts.
+    // the gateway's identity-bound voice-code redemption engine.
     return undefined;
   },
 };

package/src/runtime/channel-readiness-service.ts

@@ -1,3 +1,4 @@
+import { isInviteCodeRedemptionEnabled } from "@vellumai/gateway-client";
 import {
   normalizePublicBaseUrl,
   resolveTwilioPublicBaseUrl,
@@ -5,7 +6,6 @@ import {
 
 import { resolveTwilioPhoneNumber } from "../calls/twilio-config.js";
 import { hasTwilioCredentials } from "../calls/twilio-rest.js";
-import { getChannelInvitePolicy } from "../channels/config.js";
 import { getIsPlatform } from "../config/env-registry.js";
 import { getNestedValue, loadRawConfig } from "../config/loader.js";
 import { credentialKey } from "../security/credential-key.js";
@@ -168,7 +168,6 @@ const telegramProbe: ChannelProbe = {
 const emailProbe: ChannelProbe = {
   channel: "email",
   async runLocalChecks(): Promise<ReadinessCheckResult[]> {
-    const invitePolicy = getChannelInvitePolicy("email");
     return [
       check(
         "platform_email",
@@ -178,7 +177,7 @@ const emailProbe: ChannelProbe = {
       ),
       check(
         "invite_policy",
-        invitePolicy.codeRedemptionEnabled,
+        isInviteCodeRedemptionEnabled("email"),
         "Email invite code redemption is enabled",
         "Email invite code redemption is disabled",
       ),
@@ -218,7 +217,6 @@ const whatsappProbe: ChannelProbe = {
   channel: "whatsapp",
   async runLocalChecks(): Promise<ReadinessCheckResult[]> {
     const displayNumber = resolveWhatsAppDisplayNumber();
-    const invitePolicy = getChannelInvitePolicy("whatsapp");
     return [
       await checkCredential(
         "whatsapp_phone_number_id",
@@ -252,7 +250,7 @@ const whatsappProbe: ChannelProbe = {
       ),
       check(
         "invite_policy",
-        invitePolicy.codeRedemptionEnabled,
+        isInviteCodeRedemptionEnabled("whatsapp"),
         "WhatsApp invite code redemption is enabled",
         "WhatsApp invite code redemption is disabled",
       ),

package/src/runtime/channel-retry-sweep.ts

@@ -11,11 +11,7 @@ import { getDiskPressureStatus } from "../daemon/disk-pressure-guard.js";
 import { classifyDiskPressureTurnPolicy } from "../daemon/disk-pressure-policy.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import type { TrustContext } from "../daemon/trust-context.js";
-import {
-  addSlackDmLiveDeliveredTextResponseIndex,
-  getSlackDmLiveDeliveredTextResponseIndexes,
-  updateDeliveredSegmentCount,
-} from "../persistence/delivery-channels.js";
+import { updateDeliveredSegmentCount } from "../persistence/delivery-channels.js";
 import {
   clearPayload,
   linkMessage,
@@ -38,7 +34,6 @@ import {
 import { finalizeEventDelivery } from "./finalize-event-delivery.js";
 import { deliverChannelReply } from "./gateway-client.js";
 import type { MessageProcessor } from "./http-types.js";
-import { createSlackDmTextDeliveryController } from "./slack-dm-text-delivery.js";
 import { resolveRoutingStateFromRuntime } from "./trust-context-resolver.js";
 
 const log = getLogger("runtime-http");
@@ -293,19 +288,13 @@ export async function sweepFailedEvents(
       typeof payload.externalChatId === "string"
         ? payload.externalChatId
         : undefined;
-    const slackDmTextDelivery = externalChatId
-      ? createSlackDmTextDeliveryController({
-          sourceChannel,
-          chatType: metadataChatType,
-          replyCallbackUrl,
-          chatId: externalChatId,
-          assistantId,
-          deliveredTextResponseIndexes:
-            getSlackDmLiveDeliveredTextResponseIndexes(event.id),
-          onTextResponseDelivered: (responseIndex) =>
-            addSlackDmLiveDeliveredTextResponseIndex(event.id, responseIndex),
-        })
-      : undefined;
+    // A retry never opens a new stream: a prior attempt may already have
+    // streamed a message, so re-streaming would duplicate the reply. The
+    // durable delivery below edits that message in place when one exists.
+    const priorStreamMessageTs =
+      typeof payload.slackStreamMessageTs === "string"
+        ? payload.slackStreamMessageTs
+        : undefined;
     let replyMessageId: string | undefined;
     const observeAgentEvent = (msg: ServerMessage): void => {
       if (
@@ -315,7 +304,6 @@ export async function sweepFailedEvents(
       ) {
         replyMessageId = msg.messageId;
       }
-      slackDmTextDelivery?.observeEvent(msg);
     };
 
     let userMessageId: string | undefined;
@@ -349,9 +337,6 @@ export async function sweepFailedEvents(
       );
     } catch (err) {
       log.error({ err, eventId: event.id }, "Retry failed for channel event");
-      if (slackDmTextDelivery) {
-        await slackDmTextDelivery.waitForPendingDeliveries();
-      }
       recordProcessingFailure(event.id, err);
       continue;
     }
@@ -366,7 +351,8 @@ export async function sweepFailedEvents(
           assistantId,
           replyMessageId,
           userMessageId,
-          slackDmTextDelivery,
+          slackReplySession: undefined,
+          priorStreamMessageTs,
         });
       } catch (err) {
         log.error(
@@ -411,6 +397,13 @@ export async function sweepFailedEvents(
         : undefined;
     const assistantId =
       typeof payload.assistantId === "string" ? payload.assistantId : undefined;
+    // A prior attempt may already have streamed a message; its first
+    // undelivered segment edits that message in place rather than posting a
+    // duplicate reply beside it.
+    const priorStreamMessageTs =
+      typeof payload.slackStreamMessageTs === "string"
+        ? payload.slackStreamMessageTs
+        : undefined;
     if (!replyCallbackUrl || !externalChatId) {
       recordDeliveryFailure(
         event.id,
@@ -444,6 +437,7 @@ export async function sweepFailedEvents(
         {
           messageId: replyMessageId,
           startFromSegment: event.deliveredSegmentCount,
+          ...(priorStreamMessageTs ? { messageTs: priorStreamMessageTs } : {}),
           onSegmentDelivered: (count) =>
             updateDeliveredSegmentCount(event.id, count),
         },

package/src/runtime/channel-verification-service.ts

@@ -31,7 +31,6 @@ import {
   updateSessionDelivery as storeUpdateSessionDelivery,
   updateSessionStatus as storeUpdateSessionStatus,
 } from "../channels/channel-verification-sessions.js";
-import { revokeGuardianBinding } from "../contacts/contacts-write.js";
 import {
   getGuardianDelivery,
   getGuardianDeliveryFresh,
@@ -48,8 +47,12 @@ import { composeApprovalMessage } from "./approval-message-composer.js";
 // Constants
 // ---------------------------------------------------------------------------
 
-/** Challenge TTL in milliseconds (10 minutes). */
-const CHALLENGE_TTL_MS = 10 * 60 * 1000;
+/**
+ * Challenge TTL in milliseconds (10 minutes). Exported so consumers that
+ * reason about "is a just-issued code still redeemable" (e.g. the
+ * access-request handshake window) share this exact bound.
+ */
+export const CHALLENGE_TTL_MS = 10 * 60 * 1000;
 
 /** Maximum invalid verification attempts within the throttling window before lockout. */
 const RATE_LIMIT_MAX_ATTEMPTS = 5;
@@ -342,7 +345,9 @@ export async function getGuardianBinding(
     channel,
     guardianExternalUserId: delivery.address,
     guardianDeliveryChatId: delivery.externalChatId ?? "",
-    guardianPrincipalId: delivery.principalId ?? "",
+    // A missing principal is surfaced as null (unresolved), never coerced to
+    // an empty string that would masquerade as a present-but-empty principal.
+    guardianPrincipalId: delivery.principalId ?? null,
     status: "active" as const,
     verifiedAt: delivery.verifiedAt ?? 0,
     // verifiedVia is not carried on the delivery contract; a bound guardian
@@ -390,13 +395,6 @@ export async function isGuardian(
   return delivery.address.toLowerCase() === address.toLowerCase();
 }
 
-/**
- * Revoke the active guardian binding for a given assistant and channel.
- */
-export function revokeBinding(assistantId: string, channel: string): boolean {
-  return revokeGuardianBinding(channel);
-}
-
 /**
  * Revoke all pending sessions for a given channel.
  * Called when the user cancels verification so that stale sessions

package/src/runtime/finalize-event-delivery.ts

@@ -4,14 +4,14 @@ import {
   recordDeliveryFailure,
 } from "../persistence/delivery-status.js";
 import { deliverReplyViaCallback } from "./channel-reply-delivery.js";
-import type { SlackDmTextDeliveryController } from "./slack-dm-text-delivery.js";
+import type { SlackReplySession } from "./slack-reply-session.js";
 
 /**
  * Owns the complete delivery-after-processing sequence for a channel
- * inbound event: waits for in-flight live Slack DM deliveries to settle,
- * persists the segment baseline so delivery-only retries resume correctly,
- * delivers remaining content + attachments, and transitions the event to
- * its terminal delivery state.
+ * inbound event: finalizes any live Slack stream, persists the segment
+ * baseline so delivery-only retries resume correctly, delivers remaining
+ * content + attachments, and transitions the event to its terminal delivery
+ * state.
  *
  * Both the primary dispatch path and the processing-retry path call this
  * function. The delivery-only retry path does NOT use this function — it
@@ -26,7 +26,13 @@ export async function finalizeEventDelivery(params: {
   assistantId: string | undefined;
   replyMessageId: string | undefined;
   userMessageId: string | undefined;
-  slackDmTextDelivery: SlackDmTextDeliveryController | undefined;
+  slackReplySession: SlackReplySession | undefined;
+  /**
+   * `ts` of a Slack message streamed on a previous, failed attempt. A retry
+   * has no live stream of its own, so it edits this message in place rather
+   * than posting a duplicate reply.
+   */
+  priorStreamMessageTs?: string;
 }): Promise<void> {
   const {
     eventId,
@@ -36,16 +42,26 @@ export async function finalizeEventDelivery(params: {
     assistantId,
     replyMessageId,
     userMessageId,
-    slackDmTextDelivery,
+    slackReplySession,
+    priorStreamMessageTs,
   } = params;
 
-  if (slackDmTextDelivery) {
-    await slackDmTextDelivery.waitForPendingDeliveries();
-  }
+  const reconciliation = await slackReplySession?.finish();
+
+  // A streamed reply already delivered its text live into a single message;
+  // durable delivery skips that text, reconciles `slackMeta.channelTs` to the
+  // stream `ts`, and posts only attachments. A retry reuses the prior attempt's
+  // streamed message, re-delivering the full reply with its first segment
+  // editing that message. A plain turn delivers the full reply from segment 0.
+  const startFromSegment =
+    reconciliation?.mode === "streamed"
+      ? reconciliation.deliveredSegmentCount
+      : 0;
+  const streamMessageTs =
+    reconciliation?.mode === "streamed"
+      ? reconciliation.messageTs
+      : priorStreamMessageTs;
 
-  const resumeOptions =
-    slackDmTextDelivery?.getFinalDeliveryResumeOptions(replyMessageId);
-  const startFromSegment = resumeOptions?.startFromSegment ?? 0;
   try {
     updateDeliveredSegmentCount(eventId, startFromSegment);
     await deliverReplyViaCallback(
@@ -57,9 +73,7 @@ export async function finalizeEventDelivery(params: {
         messageId: replyMessageId,
         sinceMessageId: userMessageId,
         startFromSegment,
-        ...(resumeOptions?.messageTs
-          ? { messageTs: resumeOptions.messageTs }
-          : {}),
+        ...(streamMessageTs ? { messageTs: streamMessageTs } : {}),
         onSegmentDelivered: (count) =>
           updateDeliveredSegmentCount(eventId, count),
       },

package/src/runtime/guardian-action-service.ts

@@ -11,18 +11,15 @@ import {
   getCanonicalGuardianRequest,
   isRequestInConversationScope,
 } from "../contacts/canonical-guardian-store.js";
-import type { ApprovalAction } from "./channel-approval-types.js";
+import {
+  APPROVAL_ACTION_IDS,
+  isApprovalAction,
+} from "./channel-approval-types.js";
 
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 
-/** Canonical set of valid guardian actions, shared across all entrypoints. */
-const VALID_GUARDIAN_ACTIONS: ReadonlySet<string> = new Set<string>([
-  "approve_once",
-  "reject",
-]);
-
 /**
  * Legacy actions that map to canonical ones during client rollout.
  * All temporal/persistent approval variants collapse to approve_once.
@@ -71,7 +68,9 @@ export type ProcessGuardianDecisionResult =
  * canonical decision, and maps the result to a caller-agnostic shape that
  * both HTTP and message handlers can interpret.
  *
- * Only `approve_once` and `reject` are valid actions.
+ * Valid actions are the `ApprovalAction` union; the canonical primitive
+ * additionally scopes the introduction-card actions to `access_request`
+ * requests.
  */
 export async function processGuardianDecision(
   params: ProcessGuardianDecisionParams,
@@ -80,11 +79,11 @@ export async function processGuardianDecision(
 
   // 1. Canonicalize legacy actions, then validate
   const action = LEGACY_ACTION_MAP[params.action] ?? params.action;
-  if (!VALID_GUARDIAN_ACTIONS.has(action)) {
+  if (!isApprovalAction(action)) {
     return {
       ok: false,
       error: "invalid_action",
-      message: `Invalid action: ${params.action}. Must be one of: approve_once, reject`,
+      message: `Invalid action: ${params.action}. Must be one of: ${APPROVAL_ACTION_IDS.join(", ")}`,
     };
   }
 
@@ -105,7 +104,7 @@ export async function processGuardianDecision(
   // 3. Apply the canonical decision
   const canonicalResult = await applyCanonicalGuardianDecision({
     requestId,
-    action: action as ApprovalAction,
+    action,
     actorContext: {
       actorPrincipalId: actorContext.actorPrincipalId,
       actorExternalUserId: undefined, // Desktop path — no channel-native ID