@vellumai/assistant 0.11.2 → 0.11.3-dev.202608080427.92f668a

package/src/runtime/routes/__tests__/stt-routes.test.ts

@@ -288,6 +288,31 @@ describe("stt-routes", () => {
     expect(err.message).toContain("not available");
   });
 
+  test("surfaces a typed resolver error verbatim instead of the generic copy", async () => {
+    // A streaming-only provider IS configured, so the "nothing configured"
+    // and "not available" strings would both send the caller looking for a
+    // problem that does not exist.
+    const reason =
+      'Deepgram Flux is streaming-only. Batch transcription requires the deepgram provider: set services.stt.provider to "deepgram".';
+    mockResolveError = new SttError("provider-error", reason, {
+      userFacing: true,
+    });
+
+    const { handler } = getRoute("stt/transcribe");
+    const err = await expectRouteError(
+      () =>
+        handler(
+          makeArgs({
+            audioBase64: toBase64("audio-data"),
+            mimeType: "audio/wav",
+          }),
+        ),
+      503,
+      "SERVICE_UNAVAILABLE",
+    );
+    expect(err.message).toBe(reason);
+  });
+
   // -- Timeout --------------------------------------------------------------
 
   test("throws 504 when transcription times out", async () => {

package/src/runtime/routes/__tests__/surface-action-routes.test.ts

@@ -59,6 +59,8 @@ let mockReResolve: { trustClass: string; sourceChannel: string } | null = null;
 mock.module("../../../contacts/guardian-delivery-reader.js", () => ({
   getGuardianDelivery: (_input?: { channelTypes?: string[] }) =>
     Promise.resolve(mockGuardianList),
+  getGuardianDeliveryFresh: (_input?: { channelTypes?: string[] }) =>
+    Promise.resolve(mockGuardianList),
   peekCachedGuardianDelivery: () => mockGuardianList ?? undefined,
   guardianForChannel: (
     list: Array<Record<string, unknown>>,

package/src/runtime/routes/__tests__/wake-conversation-routes.test.ts

@@ -2,8 +2,10 @@
  * Asserts the `wake_conversation` route elevates trust from the caller's
  * verified principal type, never the request body: a `local` (CLI/IPC) caller
  * runs the woken turn as a non-interactive guardian (clientless + guardian
- * trustContext) and may attribute cost to a body-supplied `cronRunId`; a remote
- * `actor` stays `unknown`/interactive and its body `cronRunId` is ignored.
+ * trustContext) and may attribute cost to a body-supplied `cronRunId` and run
+ * on a body-supplied schedule's pinned inference profile; a remote `actor`
+ * stays `unknown`/interactive and its body `cronRunId` and `scheduleId` are
+ * ignored.
  */
 
 import { describe, expect, mock, test } from "bun:test";
@@ -13,6 +15,7 @@ interface CapturedWake {
   hint: string;
   trustContext?: { sourceChannel: string; trustClass: string };
   cronRunId?: string;
+  forceOverrideProfile?: string;
   clientless?: boolean;
   persistTriggerAsEvent?: boolean;
   untrustedOutput?: { content: string; source: string };
@@ -25,6 +28,14 @@ mock.module("../../agent-wake.js", () => ({
   },
 }));
 
+const schedules = new Map<string, { inferenceProfile: string | null }>([
+  ["sched-pinned", { inferenceProfile: "profile-cheap" }],
+  ["sched-unpinned", { inferenceProfile: null }],
+]);
+mock.module("../../../schedule/schedule-store.js", () => ({
+  getSchedule: (id: string) => schedules.get(id) ?? null,
+}));
+
 import { createConversation } from "../../../persistence/conversation-crud.js";
 import { initializeDb } from "../../../persistence/db-init.js";
 import { ROUTES } from "../wake-conversation-routes.js";
@@ -85,6 +96,53 @@ describe("wake_conversation principal-gated elevation", () => {
   });
 });
 
+describe("wake_conversation schedule profile pin", () => {
+  test("local principal → woken turn runs on the schedule's pinned profile", async () => {
+    wakeCalls.length = 0;
+    const conversationId = makeConversation();
+    await handler({
+      body: { conversationId, hint: "poll result", scheduleId: "sched-pinned" },
+      headers: { "x-vellum-principal-type": "local" },
+    });
+    expect(wakeCalls[0].forceOverrideProfile).toBe("profile-cheap");
+  });
+
+  test("schedule with no pinned profile leaves resolution unchanged", async () => {
+    wakeCalls.length = 0;
+    const conversationId = makeConversation();
+    await handler({
+      body: {
+        conversationId,
+        hint: "poll result",
+        scheduleId: "sched-unpinned",
+      },
+      headers: { "x-vellum-principal-type": "local" },
+    });
+    expect(wakeCalls[0].forceOverrideProfile).toBeUndefined();
+  });
+
+  test("unknown scheduleId resolves as an ordinary wake", async () => {
+    wakeCalls.length = 0;
+    const conversationId = makeConversation();
+    const result = await handler({
+      body: { conversationId, hint: "poll result", scheduleId: "sched-gone" },
+      headers: { "x-vellum-principal-type": "local" },
+    });
+    expect(result).toEqual({ invoked: true, producedToolCalls: false });
+    expect(wakeCalls[0].forceOverrideProfile).toBeUndefined();
+  });
+
+  test("actor principal → body scheduleId is ignored", async () => {
+    wakeCalls.length = 0;
+    const conversationId = makeConversation();
+    await handler({
+      body: { conversationId, hint: "poll result", scheduleId: "sched-pinned" },
+      headers: { "x-vellum-principal-type": "actor" },
+    });
+    expect(wakeCalls[0].forceOverrideProfile).toBeUndefined();
+  });
+});
+
 describe("wake_conversation fencing", () => {
   test("persist + externalContent fence untrusted data, keep hint trusted", async () => {
     wakeCalls.length = 0;

package/src/runtime/routes/archive-utils.ts

@@ -3,7 +3,10 @@
  * log export and profiler export routes.
  */
 
-import { spawnSync } from "node:child_process";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
 
 /** Maximum compressed archive size (50 MB). */
 export const MAX_ARCHIVE_BYTES = 50 * 1024 * 1024;
@@ -13,19 +16,20 @@ export const MAX_ARCHIVE_BYTES = 50 * 1024 * 1024;
  * Returns the Buffer on success, or `undefined` if the archive exceeds
  * the size limit or tar otherwise fails.
  */
-export function createTarGz(
+export async function createTarGz(
   staging: string,
   maxBytes: number = MAX_ARCHIVE_BYTES,
-): ArrayBuffer | undefined {
-  const proc = spawnSync("tar", ["czf", "-", "-C", staging, "."], {
-    maxBuffer: maxBytes,
-    timeout: 30_000,
-  });
-  if (proc.status !== 0) {
+): Promise<ArrayBuffer | undefined> {
+  try {
+    // Exceeding maxBuffer rejects, which maps to the undefined failure return.
+    const { stdout } = await execFileAsync(
+      "tar",
+      ["czf", "-", "-C", staging, "."],
+      { maxBuffer: maxBytes, timeout: 30_000, encoding: "buffer" },
+    );
+    const buf = Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout);
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  } catch {
     return undefined;
   }
-  const buf = Buffer.isBuffer(proc.stdout)
-    ? proc.stdout
-    : Buffer.from(proc.stdout);
-  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
 }

package/src/runtime/routes/attachment-routes.ts

@@ -238,7 +238,7 @@ async function handleMultipartUpload(
 
   const bytes = new Uint8Array(await file.arrayBuffer());
 
-  const attachment = uploadAttachmentFromBytes(filename, mimeType, bytes);
+  const attachment = await uploadAttachmentFromBytes(filename, mimeType, bytes);
   return attachmentPayload(attachment);
 }
 
@@ -248,7 +248,7 @@ async function handleMultipartUpload(
  *
  * See `handleMultipartUpload` for `gatewayTrustedSource` semantics.
  */
-function handleOctetStreamUpload(
+async function handleOctetStreamUpload(
   rawBody: Uint8Array,
   headers: Record<string, string>,
   queryParams: Record<string, string>,
@@ -287,7 +287,11 @@ function handleOctetStreamUpload(
     throw new UnsupportedMediaTypeError(validation.error);
   }
 
-  const attachment = uploadAttachmentFromBytes(filename, mimeType, rawBody);
+  const attachment = await uploadAttachmentFromBytes(
+    filename,
+    mimeType,
+    rawBody,
+  );
   return attachmentPayload(attachment);
 }
 
@@ -296,7 +300,7 @@ function handleOctetStreamUpload(
  *
  * See `handleMultipartUpload` for `gatewayTrustedSource` semantics.
  */
-function handleJsonUpload(
+async function handleJsonUpload(
   body: Record<string, unknown>,
   rawBody: Uint8Array | undefined,
   gatewayTrustedSource: boolean,
@@ -369,7 +373,10 @@ function handleJsonUpload(
       // non-HEIF files (e.g. large videos) from being read into memory.
       try {
         if (isHeifImage(readFileHead(destPath, 12))) {
-          const norm = normalizeImageBytes(mimeType, readFileSync(destPath));
+          const norm = await normalizeImageBytes(
+            mimeType,
+            readFileSync(destPath),
+          );
           if (
             norm.converted &&
             norm.bytes.length <= MAX_FILE_BACKED_UPLOAD_BYTES
@@ -407,7 +414,7 @@ function handleJsonUpload(
     }
 
     try {
-      attachment = uploadAttachment(
+      attachment = await uploadAttachment(
         filename,
         mimeType,
         data,

package/src/runtime/routes/canned-reply-release.ts

@@ -0,0 +1,54 @@
+/**
+ * Deferred release for the canned-reply routes (canned first greeting, unknown
+ * slash command).
+ *
+ * These routes answer without an agent loop, so they hold the processing lock
+ * themselves and are the only thing that will ever clear it. They publish their
+ * client events on the next tick so the HTTP 202 reaches the client first and
+ * its `serverToLocalConversationMap` is populated before any SSE arrives, and
+ * they release only after that burst so the next queued message cannot start
+ * processing ahead of the reply the client is still being told about.
+ *
+ * The release therefore has to be unconditional: a throw from any broadcast in
+ * the burst would otherwise latch the conversation "processing" with no agent
+ * loop, no `finally`, and no later path left to clear it, so every subsequent
+ * send is queued behind an idle conversation for the life of the daemon.
+ */
+
+import type { Conversation } from "../../daemon/conversation.js";
+import { getLogger } from "../../util/logger.js";
+
+const log = getLogger("canned-reply-release");
+
+/** The conversation surface {@link scheduleCannedReplyRelease} touches. */
+export type CannedReplyReleaseTarget = Pick<
+  Conversation,
+  "setProcessing" | "kickDrainQueue"
+>;
+
+export function scheduleCannedReplyRelease(params: {
+  conversation: CannedReplyReleaseTarget;
+  /** Names the release site in drain logs (e.g. `"canned_greeting"`). */
+  origin: string;
+  /** The deferred client event burst. Runs before the release. */
+  emit: () => void;
+  /** Optional work that only makes sense once the lock is free. */
+  afterRelease?: () => void;
+}): void {
+  const { conversation, origin, emit, afterRelease } = params;
+  setTimeout(() => {
+    try {
+      emit();
+    } catch (err) {
+      // Swallowed rather than rethrown: this runs from a timer with no caller
+      // left to handle it, so an escaping error is an uncaught exception in
+      // the daemon process. The reply is already persisted, and clients
+      // reconcile a missed event burst on their next fetch.
+      log.error({ err, origin }, "Canned reply event burst failed");
+    } finally {
+      conversation.setProcessing(false);
+      void conversation.kickDrainQueue("loop_complete", origin);
+    }
+    afterRelease?.();
+  }, 0);
+}

package/src/runtime/routes/channel-availability-routes.ts

@@ -4,11 +4,11 @@
  * GET /v1/channels/available — return the channels this assistant can
  * surface to clients (Contacts / GuardianChannels views, etc.) along with
  * their display metadata (label, subtitle, icon, verification capability,
- * setup-message copy). Today this is a fixed base list plus `email` when
- * an inbox is registered; eventually the list will be driven by
- * plugins/skills the assistant has loaded. Clients should treat the
- * response as authoritative and stop carrying their own per-channel
- * switches.
+ * setup-message copy). A fixed base list, plus `email` when an inbox is
+ * registered, plus the channels installed plugins bring by declaring
+ * ingress. One list, because a plugin channel is a channel; each row's
+ * `source` says who contributes it. Clients should treat the response as
+ * authoritative and stop carrying their own per-channel switches.
  *
  * Distinct from `/v1/channels/readiness` (which answers "is this channel
  * configured and working?"). Availability answers "could this channel be
@@ -18,8 +18,9 @@
 import { z } from "zod";
 
 import { isA2AEnabled } from "../../a2a/feature-gate.js";
+import { discoverPluginChannels } from "../../channels/plugin-channel-declarations.js";
 import {
-  CHANNEL_IDS,
+  type AvailableChannel,
   CHANNEL_METADATA,
   type ChannelId,
   type ChannelInfo,
@@ -73,7 +74,7 @@ async function hasRegisteredInbox(): Promise<boolean> {
 
 async function handleGetChannelAvailability(
   _args: RouteHandlerArgs,
-): Promise<{ channels: ChannelInfo[] }> {
+): Promise<{ channels: AvailableChannel[] }> {
   const ids: ChannelId[] = [...BASE_AVAILABLE_CHANNELS];
   if (await hasRegisteredInbox()) {
     ids.push("email");
@@ -86,14 +87,26 @@ async function handleGetChannelAvailability(
   // contains channels that BASE_AVAILABLE_CHANNELS / the email branch
   // explicitly chose, so the lookup is always defined — filter to satisfy
   // the type system without a non-null assertion.
-  const channels = ids
+  const builtIn: AvailableChannel[] = ids
     .map((id) => CHANNEL_METADATA[id])
-    .filter((info): info is ChannelInfo => info !== undefined);
-  return { channels };
+    .filter((info): info is ChannelInfo => info !== undefined)
+    .map((info) => ({ ...info, source: "default" as const }));
+  // One list, because a plugin channel is a channel: what differs is who
+  // contributes it, which is what `source` says. Built-ins lead, so a client
+  // rendering in order gets a stable list that plugin installs append to.
+  return { channels: [...builtIn, ...(await discoverPluginChannels())] };
 }
 
 const channelInfoSchema = z.object({
-  id: z.enum(CHANNEL_IDS),
+  // A string rather than the channel enum: a plugin channel's id is its
+  // plugin name, and `source` is what says which kind a row is.
+  id: z.string(),
+  source: z
+    .string()
+    .describe(
+      "`default` for a channel the assistant ships, `plugin:<name>` for one " +
+        "an installed plugin brings",
+    ),
   label: z.string(),
   subtitle: z.string(),
   icon: z.string(),
@@ -117,14 +130,19 @@ export const ROUTES: RouteDefinition[] = [
     description:
       "Return the channels this assistant can surface to clients, with " +
       "display metadata (label, icon, verification capability, setup " +
-      "copy). Today this is a fixed base list plus `email` when an inbox " +
-      "is registered; will become plugin/skill-driven in future.",
+      "copy). A fixed base list plus `email` when an inbox is registered, " +
+      "plus the channels installed plugins bring by declaring ingress " +
+      "routes. Each carries a `source` saying which of those it is.",
     tags: ["channels"],
     handler: handleGetChannelAvailability,
     responseBody: z.object({
       channels: z
         .array(channelInfoSchema)
-        .describe("Available channels in display order"),
+        .describe(
+          "Available channels in display order: the ones the assistant " +
+            "ships, then the ones installed plugins bring by declaring " +
+            "ingress routes. `source` distinguishes them.",
+        ),
     }),
   },
 ];

package/src/runtime/routes/channel-verification-routes.ts

@@ -35,8 +35,6 @@ import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   cancelOutbound,
-  deliverVerificationEmail,
-  deliverVerificationSlack,
   normalizeTelegramDestination,
   resendOutbound,
   startOutbound,
@@ -152,16 +150,6 @@ export async function handleCreateVerificationSession({
       verificationRateLimiter.recordFailure(rateLimitKey);
     }
 
-    // Dispatch delivery from the daemon process (not sandboxed).
-    if (result._pendingSlackDm) {
-      const { userId, text, assistantId: aid } = result._pendingSlackDm;
-      deliverVerificationSlack(userId, text, aid);
-    }
-    if (result._pendingEmail) {
-      const { to, text, subject, assistantId: aid } = result._pendingEmail;
-      deliverVerificationEmail(to, text, subject, aid);
-    }
-
     if (!result.success) {
       if (result.error === "rate_limited") {
         throw new TooManyRequestsError(
@@ -174,9 +162,7 @@ export async function handleCreateVerificationSession({
       );
     }
 
-    // Strip internal fields from the response
-    const { _pendingSlackDm: _, _pendingEmail: __, ...publicResult } = result;
-    return publicResult;
+    return result;
   }
 
   // Inbound challenge path
@@ -222,16 +208,6 @@ export async function handleResendVerificationSession({
 
   const result = await resendOutbound({ channel, originConversationId });
 
-  // Dispatch delivery from the daemon process (not sandboxed).
-  if (result._pendingSlackDm) {
-    const { userId, text, assistantId: aid } = result._pendingSlackDm;
-    deliverVerificationSlack(userId, text, aid);
-  }
-  if (result._pendingEmail) {
-    const { to, text, subject, assistantId: aid } = result._pendingEmail;
-    deliverVerificationEmail(to, text, subject, aid);
-  }
-
   if (!result.success) {
     if (result.error === "rate_limited") {
       throw new TooManyRequestsError(
@@ -243,8 +219,7 @@ export async function handleResendVerificationSession({
     );
   }
 
-  const { _pendingSlackDm: _, _pendingEmail: __, ...publicResult } = result;
-  return publicResult;
+  return result;
 }
 
 /**

package/src/runtime/routes/chatgpt-subscription-auth-routes.ts

@@ -159,8 +159,13 @@ async function handleExchange(args: RouteHandlerArgs) {
 
   const existing = getConnection(db, CONNECTION_NAME);
   if (existing) {
+    // Stamp the provider with the auth: this row is the subscription
+    // connection by name, and dispatch derives auth from the provider for
+    // managed rows, so a claiming row with e.g. provider "vellum" would
+    // otherwise strand the fresh token behind derived platform auth.
     const updateResult = updateConnection(db, CONNECTION_NAME, {
       auth: authInput,
+      provider: "openai",
     });
     if (!updateResult.ok) {
       log.error(

package/src/runtime/routes/client-routes.ts

@@ -10,15 +10,33 @@ import { z } from "zod";
 import type { HostProxyCapability } from "../../channels/types.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { datesToISO } from "../../util/json.js";
-import { assistantEventHub } from "../assistant-event-hub.js";
+import { getLogger } from "../../util/logger.js";
+import {
+  assistantEventHub,
+  DESKTOP_PRESENCE_STATES,
+} from "../assistant-event-hub.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   DEFAULT_HEARTBEAT_INTERVAL_MS,
   isClientDegraded,
 } from "../client-health.js";
-import { NotFoundError } from "./errors.js";
+import { BadRequestError, NotFoundError } from "./errors.js";
+import { parseBody } from "./parse-body.js";
 import type { RouteDefinition } from "./types.js";
 
+const log = getLogger("client-routes");
+
+/**
+ * Body of `POST /v1/clients/presence`, declared as the route's `requestBody`
+ * and parsed by the handler, so the OpenAPI contract and the runtime check are
+ * one schema rather than two hand-kept copies.
+ */
+const PresenceBodySchema = z.object({
+  state: z
+    .enum(DESKTOP_PRESENCE_STATES)
+    .describe("Reported desktop presence state."),
+});
+
 export const ROUTES: RouteDefinition[] = [
   {
     operationId: "list_clients",
@@ -116,4 +134,98 @@ export const ROUTES: RouteDefinition[] = [
       return { disconnected: count };
     },
   },
+  {
+    operationId: "report_client_presence",
+    endpoint: "clients/presence",
+    method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Report desktop presence",
+    description:
+      "Record the desktop presence state reported by the client identified by the X-Vellum-Client-Id header.",
+    tags: ["clients"],
+    requestBody: PresenceBodySchema,
+    responseBody: z.object({
+      recorded: z
+        .boolean()
+        .describe("Whether a connected client matched the reporting clientId."),
+    }),
+    handler: ({ body, headers }) => {
+      const clientId = headers?.["x-vellum-client-id"]?.trim();
+      if (!clientId) {
+        throw new BadRequestError(
+          "x-vellum-client-id header is required to report presence.",
+        );
+      }
+      const { state } = parseBody(PresenceBodySchema, body);
+
+      // Resolving the client first separates "nobody is listening" from
+      // "somebody else owns this", so only the second one is worth a warn.
+      const client = assistantEventHub.getClientById(clientId);
+      if (!client) {
+        // Debug, not warn: a report racing an SSE reconnect matches nothing,
+        // and a reconnect storm would otherwise emit a warn per client every
+        // 30 seconds for a benign race. Not a 404 either, for the same reason.
+        log.debug(
+          { op: "report_client_presence", state },
+          "Presence report matched no connected client",
+        );
+        return { recorded: false };
+      }
+
+      // Only the actor that opened the target client's SSE stream may report
+      // its presence, so a caller who learns another user's clientId cannot
+      // spoof that desktop. Clients with no stored `actorPrincipalId` (legacy
+      // SSE subscribers, service-gateway tokens) never match: fail-closed, the
+      // same posture as the listing filter above. Dev-bypass mode
+      // (DISABLE_HTTP_AUTH=true) skips the check for platform-managed
+      // deployments where the platform handles auth.
+      if (!isHttpAuthDisabled()) {
+        const callerPrincipalId = headers?.["x-vellum-actor-principal-id"];
+        const ownerPrincipalId = client.actorPrincipalId;
+        if (
+          ownerPrincipalId === undefined ||
+          ownerPrincipalId !== callerPrincipalId
+        ) {
+          // Warn, not debug: the client is connected, so a mismatch means the
+          // gateway stopped forwarding the actor header, a scope profile
+          // shifted, or a caller is probing someone else's client. Without this
+          // line presence gating dies silently and every suppressed push
+          // quietly resumes. Client and principal ids stay out of the entry so
+          // the log cannot be used to enumerate them.
+          log.warn(
+            {
+              op: "report_client_presence",
+              hasStoredOwner: ownerPrincipalId !== undefined,
+              hasCallerPrincipal: callerPrincipalId !== undefined,
+              targetInterfaceId: client.interfaceId,
+            },
+            "Rejecting presence report from a caller that does not own the client",
+          );
+          // Answering like "no match" keeps the reply from probing client ids.
+          return { recorded: false };
+        }
+      }
+
+      // The lookup ran in this same synchronous handler, so the write lands on
+      // the entry it resolved.
+      assistantEventHub.setClientPresence(clientId, state);
+
+      // Records which state a client actually reported. Nothing else persists
+      // it, so this is the only evidence for why a machine did or did not
+      // count as attended. Only `macos` clients gate pushes, hence the
+      // interface id.
+      log.debug(
+        {
+          op: "report_client_presence",
+          state,
+          interfaceId: client.interfaceId,
+        },
+        "Recorded desktop presence",
+      );
+      return { recorded: true };
+    },
+  },
 ];

package/src/runtime/routes/conversation-cli-routes.ts

@@ -44,12 +44,11 @@ function handleListCli({ body = {} }: RouteHandlerArgs) {
   // user sees archived rows alongside live ones in the picker.
   const includeArchived = (body.includeArchived as boolean) ?? false;
 
-  const rows = listConversations(
+  const rows = listConversations({
     limit,
-    "standard",
-    0,
-    includeArchived ? "all" : "active",
-  );
+    conversationType: "standard",
+    archiveStatus: includeArchived ? "all" : "active",
+  });
   return {
     conversations: rows.map((c) => ({
       id: c.id,
@@ -140,7 +139,7 @@ function handleExportCli({ body = {} }: RouteHandlerArgs) {
   let conversationId = body.conversationId as string | undefined;
 
   if (!conversationId) {
-    const all = listConversations(1);
+    const all = listConversations({ limit: 1 });
     if (all.length === 0) {
       throw new NotFoundError("No conversations found");
     }
@@ -151,12 +150,11 @@ function handleExportCli({ body = {} }: RouteHandlerArgs) {
   // behavior of letting `vellum export <prefix>` resolve an archived row.
   let conversation = getConversation(conversationId);
   if (!conversation) {
-    const all = listConversations(
-      Number.MAX_SAFE_INTEGER,
-      "standard",
-      0,
-      "all",
-    );
+    const all = listConversations({
+      limit: Number.MAX_SAFE_INTEGER,
+      conversationType: "standard",
+      archiveStatus: "all",
+    });
     const match = all.find((c) => c.id.startsWith(conversationId!));
     if (match) {
       conversation = match;