@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/__tests__/tool-executor.test.ts

@@ -43,8 +43,11 @@ let checkFnOverride:
 /** Override for generateScopeOptions — when set, returns this value instead of the default. */
 let scopeOptionsOverride: ScopeOption[] | undefined;
 
-/** Override for getCachedAssessment — when set, returns this value. */
-let cachedAssessmentOverride:
+/**
+ * Override for the classification `classifyRisk` returns; when unset the
+ * classifier answers low with no reason and no options.
+ */
+let classificationOverride:
   | {
       riskLevel: string;
       reason: string;
@@ -61,7 +64,14 @@ let cachedAssessmentOverride:
 
 mock.module("../permissions/checker.js", () => ({
   isDynamicSkillLoadInvocation: () => false,
-  classifyRisk: async () => ({ level: "low" }),
+  classifyRisk: async () => ({
+    level: classificationOverride?.riskLevel ?? "low",
+    reason: classificationOverride?.reason,
+    scopeOptions: classificationOverride?.scopeOptions ?? [],
+    allowlistOptions: classificationOverride?.allowlistOptions,
+    directoryScopeOptions: classificationOverride?.directoryScopeOptions,
+    matchType: classificationOverride?.matchType ?? "unknown",
+  }),
   check: async (
     toolName: string,
     input: Record<string, unknown>,
@@ -77,12 +87,8 @@ mock.module("../permissions/checker.js", () => ({
     }
     return { decision: "allow", reason: "allowed" };
   },
-  generateAllowlistOptions: () => [
-    { label: "exact", description: "exact", pattern: "exact" },
-  ],
   generateScopeOptions: () =>
     scopeOptionsOverride ?? [{ label: "/tmp", scope: "/tmp" }],
-  getCachedAssessment: () => cachedAssessmentOverride,
 }));
 
 // Mock every export so downstream test files that dynamically import modules
@@ -167,7 +173,7 @@ describe("ToolExecutor allowedToolNames gating", () => {
     getAllToolsOverride = undefined;
     checkResultOverride = undefined;
     checkFnOverride = undefined;
-    cachedAssessmentOverride = undefined;
+    classificationOverride = undefined;
   });
 
   test("executes normally when allowedToolNames is not set", async () => {
@@ -385,7 +391,7 @@ describe("ToolExecutor policy context plumbing", () => {
     getToolOverride = undefined;
     checkResultOverride = undefined;
     checkFnOverride = undefined;
-    cachedAssessmentOverride = undefined;
+    classificationOverride = undefined;
   });
 
   test("passes PolicyContext with executionTarget for skill-origin tools", async () => {
@@ -604,7 +610,7 @@ describe("ToolExecutor forcePromptSideEffects enforcement", () => {
     getToolOverride = undefined;
     checkResultOverride = undefined;
     checkFnOverride = undefined;
-    cachedAssessmentOverride = undefined;
+    classificationOverride = undefined;
     promptCalled = false;
   });
 
@@ -931,11 +937,30 @@ describe("integration regressions — prompt payload (PR 11)", () => {
     getToolOverride = undefined;
   });
 
-  test("shell command prompt payload includes allowlist and scope options", async () => {
+  test("shell command prompt payload carries the classifier's ladder and the scope options", async () => {
     checkResultOverride = {
       decision: "prompt",
       reason: "Medium risk: requires approval",
     };
+    // The ladder is the gateway's; the daemon passes it through untouched.
+    classificationOverride = {
+      riskLevel: "medium",
+      reason: "npm install",
+      scopeOptions: [],
+      allowlistOptions: [
+        {
+          label: "npm install",
+          description: "Exact command",
+          pattern: "npm install",
+        },
+        {
+          label: "action:npm",
+          description: "Any npm command",
+          pattern: "action:npm",
+        },
+      ],
+      matchType: "registry",
+    };
 
     let capturedAllowlist: AllowlistOption[] | undefined;
     let capturedScopes: ScopeOption[] | undefined;
@@ -963,13 +988,11 @@ describe("integration regressions — prompt payload (PR 11)", () => {
       makeContext({ forcePromptSideEffects: true }),
     );
 
-    // Verify that the prompter received allowlist options
-    expect(capturedAllowlist).toBeDefined();
-    expect(capturedAllowlist!.length).toBeGreaterThan(0);
-    // The mock returns [{label: 'exact', description: 'exact', pattern: 'exact'}]
-    expect(capturedAllowlist![0]).toHaveProperty("pattern");
-    expect(capturedAllowlist![0]).toHaveProperty("label");
-    expect(capturedAllowlist![0]).toHaveProperty("description");
+    // The prompt offers exactly what the classifier produced, in order.
+    expect(capturedAllowlist?.map((o) => o.pattern)).toEqual([
+      "npm install",
+      "action:npm",
+    ]);
 
     // Verify scope options are also passed
     expect(capturedScopes).toBeDefined();
@@ -989,11 +1012,11 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
     getToolOverride = undefined;
     checkResultOverride = undefined;
     checkFnOverride = undefined;
-    cachedAssessmentOverride = undefined;
+    classificationOverride = undefined;
   });
 
   test("auto-approved tool result includes risk metadata when classifier assessment exists", async () => {
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "medium",
       reason: "Writes to a file outside the workspace",
       scopeOptions: [
@@ -1019,8 +1042,10 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
     ]);
   });
 
-  test("tool result omits risk metadata when no classifier assessment exists (e.g. MCP tools)", async () => {
-    // cachedAssessmentOverride is undefined (no classifier ran)
+  test("tool result carries the classification's risk metadata even when the classifier produced no options", async () => {
+    // classificationOverride is unset: the classifier answered low with no
+    // reason and no options, which is what a tool with no dedicated classifier
+    // (registry default risk) looks like.
     const executor = new ToolExecutor(makePrompter());
     const result = await executor.execute(
       "file_read",
@@ -1029,9 +1054,9 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
     );
 
     expect(result.isError).toBe(false);
-    expect(result.riskLevel).toBeUndefined();
-    expect(result.riskReason).toBeUndefined();
-    expect(result.riskScopeOptions).toBeUndefined();
+    expect(result.riskLevel).toBe("low");
+    expect(result.riskScopeOptions).toEqual([]);
+    expect(result.riskAllowlistOptions).toBeUndefined();
   });
 
   test("denied tool result includes risk metadata", async () => {
@@ -1039,7 +1064,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
       decision: "deny",
       reason: "Blocked by deny rule",
     };
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "high",
       reason: "Recursive force delete",
       scopeOptions: [{ pattern: "bash:rm -rf*", label: "rm -rf commands" }],
@@ -1066,7 +1091,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
       decision: "prompt",
       reason: "Medium risk: requires approval",
     };
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "medium",
       reason: "Package manager installation",
       scopeOptions: [
@@ -1091,7 +1116,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
   });
 
   test("tool result includes riskDirectoryScopeOptions when classifier emits directoryScopeOptions", async () => {
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "medium",
       reason: "Writes to file in workspace",
       scopeOptions: [
@@ -1124,7 +1149,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
   });
 
   test("tool result omits riskDirectoryScopeOptions when classifier does not emit directoryScopeOptions", async () => {
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "low",
       reason: "Read-only operation",
       scopeOptions: [],
@@ -1144,7 +1169,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
   });
 
   test("riskScopeOptions and riskDirectoryScopeOptions are independent — one does not clobber the other", async () => {
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "medium",
       reason: "Filesystem write",
       scopeOptions: [
@@ -1170,7 +1195,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
   });
 
   test("auto-approved tool result includes riskAllowlistOptions when classifier emits them (Minimatch-glob shape for save path)", async () => {
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "medium",
       reason: "Reads workspace files",
       // Display ladder (regex shape — not for save).
@@ -1222,7 +1247,7 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
   });
 
   test("riskAllowlistOptions is undefined when classifier did not produce allowlist (e.g. web-risk classifier)", async () => {
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "low",
       reason: "GET request to public URL",
       scopeOptions: [
@@ -1248,8 +1273,8 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
     expect(result.riskAllowlistOptions).toBeUndefined();
   });
 
-  test("riskAllowlistOptions is undefined when no classifier ran (MCP tools)", async () => {
-    // cachedAssessmentOverride is undefined — no classifier ran.
+  test("riskAllowlistOptions is undefined when the classifier produced none", async () => {
+    // classificationOverride is unset: no allowlist options on the answer.
     const executor = new ToolExecutor(makePrompter());
     const result = await executor.execute(
       "file_read",
@@ -1258,13 +1283,13 @@ describe("ToolExecutionResult includes risk metadata from classifier assessment"
     );
 
     expect(result.isError).toBe(false);
-    expect(result.riskScopeOptions).toBeUndefined();
+    expect(result.riskScopeOptions).toEqual([]);
     expect(result.riskAllowlistOptions).toBeUndefined();
   });
 
   test("denied tool result still carries riskAllowlistOptions for the rule editor save path", async () => {
     checkResultOverride = { decision: "deny", reason: "Blocked by deny rule" };
-    cachedAssessmentOverride = {
+    classificationOverride = {
       riskLevel: "high",
       reason: "Recursive force delete",
       scopeOptions: [{ pattern: "^rm\\s+-rf", label: "rm -rf *" }],
@@ -1334,7 +1359,7 @@ describe("ToolExecutor thrown-value rendering", () => {
     getAllToolsOverride = undefined;
     checkResultOverride = undefined;
     checkFnOverride = undefined;
-    cachedAssessmentOverride = undefined;
+    classificationOverride = undefined;
   });
 
   function throwingTool(name: string, thrown: unknown): void {
@@ -1406,7 +1431,7 @@ describe("ToolExecutor input-schema validation gate", () => {
     getAllToolsOverride = undefined;
     checkResultOverride = undefined;
     checkFnOverride = undefined;
-    cachedAssessmentOverride = undefined;
+    classificationOverride = undefined;
   });
 
   /**

package/src/__tests__/tool-policy.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, test } from "bun:test";
 
-import { isToolAllowed } from "../tools/credentials/tool-policy.js";
+import type { CredentialMetadata } from "../tools/credentials/metadata-store.js";
+import {
+  BROWSER_FILL_CAPABILITY,
+  isToolAllowed,
+  serverUseDenialReason,
+} from "../tools/credentials/tool-policy.js";
 
 describe("isToolAllowed", () => {
   // ── Allow cases ─────────────────────────────────────────────────────
@@ -72,3 +77,94 @@ describe("isToolAllowed", () => {
     ).toBe(false);
   });
 });
+
+describe("serverUseDenialReason", () => {
+  function metadata(
+    overrides: Partial<CredentialMetadata> = {},
+  ): CredentialMetadata {
+    return {
+      credentialId: "cred-1",
+      service: "acp",
+      field: "claude_oauth_token",
+      allowedTools: ["acp_spawn"],
+      allowedDomains: [],
+      createdAt: 0,
+      updatedAt: 0,
+      ...overrides,
+    };
+  }
+
+  test("denies when metadata is missing", () => {
+    expect(
+      serverUseDenialReason(
+        undefined,
+        "acp_spawn",
+        "acp",
+        "claude_oauth_token",
+      ),
+    ).toBe("No credential found for acp/claude_oauth_token");
+  });
+
+  test("denies fail-closed when allowedTools is empty", () => {
+    const reason = serverUseDenialReason(
+      metadata({ allowedTools: [] }),
+      "acp_spawn",
+      "acp",
+      "claude_oauth_token",
+    );
+    expect(reason).toContain(
+      'Tool "acp_spawn" is not allowed to use credential acp/claude_oauth_token.',
+    );
+    expect(reason).toContain("No tools are currently allowed");
+  });
+
+  test("denies when allowedTools omits the requesting tool", () => {
+    const reason = serverUseDenialReason(
+      metadata({ allowedTools: ["bash", "web_fetch"] }),
+      "acp_spawn",
+      "acp",
+      "claude_oauth_token",
+    );
+    expect(reason).toContain(
+      'Tool "acp_spawn" is not allowed to use credential acp/claude_oauth_token.',
+    );
+    expect(reason).toContain("Allowed tools: bash, web_fetch.");
+  });
+
+  test("allows when a legacy alias canonicalizes to the requesting tool", () => {
+    expect(
+      serverUseDenialReason(
+        metadata({ allowedTools: ["browser_fill_credential"] }),
+        BROWSER_FILL_CAPABILITY,
+        "acp",
+        "claude_oauth_token",
+      ),
+    ).toBeUndefined();
+  });
+
+  test("denies a domain-restricted credential", () => {
+    expect(
+      serverUseDenialReason(
+        metadata({ allowedDomains: ["example.com", "example.org"] }),
+        "acp_spawn",
+        "acp",
+        "claude_oauth_token",
+      ),
+    ).toBe(
+      "Credential acp/claude_oauth_token has domain restrictions " +
+        "(example.com, example.org) and cannot be used server-side. " +
+        "Remove domain restrictions or use a separate credential without domain policy.",
+    );
+  });
+
+  test("allows fully-permitted metadata", () => {
+    expect(
+      serverUseDenialReason(
+        metadata(),
+        "acp_spawn",
+        "acp",
+        "claude_oauth_token",
+      ),
+    ).toBeUndefined();
+  });
+});

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -1231,8 +1231,9 @@ describe("(g) access_request resolver: requester code delivery", () => {
     expect(requesterCodeReply!.payload.text).toContain(
       "your access request was approved",
     );
-    // The code DM is durable, never ephemeral.
-    expect(requesterCodeReply!.payload.ephemeral).toBeUndefined();
+    // The code DM is durable, so it carries no audience: restricting it
+    // would cost durability without hiding it from anyone.
+    expect(requesterCodeReply!.payload.audience).toBeUndefined();
     // threadTs (the guardian's channel thread) is stripped for the DM.
     expect(requesterCodeReply!.url).not.toContain("threadTs");
 
@@ -1411,8 +1412,10 @@ describe("(g) access_request resolver: requester code delivery", () => {
     );
     expect(courier).toBeDefined();
     expect(courier!.payload.chatId).toBe("C_SHARED_CHANNEL");
-    expect(courier!.payload.ephemeral).toBe(true);
-    expect(courier!.payload.user).toBe(REQUESTER_UID);
+    expect(courier!.payload.audience).toEqual({
+      kind: "oneReader",
+      userId: REQUESTER_UID,
+    });
   });
 
   test("guardian-facing reply uses the requester's display name, not the raw ID", async () => {

package/src/__tests__/user-plugin-loader.test.ts

@@ -28,6 +28,7 @@ import {
   getCachedUserTools,
   resetPluginCacheForTests,
 } from "../plugins/mtime-cache.js";
+import { resetPluginRegistryForTests } from "../plugins/registry.js";
 import { loadUserPlugins } from "../plugins/user-loader.js";
 
 // Isolate every run under its own tempdir so parallel test files (and
@@ -71,6 +72,7 @@ function clearPluginsDir(): void {
 describe("user plugin loader", () => {
   beforeEach(() => {
     resetPluginCacheForTests();
+    resetPluginRegistryForTests();
     clearPluginsDir();
   });
 

package/src/__tests__/validate-input.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
 import {
+  coerceArrayShapes,
   coerceStringBooleans,
   validateInputAgainstSchema,
 } from "../skills/validate-input.js";
@@ -450,20 +451,255 @@ describe("coerceStringBooleans", () => {
   });
 });
 
-describe("validateInputAgainstSchema — boolean string error message", () => {
-  test("points at the JSON boolean form when a string is passed", () => {
+describe("coerceArrayShapes", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      activation_hints: { type: "array", items: { type: "string" } },
+      files: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            path: { type: "string" },
+            content: { type: "string" },
+            copy_from: { type: "string" },
+          },
+          required: ["path"],
+        },
+      },
+      steps: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            action: { type: "string" },
+            require_approval: { type: "boolean" },
+          },
+        },
+      },
+      name: { type: "string" },
+      tags: { type: ["array", "null"] },
+      untyped: { type: "array" },
+    },
+  };
+
+  describe("a string holding the JSON text of the array", () => {
+    test("decodes an array of strings", () => {
+      const result = coerceArrayShapes(
+        { activation_hints: '["deploy staging","roll back"]' },
+        schema,
+      );
+      expect(result.activation_hints).toEqual(["deploy staging", "roll back"]);
+    });
+
+    test("decodes an array of objects", () => {
+      const result = coerceArrayShapes(
+        { files: '[{"path":"references/notes.md","content":"hi"}]' },
+        schema,
+      );
+      expect(result.files).toEqual([
+        { path: "references/notes.md", content: "hi" },
+      ]);
+    });
+
+    test("decodes for an array property that declares no item type", () => {
+      const result = coerceArrayShapes({ untyped: '["a"]' }, schema);
+      expect(result.untyped).toEqual(["a"]);
+    });
+  });
+
+  describe("a single element where a list was expected", () => {
+    test("wraps a bare phrase for a string-item array", () => {
+      const result = coerceArrayShapes(
+        { activation_hints: "user asks to deploy staging" },
+        schema,
+      );
+      expect(result.activation_hints).toEqual(["user asks to deploy staging"]);
+    });
+
+    test("wraps the decoded text of a JSON-quoted phrase", () => {
+      const result = coerceArrayShapes(
+        { activation_hints: '"user asks to deploy staging"' },
+        schema,
+      );
+      expect(result.activation_hints).toEqual(["user asks to deploy staging"]);
+    });
+
+    test("wraps one object that spells out the item schema's properties", () => {
+      const result = coerceArrayShapes(
+        { files: { path: "references/notes.md", content: "hi" } },
+        schema,
+      );
+      expect(result.files).toEqual([
+        { path: "references/notes.md", content: "hi" },
+      ]);
+    });
+
+    test("leaves an object keyed by something the item schema does not name", () => {
+      const input = { files: { "references/notes.md": "hi" } };
+      const result = coerceArrayShapes(input, schema);
+      expect(result).toBe(input);
+    });
+
+    test("leaves a bare phrase for an object-item array", () => {
+      const input = { files: "references/notes.md" };
+      const result = coerceArrayShapes(input, schema);
+      expect(result).toBe(input);
+    });
+
+    test("leaves a bare phrase when the array declares no item type", () => {
+      const input = { untyped: "one thing" };
+      expect(coerceArrayShapes(input, schema)).toBe(input);
+    });
+  });
+
+  describe("shapes left for the validator to reject", () => {
+    test.each([
+      ['["deploy staging"', "a truncated array"],
+      ['{"path":"references/notes.md"', "a truncated object"],
+      ["", "an empty string"],
+      ["   ", "blank text"],
+    ])("leaves %p (%s)", (raw) => {
+      const input = { activation_hints: raw };
+      const result = coerceArrayShapes(input, schema);
+      expect(result).toBe(input);
+      const validation = validateInputAgainstSchema(
+        "scaffold_managed_skill",
+        result,
+        schema,
+      );
+      expect(validation.ok).toBe(false);
+    });
+  });
+
+  test("repaired input passes validation and preserves intent", () => {
+    const coerced = coerceArrayShapes(
+      {
+        activation_hints: "user asks to deploy staging",
+        files: { path: "references/notes.md", content: "hi" },
+        name: "x",
+      },
+      schema,
+    );
+    expect(
+      validateInputAgainstSchema("scaffold_managed_skill", coerced, schema),
+    ).toEqual({ ok: true });
+    expect(coerced.activation_hints).toEqual(["user asks to deploy staging"]);
+  });
+
+  describe("elements an array gains here", () => {
+    test("are coerced against the item schema when decoded", () => {
+      const result = coerceArrayShapes(
+        { steps: '[{"action":"send","require_approval":"false"}]' },
+        schema,
+      );
+      expect(result.steps).toEqual([
+        { action: "send", require_approval: false },
+      ]);
+    });
+
+    test("are coerced against the item schema when wrapped", () => {
+      const result = coerceArrayShapes(
+        { steps: { action: "send", require_approval: "true" } },
+        schema,
+      );
+      expect(result.steps).toEqual([
+        { action: "send", require_approval: true },
+      ]);
+    });
+
+    test("leave non-object elements alone", () => {
+      const result = coerceArrayShapes({ steps: '["send",7]' }, schema);
+      expect(result.steps).toEqual(["send", 7]);
+    });
+  });
+
+  test("still reports a wrong element type after repair", () => {
+    const coerced = coerceArrayShapes(
+      { activation_hints: '["deploy staging",7]' },
+      schema,
+    );
+    const validation = validateInputAgainstSchema(
+      "scaffold_managed_skill",
+      coerced,
+      schema,
+    );
+    expect(validation.ok).toBe(false);
+    if (validation.ok) {
+      return;
+    }
+    expect(validation.errors).toContain("activation_hints[1] must be a string");
+  });
+
+  test("does not touch non-array-typed or union-typed properties", () => {
+    const input = { name: '["x"]', tags: '["x"]' };
+    const result = coerceArrayShapes(input, schema);
+    expect(result).toBe(input);
+    expect(result.name).toBe('["x"]');
+    expect(result.tags).toBe('["x"]');
+  });
+
+  test("does not touch real arrays or other types", () => {
+    const input = { activation_hints: ["deploy staging"] };
+    expect(coerceArrayShapes(input, schema)).toBe(input);
+    const inputNum = { activation_hints: 7 };
+    expect(coerceArrayShapes(inputNum, schema)).toBe(inputNum);
+  });
+
+  test("returns the same object when there is nothing to repair", () => {
+    const input = { name: "x" };
+    expect(coerceArrayShapes(input, schema)).toBe(input);
+    expect(coerceArrayShapes(input, undefined)).toBe(input);
+    expect(coerceArrayShapes(input, { type: "object" })).toBe(input);
+  });
+
+  test("returns a new object and never mutates the original input", () => {
+    const input = { activation_hints: '["deploy staging"]', name: "x" };
+    const snapshot = JSON.parse(JSON.stringify(input));
+    const result = coerceArrayShapes(input, schema);
+    expect(result).not.toBe(input);
+    expect(input).toEqual(snapshot);
+    expect(result.name).toBe("x");
+  });
+});
+
+describe("validateInputAgainstSchema: array shape error message", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      activation_hints: { type: "array", items: { type: "string" } },
+    },
+  };
+
+  test("points at the JSON array form when a string is passed", () => {
     const result = validateInputAgainstSchema(
-      "app_create",
-      { auto_open: "yes" },
-      { type: "object", properties: { auto_open: { type: "boolean" } } },
+      "scaffold_managed_skill",
+      { activation_hints: "[deploy staging" },
+      schema,
     );
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
     }
-    expect(result.errors).toContain(
-      "auto_open must be a boolean — pass true or false as a JSON boolean, not a string",
+    expect(result.errors).toEqual([
+      "activation_hints must be an array: pass a JSON array, not a string",
+    ]);
+  });
+
+  test("names an object when an object is passed", () => {
+    const result = validateInputAgainstSchema(
+      "scaffold_managed_skill",
+      { activation_hints: { first: "deploy staging" } },
+      schema,
     );
+    expect(result.ok).toBe(false);
+    if (result.ok) {
+      return;
+    }
+    expect(result.errors).toEqual([
+      "activation_hints must be an array: pass a JSON array, not an object",
+    ]);
   });
 });