@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/permissions/confirmation-guardian-request.test.ts

@@ -1,7 +1,9 @@
 /**
- * Tests for the confirmation → guardian-request promotion, including the
- * in-flight race: a confirmation resolved while the fire-and-forget gateway
- * create is still pending must not strand a pending tool_approval row.
+ * Tests for the confirmation to guardian-request promotion, including the
+ * in-flight race (a confirmation resolved while the fire-and-forget gateway
+ * create is still pending must not strand a pending tool_approval row) and
+ * the deadline, which is derived from the approval-window resolver rather
+ * than restated as a constant.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -52,6 +54,15 @@ mock.module("../runtime/confirmation-request-guardian-bridge.js", () => ({
   },
 }));
 
+// Deliberately not 300_000, the resolver's default. A fixture on the default
+// passes whether the deadline is read from the resolver or restated as a
+// constant beside it; this value only matches if it is read.
+const APPROVAL_WINDOW_MS = 900_000;
+
+mock.module("../tools/tool-approval-handler.js", () => ({
+  resolveInlineGrantWaitMs: () => APPROVAL_WINDOW_MS,
+}));
+
 import { asConversation } from "../__tests__/helpers/mock-conversation.js";
 import type { AssistantEvent } from "../api/index.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
@@ -86,6 +97,20 @@ describe("createGuardianRequestForConfirmation", () => {
     expect(bridgeCalls).toHaveLength(1);
   });
 
+  test("takes the row deadline from the approval-window resolver", async () => {
+    const before = Date.now();
+    await createGuardianRequestForConfirmation(MSG, "conv-1");
+    const after = Date.now();
+
+    expect(createCalls).toHaveLength(1);
+    const expiresAt = createCalls[0].expiresAt as number;
+
+    // Bracketed against the clock either side of the call rather than compared
+    // to a single Date.now(), so the assertion cannot flake on a slow tick.
+    expect(expiresAt).toBeGreaterThanOrEqual(before + APPROVAL_WINDOW_MS);
+    expect(expiresAt).toBeLessThanOrEqual(after + APPROVAL_WINDOW_MS);
+  });
+
   test("expires the row and skips the bridge when the confirmation resolved mid-create", async () => {
     confirmationPending = false;
 

package/src/permissions/confirmation-guardian-request.ts

@@ -55,6 +55,7 @@ export async function createGuardianRequestForConfirmation(
       { summarizeToolInput },
       { DAEMON_INTERNAL_ASSISTANT_ID },
       { bridgeConfirmationRequestToGuardian },
+      { resolveInlineGrantWaitMs },
     ] = await Promise.all([
       import("../daemon/conversation-registry.js"),
       import("../channels/gateway-guardian-requests.js"),
@@ -62,6 +63,7 @@ export async function createGuardianRequestForConfirmation(
       import("../tools/tool-input-summary.js"),
       import("../runtime/assistant-scope.js"),
       import("../runtime/confirmation-request-guardian-bridge.js"),
+      import("../tools/tool-approval-handler.js"),
     ]);
 
     const conversation = findConversation(conversationId);
@@ -100,7 +102,9 @@ export async function createGuardianRequestForConfirmation(
       activityText: activityRaw ? redactSecrets(activityRaw) : undefined,
       executionTarget: msg.executionTarget,
       status: "pending",
-      expiresAt: Date.now() + 5 * 60 * 1000,
+      // The row stays decidable exactly as long as the prompt stays parked:
+      // one budget, so raising `timeouts.permissionTimeoutSec` moves both.
+      expiresAt: Date.now() + resolveInlineGrantWaitMs(),
     });
 
     // The prompt is actionable before this fire-and-forget create lands, so

package/src/persistence/conversation-crud.ts

@@ -87,6 +87,7 @@ import {
   type ConversationCreateType,
   type ConversationOrigin,
   isHiddenMessageMetadata,
+  isSystemCardMetadata,
   PINNED_GROUP_ID,
   UNGROUPED_GROUP_ID,
 } from "./conversation-types.js";
@@ -259,6 +260,14 @@ const backgroundToolCompletionMetadataSchema = z.object({
 
 export const messageMetadataSchema = z
   .object({
+    /**
+     * Epoch ms the content actually happened, when that differs from when
+     * the row was written. Set wherever persistence lags the event: a queued
+     * turn draining, or channel history imported long after the fact.
+     * History serialization prefers it over `createdAt` for the display
+     * timestamp.
+     */
+    sentAt: z.number().optional(),
     userMessageChannel: channelIdSchema.optional(),
     assistantMessageChannel: channelIdSchema.optional(),
     userMessageInterface: interfaceIdSchema.optional(),
@@ -413,13 +422,15 @@ export {
 } from "./conversation-types.js";
 
 /**
- * `messageKind` value marking a daemon-authored system card — a pre-composed
- * status reply (the /compact, /clean, and summarize-up-to result cards) that
- * bypasses the agent loop. Cards render as standalone system notices, never
- * as the assistant persona speaking, and never merge into adjacent assistant
- * display turns.
+ * The system-card `messageKind` marker and its predicate live in the
+ * `conversation-types` leaf so a caller that only stamps or classifies the
+ * marker does not pull in this module's DB graph, and are re-exported here
+ * alongside the schema that carries them.
  */
-export const SYSTEM_CARD_MESSAGE_KIND = "system_card";
+export {
+  isSystemCardMetadata,
+  SYSTEM_CARD_MESSAGE_KIND,
+} from "./conversation-types.js";
 
 /**
  * `messageKind` value marking the synthetic assistant row the agent loop
@@ -431,18 +442,6 @@ export const SYSTEM_CARD_MESSAGE_KIND = "system_card";
  */
 export const PROVIDER_ERROR_MESSAGE_KIND = "provider_error";
 
-/**
- * Shared predicate for the system-card marker on assistant-message metadata
- * (see the `messageKind` field on {@link messageMetadataSchema}). One
- * definition so display merging, transcript rendering, and turn grouping
- * cannot drift.
- */
-export function isSystemCardMetadata(
-  metadata: Record<string, unknown> | null | undefined,
-): boolean {
-  return metadata?.messageKind === SYSTEM_CARD_MESSAGE_KIND;
-}
-
 /**
  * Shared predicate for the provider-error marker on assistant-message
  * metadata (see the `messageKind` field on {@link messageMetadataSchema}).
@@ -2467,7 +2466,7 @@ export function getMessages(conversationId: string): MessageRow[] {
  * offsets until the target is reached (capped at a reasonable maximum to bound
  * scan cost).
  */
-export function selectSlackMetaCandidateMetadata(
+export function selectProviderMetaCandidateMetadata(
   conversationId: string,
   limit: number,
   offset = 0,
@@ -2482,10 +2481,14 @@ export function selectSlackMetaCandidateMetadata(
         lineageFilter(conversationId),
         opts?.includeFlatLegacy
           ? or(
+              like(messages.metadata, '%"providerMeta"%'),
               like(messages.metadata, '%"slackMeta"%'),
               like(messages.metadata, '%"source":"slack"%'),
             )
-          : like(messages.metadata, '%"slackMeta"%'),
+          : or(
+              like(messages.metadata, '%"providerMeta"%'),
+              like(messages.metadata, '%"slackMeta"%'),
+            ),
       ),
     )
     .orderBy(asc(messages.createdAt))

package/src/persistence/conversation-queries.ts

@@ -199,7 +199,8 @@ function surfacedVisibilitySql(alias = "conversations"): string {
  * explicitly surfaced. {@link standardListingVisibilitySql} already admits
  * such rows through its surfaced and custom-group arms, so a caller that
  * must distinguish "visible in the listing" from "user-facing foreground"
- * (unread counting) applies this on top.
+ * (unread counting, the section index, a `foregroundOnly` list read) applies
+ * this on top.
  *
  * The SQL twin of `isBackgroundConversation` in the web client's
  * `utils/conversation-predicates.ts`.
@@ -282,6 +283,16 @@ export interface ConversationListFilter {
    * the rows its attention surfaces need instead of scanning for them.
    */
   needsAttention?: true;
+  /**
+   * Restrict to user-facing foreground conversations: drop the automated
+   * background/scheduled rows the standard listing admits through its
+   * custom-group arm ({@link notBackgroundVisibilitySql}, the same predicate
+   * the unread count and the section index apply on top of visibility).
+   * Only `true` narrows; omit to keep every visible row. A client that
+   * needs the newest conversation a user can open can ask for it in one
+   * row instead of paging past runs it would skip.
+   */
+  foregroundOnly?: true;
 }
 
 export interface ConversationListQuery extends ConversationListFilter {
@@ -364,6 +375,7 @@ function conversationListWhere(filter: ConversationListFilter) {
     originChannel,
     groupId,
     needsAttention,
+    foregroundOnly,
   } = filter;
   return and(
     conversationTypeClause(conversationType),
@@ -371,6 +383,7 @@ function conversationListWhere(filter: ConversationListFilter) {
     originChannel ? originChannelClause(originChannel) : undefined,
     groupId ? groupIdClause(groupId) : undefined,
     ...(needsAttention ? unseenAttentionStateConditions() : []),
+    foregroundOnly ? sql.raw(notBackgroundVisibilitySql()) : undefined,
   );
 }
 

package/src/persistence/conversation-types.ts

@@ -135,6 +135,28 @@ export function isBackgroundEventMetadata(
   return typeof metadata?.backgroundEventSource === "string";
 }
 
+/**
+ * `messageKind` value marking a daemon-authored system card: a notice that
+ * bypasses the agent loop (the /compact, /clean, and summarize-up-to result
+ * cards, and plugin notices about what a turn did to the user's input). Cards
+ * render as standalone system notices, never as the assistant persona
+ * speaking, and never merge into adjacent assistant display turns.
+ *
+ * Lives in this leaf so a caller that only stamps or classifies the marker
+ * does not pull in `conversation-crud`'s DB graph.
+ */
+export const SYSTEM_CARD_MESSAGE_KIND = "system_card";
+
+/**
+ * Shared predicate for the system-card marker on assistant-message metadata,
+ * so display merging, transcript rendering, and turn grouping cannot drift.
+ */
+export function isSystemCardMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+): boolean {
+  return metadata?.messageKind === SYSTEM_CARD_MESSAGE_KIND;
+}
+
 /**
  * True when a role-`"user"` row is internal scaffolding rather than a person's
  * prompt: a daemon-injected run lifecycle notification (subagent

package/src/persistence/delivery-crud.ts

@@ -5,15 +5,15 @@
  * finding messages by source identifiers, and managing raw payload storage.
  */
 
-import { and, desc, eq, isNotNull, ne, or, sql } from "drizzle-orm";
+import { and, desc, eq, isNotNull, like, ne, or, sql } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import type { ChannelId } from "../channels/types.js";
-import { readSlackMetadataFromMessageMetadata } from "../messaging/providers/slack/message-metadata.js";
+import { readProviderMetadata } from "../messaging/read-provider-metadata.js";
 import type { SlackInboundMessageMetadata } from "../runtime/http-types.js";
 import { parseJsonSafe } from "../util/json.js";
 import { isPlainObject } from "../util/object.js";
-import { selectSlackMetaCandidateMetadata } from "./conversation-crud.js";
+import { selectProviderMetaCandidateMetadata } from "./conversation-crud.js";
 import {
   getConversationByKey,
   getOrCreateConversation,
@@ -21,7 +21,12 @@ import {
 } from "./conversation-key-store.js";
 import type { NonScheduledConversationType } from "./conversation-types.js";
 import { getDb } from "./db-connection.js";
-import { channelInboundEvents, conversations } from "./schema.js";
+import {
+  channelInboundEvents,
+  conversationKeys,
+  conversations,
+  messages,
+} from "./schema.js";
 
 export interface InboundResult {
   accepted: boolean;
@@ -33,11 +38,26 @@ export interface InboundResult {
 export interface RecordInboundOptions {
   sourceMessageId?: string;
   sourceThreadId?: string;
+  /**
+   * Record the event against this conversation instead of resolving one from
+   * the address. For events that belong to a message rather than to a chat: a
+   * reaction lives in the conversation of the message it was attached to, and
+   * resolving from its own address would mint a second one.
+   */
+  conversationId?: string;
 }
 
 const SLACK_LEGACY_THREAD_EVIDENCE_BATCH_SIZE = 50;
 const SLACK_LEGACY_THREAD_EVIDENCE_MAX_SCAN = 500;
 
+/**
+ * Rows examined when locating a Slack message the assistant itself posted.
+ * Bounded on purpose: the scan runs on the inbound path while the gateway
+ * waits for its ack, and reactions land on recent messages, so a cap costs
+ * almost no recall and keeps the cost flat as the database grows.
+ */
+const SLACK_OUTBOUND_TS_MAX_SCAN = 400;
+
 /**
  * Channels where an inbound thread id scopes the conversation: a Slack thread
  * or a Telegram private-chat topic each maps to its own conversation. A
@@ -99,7 +119,7 @@ function legacySlackConversationHasThreadEvidence(
       SLACK_LEGACY_THREAD_EVIDENCE_BATCH_SIZE,
       remaining,
     );
-    const metadataRows = selectSlackMetaCandidateMetadata(
+    const metadataRows = selectProviderMetaCandidateMetadata(
       conversationId,
       batchLimit,
       offset,
@@ -110,12 +130,10 @@ function legacySlackConversationHasThreadEvidence(
       return false;
     }
     for (const metadata of metadataRows) {
-      const slackMeta = readSlackMetadataFromMessageMetadata(metadata, {
-        allowFlatLegacy: true,
-      });
+      const meta = readProviderMetadata(metadata, { allowFlatLegacy: true });
       if (
-        slackMeta?.channelId === externalChatId &&
-        slackMeta.threadTs === sourceThreadId
+        meta?.conversationExternalId === externalChatId &&
+        meta.threadId === sourceThreadId
       ) {
         return true;
       }
@@ -248,6 +266,93 @@ export function findInboundConversationId(
  * the conversation and tracks the reply. Both must key on the same three
  * fields for either to mean anything.
  */
+/**
+ * The inbound event already recorded for this address, if any. Read-only twin
+ * of the dedup check inside {@link recordInbound}, for callers that must know
+ * an event is a redelivery before doing work that recording would otherwise
+ * gate (routing a guardian decision, for one).
+ */
+export function findInboundEvent(
+  sourceChannel: string,
+  externalChatId: string,
+  externalMessageId: string,
+): { eventId: string; conversationId: string } | null {
+  const row = getDb()
+    .select({
+      id: channelInboundEvents.id,
+      conversationId: channelInboundEvents.conversationId,
+    })
+    .from(channelInboundEvents)
+    .where(
+      and(
+        eq(channelInboundEvents.sourceChannel, sourceChannel),
+        eq(channelInboundEvents.externalChatId, externalChatId),
+        eq(channelInboundEvents.externalMessageId, externalMessageId),
+      ),
+    )
+    .get();
+  return row ? { eventId: row.id, conversationId: row.conversationId } : null;
+}
+
+/**
+ * The conversation holding the message with this provider id, found by reading
+ * the metadata the assistant's own posts carry.
+ *
+ * Reads through `readProviderMetadata`, so it matches any channel that
+ * describes its rows in the neutral shape as well as Slack's own envelope.
+ *
+ * `findMessageBySourceId` covers every message that arrived as an inbound
+ * event. It cannot see what the assistant posted, because an outbound reply
+ * opens no inbound event, so a reaction on the assistant's own message needs
+ * this. The search is confined to conversations already bound to the same
+ * Slack channel and to the most recent {@link SLACK_OUTBOUND_TS_MAX_SCAN}
+ * rows among them; beyond that it gives up and the caller drops the
+ * annotation, which is the same outcome as never finding it at all.
+ */
+export function findSlackConversationByMessageTs(
+  externalChatId: string,
+  channelTs: string,
+): string | null {
+  const db = getDb();
+  const keyPrefix = `${CONVERSATION_KEY_SCOPE}:slack:${externalChatId}`;
+  const rows = db
+    .select({
+      conversationId: messages.conversationId,
+      metadata: messages.metadata,
+    })
+    .from(messages)
+    .innerJoin(
+      conversationKeys,
+      eq(conversationKeys.conversationId, messages.conversationId),
+    )
+    .where(
+      and(
+        or(
+          eq(conversationKeys.conversationKey, keyPrefix),
+          like(conversationKeys.conversationKey, `${keyPrefix}:thread:%`),
+        ),
+        or(
+          like(messages.metadata, '%"providerMeta"%'),
+          like(messages.metadata, '%"slackMeta"%'),
+        ),
+      ),
+    )
+    .orderBy(desc(messages.createdAt))
+    .limit(SLACK_OUTBOUND_TS_MAX_SCAN)
+    .all();
+
+  for (const row of rows) {
+    const meta = readProviderMetadata(row.metadata, { allowFlatLegacy: true });
+    if (
+      meta?.conversationExternalId === externalChatId &&
+      meta.messageId === channelTs
+    ) {
+      return row.conversationId;
+    }
+  }
+  return null;
+}
+
 export function recordInbound(
   sourceChannel: string,
   externalChatId: string,
@@ -280,11 +385,13 @@ export function recordInbound(
     };
   }
 
-  const mapping = resolveInboundConversation(
-    sourceChannel,
-    externalChatId,
-    options?.sourceThreadId,
-  );
+  const mapping = options?.conversationId
+    ? { conversationId: options.conversationId }
+    : resolveInboundConversation(
+        sourceChannel,
+        externalChatId,
+        options?.sourceThreadId,
+      );
   const now = Date.now();
   const eventId = uuid();
 

package/src/plugin-api/__tests__/import-graph-partial-mock.test.ts

@@ -0,0 +1,67 @@
+/**
+ * Guards that importing `@vellumai/plugin-api` does not force a DB-graph
+ * module's named exports to resolve.
+ *
+ * Plugin suites routinely partial-mock modules in the persistence/embeddings
+ * graph (a handful of functions, not the whole surface). `mock.module` replaces
+ * the module for every importer, so a static edge from plugin-api into that
+ * graph makes some unrelated host module import a name the partial mock does not
+ * define, and the entire suite fails to instantiate with
+ * `SyntaxError: Export named '...' not found in module`. Facades over DB-graph
+ * writers therefore load them through a dynamic `import()` inside the wrapper.
+ *
+ * The probe runs in a subprocess: `mock.module` is process-wide and permanent,
+ * so mocking the embedding backend in this process would leak into every other
+ * suite sharing the test process.
+ */
+
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+const PLUGIN_API_DIR = join(import.meta.dir, "..");
+
+let probeDir: string | null = null;
+
+afterEach(() => {
+  if (probeDir !== null) {
+    rmSync(probeDir, { recursive: true, force: true });
+    probeDir = null;
+  }
+});
+
+describe("plugin-api import graph", () => {
+  test("instantiates against a partial-mocked DB-graph module", () => {
+    // GIVEN a probe suite that partial-mocks a DB-graph module the way plugin
+    // suites do (one function, not the module's full export surface) and then
+    // imports the public plugin API surface.
+    probeDir = mkdtempSync(join(tmpdir(), "plugin-api-import-graph-"));
+    const probe = join(probeDir, "probe.test.ts");
+    writeFileSync(
+      probe,
+      `import { expect, mock, test } from "bun:test";\n` +
+        `mock.module(${JSON.stringify(join(PLUGIN_API_DIR, "..", "persistence", "embeddings", "embedding-backend.ts"))}, () => ({\n` +
+        `  embedWithBackend: async () => [],\n` +
+        `}));\n` +
+        `test("plugin-api instantiates", async () => {\n` +
+        `  const api = await import(${JSON.stringify(join(PLUGIN_API_DIR, "index.ts"))});\n` +
+        `  expect(typeof api.persistSystemCard).toEqual("function");\n` +
+        `  expect(typeof api.addMessage).toEqual("function");\n` +
+        `});\n`,
+    );
+
+    // WHEN the probe suite runs in its own process.
+    const result = spawnSync(process.execPath, ["test", probe], {
+      cwd: join(PLUGIN_API_DIR, "..", ".."),
+      encoding: "utf8",
+      timeout: 60_000,
+    });
+
+    // THEN plugin-api instantiated, so nothing in its static import graph
+    // reached a name the partial mock left undefined.
+    expect(`${result.stdout}${result.stderr}`).not.toContain("SyntaxError");
+    expect(result.status).toBe(0);
+  });
+});

package/src/plugin-api/conversation-turn.ts

@@ -280,6 +280,9 @@ export async function runConversationTurn(
     await import("../persistence/conversation-crud.js");
   const { publishConversationListAndMetadataChanged } =
     await import("../runtime/sync/resource-sync-events.js");
+  const { parseInterfaceId } = await import("../channels/types.js");
+  const { resolveChannelCapabilities } =
+    await import("../daemon/conversation-runtime-assembly.js");
 
   // Plugin-driven turns run as the guardian: plugins are installed by the
   // guardian, so their conversations inherit guardian trust. This lets the
@@ -351,6 +354,28 @@ export async function runConversationTurn(
         assistantMessageChannel: options.channel.sourceChannel,
       }
     : null;
+  // The interface the message arrived on. `plugin` is in both the channel
+  // and interface unions, matching gateway inbound. Tool gating reads this
+  // as `transportInterface`; unset, the loop falls back to `web`.
+  const turnInterfaceContext = options.channel
+    ? (() => {
+        const iface = parseInterfaceId(options.channel.sourceChannel);
+        return iface
+          ? {
+              userMessageInterface: iface,
+              assistantMessageInterface: iface,
+            }
+          : null;
+      })()
+    : null;
+  if (options.channel) {
+    conversation.setChannelCapabilities(
+      resolveChannelCapabilities(
+        options.channel.sourceChannel,
+        turnInterfaceContext?.userMessageInterface,
+      ),
+    );
+  }
   // Carried on the metadata as well, because a queued turn is drained after
   // this call returns and reads its channel from there. Without it the drain
   // inherits whichever turn was in flight, which on a shared conversation is
@@ -358,6 +383,7 @@ export async function runConversationTurn(
   const metadata = {
     ...PLUGIN_TURN_MESSAGE_METADATA,
     ...(turnChannelContext ?? {}),
+    ...(turnInterfaceContext ?? {}),
   };
 
   // Build the event emitter: fan out to SSE/event-hub subscribers via
@@ -398,6 +424,7 @@ export async function runConversationTurn(
   }
 
   conversation.setTurnChannelContext(turnChannelContext);
+  conversation.setTurnInterfaceContext(turnInterfaceContext);
 
   const userMessageId = await conversation.processMessage({
     content: text,

package/src/plugin-api/credential-scope.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test";
+
+import { credentialInPluginScope } from "./credential-scope.js";
+
+describe("credentialInPluginScope", () => {
+  test("allows every field under the plugin's own service", () => {
+    expect(credentialInPluginScope("imessage", "imessage")).toBe(true);
+    expect(credentialInPluginScope("acme", "acme")).toBe(true);
+  });
+
+  test("blocks another service, even when the field matches the plugin name", () => {
+    expect(credentialInPluginScope("acme", "openai")).toBe(false);
+    expect(credentialInPluginScope("imessage", "openai")).toBe(false);
+  });
+});

package/src/plugin-api/credential-scope.ts

@@ -0,0 +1,14 @@
+/**
+ * Whether a plugin may read or write a credential named `service/field`.
+ *
+ * The plugin's manifest name is the service it owns. Plugin `imessage` may
+ * resolve `imessage/api_key` and `imessage/photon_project_id`, and nothing
+ * under another service (`openai/api_key`, `openai/imessage`). The check is
+ * name equality only; it does not look the credential up.
+ */
+export function credentialInPluginScope(
+  pluginName: string,
+  service: string,
+): boolean {
+  return service === pluginName;
+}

package/src/plugin-api/index.ts

@@ -170,13 +170,25 @@ export { doesSupportVision } from "./vision-support.js";
 // Resolve a stored credential to its plaintext value — the same value
 // `assistant credentials reveal` prints — from a UUID or a "service/field"
 // reference. When a plugin is in context, resolution is scoped to credentials
-// whose `field` matches the plugin's manifest name; outside any plugin it is
+// whose service matches the plugin's manifest name; outside any plugin it is
 // unscoped. Throws CredentialResolutionError when the ref does not resolve, the
 // store is unreachable, or the credential is out of the plugin's scope.
 export {
   CredentialResolutionError,
   resolveCredential,
 } from "./resolve-credential.js";
+// Store a credential's plaintext value (the same write `assistant credentials
+// set` performs), creating it or replacing an existing one, named by UUID or a
+// "service/field" reference. A plugin may only write credentials whose service
+// matches its manifest name, and the write fails closed with no plugin in
+// context. Throws CredentialStoreError when there is no calling plugin, the ref
+// is malformed, the value is invalid, the store rejects the write, or the
+// credential is out of the plugin's scope.
+export type {
+  StoreCredentialOptions,
+  StoredCredentialRef,
+} from "./store-credential.js";
+export { CredentialStoreError, storeCredential } from "./store-credential.js";
 // Resolve the public URL a third party should deliver to for one of the
 // plugin's own ingress routes. Which URL is correct depends on how the
 // assistant is reachable (a managed platform callback route, or a configured
@@ -348,6 +360,12 @@ export {
   syncMessageToDisk,
   updateMessageMetadata,
 } from "../persistence/conversation-plugin-facade.js";
+// System cards: a transcript notice authored by the daemon rather than the
+// assistant persona, for telling the user something a turn did to their input
+// that the model's reply cannot explain (e.g. an attachment that could not be
+// sent). Persisted and pushed to clients; not seated in the turn's working
+// history.
+export { persistSystemCard } from "./system-card.js";
 // Synthesize text to speech through the assistant's globally configured TTS
 // provider (ElevenLabs, Fish Audio, etc.). Plugins that need voice output —
 // e.g. a meeting bot speaking into a live call — use this instead of managing