@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/rpc.ts

@@ -16,6 +16,13 @@
  * - `delete_credential` — Delete a credential by account name
  * - `list_credentials` — List all credential account names
  * - `bulk_set_credentials` — Store multiple credentials at once
+ *
+ * **Credential records** (non-secret identity + policy)
+ * - `get_credential_record` — Retrieve a credential record by account name
+ * - `set_credential_record` — Store or update a credential record
+ * - `delete_credential_record` — Delete a credential record by account name
+ * - `list_credential_records` — List all credential records
+ * - `bulk_set_credential_records` — Store multiple credential records at once
  */
 
 import { z } from "zod";
@@ -38,6 +45,16 @@ export const CesRpcMethod = {
   ListCredentials: "list_credentials",
   /** Bulk-import credentials (set multiple at once). */
   BulkSetCredentials: "bulk_set_credentials",
+  /** Retrieve a single credential record (identity + policy) by account name. */
+  GetCredentialRecord: "get_credential_record",
+  /** Store or update a credential record by account name. */
+  SetCredentialRecord: "set_credential_record",
+  /** Delete a credential record by account name. */
+  DeleteCredentialRecord: "delete_credential_record",
+  /** List all credential records. */
+  ListCredentialRecords: "list_credential_records",
+  /** Bulk-import credential records. */
+  BulkSetCredentialRecords: "bulk_set_credential_records",
 } as const;
 
 export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
@@ -168,6 +185,123 @@ export type BulkSetCredentialsResponse = z.infer<
   typeof BulkSetCredentialsResponseSchema
 >;
 
+// ---------------------------------------------------------------------------
+// Credential records (identity + policy, never secret values)
+// ---------------------------------------------------------------------------
+
+export const CredentialInjectionTemplateSchema = z.object({
+  hostPattern: z.string(),
+  injectionType: z.enum(["header", "query"]),
+  headerName: z.string().optional(),
+  valuePrefix: z.string().optional(),
+  queryParamName: z.string().optional(),
+  composeWith: z
+    .object({
+      service: z.string(),
+      field: z.string(),
+      separator: z.string(),
+    })
+    .optional(),
+  valueTransform: z.enum(["base64"]).optional(),
+});
+export type CredentialInjectionTemplate = z.infer<
+  typeof CredentialInjectionTemplateSchema
+>;
+
+export const CredentialRecordSchema = z.object({
+  credentialId: z.string(),
+  service: z.string(),
+  field: z.string(),
+  allowedTools: z.array(z.string()),
+  allowedDomains: z.array(z.string()),
+  usageDescription: z.string().optional(),
+  alias: z.string().optional(),
+  injectionTemplates: z.array(CredentialInjectionTemplateSchema).optional(),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type CredentialRecord = z.infer<typeof CredentialRecordSchema>;
+
+export const GetCredentialRecordSchema = z.object({
+  /** The account name to look up (`credential/{service}/{field}`). */
+  account: z.string(),
+});
+export type GetCredentialRecord = z.infer<typeof GetCredentialRecordSchema>;
+
+export const GetCredentialRecordResponseSchema = z.object({
+  found: z.boolean(),
+  record: CredentialRecordSchema.optional(),
+});
+export type GetCredentialRecordResponse = z.infer<
+  typeof GetCredentialRecordResponseSchema
+>;
+
+export const SetCredentialRecordSchema = z.object({
+  account: z.string(),
+  record: CredentialRecordSchema,
+});
+export type SetCredentialRecord = z.infer<typeof SetCredentialRecordSchema>;
+
+export const SetCredentialRecordResponseSchema = z.object({
+  ok: z.boolean(),
+});
+export type SetCredentialRecordResponse = z.infer<
+  typeof SetCredentialRecordResponseSchema
+>;
+
+export const DeleteCredentialRecordSchema = z.object({
+  account: z.string(),
+});
+export type DeleteCredentialRecord = z.infer<
+  typeof DeleteCredentialRecordSchema
+>;
+
+export const DeleteCredentialRecordResponseSchema = z.object({
+  result: z.enum(["deleted", "not-found", "error"]),
+});
+export type DeleteCredentialRecordResponse = z.infer<
+  typeof DeleteCredentialRecordResponseSchema
+>;
+
+export const ListCredentialRecordsSchema = z.object({});
+export type ListCredentialRecords = z.infer<typeof ListCredentialRecordsSchema>;
+
+export const ListCredentialRecordsResponseSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type ListCredentialRecordsResponse = z.infer<
+  typeof ListCredentialRecordsResponseSchema
+>;
+
+export const BulkSetCredentialRecordsSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type BulkSetCredentialRecords = z.infer<
+  typeof BulkSetCredentialRecordsSchema
+>;
+
+export const BulkSetCredentialRecordsResponseSchema = z.object({
+  results: z.array(
+    z.object({
+      account: z.string(),
+      ok: z.boolean(),
+    }),
+  ),
+});
+export type BulkSetCredentialRecordsResponse = z.infer<
+  typeof BulkSetCredentialRecordsResponseSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Full RPC contract type map
 // ---------------------------------------------------------------------------
@@ -201,6 +335,26 @@ export interface CesRpcContract {
     request: BulkSetCredentials;
     response: BulkSetCredentialsResponse;
   };
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecord;
+    response: GetCredentialRecordResponse;
+  };
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecord;
+    response: SetCredentialRecordResponse;
+  };
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecord;
+    response: DeleteCredentialRecordResponse;
+  };
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecords;
+    response: ListCredentialRecordsResponse;
+  };
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecords;
+    response: BulkSetCredentialRecordsResponse;
+  };
 }
 
 /**
@@ -231,4 +385,24 @@ export const CesRpcSchemas = {
     request: BulkSetCredentialsSchema,
     response: BulkSetCredentialsResponseSchema,
   },
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecordSchema,
+    response: GetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecordSchema,
+    response: SetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecordSchema,
+    response: DeleteCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecordsSchema,
+    response: ListCredentialRecordsResponseSchema,
+  },
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecordsSchema,
+    response: BulkSetCredentialRecordsResponseSchema,
+  },
 } as const;

package/node_modules/@vellumai/gateway-client/src/__tests__/contact-read-contracts.test.ts

@@ -20,6 +20,7 @@ describe("contact read contracts", () => {
       contactType: "human",
       lastInteraction: 1700000000,
       interactionCount: 12,
+      autoApproveThreshold: "medium",
       createdAt: 1699000000,
       updatedAt: 1700000000,
       channels: [
@@ -46,6 +47,7 @@ describe("contact read contracts", () => {
     const parsed = ContactReadSchema.parse(contact);
     expect(parsed.createdAt).toBe(1699000000);
     expect(parsed.updatedAt).toBe(1700000000);
+    expect(parsed.autoApproveThreshold).toBe("medium");
   });
 
   test("ContactReadSchema accepts null interactionCount (daemon-native gateway-telemetry outage fail-soft)", () => {
@@ -82,6 +84,36 @@ describe("contact read contracts", () => {
     const parsed = ContactReadSchema.parse(contact);
     expect(parsed.interactionCount).toBeNull();
     expect(parsed.channels[0].interactionCount).toBeNull();
+    expect(parsed.autoApproveThreshold).toBeUndefined();
+  });
+
+  test("ContactReadSchema accepts a null auto-approve threshold", () => {
+    const contact = {
+      id: "c1",
+      displayName: "Example User",
+      role: "contact",
+      interactionCount: 0,
+      autoApproveThreshold: null,
+      createdAt: 1699000000,
+      updatedAt: 1700000000,
+      channels: [],
+    };
+    expect(ContactReadSchema.parse(contact).autoApproveThreshold).toBeNull();
+  });
+
+  test("ContactReadSchema rejects an unknown auto-approve threshold", () => {
+    expect(() =>
+      ContactReadSchema.parse({
+        id: "c1",
+        displayName: "Example User",
+        role: "contact",
+        interactionCount: 0,
+        autoApproveThreshold: "full",
+        createdAt: 1699000000,
+        updatedAt: 1700000000,
+        channels: [],
+      }),
+    ).toThrow();
   });
 
   test("ContactReadSchema requires createdAt/updatedAt", () => {

package/node_modules/@vellumai/gateway-client/src/__tests__/gateway-client.test.ts

@@ -30,6 +30,7 @@ describe("package independence", () => {
     "../http-delivery.ts",
     "../ipc-client.ts",
     "../gateway-ipc-contracts.ts",
+    "../plugin-admission-denied-contract.ts",
   ];
 
   for (const file of sourceFiles) {

package/node_modules/@vellumai/gateway-client/src/__tests__/inbound-event-kind.test.ts

@@ -0,0 +1,82 @@
+/**
+ * The kind derivation is the single reader of the field encodings, so its
+ * matrix is the compatibility contract: every shape an unstamped replayed
+ * retry payload can carry must classify exactly as the consumers that read
+ * those fields directly would classify it.
+ */
+import { describe, expect, test } from "bun:test";
+
+import {
+  inboundEventRefersToAnotherMessage,
+  resolveInboundEventKind,
+} from "../inbound-event-kind.js";
+
+describe("resolveInboundEventKind", () => {
+  test("a stamped kind wins over every legacy field", () => {
+    expect(
+      resolveInboundEventKind({
+        eventKind: "edit",
+        callbackData: "message_deleted",
+      }),
+    ).toBe("edit");
+  });
+
+  test("an unrecognized stamp falls back to legacy derivation", () => {
+    expect(
+      resolveInboundEventKind({ eventKind: "future-kind", isEdit: true }),
+    ).toBe("edit");
+  });
+
+  test("legacy isEdit classifies as edit", () => {
+    expect(resolveInboundEventKind({ isEdit: true })).toBe("edit");
+  });
+
+  test("the delete sentinel classifies as delete", () => {
+    expect(resolveInboundEventKind({ callbackData: "message_deleted" })).toBe(
+      "delete",
+    );
+  });
+
+  test("reaction prefixes classify as reaction, both directions", () => {
+    expect(resolveInboundEventKind({ callbackData: "reaction:+1" })).toBe(
+      "reaction",
+    );
+    expect(
+      resolveInboundEventKind({ callbackData: "reaction_removed:+1" }),
+    ).toBe("reaction");
+  });
+
+  test("any other callbackData classifies as button", () => {
+    expect(
+      resolveInboundEventKind({ callbackData: "apr:req-1:approve_once" }),
+    ).toBe("button");
+    expect(resolveInboundEventKind({ callbackData: "some-action-id" })).toBe(
+      "button",
+    );
+  });
+
+  test("an empty callbackData is not a family", () => {
+    // Mirrors the old hasCallbackData predicate, which required length > 0.
+    expect(resolveInboundEventKind({ callbackData: "" })).toBe("message");
+  });
+
+  test("callbackQueryId alone classifies as button", () => {
+    expect(resolveInboundEventKind({ callbackQueryId: "cbq-1" })).toBe(
+      "button",
+    );
+  });
+
+  test("nothing stated is a plain message", () => {
+    expect(resolveInboundEventKind({})).toBe("message");
+  });
+});
+
+describe("inboundEventRefersToAnotherMessage", () => {
+  test("only a plain message stands alone", () => {
+    expect(inboundEventRefersToAnotherMessage("message")).toBe(false);
+    expect(inboundEventRefersToAnotherMessage("edit")).toBe(true);
+    expect(inboundEventRefersToAnotherMessage("delete")).toBe(true);
+    expect(inboundEventRefersToAnotherMessage("reaction")).toBe(true);
+    expect(inboundEventRefersToAnotherMessage("button")).toBe(true);
+  });
+});

package/node_modules/@vellumai/gateway-client/src/__tests__/plugin-admission-denied-contract.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  ACCESS_DENIED_NOT_APPROVED_REPLY,
+  PLUGIN_ADMISSION_DENIED_NOTICE_PATH,
+  PluginAdmissionDeniedNoticeSchema,
+} from "../plugin-admission-denied-contract.js";
+
+describe("plugin admission-denied contract", () => {
+  test("keeps the not-approved copy stable", () => {
+    expect(ACCESS_DENIED_NOT_APPROVED_REPLY).toBe(
+      "Sorry, you haven't been approved to message this assistant.",
+    );
+  });
+
+  test("names the internal plugin notice path", () => {
+    expect(PLUGIN_ADMISSION_DENIED_NOTICE_PATH).toBe(
+      "notices/admission-denied",
+    );
+  });
+
+  test("round-trips a floor-deny notice", () => {
+    const notice = {
+      reason: "admission_floor" as const,
+      plugin: "imessage",
+      ingressRoute: "events-linq",
+      admissionPolicy: "guardian_only" as const,
+      trustClass: "unknown" as const,
+      conversationExternalId: "chat-1",
+      actorExternalId: "+15550100",
+      externalMessageId: "msg-1",
+      replyText: ACCESS_DENIED_NOT_APPROVED_REPLY,
+    };
+
+    expect(PluginAdmissionDeniedNoticeSchema.parse(notice)).toEqual(notice);
+  });
+
+  test("rejects a notice that still carries a plugin-scoped id as the chat", () => {
+    // The send API addresses vendor chats. An empty chat id is the failure
+    // that matters; the schema only requires a non-empty string, so this
+    // asserts the required fields rather than the prefix rule.
+    expect(() =>
+      PluginAdmissionDeniedNoticeSchema.parse({
+        reason: "admission_floor",
+        plugin: "imessage",
+        ingressRoute: "events-linq",
+        admissionPolicy: "guardian_only",
+        trustClass: "unknown",
+        conversationExternalId: "",
+        actorExternalId: "+15550100",
+        externalMessageId: "msg-1",
+        replyText: ACCESS_DENIED_NOT_APPROVED_REPLY,
+      }),
+    ).toThrow();
+  });
+});

package/node_modules/@vellumai/gateway-client/src/__tests__/trust-verdict-contract.test.ts

@@ -31,6 +31,7 @@ const fullVerdict: TrustVerdict = {
   verifiedAt: 1699999999,
   interactionCount: 12,
   memberDisplayName: "Member Name",
+  autoApproveThreshold: "high",
 };
 
 describe("TrustVerdictSchema", () => {
@@ -38,6 +39,23 @@ describe("TrustVerdictSchema", () => {
     expect(TrustVerdictSchema.parse(fullVerdict)).toEqual(fullVerdict);
   });
 
+  test("parses a verdict with a null contact auto-approve threshold", () => {
+    const verdict = {
+      ...fullVerdict,
+      autoApproveThreshold: null,
+    } satisfies TrustVerdict;
+    expect(TrustVerdictSchema.parse(verdict)).toEqual(verdict);
+  });
+
+  test("rejects an unknown contact auto-approve threshold", () => {
+    expect(() =>
+      TrustVerdictSchema.parse({
+        ...fullVerdict,
+        autoApproveThreshold: "full",
+      }),
+    ).toThrow();
+  });
+
   test("parses a minimal verdict", () => {
     const minimal = {
       trustClass: "unknown",

package/node_modules/@vellumai/gateway-client/src/admission-policy-contract.ts

@@ -3,9 +3,8 @@
  *
  * Both the gateway (channel admission policy storage + kill switch) and the
  * runtime (admission-policy stage) consume these values. Keeping the type
- * here avoids the runtime importing from `gateway/src` and avoids the
- * vocabulary drift the plan §2.1 flags for the verification-purpose
- * `trustClass` enum.
+ * here avoids the runtime importing from `gateway/src` and keeps both
+ * sides on a single shared vocabulary.
  */
 
 import { z } from "zod";
@@ -15,7 +14,7 @@ import type { TrustClass } from "./trust-verdict-contract.js";
 /**
  * Per-channel inbound admission policy — ordered from most-restrictive
  * (`no_one`, hard kill switch) to most-permissive (`strangers`, admits any
- * sender). See `unverified-contact-role-plan.md` §2.3.
+ * sender).
  */
 export const ADMISSION_POLICY_VALUES = [
   "no_one",
@@ -32,14 +31,14 @@ export const AdmissionPolicySchema = z.enum(ADMISSION_POLICY_VALUES);
 /**
  * Read-side default applied when a channel has no row in the DB. Matches
  * today's effective semantics: guardian + active contacts admitted,
- * strangers denied. See plan §2.2.
+ * strangers denied.
  */
 export const ADMISSION_POLICY_DEFAULT: AdmissionPolicy = "trusted_contacts";
 
 /**
  * Minimum trust rank required for each policy. Higher rank = more trusted.
  * `no_one` is 5 — above the maximum guardian rank (4) — so no class is ever
- * admitted. See plan §2.4 for the rank table.
+ * admitted.
  */
 export const ADMISSION_FLOOR: Record<AdmissionPolicy, number> = {
   no_one: 5,
@@ -82,15 +81,10 @@ export function isAdmissionPolicyExemptChannel(channelType: string): boolean {
  * `vellum` is the local desktop/web client surface; the guardian is always
  * max-rank there, so the seed default admits them regardless of the floor.
  *
- * `discord` has no ingress implementation, so there is nothing for a floor to
- * gate and nothing for the user to configure. Hiding keeps it pinned at the
- * seed default rather than offering a Channel Trust Floors row for a channel
- * that receives nothing.
  */
 export const ADMISSION_POLICY_HIDDEN_CHANNELS: ReadonlySet<string> = new Set([
   "vellum",
   "whatsapp",
-  "discord",
 ]);
 
 export function isAdmissionPolicyHiddenChannel(channelType: string): boolean {

package/node_modules/@vellumai/gateway-client/src/channel-permission-contract.ts

@@ -10,7 +10,9 @@
  *
  * Storage lives in the gateway DB (`channel_permission_overrides`) so the
  * assistant cannot tamper with it, matching `channel_admission_policy` and
- * `auto_approve_thresholds`.
+ * `auto_approve_thresholds`. A contact-level ceiling can live on
+ * `contacts.auto_approve_threshold` and is stamped on the trust verdict;
+ * that override is not a matrix cell.
  */
 
 import { z } from "zod";

package/node_modules/@vellumai/gateway-client/src/gateway-ipc-contracts.ts

@@ -5,6 +5,8 @@
 import { CHANNEL_IDS } from "@vellumai/service-contracts/channels";
 import { z } from "zod";
 
+import { RiskThresholdSchema } from "./channel-permission-contract.js";
+
 export const GATEWAY_LOG_LEVEL_NAMES = [
   "trace",
   "debug",
@@ -275,6 +277,11 @@ export const ContactReadSchema = z.object({
   contactType: z.string().nullable().optional(),
   lastInteraction: z.number().nullable().optional(),
   interactionCount: z.number().nullable(),
+  /**
+   * Per-contact auto-approve ceiling. Null when unset (inherit cascade).
+   * Optional on the wire for version skew; gateway reads always emit it.
+   */
+  autoApproveThreshold: RiskThresholdSchema.nullable().optional(),
   createdAt: z.number(),
   updatedAt: z.number(),
   channels: z.array(ContactReadChannelSchema),
@@ -401,6 +408,8 @@ export type ClassifyRiskSkillMetadata = z.infer<
 export const ClassifyRiskIpcParamsSchema = z.object({
   tool: z.string().min(1),
   command: z.string().optional(),
+  /** Shell grammar used by host_bash on the target desktop. */
+  shell: z.enum(["bash", "powershell"]).optional(),
   url: z.string().optional(),
   path: z.string().optional(),
   /**

package/node_modules/@vellumai/gateway-client/src/inbound-contract.ts

@@ -10,6 +10,7 @@
  * it in `handleChannelInbound()`.
  */
 
+import { INBOUND_EVENT_KINDS } from "./inbound-event-kind.js";
 import { z } from "zod";
 
 import { ChannelConversationTypeSchema } from "./channel-permission-contract.js";
@@ -168,6 +169,9 @@ export const RuntimeInboundPayloadSchema = z.object({
   conversationExternalId: z.string(),
   externalMessageId: z.string(),
   content: z.string(),
+  /** The named event family; absent only on replayed retry payloads,
+   *  where resolveInboundEventKind derives it from the legacy fields. */
+  eventKind: z.enum(INBOUND_EVENT_KINDS).optional(),
   isEdit: z.boolean().optional(),
   callbackQueryId: z.string().optional(),
   callbackData: z.string().optional(),

package/node_modules/@vellumai/gateway-client/src/inbound-event-kind.ts

@@ -0,0 +1,75 @@
+/**
+ * The inbound event families, named.
+ *
+ * Every inbound event is one of these, and the kind decides which pipeline
+ * stages apply: only user-authored text (message, edit) can carry a
+ * verification code or an invite, only a message starts an agent turn, and
+ * edit/delete/reaction/button all refer to another message rather than
+ * standing alone. A payload can also encode its family in the field that
+ * carries it: `isEdit`, the sentinel string `"message_deleted"`, the
+ * `"reaction:"` prefix, the presence of `callbackData` at all. Replayed
+ * retry payloads arrive with only those encodings, so
+ * {@link resolveInboundEventKind} derives the kind from them exactly once;
+ * nothing else may sniff them.
+ */
+
+export const INBOUND_EVENT_KINDS = [
+  "message",
+  "edit",
+  "delete",
+  "reaction",
+  "button",
+] as const;
+
+export type InboundEventKind = (typeof INBOUND_EVENT_KINDS)[number];
+
+export function isInboundEventKind(value: string): value is InboundEventKind {
+  return (INBOUND_EVENT_KINDS as readonly string[]).includes(value);
+}
+
+/**
+ * The one place the field encodings are read. A payload stamped with a
+ * kind wins outright; an unstamped one (a replayed retry payload) is
+ * classified by the fields that carry its family. The fallback order is
+ * specific-before-generic: reaction prefixes and the delete sentinel are
+ * particular `callbackData` values, so they are tested before the generic
+ * button reading.
+ */
+export function resolveInboundEventKind(fields: {
+  eventKind?: string;
+  isEdit?: boolean;
+  callbackData?: string;
+  callbackQueryId?: string;
+}): InboundEventKind {
+  if (fields.eventKind !== undefined && isInboundEventKind(fields.eventKind)) {
+    return fields.eventKind;
+  }
+  if (fields.isEdit === true) {
+    return "edit";
+  }
+  const cb = fields.callbackData;
+  if (cb !== undefined && cb.length > 0) {
+    if (cb === "message_deleted") {
+      return "delete";
+    }
+    if (cb.startsWith("reaction:") || cb.startsWith("reaction_removed:")) {
+      return "reaction";
+    }
+    return "button";
+  }
+  if (fields.callbackQueryId !== undefined) {
+    return "button";
+  }
+  return "message";
+}
+
+/**
+ * Whether an event of this kind refers to another message rather than
+ * standing alone as new content. Referring events never mint a
+ * conversation of their own and never carry ingestable attachments.
+ */
+export function inboundEventRefersToAnotherMessage(
+  kind: InboundEventKind,
+): boolean {
+  return kind !== "message";
+}

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -83,6 +83,23 @@ export {
 
 export type { AdmissionPolicy } from "./admission-policy-contract.js";
 
+export {
+  INBOUND_EVENT_KINDS,
+  inboundEventRefersToAnotherMessage,
+  isInboundEventKind,
+  resolveInboundEventKind,
+} from "./inbound-event-kind.js";
+export type { InboundEventKind } from "./inbound-event-kind.js";
+
+// Plugin admission-denied notice (gateway → plugin) — canned deny copy + envelope
+export {
+  ACCESS_DENIED_NOT_APPROVED_REPLY,
+  PLUGIN_ADMISSION_DENIED_NOTICE_PATH,
+  PluginAdmissionDeniedNoticeSchema,
+} from "./plugin-admission-denied-contract.js";
+
+export type { PluginAdmissionDeniedNotice } from "./plugin-admission-denied-contract.js";
+
 // Trust verdict contract (gateway → daemon) — Zod schemas + derived types
 export {
   isTrustClass,

package/node_modules/@vellumai/gateway-client/src/outbound-contract.ts

@@ -61,6 +61,14 @@ export const ApprovalUIMetadataSchema = z.object({
   actions: z.array(ApprovalActionOptionSchema),
   plainTextFallback: z.string(),
   permissionDetails: PermissionRequestDetailsSchema.optional(),
+  /**
+   * What the recipient is being asked to do, so a renderer can head the card
+   * with the right verb. Resolved once by the producer; a renderer that reads
+   * the actions to work it out would be parsing a payload it is meant only to
+   * draw. Absent means an approval, which is what every existing producer
+   * sends and what a renderer without this field already assumes.
+   */
+  intent: z.enum(["approval", "question"]).optional(),
 });
 
 export type ApprovalUIMetadata = z.infer<typeof ApprovalUIMetadataSchema>;