@vellumai/assistant 0.11.8 → 0.11.9-staging.2

package/src/persistence/migrations/374-channel-inbound-message-id-index.ts

@@ -0,0 +1,26 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+const INDEX = "idx_channel_inbound_events_message_id";
+
+/**
+ * Index the inbound-event to message link.
+ *
+ * Three queries filter on `message_id`: the sibling lookups on the
+ * redelivery path (`getSiblingStreamedReplyTs`,
+ * `isDeduplicatedDeliveryOwnedBySibling`) and the NOT EXISTS prefilter in
+ * `findMessageByProviderMessageId` that skips rows the inbound-event
+ * index already resolves. Without this index each is a full table scan.
+ *
+ * Partial, on linked rows only: unlinked events (crash-window orphans,
+ * reactions before linking) contribute nothing to it.
+ *
+ * Idempotent via IF NOT EXISTS.
+ */
+export function migrateChannelInboundMessageIdIndex(database: DrizzleDb): void {
+  getSqliteFrom(database).exec(
+    `CREATE INDEX IF NOT EXISTS ${INDEX}
+       ON channel_inbound_events (message_id)
+       WHERE message_id IS NOT NULL`,
+  );
+}

package/src/persistence/migrations/375-create-channel-outbound-posts.ts

@@ -0,0 +1,52 @@
+import type { DrizzleDb } from "../db-connection.js";
+import { getSqliteFrom } from "../db-connection.js";
+
+const TABLE = "channel_outbound_posts";
+
+/**
+ * Create `channel_outbound_posts`: the provider-id index for messages the
+ * assistant itself posted, the outbound counterpart of
+ * `channel_inbound_events`' provider-id resolution.
+ *
+ * Its own table rather than more envelope fields on `messages`, because one
+ * stored reply fans out to many provider posts (a reply split at tool
+ * boundaries or length limits) and resolution by id must be exact: reactions
+ * and deletions name a provider post, and a JSON-array scan over recent rows
+ * is a recency heuristic, not a resolution contract. The row's
+ * `providerMeta` envelope stays the self-description every reader consumes;
+ * this table is the derived index over its id facts, written by the same
+ * post-send reconciliation that writes them.
+ *
+ * Composite primary key: a provider post id is unique within its channel's
+ * chat, and the triple is exactly how an inbound reaction or delete
+ * addresses it. Secondary indexes on the two FK columns because SQLite does
+ * not index FK columns automatically and both parents cascade deletes.
+ *
+ * No backfill: rows delivered before this table resolve through the
+ * transitional envelope-scan fallback in `findMessageByProviderMessageId`
+ * until they age out of relevance.
+ *
+ * Idempotent via IF NOT EXISTS.
+ */
+export function migrateCreateChannelOutboundPosts(database: DrizzleDb): void {
+  const sqlite = getSqliteFrom(database);
+  sqlite.exec(
+    `CREATE TABLE IF NOT EXISTS ${TABLE} (
+       source_channel TEXT NOT NULL,
+       external_chat_id TEXT NOT NULL,
+       provider_message_id TEXT NOT NULL,
+       message_id TEXT NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+       conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+       created_at INTEGER NOT NULL,
+       PRIMARY KEY (source_channel, external_chat_id, provider_message_id)
+     )`,
+  );
+  sqlite.exec(
+    `CREATE INDEX IF NOT EXISTS idx_channel_outbound_posts_message_id
+       ON ${TABLE} (message_id)`,
+  );
+  sqlite.exec(
+    `CREATE INDEX IF NOT EXISTS idx_channel_outbound_posts_conversation_id
+       ON ${TABLE} (conversation_id)`,
+  );
+}

package/src/persistence/migrations/__tests__/375-create-channel-outbound-posts.test.ts

@@ -0,0 +1,84 @@
+/**
+ * Migration 375 creates `channel_outbound_posts`, the provider-id resolution
+ * index for messages the assistant itself posted: the outbound counterpart
+ * of `channel_inbound_events`. Keyed by the (channel, chat, provider id)
+ * triple, which is exactly how an inbound reaction or delete addresses a
+ * post.
+ */
+
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import { getSqliteFrom } from "../../db-connection.js";
+import * as schema from "../../schema.js";
+import { migrateCreateChannelOutboundPosts } from "../375-create-channel-outbound-posts.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec("PRAGMA journal_mode=WAL");
+  return drizzle(sqlite, { schema });
+}
+
+function tableNames(db: ReturnType<typeof createTestDb>): string[] {
+  const rows = getSqliteFrom(db)
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+    .all() as { name: string }[];
+  return rows.map((row) => row.name);
+}
+
+function indexNames(db: ReturnType<typeof createTestDb>): string[] {
+  const rows = getSqliteFrom(db)
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'index'")
+    .all() as { name: string }[];
+  return rows.map((row) => row.name);
+}
+
+describe("migrateCreateChannelOutboundPosts", () => {
+  test("creates the table and its FK indexes", () => {
+    const db = createTestDb();
+
+    migrateCreateChannelOutboundPosts(db);
+
+    expect(tableNames(db)).toContain("channel_outbound_posts");
+    // SQLite does not index FK columns automatically, and both parents
+    // cascade deletes through them.
+    expect(indexNames(db)).toContain("idx_channel_outbound_posts_message_id");
+    expect(indexNames(db)).toContain(
+      "idx_channel_outbound_posts_conversation_id",
+    );
+  });
+
+  test("re-running is a no-op", () => {
+    const db = createTestDb();
+
+    migrateCreateChannelOutboundPosts(db);
+    migrateCreateChannelOutboundPosts(db);
+
+    expect(tableNames(db)).toContain("channel_outbound_posts");
+  });
+
+  test("the triple is the primary key: one row per provider post", () => {
+    const db = createTestDb();
+    migrateCreateChannelOutboundPosts(db);
+    const sqlite = getSqliteFrom(db);
+    const insert = () =>
+      sqlite
+        .prepare(
+          `INSERT OR IGNORE INTO channel_outbound_posts
+             (source_channel, external_chat_id, provider_message_id,
+              message_id, conversation_id, created_at)
+           VALUES ('discord', 'chat-1', 'post-1', 'row-1', 'conv-1', 1)`,
+        )
+        .run();
+
+    insert();
+    insert();
+
+    const count = sqlite
+      .prepare("SELECT COUNT(*) AS n FROM channel_outbound_posts")
+      .get() as { n: number };
+    expect(count.n).toBe(1);
+  });
+});

package/src/persistence/schema/conversations.ts

@@ -2,6 +2,7 @@ import { sql } from "drizzle-orm";
 import {
   index,
   integer,
+  primaryKey,
   real,
   sqliteTable,
   text,
@@ -282,6 +283,30 @@ export const conversationCompactionEvents = sqliteTable(
   ],
 );
 
+/**
+ * Lifecycle of a channel inbound event's reply delivery. `pending` is the only
+ * non-terminal value, so every path that finishes a turn has to move the row
+ * off it, including the paths that finish WITHOUT delivering: recovery reads a
+ * lingering `pending` as a reply still owed. See `runtime/AGENTS.md`.
+ */
+export const CHANNEL_DELIVERY_STATUSES = [
+  "pending",
+  "delivered",
+  "failed",
+  "dead_letter",
+] as const;
+export type ChannelDeliveryStatus = (typeof CHANNEL_DELIVERY_STATUSES)[number];
+
+/** Lifecycle of a channel inbound event's agent-turn processing. */
+export const CHANNEL_PROCESSING_STATUSES = [
+  "pending",
+  "processed",
+  "failed",
+  "dead_letter",
+] as const;
+export type ChannelProcessingStatus =
+  (typeof CHANNEL_PROCESSING_STATUSES)[number];
+
 export const channelInboundEvents = sqliteTable("channel_inbound_events", {
   id: text("id").primaryKey(),
   sourceChannel: text("source_channel").notNull(),
@@ -294,8 +319,14 @@ export const channelInboundEvents = sqliteTable("channel_inbound_events", {
   messageId: text("message_id").references(() => messages.id, {
     onDelete: "cascade",
   }),
-  deliveryStatus: text("delivery_status").notNull().default("pending"),
-  processingStatus: text("processing_status").notNull().default("pending"),
+  deliveryStatus: text("delivery_status", { enum: CHANNEL_DELIVERY_STATUSES })
+    .notNull()
+    .default("pending"),
+  processingStatus: text("processing_status", {
+    enum: CHANNEL_PROCESSING_STATUSES,
+  })
+    .notNull()
+    .default("pending"),
   processingAttempts: integer("processing_attempts").notNull().default(0),
   deliveryAttempts: integer("delivery_attempts").notNull().default(0),
   lastProcessingError: text("last_processing_error"),
@@ -307,3 +338,41 @@ export const channelInboundEvents = sqliteTable("channel_inbound_events", {
   createdAt: integer("created_at").notNull(),
   updatedAt: integer("updated_at").notNull(),
 });
+
+/**
+ * Provider-id index for messages the assistant itself posted: the outbound
+ * counterpart of `channelInboundEvents`' provider-id resolution. One stored
+ * reply fans out to many provider posts, and a reaction or deletion names a
+ * post, so resolution is keyed by the (channel, chat, provider id) triple.
+ * Written by the post-send reconciliation alongside the row's `providerMeta`
+ * envelope, which remains the row's self-description; this table is the
+ * derived index over its id facts.
+ */
+export const channelOutboundPosts = sqliteTable(
+  "channel_outbound_posts",
+  {
+    sourceChannel: text("source_channel").notNull(),
+    externalChatId: text("external_chat_id").notNull(),
+    providerMessageId: text("provider_message_id").notNull(),
+    messageId: text("message_id")
+      .notNull()
+      .references(() => messages.id, { onDelete: "cascade" }),
+    conversationId: text("conversation_id")
+      .notNull()
+      .references(() => conversations.id, { onDelete: "cascade" }),
+    createdAt: integer("created_at").notNull(),
+  },
+  (table) => [
+    primaryKey({
+      columns: [
+        table.sourceChannel,
+        table.externalChatId,
+        table.providerMessageId,
+      ],
+    }),
+    index("idx_channel_outbound_posts_message_id").on(table.messageId),
+    index("idx_channel_outbound_posts_conversation_id").on(
+      table.conversationId,
+    ),
+  ],
+);

package/src/persistence/schema-contract.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  diffDrizzleSchemaContract,
+  listDrizzleTables,
+  schemaContractIsClean,
+} from "./schema-contract.js";
+
+describe("listDrizzleTables", () => {
+  test("includes conversations.fork_strategy from the source catalog", () => {
+    const conversations = listDrizzleTables().find(
+      (table) => table.name === "conversations",
+    );
+    expect(conversations).toBeDefined();
+    expect(conversations!.columns).toContain("fork_strategy");
+    expect(conversations!.columns).toContain("id");
+  });
+
+  test("de-duplicates aliased table exports", () => {
+    const names = listDrizzleTables().map((table) => table.name);
+    expect(names.filter((name) => name === "cron_jobs")).toEqual(["cron_jobs"]);
+  });
+});
+
+describe("diffDrizzleSchemaContract", () => {
+  test("reports a missing column on a table that exists", () => {
+    const conversations = listDrizzleTables().find(
+      (table) => table.name === "conversations",
+    );
+    expect(conversations).toBeDefined();
+    const liveColumns = new Set(
+      conversations!.columns.filter((column) => column !== "fork_strategy"),
+    );
+    const live = new Map<string, Set<string>>(
+      listDrizzleTables().map((table) => [
+        table.name,
+        table.name === "conversations" ? liveColumns : new Set(table.columns),
+      ]),
+    );
+
+    const report = diffDrizzleSchemaContract(live);
+    expect(schemaContractIsClean(report)).toBe(false);
+    expect(report.missingTables).toEqual([]);
+    expect(report.missingColumns).toEqual([
+      { table: "conversations", column: "fork_strategy" },
+    ]);
+  });
+
+  test("ignores extra SQLite columns that Drizzle does not own", () => {
+    const live = new Map<string, Set<string>>(
+      listDrizzleTables().map((table) => {
+        const columns = new Set(table.columns);
+        if (table.name === "conversations") {
+          columns.add("group_id");
+        }
+        return [table.name, columns];
+      }),
+    );
+
+    const report = diffDrizzleSchemaContract(live);
+    expect(schemaContractIsClean(report)).toBe(true);
+    expect(report.missingColumns).toEqual([]);
+  });
+
+  test("reports a drizzle table that is absent from every live file", () => {
+    const live = new Map<string, Set<string>>(
+      listDrizzleTables()
+        .filter((table) => table.name !== "conversations")
+        .map((table) => [table.name, new Set(table.columns)]),
+    );
+
+    const report = diffDrizzleSchemaContract(live);
+    expect(report.missingTables).toEqual(["conversations"]);
+    expect(
+      report.missingColumns.some((miss) => miss.table === "conversations"),
+    ).toBe(false);
+  });
+});

package/src/persistence/schema-contract.ts

@@ -0,0 +1,96 @@
+/**
+ * Compare the Drizzle table/column catalog in source to a live SQLite schema.
+ *
+ * Used by `assistant db status` to surface a binary that selects a
+ * column the live database never received. Extra SQLite tables or
+ * columns are ignored. Those are often raw-SQL fields (`group_id`) that
+ * Drizzle does not own.
+ *
+ * The catalog is the union of every `sqliteTable` exported from
+ * `schema/index.ts`. Tables live across the main, logs, memory, and
+ * telemetry files; callers merge those files before calling
+ * {@link diffDrizzleSchemaContract}.
+ */
+
+import { getTableColumns, getTableName, is, Table } from "drizzle-orm";
+
+import * as schema from "./schema/index.js";
+
+export interface SchemaColumnMiss {
+  table: string;
+  column: string;
+}
+
+export interface SchemaContractReport {
+  /** Drizzle tables with no matching SQLite table in the live files. */
+  missingTables: string[];
+  /** Drizzle columns whose table exists in SQLite but the column does not. */
+  missingColumns: SchemaColumnMiss[];
+}
+
+export interface DrizzleTableColumns {
+  name: string;
+  columns: string[];
+}
+
+/** Every Drizzle table name and its SQL column names, de-duplicated. */
+export function listDrizzleTables(): DrizzleTableColumns[] {
+  const byName = new Map<string, string[]>();
+  for (const value of Object.values(schema)) {
+    if (!is(value, Table)) {
+      continue;
+    }
+    const name = getTableName(value);
+    if (!name) {
+      continue;
+    }
+    const columns = Object.values(getTableColumns(value)).map(
+      (column) => column.name,
+    );
+    byName.set(name, columns);
+  }
+  return [...byName.entries()]
+    .map(([name, columns]) => ({ name, columns: [...columns].sort() }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Diff Drizzle's catalog against a merged live schema (table name → columns).
+ * Tables and columns present only in SQLite are not reported.
+ */
+export function diffDrizzleSchemaContract(
+  liveColumnsByTable: Map<string, ReadonlySet<string>>,
+): SchemaContractReport {
+  const missingTables: string[] = [];
+  const missingColumns: SchemaColumnMiss[] = [];
+
+  for (const table of listDrizzleTables()) {
+    const live = liveColumnsByTable.get(table.name);
+    if (!live) {
+      missingTables.push(table.name);
+      continue;
+    }
+    for (const column of table.columns) {
+      if (!live.has(column)) {
+        missingColumns.push({ table: table.name, column });
+      }
+    }
+  }
+
+  missingTables.sort();
+  missingColumns.sort((a, b) => {
+    const tableCmp = a.table.localeCompare(b.table);
+    if (tableCmp !== 0) {
+      return tableCmp;
+    }
+    return a.column.localeCompare(b.column);
+  });
+
+  return { missingTables, missingColumns };
+}
+
+export function schemaContractIsClean(report: SchemaContractReport): boolean {
+  return (
+    report.missingTables.length === 0 && report.missingColumns.length === 0
+  );
+}

package/src/persistence/steps.ts

@@ -481,6 +481,8 @@ import { migrateAcpSessionHistoryAuthErrorCode } from "./migrations/370-acp-sess
 import { migrateAcpSessionHistoryAuthErrorCredential } from "./migrations/371-acp-session-history-auth-error-credential.js";
 import { migrateCreateAcpRefusedCredentials } from "./migrations/372-create-acp-refused-credentials.js";
 import { migrateAcpAuthMarkerIndex } from "./migrations/373-acp-auth-marker-index.js";
+import { migrateChannelInboundMessageIdIndex } from "./migrations/374-channel-inbound-message-id-index.js";
+import { migrateCreateChannelOutboundPosts } from "./migrations/375-create-channel-outbound-posts.js";
 import type { MigrationStep } from "./migrations/run-migrations.js";
 
 export const migrationSteps: MigrationStep[] = [
@@ -1596,4 +1598,6 @@ export const migrationSteps: MigrationStep[] = [
   migrateAcpSessionHistoryAuthErrorCredential,
   migrateCreateAcpRefusedCredentials,
   migrateAcpAuthMarkerIndex,
+  migrateChannelInboundMessageIdIndex,
+  migrateCreateChannelOutboundPosts,
 ];

package/src/platform/client.ts

@@ -5,6 +5,8 @@
  * authenticated fetch for all platform API calls.
  */
 
+import type { PlatformCredentialVerificationStatus } from "@vellumai/service-contracts/platform-credential";
+
 import { getPlatformAssistantId } from "../config/env.js";
 import { resolveManagedProxyContext } from "../providers/platform-proxy/context.js";
 import { credentialKey } from "../security/credential-key.js";
@@ -106,6 +108,9 @@ async function resolvePlatformClientConfig(): Promise<PlatformClientConfig | nul
 // credential backend must answer from cache instead of stalling the banner.
 const CONFIGURED_PROBE_DEADLINE_MS = 500;
 
+/** Bound for the credential check; the heartbeat waits on it. */
+const CREDENTIAL_VERIFY_TIMEOUT_MS = 5_000;
+
 let lastKnownConfigured: boolean | null = null;
 // Single-flight slot with rotation: concurrent probes share one resolution,
 // while a flight some caller already gave up on is replaced so a hung
@@ -308,6 +313,56 @@ export class VellumPlatformClient {
     }
   }
 
+  /**
+   * Ask the platform whether this client's assistant API key still
+   * authenticates.
+   *
+   * `"rejected"` is a settled negative: the platform answered, and the answer
+   * was that the credential is not accepted (401/403, which is how
+   * `AssistantAPIKeyAuthentication` reports a revoked, expired, or unknown
+   * key). Only that verdict may drive a rotation, because rotating on a
+   * network blip would replace a working credential for no reason.
+   * `"unknown"` covers every unsettled case (no assistant id, transport
+   * failure, server error) and means "ask again later", never "broken".
+   *
+   * The carrier is the owner-consent endpoint. Nothing here reads consent:
+   * the request is a side-effect-free authenticated GET this client already
+   * makes, and the only thing inspected is whether authentication succeeded.
+   * The platform exposes no dedicated credential-verification endpoint, so
+   * the carrier is named here rather than left implicit at call sites.
+   */
+  async verifyCredential(): Promise<PlatformCredentialVerificationStatus> {
+    if (!this.assistantId) {
+      return "unknown";
+    }
+
+    try {
+      const res = await this.fetch(
+        `/v1/assistants/${this.assistantId}/owner-consent/`,
+        // The heartbeat awaits this check, so an unanswered request must
+        // settle as unknown rather than hold the credential pass open.
+        { signal: AbortSignal.timeout(CREDENTIAL_VERIFY_TIMEOUT_MS) },
+      );
+      if (res.ok) {
+        return "valid";
+      }
+      if (res.status === 401 || res.status === 403) {
+        return "rejected";
+      }
+      log.debug(
+        { status: res.status },
+        "credential verification returned an unsettled status",
+      );
+      return "unknown";
+    } catch (err) {
+      log.debug(
+        { err },
+        "credential verification could not reach the platform",
+      );
+      return "unknown";
+    }
+  }
+
   get baseUrl(): string {
     return this.platformBaseUrl;
   }

package/src/plugins/__tests__/mcp-servers.test.ts

@@ -137,6 +137,52 @@ describe("readPluginMcpServers", () => {
     });
   });
 
+  test("defaults an omitted type to streamable-http", () => {
+    const dir = makePluginsDir({
+      openseo: {
+        mcpJson: JSON.stringify({
+          mcpServers: {
+            openseo: { url: "https://app.openseo.so/mcp" },
+          },
+        }),
+      },
+    });
+    const { servers, issues } = readPluginMcpServers({
+      workspacePluginsDir: dir,
+    });
+
+    expect(issues).toEqual([]);
+    expect(servers).toHaveLength(1);
+    expect(servers[0].config.transport).toEqual({
+      type: "streamable-http",
+      url: "https://app.openseo.so/mcp",
+    });
+  });
+
+  test("treats the Claude-style http alias as streamable-http", () => {
+    const dir = makePluginsDir({
+      openseo: {
+        mcpJson: JSON.stringify({
+          mcpServers: {
+            openseo: {
+              type: "http",
+              url: "https://app.openseo.so/mcp",
+            },
+          },
+        }),
+      },
+    });
+    const { servers, issues } = readPluginMcpServers({
+      workspacePluginsDir: dir,
+    });
+
+    expect(issues).toEqual([]);
+    expect(servers[0].config.transport).toEqual({
+      type: "streamable-http",
+      url: "https://app.openseo.so/mcp",
+    });
+  });
+
   test("defaults plugin servers to low risk", () => {
     // mcp.json has no risk field, so a host default applies. It is `low`
     // because the review happens at install time — curated marketplace,

package/src/plugins/defaults/injector-order.ts

@@ -34,7 +34,8 @@
  *
  * Gaps between slots leave room for future injectors to slot in at granular
  * positions (e.g. `25` between unified-turn-context and pkb) without
- * renumbering. The memory-v3 injectors sit far above this range (1000 / 1001).
+ * renumbering. The memory-v3 injectors sit far above this range (1000 cards
+ * / 1001 outbound spotlight).
  */
 export const DEFAULT_INJECTOR_ORDER = {
   diskPressureWarning: 5,

package/src/plugins/defaults/memory/__tests__/memory-retrospective-accounting.test.ts

@@ -44,8 +44,8 @@ const SIGHT_FRAME_CONTENT = JSON.stringify([
 ]);
 
 /**
- * What `persistLiveVoiceSightFrame` writes: the gate sampled this, nobody
- * spoke it, so `scripted` rides along with the tag.
+ * What `persistAmbientSightFrame` writes on the voice surface: the gate
+ * sampled this, nobody spoke it, so `scripted` rides along with the tag.
  */
 function sightFrameMetadata(attachmentId: string): string {
   return JSON.stringify({

package/src/plugins/defaults/memory/context-search/sources/conversations.ts

@@ -4,7 +4,7 @@ import {
   searchMessageIdsLexical,
 } from "@vellumai/plugin-api";
 
-import { readSlackMetadata } from "../../../../../messaging/providers/slack/message-metadata.js";
+import { readSlackMetadataFromMessageMetadata } from "../../../../../messaging/providers/slack/message-metadata.js";
 import { AUTO_ANALYSIS_SOURCE } from "../../../../../persistence/auto-analysis-constants.js";
 import { isLexicalBackfillComplete } from "../../../../../persistence/checkpoints.js";
 import { rawAll } from "../../../../../persistence/raw-query.js";
@@ -296,25 +296,23 @@ function parseSlackRecallMetadata(rawMetadata: string | null): {
     return null;
   }
 
+  const slackMeta = readSlackMetadataFromMessageMetadata(rawMetadata);
+  if (!slackMeta) {
+    return null;
+  }
+  // The trust class sits beside the envelope, on the row's top-level
+  // metadata. Parsed here rather than through the host's JSON helper, which
+  // is outside the plugin's import boundary.
   let parsed: unknown;
   try {
     parsed = JSON.parse(rawMetadata);
   } catch {
-    return null;
-  }
-
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return null;
-  }
-
-  const metadata = parsed as Record<string, unknown>;
-  if (typeof metadata.slackMeta !== "string") {
-    return null;
-  }
-  const slackMeta = readSlackMetadata(metadata.slackMeta);
-  if (!slackMeta) {
-    return null;
+    parsed = null;
   }
+  const metadata =
+    parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : {};
 
   return {
     ...(slackMeta.displayName ? { displayName: slackMeta.displayName } : {}),