@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/util/__tests__/language-subtag.test.ts

@@ -1,6 +1,10 @@
 import { describe, expect, test } from "bun:test";
 
-import { baseLanguageSubtag, localizedOrDefault } from "../language-subtag.js";
+import {
+  baseLanguageSubtag,
+  fixedPhraseLanguage,
+  localizedOrDefault,
+} from "../language-subtag.js";
 
 describe("baseLanguageSubtag", () => {
   test("lowercases a bare tag", () => {
@@ -52,3 +56,21 @@ describe("localizedOrDefault", () => {
     expect(localizedOrDefault(table, "__proto__", "fallback")).toBe("fallback");
   });
 });
+
+describe("fixedPhraseLanguage", () => {
+  const table = { en: "one", es: "uno" };
+
+  test("pins English when the speaker's language has no table entry", () => {
+    expect(fixedPhraseLanguage(table, "ko")).toBe("en");
+    expect(fixedPhraseLanguage(table, "ar-EG")).toBe("en");
+  });
+
+  test("rides the speaker's language when the table covers it", () => {
+    expect(fixedPhraseLanguage(table, "es")).toBeUndefined();
+    expect(fixedPhraseLanguage(table, "es-419")).toBeUndefined();
+  });
+
+  test("carries no hint when the language is unknown", () => {
+    expect(fixedPhraseLanguage(table, undefined)).toBeUndefined();
+  });
+});

package/src/util/ca-bundle.ts

@@ -0,0 +1,13 @@
+import { readFile, writeFile } from "node:fs/promises";
+
+export async function writeCombinedCABundle(
+  systemBundlePath: string,
+  extraCAPath: string,
+  outputPath: string,
+): Promise<void> {
+  const [systemCAs, extraCAs] = await Promise.all([
+    readFile(systemBundlePath, "utf-8"),
+    readFile(extraCAPath, "utf-8"),
+  ]);
+  await writeFile(outputPath, `${systemCAs}\n${extraCAs}`, { mode: 0o644 });
+}

package/src/util/language-subtag.ts

@@ -41,3 +41,19 @@ export function localizedOrDefault<T>(
     ? (table[baseLanguageSubtag(language)!] as T)
     : fallback;
 }
+
+/**
+ * The TTS language hint for a fixed phrase picked from a localized table:
+ * "en" when the speaker has a language the table does not cover (the
+ * picker fell back to English text, which must not be synthesized under
+ * an ar/ko/ta hint), undefined otherwise (the phrase rides the speaker's
+ * language, or carries no hint at all when the language is unknown).
+ */
+export function fixedPhraseLanguage(
+  table: Readonly<Record<string, unknown>>,
+  language: string | undefined,
+): string | undefined {
+  return language !== undefined && !hasLocalizedEntry(table, language)
+    ? "en"
+    : undefined;
+}

package/src/util/platform.ts

@@ -470,6 +470,14 @@ export function getWorkspaceConfigPath(): string {
   return join(getWorkspaceDir(), "config.json");
 }
 
+/** Filename for the user-owned Agent Plugins MCP document. */
+export const WORKSPACE_MCP_FILENAME = "mcp.json";
+
+/** Returns $VELLUM_WORKSPACE_DIR/mcp.json */
+export function getWorkspaceMcpConfigPath(): string {
+  return join(getWorkspaceDir(), WORKSPACE_MCP_FILENAME);
+}
+
 /** Returns $VELLUM_WORKSPACE_DIR/skills */
 export function getWorkspaceSkillsDir(): string {
   return join(getWorkspaceDir(), "skills");

package/src/util/unicode.ts

@@ -126,6 +126,15 @@ export interface DeepSanitizeResult<T> {
   fixedStringCount: number;
 }
 
+export interface DeepSanitizeOptions {
+  /**
+   * Skip a plain-object property entirely: its value is neither scanned nor
+   * copied. For fields known to hold ASCII (base64 payloads), scanning is
+   * pure cost.
+   */
+  skipKey?: (key: string, parent: Record<string, unknown>) => boolean;
+}
+
 /**
  * Recursively walk arrays and plain objects, replacing orphaned surrogates in
  * every string value. Non-plain objects (class instances, Date, Buffer, Map,
@@ -136,8 +145,10 @@ export interface DeepSanitizeResult<T> {
  */
 export function stripOrphanedSurrogatesDeep<T>(
   input: T,
+  options: DeepSanitizeOptions = {},
 ): DeepSanitizeResult<T> {
   let fixedStringCount = 0;
+  const { skipKey } = options;
 
   const walk = (value: unknown): { value: unknown; changed: boolean } => {
     if (typeof value === "string") {
@@ -178,7 +189,10 @@ export function stripOrphanedSurrogatesDeep<T>(
       let next: Record<string, unknown> | null = null;
       for (let i = 0; i < keys.length; i++) {
         const key = keys[i]!;
-        const result = walk(source[key]);
+        const result =
+          skipKey?.(key, source) === true
+            ? { value: source[key], changed: false }
+            : walk(source[key]);
         if (result.changed && next === null) {
           next = {};
           for (let j = 0; j < i; j++) {

package/src/watch/watch-timeline.ts

@@ -366,8 +366,8 @@ export function appendNarration(
  * timeline of a session where observation stalled is simply a sparser one.
  *
  * The screenshot is stored only when `attachScreenshot` asks for it, and
- * carrying one is not asking. The host captures a screenshot on every observe
- * with no opt-out, so an observation always has pixels available and a policy
+ * carrying one is not asking. Watch requests a screenshot on every observe, so
+ * an observation normally has pixels available and a policy
  * of "store what arrives" is a policy of storing every frame. Which frames are
  * worth an image is a cadence decision, and it belongs to the caller driving
  * the session rather than to the row writer.

package/src/workflows/run-manager.ts

@@ -33,6 +33,7 @@ import type { TrustContext } from "../daemon/trust-context-types.js";
 import { wakeAgentForOpportunity } from "../runtime/agent-wake.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { getLogger } from "../util/logger.js";
+import { safeStringSlice } from "../util/unicode.js";
 import type { CapabilityManifest } from "./capabilities.js";
 import {
   normalizeCapabilityManifest,
@@ -611,7 +612,7 @@ function truncateForSummary(s: string, runId: string): string {
   }
   const omitted = s.length - MAX_SUMMARY_RESULT_CHARS;
   return (
-    `${s.slice(0, MAX_SUMMARY_RESULT_CHARS)}… ` +
+    `${safeStringSlice(s, 0, MAX_SUMMARY_RESULT_CHARS)}… ` +
     `[truncated ${omitted} chars — fetch the full result with manage_workflows ` +
     `{ action: "get_result", run_id: "${runId}" }]`
   );

package/src/workspace/git-porcelain.ts

@@ -0,0 +1,66 @@
+/**
+ * NUL-terminated `git status --porcelain -z` parsing.
+ *
+ * Status reporting and batched staging share this parser so rename/copy
+ * origin paths cannot drift between the two readers.
+ */
+
+export interface PorcelainEntry {
+  /** Two-character XY status from porcelain v1. */
+  status: string;
+  /** Path git reports for this record (the destination for rename/copy). */
+  path: string;
+  /** Pre-rename/copy path. Present when the record is a rename or copy. */
+  origin?: string;
+}
+
+/**
+ * Parse NUL-terminated `git status --porcelain -z` output into status/path
+ * records. NUL termination is required so paths with special characters
+ * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
+ *
+ * A rename/copy record is followed by a bare origin-path entry, captured on
+ * {@link PorcelainEntry.origin}.
+ */
+export function parsePorcelainZ(stdout: string): PorcelainEntry[] {
+  const entries = stdout.split("\0");
+  const parsed: PorcelainEntry[] = [];
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i] ?? "";
+    if (entry.length < 4) {
+      continue;
+    }
+    const status = entry.substring(0, 2);
+    const path = entry.substring(3);
+    if (status[0] === "R" || status[0] === "C") {
+      i++;
+      const origin = entries[i];
+      if (origin && origin.length > 0) {
+        parsed.push({ status, path, origin });
+        continue;
+      }
+    }
+    parsed.push({ status, path });
+  }
+  return parsed;
+}
+
+/**
+ * Every path git status knows about, including rename/copy origins.
+ * Origins still need to be staged so a deletion is not left behind when a
+ * rename is split across add batches.
+ */
+export function collectDirtyPathsFromPorcelain(stdout: string): string[] {
+  const paths: string[] = [];
+  const seen = new Set<string>();
+  for (const entry of parsePorcelainZ(stdout)) {
+    for (const path of [entry.path, entry.origin]) {
+      if (!path || seen.has(path)) {
+        continue;
+      }
+      seen.add(path);
+      paths.push(path);
+    }
+  }
+  return paths;
+}

package/src/workspace/git-service.ts

@@ -17,6 +17,10 @@ import { getLogger } from "../util/logger.js";
 import { Mutex } from "../util/mutex.js";
 import { addToPathEnv, getExtraToolPathDirs } from "../util/platform.js";
 import { PromiseGuard } from "../util/promise-guard.js";
+import {
+  collectDirtyPathsFromPorcelain,
+  parsePorcelainZ,
+} from "./git-porcelain.js";
 
 const execFileAsync = promisify(execFile);
 const log = getLogger("workspace-git");
@@ -51,7 +55,7 @@ function cleanGitEnv(workspaceDir: string): Record<string, string> {
  * Patterns excluded from workspace git tracking.
  * These are written to .gitignore on init and appended to existing .gitignore files.
  */
-const WORKSPACE_GITIGNORE_RULES = [
+export const WORKSPACE_GITIGNORE_RULES = [
   // Runtime state directories
   "data/db/",
   "data/qdrant/",
@@ -226,59 +230,6 @@ done
 exit 0
 `;
 
-/**
- * Parse NUL-terminated `git status --porcelain -z` output into status/path
- * pairs. NUL termination is required so paths with special characters
- * (non-ASCII, quotes, newlines) arrive verbatim instead of C-style quoted.
- * A rename/copy record is followed by a bare origin-path entry, which is
- * skipped.
- */
-function parsePorcelainZ(
-  stdout: string,
-): Array<{ status: string; path: string }> {
-  const entries = stdout.split("\0");
-  const parsed: Array<{ status: string; path: string }> = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    parsed.push({ status, path: entry.substring(3) });
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-    }
-  }
-  return parsed;
-}
-
-/**
- * Every path git status knows about, including rename/copy origins.
- * Origins are skipped by {@link parsePorcelainZ} (they have no status
- * prefix) but still need to be staged so a deletion is not left behind
- * when a rename is split across add batches.
- */
-function collectDirtyPathsFromPorcelain(stdout: string): string[] {
-  const entries = stdout.split("\0");
-  const paths: string[] = [];
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i] ?? "";
-    if (entry.length < 4) {
-      continue;
-    }
-    const status = entry.substring(0, 2);
-    paths.push(entry.substring(3));
-    if (status[0] === "R" || status[0] === "C") {
-      i++;
-      const origin = entries[i];
-      if (origin && origin.length > 0) {
-        paths.push(origin);
-      }
-    }
-  }
-  return paths;
-}
-
 /** Properties added by Node's child_process errors. */
 interface ExecError extends Error {
   killed?: boolean;
@@ -433,7 +384,7 @@ export class WorkspaceGitService {
    *
    * This method is always called inside the mutex, so no git operation from
    * our code can be concurrently holding the lock. However, an external git
-   * process (user running `git add`, IDE tooling, etc.) could legitimately
+   * git process (user running `git add`, IDE tooling, etc.) could legitimately
    * hold the lock. We use `lsof` to check — if any process has the file
    * open, we leave it alone. If no process holds it, it's stale (crashed
    * process) and safe to remove.

package/src/workspace/migrations/154-repair-retired-codex-gpt-5-4-model-ids.ts

@@ -0,0 +1,258 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+
+import type { WorkspaceMigration } from "./types.js";
+
+/**
+ * Repair `gpt-5.4` and `gpt-5.4-mini` pins on fragments that dispatch
+ * through the ChatGPT subscription.
+ *
+ * OpenAI serves neither model under ChatGPT sign-in: the Codex endpoint
+ * rejects them with HTTP 400 ("not supported when using Codex with a
+ * ChatGPT account"), so both are out of `CODEX_SUBSCRIPTION_MODEL_IDS`.
+ * API-key access is unaffected, so a fragment on any other route keeps
+ * its model.
+ *
+ * Two stored shapes dispatch through the subscription. The `chatgpt`
+ * routing identity fails `LLMSchema.superRefine` once the allowlist drops
+ * the model, and the loader's per-section salvage then resets the whole
+ * `llm` section, losing every profile and call-site tuning: this is the
+ * repair that prevents data loss. A profile bound to the subscription row
+ * (row kind `chatgpt`, or an `oauth_subscription` auth on the
+ * pre-DB-migration-366 row shape) bypasses the auto-resolution compat
+ * gate and 400s on every request; the row is named by the legacy
+ * `provider_connection` binding when present (dispatch honors it first,
+ * and the name is only ever a row name), otherwise by an entry-name
+ * `provider`. Both shapes are swept in `llm.default`, `llm.callSites.*`,
+ * and `llm.profiles.*`; call-site fragments carry no binding (the schema
+ * strips a raw `provider_connection`), so only their declared provider
+ * counts.
+ *
+ * A providerless call-site pin is deliberately left alone. It overlays
+ * whichever profile wins the site for a turn: on an API-key or managed
+ * winner it still serves the model, and on a subscription winner the
+ * request already fails upstream and keeps failing, with no config loss
+ * either way. Rewriting such pins would change API-key users' model and
+ * price to cover a winner that may never be selected.
+ *
+ * Replacements: `gpt-5.4` becomes `gpt-5.5` (its successor) and
+ * `gpt-5.4-mini` becomes `gpt-5.6-luna` (the subscription's Balanced model;
+ * on the subscription every model bills the same).
+ */
+export const repairRetiredCodexGpt54ModelIdsMigration: WorkspaceMigration = {
+  id: "154-repair-retired-codex-gpt-5-4-model-ids",
+  description:
+    "Repair gpt-5.4 and gpt-5.4-mini pins on ChatGPT-subscription LLM fragments in workspace config",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    // Read outside the parse catch: a transient filesystem error (EIO,
+    // EACCES) must reach the runner so the migration retries, while
+    // malformed JSON is a permanent state this migration cannot repair.
+    const rawText = readFileSync(configPath, "utf-8");
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(rawText);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const llm = readObject(config.llm);
+    if (llm === null) {
+      return;
+    }
+
+    // Entry rows load lazily: only a stale fragment naming a row needs
+    // them. An unreadable DB then fails the run (retried next boot) rather
+    // than checkpointing a pass that skips entry-bound profiles.
+    let rows: Map<string, boolean> | null | undefined;
+    const isSubscriptionRow = (name: unknown): boolean => {
+      if (typeof name !== "string" || name.length === 0) {
+        return false;
+      }
+      if (rows === undefined) {
+        rows = readConnectionRows(workspaceDir);
+      }
+      if (rows === null) {
+        throw new Error(
+          "provider_connections is not readable; retrying the model-ID repair on the next run",
+        );
+      }
+      return rows.get(name) === true;
+    };
+    // A `provider` value: the identity dispatches to the subscription, a
+    // known vendor never does, and any other value is an entry name.
+    const isSubscriptionProvider = (provider: unknown): boolean =>
+      provider === CHATGPT_IDENTITY ||
+      (typeof provider === "string" &&
+        !KNOWN_PROVIDERS.has(provider) &&
+        isSubscriptionRow(provider));
+    // The binding is authoritative when present, since dispatch honors it
+    // ahead of the declared provider; the identity is repaired regardless
+    // (the schema rejects the pair whatever the binding).
+    const isBound = (fragment: Record<string, unknown>): boolean => {
+      if (fragment.provider === CHATGPT_IDENTITY) {
+        return true;
+      }
+      const binding = fragment.provider_connection;
+      return typeof binding === "string" && binding.length > 0
+        ? isSubscriptionRow(binding)
+        : isSubscriptionProvider(fragment.provider);
+    };
+    const isProviderBound = (fragment: Record<string, unknown>): boolean =>
+      isSubscriptionProvider(fragment.provider);
+
+    let changed = false;
+
+    changed = repairFragment(readObject(llm.default), isBound) || changed;
+
+    const callSites = readObject(llm.callSites);
+    if (callSites !== null) {
+      for (const rawConfig of Object.values(callSites)) {
+        changed =
+          repairFragment(readObject(rawConfig), isProviderBound) || changed;
+      }
+    }
+
+    const profiles = readObject(llm.profiles);
+    if (profiles !== null) {
+      for (const rawProfile of Object.values(profiles)) {
+        changed = repairFragment(readObject(rawProfile), isBound) || changed;
+      }
+    }
+
+    if (!changed) {
+      return;
+    }
+
+    // Write-then-rename so an interrupted write cannot leave config.json
+    // truncated: a torn in-place write would parse as invalid JSON on the
+    // retry, which the catch above treats as "nothing to do", letting the
+    // runner checkpoint the migration as completed against a corrupt file.
+    const tmpPath = `${configPath}.migration-154.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+  },
+  // The exact-match rewrite is idempotent, so a transient failure (full
+  // disk, I/O error) is safe to retry on later startups.
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: reintroducing the retired model IDs would fail schema
+    // validation once the allowlist no longer carries them.
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Helpers: self-contained per workspace migrations AGENTS.md
+// ---------------------------------------------------------------------------
+
+const CHATGPT_IDENTITY = "chatgpt";
+
+// Frozen snapshot of `KNOWN_LLM_PROVIDERS`: the vendor and identity values
+// that dispatch without a connection row, so none of them is an entry name.
+const KNOWN_PROVIDERS = new Set([
+  "anthropic",
+  "openai",
+  "gemini",
+  "ollama",
+  "fireworks",
+  "openrouter",
+  "vercel-ai-gateway",
+  "openai-compatible",
+  "minimax",
+  "atlascloud",
+  "together",
+  "litellm",
+  "opencode",
+  "baseten",
+  "poolside",
+  "vellum",
+  "chatgpt",
+]);
+
+const REPLACEMENTS: ReadonlyMap<string, string> = new Map([
+  ["gpt-5.4", "gpt-5.5"],
+  ["gpt-5.4-mini", "gpt-5.6-luna"],
+]);
+
+function repairFragment(
+  fragment: Record<string, unknown> | null,
+  isSubscriptionRouted: (fragment: Record<string, unknown>) => boolean,
+): boolean {
+  if (fragment === null || typeof fragment.model !== "string") {
+    return false;
+  }
+  const replacement = REPLACEMENTS.get(fragment.model);
+  if (replacement === undefined) {
+    return false;
+  }
+  if (!isSubscriptionRouted(fragment)) {
+    return false;
+  }
+  fragment.model = replacement;
+  return true;
+}
+
+/**
+ * `provider_connections` row name to whether the row dispatches to the
+ * ChatGPT subscription, or null when the DB or table is not readable. The
+ * caller fails the run on null: entry-name providers must be judged against
+ * real rows, never guessed. An absent DB file is a real state (no rows, so
+ * every entry name is dangling).
+ */
+function readConnectionRows(workspaceDir: string): Map<string, boolean> | null {
+  const dbPath = join(workspaceDir, "data", "db", "assistant.db");
+  if (!existsSync(dbPath)) {
+    return new Map();
+  }
+  let db: Database;
+  try {
+    db = new Database(dbPath, { readonly: true });
+  } catch {
+    return null;
+  }
+  try {
+    const rows = db
+      .query(`SELECT name, provider, auth FROM provider_connections`)
+      .all() as Array<{ name: string; provider: string; auth: string }>;
+    return new Map(
+      rows.map((row) => [
+        row.name,
+        row.provider === CHATGPT_IDENTITY || isSubscriptionAuth(row.auth),
+      ]),
+    );
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
+function isSubscriptionAuth(auth: string): boolean {
+  try {
+    const parsed: unknown = JSON.parse(auth);
+    return (
+      parsed !== null &&
+      typeof parsed === "object" &&
+      (parsed as { type?: unknown }).type === "oauth_subscription"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}

package/src/workspace/migrations/155-move-front-model-config-to-voice.ts

@@ -0,0 +1,78 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getLogger } from "../../util/logger.js";
+import type { WorkspaceMigration } from "./types.js";
+
+const log = getLogger("workspace-migration-155");
+
+/**
+ * Move `liveVoice.frontModel` to `voice.frontModel` in `config.json`.
+ *
+ * The front-door tuning (endpointing budgets and progress narration cadence)
+ * is read by phone calls as well as live voice, so it lives under a
+ * transport-agnostic key. A `voice.frontModel` already present wins field by
+ * field; the `liveVoice` block is removed either way so raw-config saves do
+ * not write it back.
+ */
+export const moveFrontModelConfigToVoiceMigration: WorkspaceMigration = {
+  id: "155-move-front-model-config-to-voice",
+  description: "Move liveVoice.frontModel to voice.frontModel in config.json",
+  run(workspaceDir: string): void {
+    const configPath = join(workspaceDir, "config.json");
+    if (!existsSync(configPath)) {
+      return;
+    }
+
+    let config: Record<string, unknown>;
+    try {
+      const raw = JSON.parse(readFileSync(configPath, "utf-8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return;
+      }
+      config = raw as Record<string, unknown>;
+    } catch {
+      return;
+    }
+
+    const liveVoice = readObject(config.liveVoice);
+    if (liveVoice === null || !Object.hasOwn(liveVoice, "frontModel")) {
+      return;
+    }
+    const legacy = readObject(liveVoice.frontModel);
+    delete liveVoice.frontModel;
+
+    if (legacy !== null) {
+      const voice = readObject(config.voice) ?? {};
+      const current = readObject(voice.frontModel) ?? {};
+      const legacyProgress = readObject(legacy.progress) ?? {};
+      const currentProgress = readObject(current.progress) ?? {};
+      const merged: Record<string, unknown> = { ...legacy, ...current };
+      if (
+        Object.keys(legacyProgress).length > 0 ||
+        Object.keys(currentProgress).length > 0
+      ) {
+        merged.progress = { ...legacyProgress, ...currentProgress };
+      }
+      voice.frontModel = merged;
+      config.voice = voice;
+    }
+
+    const tmpPath = `${configPath}.migration-155.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(config, null, 2) + "\n");
+    renameSync(tmpPath, configPath);
+    log.info("Moved liveVoice.frontModel to voice.frontModel in config.json");
+  },
+  retryFailedCheckpoint: true,
+  down(_workspaceDir: string): void {
+    // Forward-only: the schema reads voice.frontModel and strips unknown
+    // liveVoice keys, so a block moved back is dropped on the next load.
+  },
+};
+
+function readObject(value: unknown): Record<string, unknown> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}