@vellumai/assistant 0.3.27 → 0.4.0

package/src/runtime/channel-retry-sweep.ts

@@ -14,11 +14,20 @@ const log = getLogger('runtime-http');
 function parseGuardianRuntimeContext(value: unknown): GuardianRuntimeContext | undefined {
   if (!value || typeof value !== 'object') return undefined;
   const raw = value as Record<string, unknown>;
-  const actorRole = raw.actorRole;
+  const trustClass = raw.trustClass
+    ?? (
+      raw.actorRole === 'guardian'
+        ? 'guardian'
+        : raw.actorRole === 'non-guardian'
+          ? 'trusted_contact'
+          : raw.actorRole === 'unverified_channel'
+            ? 'unknown'
+            : undefined
+    );
   if (
-    actorRole !== 'guardian'
-    && actorRole !== 'non-guardian'
-    && actorRole !== 'unverified_channel'
+    trustClass !== 'guardian'
+    && trustClass !== 'trusted_contact'
+    && trustClass !== 'unknown'
   ) {
     return undefined;
   }
@@ -33,10 +42,13 @@ function parseGuardianRuntimeContext(value: unknown): GuardianRuntimeContext | u
       : undefined;
   return {
     sourceChannel,
-    actorRole,
+    trustClass,
     guardianChatId: typeof raw.guardianChatId === 'string' ? raw.guardianChatId : undefined,
     guardianExternalUserId: typeof raw.guardianExternalUserId === 'string' ? raw.guardianExternalUserId : undefined,
     requesterIdentifier: typeof raw.requesterIdentifier === 'string' ? raw.requesterIdentifier : undefined,
+    requesterDisplayName: typeof raw.requesterDisplayName === 'string' ? raw.requesterDisplayName : undefined,
+    requesterSenderDisplayName: typeof raw.requesterSenderDisplayName === 'string' ? raw.requesterSenderDisplayName : undefined,
+    requesterMemberDisplayName: typeof raw.requesterMemberDisplayName === 'string' ? raw.requesterMemberDisplayName : undefined,
     requesterExternalUserId: typeof raw.requesterExternalUserId === 'string' ? raw.requesterExternalUserId : undefined,
     requesterChatId: typeof raw.requesterChatId === 'string' ? raw.requesterChatId : undefined,
     denialReason,
@@ -117,7 +129,7 @@ export async function sweepFailedEvents(
           },
           assistantId,
           guardianContext,
-          isInteractive: guardianContext?.actorRole === 'guardian',
+          isInteractive: guardianContext?.trustClass === 'guardian',
         },
         sourceChannel,
         sourceInterface,

package/src/runtime/guardian-context-resolver.ts

@@ -1,106 +1,73 @@
 /**
- * Shared guardian actor-role resolution for inbound channels.
+ * Shared inbound trust resolution for channel actors.
  *
- * This module centralizes how we classify an inbound actor as
- * guardian/non-guardian/unverified so every channel path uses the same
- * source-of-truth logic.
+ * This module provides a compact route-level shape used by channel routes
+ * while delegating canonical classification to the unified actor trust
+ * resolver.
  */
 import type { ChannelId } from '../channels/types.js';
 import type { GuardianRuntimeContext } from '../daemon/session-runtime-assembly.js';
-import { normalizeAssistantId } from '../util/platform.js';
-import { getGuardianBinding } from './channel-guardian-service.js';
+import {
+  type DenialReason,
+  resolveActorTrust,
+  type ResolveActorTrustInput,
+  type TrustClass,
+} from './actor-trust-resolver.js';
+export type { DenialReason } from './actor-trust-resolver.js';
 
-/** Sub-reason for unverified-channel denials. */
-export type DenialReason = 'no_binding' | 'no_identity';
-export type ActorRole = 'guardian' | 'non-guardian' | 'unverified_channel';
+/** Trust classification used by route-level channel logic. */
+export type ActorTrustClass = TrustClass;
 
 /** Guardian actor context used by route-level approval logic. */
 export interface GuardianContext {
-  actorRole: ActorRole;
+  trustClass: ActorTrustClass;
   guardianChatId?: string;
   guardianExternalUserId?: string;
   requesterIdentifier?: string;
+  requesterDisplayName?: string;
+  requesterSenderDisplayName?: string;
+  requesterMemberDisplayName?: string;
   requesterExternalUserId?: string;
   requesterChatId?: string;
+  memberStatus?: string;
+  memberPolicy?: string;
   denialReason?: DenialReason;
 }
 
-export interface ResolveGuardianContextInput {
-  assistantId: string;
-  sourceChannel: ChannelId;
-  externalChatId: string;
-  senderExternalUserId?: string;
-  senderUsername?: string;
-}
+export type ResolveGuardianContextInput = ResolveActorTrustInput;
 
 /**
- * Resolve guardian actor role from canonical binding state + sender identity.
- *
- * Behavior:
- * - sender matches active binding -> guardian
- * - active binding exists but sender differs -> non-guardian
- * - no sender identity -> unverified_channel (no_identity)
- * - no binding -> unverified_channel (no_binding)
+ * Resolve route-level trust context from canonical identity state.
  */
 export function resolveGuardianContext(input: ResolveGuardianContextInput): GuardianContext {
-  const assistantId = normalizeAssistantId(input.assistantId);
-  const senderExternalUserId = typeof input.senderExternalUserId === 'string' && input.senderExternalUserId.trim().length > 0
-    ? input.senderExternalUserId.trim()
-    : undefined;
-  const senderUsername = typeof input.senderUsername === 'string' && input.senderUsername.trim().length > 0
-    ? input.senderUsername.trim()
-    : undefined;
-  const requesterIdentifier = senderUsername ? `@${senderUsername}` : senderExternalUserId;
-
-  if (!senderExternalUserId) {
-    return {
-      actorRole: 'unverified_channel',
-      denialReason: 'no_identity',
-      requesterIdentifier,
-      requesterExternalUserId: undefined,
-      requesterChatId: input.externalChatId,
-    };
-  }
-
-  const binding = getGuardianBinding(assistantId, input.sourceChannel);
-  if (!binding) {
-    return {
-      actorRole: 'unverified_channel',
-      denialReason: 'no_binding',
-      requesterIdentifier,
-      requesterExternalUserId: senderExternalUserId,
-      requesterChatId: input.externalChatId,
-    };
-  }
-
-  if (binding.guardianExternalUserId === senderExternalUserId) {
-    return {
-      actorRole: 'guardian',
-      guardianChatId: binding.guardianDeliveryChatId || input.externalChatId,
-      guardianExternalUserId: binding.guardianExternalUserId,
-      requesterIdentifier,
-      requesterExternalUserId: senderExternalUserId,
-      requesterChatId: input.externalChatId,
-    };
-  }
-
+  const trust = resolveActorTrust(input);
   return {
-    actorRole: 'non-guardian',
-    guardianChatId: binding.guardianDeliveryChatId,
-    guardianExternalUserId: binding.guardianExternalUserId,
-    requesterIdentifier,
-    requesterExternalUserId: senderExternalUserId,
+    trustClass: trust.trustClass,
+    guardianChatId: trust.guardianBindingMatch?.guardianDeliveryChatId ??
+      (trust.trustClass === 'guardian' ? input.externalChatId : undefined),
+    guardianExternalUserId: trust.guardianBindingMatch?.guardianExternalUserId,
+    requesterIdentifier: trust.actorMetadata.identifier,
+    requesterDisplayName: trust.actorMetadata.displayName,
+    requesterSenderDisplayName: trust.actorMetadata.senderDisplayName,
+    requesterMemberDisplayName: trust.actorMetadata.memberDisplayName,
+    requesterExternalUserId: trust.canonicalSenderId ?? undefined,
     requesterChatId: input.externalChatId,
+    memberStatus: trust.memberRecord?.status ?? undefined,
+    memberPolicy: trust.memberRecord?.policy ?? undefined,
+    denialReason: trust.denialReason,
   };
 }
 
 export function toGuardianRuntimeContext(sourceChannel: ChannelId, ctx: GuardianContext): GuardianRuntimeContext {
   return {
     sourceChannel,
-    actorRole: ctx.actorRole,
+    trustClass: ctx.trustClass,
     guardianChatId: ctx.guardianChatId,
     guardianExternalUserId: ctx.guardianExternalUserId,
     requesterIdentifier: ctx.requesterIdentifier,
+    requesterDisplayName: ctx.requesterDisplayName,
+    requesterSenderDisplayName: ctx.requesterSenderDisplayName,
+    requesterMemberDisplayName: ctx.requesterMemberDisplayName,
     requesterExternalUserId: ctx.requesterExternalUserId,
     requesterChatId: ctx.requesterChatId,
     denialReason: ctx.denialReason,

package/src/runtime/guardian-decision-types.ts

@@ -22,6 +22,12 @@ export interface GuardianDecisionPrompt {
   expiresAt: number;
   conversationId: string;
   callSessionId: string | null;
+  /**
+   * Canonical request kind (e.g. 'tool_approval', 'pending_question').
+   * Present when the prompt originates from the canonical guardian request
+   * store. Absent for legacy-only prompts.
+   */
+  kind?: string;
 }
 
 export interface GuardianDecisionAction {