@vellumai/assistant 0.6.4 → 0.6.6

package/src/notifications/copy-composer.ts

@@ -313,11 +313,6 @@ const TEMPLATES: Partial<Record<NotificationSourceEventName, CopyTemplate>> = {
     body: str(payload.message, str(payload.label, "A reminder has fired")),
   }),
 
-  "schedule.complete": (payload) => ({
-    title: "Schedule Complete",
-    body: `${str(payload.name, "A schedule")} has finished running`,
-  }),
-
   "guardian.question": (payload) => {
     const question = str(
       payload.questionText,

package/src/notifications/decision-engine.ts

@@ -12,7 +12,6 @@
 import { v4 as uuid } from "uuid";
 
 import { getDeliverableChannels } from "../channels/config.js";
-import { getConfig } from "../config/loader.js";
 import { listGuardianChannels } from "../contacts/contact-store.js";
 import { resolveGuardianPersona } from "../prompts/persona-resolver.js";
 import { buildCoreIdentityContext } from "../prompts/system-prompt.js";
@@ -22,7 +21,7 @@ import {
   getConfiguredProvider,
   userMessage,
 } from "../providers/provider-send-message.js";
-import type { ModelIntent, Provider } from "../providers/types.js";
+import type { Provider } from "../providers/types.js";
 import { getLogger } from "../util/logger.js";
 import { truncate } from "../util/truncate.js";
 import {
@@ -717,9 +716,6 @@ export async function evaluateSignal(
   availableChannels: NotificationChannel[],
   preferenceContext?: string,
 ): Promise<NotificationDecision> {
-  const config = getConfig();
-  const decisionModelIntent = config.notifications.decisionModelIntent;
-
   // When no explicit preference context is provided, load the user's
   // stored notification preferences from the memory-backed store.
   // Wrapped in try/catch so a DB failure doesn't break the decision path.
@@ -750,7 +746,7 @@ export async function evaluateSignal(
     );
   }
 
-  const provider = await getConfiguredProvider();
+  const provider = await getConfiguredProvider("notificationDecision");
   if (!provider) {
     log.warn(
       "Configured provider unavailable for notification decision, using fallback",
@@ -774,7 +770,6 @@ export async function evaluateSignal(
       signal,
       availableChannels,
       resolvedPreferenceContext,
-      decisionModelIntent,
       candidateSet,
     );
   } catch (err) {
@@ -805,7 +800,6 @@ async function classifyWithLLM(
   signal: NotificationSignal,
   availableChannels: NotificationChannel[],
   preferenceContext: string | undefined,
-  modelIntent: ModelIntent,
   candidateSet?: ConversationCandidateSet,
 ): Promise<NotificationDecision> {
   const { signal: abortSignal, cleanup } = createTimeout(DECISION_TIMEOUT_MS);
@@ -858,7 +852,7 @@ async function classifyWithLLM(
       systemPrompt,
       {
         config: {
-          modelIntent,
+          callSite: "notificationDecision",
           max_tokens: 2048,
           tool_choice: {
             type: "tool" as const,

package/src/notifications/emit-signal.ts

@@ -146,7 +146,7 @@ function getConnectedChannels(): NotificationChannel[] {
 // ── Public API ─────────────────────────────────────────────────────────
 
 export interface EmitSignalParams<TEventName extends string = string> {
-  /** Free-form event name, e.g. 'schedule.notify', 'schedule.complete'. */
+  /** Free-form event name, e.g. 'schedule.notify', 'guardian.question'. */
   sourceEventName: TEventName;
   /** Source channel that produced the event — must be a registered channel. */
   sourceChannel: NotificationSourceChannel;

package/src/notifications/preference-extractor.ts

@@ -11,7 +11,6 @@
  * - "Weeknights after 10pm: only critical notifications"
  */
 
-import { getConfig } from "../config/loader.js";
 import {
   createTimeout,
   extractToolUse,
@@ -140,15 +139,12 @@ const EXTRACTION_TOOL = {
 export async function extractPreferences(
   message: string,
 ): Promise<ExtractionResult> {
-  const provider = await getConfiguredProvider();
+  const provider = await getConfiguredProvider("preferenceExtraction");
   if (!provider) {
     log.debug("No provider available for preference extraction");
     return { detected: false, preferences: [] };
   }
 
-  const config = getConfig();
-  const modelIntent = config.notifications.decisionModelIntent;
-
   const { signal, cleanup } = createTimeout(EXTRACTION_TIMEOUT_MS);
 
   try {
@@ -158,7 +154,7 @@ export async function extractPreferences(
       SYSTEM_PROMPT,
       {
         config: {
-          modelIntent,
+          callSite: "preferenceExtraction",
           max_tokens: 1024,
           tool_choice: {
             type: "tool" as const,

package/src/notifications/signal.ts

@@ -41,7 +41,6 @@ export const NOTIFICATION_SOURCE_EVENT_NAMES = [
     id: "schedule.notify",
     description: "Scheduled notification triggered (one-shot or recurring)",
   },
-  { id: "schedule.complete", description: "Scheduled task finished running" },
   {
     id: "guardian.question",
     description: "Guardian approval question requiring response",
@@ -191,7 +190,7 @@ export interface NotificationSignal<TEventName extends string = string> {
   createdAt: number; // epoch ms
   sourceChannel: NotificationSourceChannel; // see NOTIFICATION_SOURCE_CHANNELS registry
   sourceContextId: string;
-  sourceEventName: TEventName; // free-form: 'reminder_fired', 'schedule_complete', 'guardian_question', etc.
+  sourceEventName: TEventName; // free-form: 'reminder_fired', 'guardian_question', etc.
   contextPayload: NotificationContextPayload<TEventName>;
   attentionHints: AttentionHints;
   /** Routing intent from the source (e.g. reminder). Controls post-decision channel enforcement. */

package/src/oauth/AGENTS.md

@@ -6,7 +6,7 @@ When introducing a new built-in OAuth integration (one that appears in `seed-pro
 
 ### 1. Seed the provider — `seed-providers.ts`
 
-Add an entry to `PROVIDER_SEED_DATA`. Required fields: `provider`, `authorizeUrl`, `tokenExchangeUrl`, `defaultScopes`, `scopePolicy`, `displayLabel`, `description`, `dashboardUrl`, `clientIdPlaceholder`, `logoUrl`, and `injectionTemplates`. See existing entries for the full shape. The `provider` key must be snake_case and is used as the canonical identifier everywhere else.
+Add an entry to `PROVIDER_SEED_DATA`. Required fields: `provider`, `authorizeUrl`, `tokenExchangeUrl`, `defaultScopes`, `displayLabel`, `description`, `dashboardUrl`, `clientIdPlaceholder`, `logoUrl`, and `injectionTemplates`. Optional: `availableScopes` — either a structured array of `{scope, description?}` objects or a URL string pointing to the provider's scope documentation. See existing entries for the full shape. The `provider` key must be snake_case and is used as the canonical identifier everywhere else.
 
 If the provider will support managed mode, set `managedServiceConfigKey` to a slug matching the key you will add to `ServicesSchema` (e.g. `"acme-oauth"`).
 

package/src/oauth/__tests__/identity-verifier.test.ts

@@ -38,7 +38,7 @@ function makeProviderRow(
     userinfoUrl: null,
     baseUrl: null,
     defaultScopes: "[]",
-    scopePolicy: "{}",
+    availableScopes: null,
     scopeSeparator: " ",
     authorizeParams: null,
     pingUrl: null,
@@ -48,6 +48,7 @@ function makeProviderRow(
     revokeUrl: null,
     revokeBodyTemplate: null,
     managedServiceConfigKey: null,
+    managedServiceIsPaid: false,
     displayLabel: null,
     description: null,
     dashboardUrl: null,

package/src/oauth/connect-orchestrator.ts

@@ -13,7 +13,6 @@
  *
  * The orchestrator handles:
  * - Provider config resolution (from DB)
- * - Scope policy enforcement
  * - Building the OAuth2Config
  * - Running the interactive or deferred flow
  * - Storing tokens on completion
@@ -23,10 +22,9 @@
 import type { TokenEndpointAuthMethod } from "../security/oauth2.js";
 import { prepareOAuth2Flow, startOAuth2Flow } from "../security/oauth2.js";
 import { getLogger } from "../util/logger.js";
-import type { OAuthConnectResult, OAuthScopePolicy } from "./connect-types.js";
+import type { OAuthConnectResult } from "./connect-types.js";
 import { verifyIdentity } from "./identity-verifier.js";
 import { getProvider } from "./oauth-store.js";
-import { resolveScopes } from "./scope-policy.js";
 import { storeOAuth2Tokens } from "./token-persistence.js";
 
 const log = getLogger("oauth-connect-orchestrator");
@@ -52,7 +50,7 @@ function safeJsonParse<T>(value: string | null | undefined, fallback: T): T {
 export interface OAuthConnectOptions {
   /** Canonical service name (e.g. "google", "slack"). */
   service: string;
-  /** Scopes to request beyond the provider's defaults. */
+  /** Scopes to request. When provided, used instead of the provider's default scopes. */
   requestedScopes?: string[];
   /** OAuth2 client ID (required). */
   clientId: string;
@@ -122,18 +120,6 @@ export async function orchestrateOAuthConnect(
   }
 
   // Deserialize JSON fields from the DB row
-  const dbDefaultScopes = safeJsonParse<string[]>(
-    providerRow.defaultScopes,
-    [],
-  );
-  const dbScopePolicy = safeJsonParse<OAuthScopePolicy>(
-    providerRow.scopePolicy,
-    {
-      allowAdditionalScopes: false,
-      allowedOptionalScopes: [],
-      forbiddenScopes: [],
-    },
-  );
   const dbAuthorizeParams = safeJsonParse<Record<string, string> | undefined>(
     providerRow.authorizeParams,
     undefined,
@@ -151,24 +137,12 @@ export async function orchestrateOAuthConnect(
     options.callbackTransport ?? "loopback";
   const loopbackPort = providerRow.loopbackPort ?? undefined;
 
-  // Resolve scopes via the scope policy engine
-  const scopeProfile = {
-    service: options.service,
-    defaultScopes: dbDefaultScopes,
-    scopePolicy: dbScopePolicy,
-  };
-  const scopeResult = resolveScopes(scopeProfile, options.requestedScopes);
-  if (!scopeResult.ok) {
-    const guidance = scopeResult.allowedScopes
-      ? ` Allowed scopes: ${scopeResult.allowedScopes.join(", ")}`
-      : "";
-    return {
-      success: false,
-      error: `${scopeResult.error}${guidance}`,
-      safeError: true,
-    };
-  }
-  const finalScopes = scopeResult.scopes;
+  // Resolve scopes: use requested scopes when provided, otherwise fall back
+  // to the provider's default scopes. No validation layer — the OAuth
+  // provider itself rejects invalid scopes.
+  const finalScopes = options.requestedScopes?.length
+    ? options.requestedScopes
+    : safeJsonParse<string[]>(providerRow.defaultScopes, []);
 
   if (!authorizeUrl) {
     return {

package/src/oauth/connect-types.ts

@@ -12,18 +12,14 @@
  */
 
 // ---------------------------------------------------------------------------
-// Scope policy
+// Available scopes
 // ---------------------------------------------------------------------------
 
-/** Controls which additional scopes may be requested beyond the default set. */
-export interface OAuthScopePolicy {
-  /** Whether callers may request scopes not listed in defaultScopes. */
-  allowAdditionalScopes: boolean;
-  /** Scopes that may optionally be added beyond the defaults. */
-  allowedOptionalScopes: string[];
-  /** Scopes that must never be requested, regardless of other settings. */
-  forbiddenScopes: string[];
-}
+/** Informational scope metadata for the assistant. Either a structured list
+ * of scopes with optional descriptions, or a URL to the provider's scope docs. */
+export type AvailableScopes =
+  | Array<{ scope: string; description?: string }>
+  | string;
 
 // ---------------------------------------------------------------------------
 // Connect result

package/src/oauth/manual-token-connection.ts

@@ -21,6 +21,29 @@ import {
 /** Sentinel client_id used for non-OAuth providers that don't have a real app. */
 const MANUAL_TOKEN_CLIENT_ID = "manual-config";
 
+/**
+ * Return the secure-store key holding the primary access token for a
+ * manual-token provider, or null for OAuth providers whose tokens live at
+ * `oauth_connection/<id>/access_token`.
+ *
+ * Manual-token providers store their tokens under `credential/<provider>/<field>`
+ * via the generic credential store, so any code that validates tokens for these
+ * providers (e.g. credential-health checks) must resolve the path through here
+ * rather than assuming the OAuth access-token path.
+ */
+export function manualTokenAccessCredentialKey(
+  provider: string,
+): string | null {
+  switch (provider) {
+    case "slack_channel":
+      return credentialKey("slack_channel", "bot_token");
+    case "telegram":
+      return credentialKey("telegram", "bot_token");
+    default:
+      return null;
+  }
+}
+
 /**
  * Ensure an active oauth_connection row exists for the given manual-token
  * provider. Creates the synthetic oauth_app row on first use.

package/src/oauth/oauth-store.ts

@@ -1,7 +1,7 @@
 /**
  * CRUD store for OAuth providers, apps, and connections.
  *
- * Backed by Drizzle + SQLite. All JSON fields (default_scopes, scope_policy,
+ * Backed by Drizzle + SQLite. All JSON fields (default_scopes, available_scopes,
  * extra_params, granted_scopes, metadata) are stored as serialized JSON strings.
  *
  * Note: TS field names use camelCase from the platform's naming
@@ -31,6 +31,7 @@ import {
   setSecureKeyAsync,
 } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
+import type { AvailableScopes } from "./connect-types.js";
 import { tryRevokeOAuthToken } from "./revoke.js";
 
 const log = getLogger("oauth-store");
@@ -56,12 +57,10 @@ export type OAuthConnectionRow = typeof oauthConnections.$inferSelect;
  * loopbackPort, injectionTemplates, appType, setupNotes,
  * identityUrl, identityMethod, identityHeaders, identityBody,
  * identityResponsePaths, identityFormat, identityOkField, featureFlag,
- * scopeSeparator)
+ * scopeSeparator, defaultScopes, availableScopes)
  * and display metadata (displayLabel, description, dashboardUrl,
  * clientIdPlaceholder, logoUrl, requiresClientSecret) propagate to existing
- * installations on every startup, while user-customizable fields
- * (defaultScopes, scopePolicy) are only written on the
- * initial insert. baseUrl is backfilled from seed data when null
+ * installations on every startup. baseUrl is backfilled from seed data when null
  * (e.g. legacy rows created before the column existed) but preserved
  * if the user has set a custom value.
  */
@@ -82,10 +81,11 @@ export function seedProviders(
     revokeBodyTemplate?: Record<string, string>;
     baseUrl?: string;
     defaultScopes: string[];
-    scopePolicy: Record<string, unknown>;
+    availableScopes?: AvailableScopes;
     scopeSeparator?: string;
     authorizeParams?: Record<string, string>;
     managedServiceConfigKey?: string;
+    managedServiceIsPaid?: boolean;
     displayLabel?: string;
     description?: string;
     dashboardUrl?: string | null;
@@ -136,7 +136,9 @@ export function seedProviders(
       : null;
     const baseUrl = p.baseUrl ?? null;
     const defaultScopes = JSON.stringify(p.defaultScopes);
-    const scopePolicy = JSON.stringify(p.scopePolicy);
+    const availableScopes = p.availableScopes
+      ? JSON.stringify(p.availableScopes)
+      : null;
     // Coerce empty string to the default space separator. An empty separator
     // would join scopes into a single concatenated token (e.g. "readwrite"),
     // which is never a valid OAuth authorize URL value.
@@ -145,6 +147,7 @@ export function seedProviders(
       ? JSON.stringify(p.authorizeParams)
       : null;
     const managedServiceConfigKey = p.managedServiceConfigKey ?? null;
+    const managedServiceIsPaid = p.managedServiceIsPaid === true;
     const displayLabel = p.displayLabel ?? null;
     const description = p.description ?? null;
     const dashboardUrl = p.dashboardUrl ?? null;
@@ -182,7 +185,7 @@ export function seedProviders(
         userinfoUrl,
         baseUrl,
         defaultScopes,
-        scopePolicy,
+        availableScopes,
         scopeSeparator,
         authorizeParams,
         pingUrl,
@@ -192,6 +195,7 @@ export function seedProviders(
         revokeUrl,
         revokeBodyTemplate,
         managedServiceConfigKey,
+        managedServiceIsPaid,
         displayLabel,
         description,
         dashboardUrl,
@@ -223,6 +227,8 @@ export function seedProviders(
           tokenExchangeBodyFormat,
           userinfoUrl,
           baseUrl: sql`COALESCE(${oauthProviders.baseUrl}, ${baseUrl})`,
+          defaultScopes,
+          availableScopes,
           scopeSeparator,
           authorizeParams,
           pingUrl,
@@ -232,6 +238,7 @@ export function seedProviders(
           revokeUrl,
           revokeBodyTemplate,
           managedServiceConfigKey,
+          managedServiceIsPaid,
           displayLabel,
           description,
           dashboardUrl,
@@ -293,10 +300,11 @@ export function registerProvider(params: {
   revokeBodyTemplate?: Record<string, string>;
   baseUrl?: string;
   defaultScopes: string[];
-  scopePolicy: Record<string, unknown>;
+  availableScopes?: AvailableScopes;
   scopeSeparator?: string;
   authorizeParams?: Record<string, string>;
   managedServiceConfigKey?: string;
+  managedServiceIsPaid?: boolean;
   displayLabel?: string;
   description?: string;
   dashboardUrl?: string;
@@ -340,7 +348,9 @@ export function registerProvider(params: {
     userinfoUrl: params.userinfoUrl ?? null,
     baseUrl: params.baseUrl ?? null,
     defaultScopes: JSON.stringify(params.defaultScopes),
-    scopePolicy: JSON.stringify(params.scopePolicy),
+    availableScopes: params.availableScopes
+      ? JSON.stringify(params.availableScopes)
+      : null,
     // Coerce empty string to the default space separator (see seedProviders).
     scopeSeparator: params.scopeSeparator || " ",
     authorizeParams: params.authorizeParams
@@ -356,6 +366,7 @@ export function registerProvider(params: {
       ? JSON.stringify(params.revokeBodyTemplate)
       : null,
     managedServiceConfigKey: params.managedServiceConfigKey ?? null,
+    managedServiceIsPaid: params.managedServiceIsPaid === true,
     displayLabel: params.displayLabel ?? null,
     description: params.description ?? null,
     dashboardUrl: params.dashboardUrl ?? null,
@@ -395,7 +406,7 @@ export function registerProvider(params: {
 /**
  * Update mutable fields on an existing provider. Only the fields explicitly
  * provided (not `undefined`) are written; everything else is left unchanged.
- * JSON fields (defaultScopes, scopePolicy, authorizeParams, pingHeaders, pingBody)
+ * JSON fields (defaultScopes, availableScopes, authorizeParams, pingHeaders, pingBody)
  * are serialized with JSON.stringify before storage.
  *
  * Returns the updated provider row, or `undefined` if no provider with the
@@ -418,7 +429,7 @@ export function updateProvider(
     revokeBodyTemplate: Record<string, string> | null;
     baseUrl: string;
     defaultScopes: string[];
-    scopePolicy: Record<string, unknown>;
+    availableScopes: AvailableScopes | null;
     scopeSeparator: string;
     authorizeParams: Record<string, string>;
     displayLabel: string;
@@ -444,6 +455,7 @@ export function updateProvider(
     identityFormat: string;
     identityOkField: string;
     featureFlag: string;
+    managedServiceIsPaid: boolean;
   }>,
 ): OAuthProviderRow | undefined {
   const existing = getProvider(provider);
@@ -477,8 +489,11 @@ export function updateProvider(
   if (params.baseUrl !== undefined) set.baseUrl = params.baseUrl;
   if (params.defaultScopes !== undefined)
     set.defaultScopes = JSON.stringify(params.defaultScopes);
-  if (params.scopePolicy !== undefined)
-    set.scopePolicy = JSON.stringify(params.scopePolicy);
+  if (params.availableScopes !== undefined)
+    set.availableScopes =
+      params.availableScopes === null
+        ? null
+        : JSON.stringify(params.availableScopes);
   if (params.scopeSeparator !== undefined)
     // Coerce empty string to the default space separator (see seedProviders).
     set.scopeSeparator = params.scopeSeparator || " ";
@@ -512,6 +527,8 @@ export function updateProvider(
   if (params.identityOkField !== undefined)
     set.identityOkField = params.identityOkField;
   if (params.featureFlag !== undefined) set.featureFlag = params.featureFlag;
+  if (params.managedServiceIsPaid !== undefined)
+    set.managedServiceIsPaid = params.managedServiceIsPaid;
 
   db.update(oauthProviders)
     .set(set)

package/src/oauth/platform-connection.test.ts

@@ -12,6 +12,7 @@ import type { VellumPlatformClient } from "../platform/client.js";
 import { BackendError, VellumError } from "../util/errors.js";
 import {
   CredentialRequiredError,
+  InsufficientBalanceError,
   PlatformOAuthConnection,
   ProviderUnreachableError,
 } from "./platform-connection.js";
@@ -199,6 +200,52 @@ describe("PlatformOAuthConnection", () => {
     const provErr = new ProviderUnreachableError();
     expect(provErr).toBeInstanceOf(BackendError);
     expect(provErr).toBeInstanceOf(VellumError);
+
+    const balErr = new InsufficientBalanceError();
+    expect(balErr).toBeInstanceOf(BackendError);
+    expect(balErr).toBeInstanceOf(VellumError);
+  });
+
+  test("402 response throws InsufficientBalanceError", async () => {
+    const client = makeMockClient(
+      mock(
+        async () => new Response("", { status: 402 }),
+      ) as unknown as typeof globalThis.fetch,
+    );
+
+    const conn = new PlatformOAuthConnection({ ...DEFAULT_OPTIONS, client });
+    await expect(
+      conn.request({ method: "GET", path: "/test" }),
+    ).rejects.toThrow(InsufficientBalanceError);
+  });
+
+  test("402 response includes actionable billing message", async () => {
+    const client = makeMockClient(
+      mock(
+        async () => new Response("", { status: 402 }),
+      ) as unknown as typeof globalThis.fetch,
+    );
+
+    const conn = new PlatformOAuthConnection({ ...DEFAULT_OPTIONS, client });
+    await expect(
+      conn.request({ method: "GET", path: "/test" }),
+    ).rejects.toThrow(/add funds/i);
+  });
+
+  test("does not retry on 402", async () => {
+    let callCount = 0;
+    const client = makeMockClient(
+      mock(async () => {
+        callCount++;
+        return new Response("", { status: 402 });
+      }) as unknown as typeof globalThis.fetch,
+    );
+
+    const conn = new PlatformOAuthConnection({ ...DEFAULT_OPTIONS, client });
+    await expect(
+      conn.request({ method: "GET", path: "/test" }),
+    ).rejects.toThrow(InsufficientBalanceError);
+    expect(callCount).toBe(1);
   });
 
   test("424 response throws CredentialRequiredError", async () => {

package/src/oauth/platform-connection.ts

@@ -1,10 +1,6 @@
 import type { VellumPlatformClient } from "../platform/client.js";
 import { BackendError } from "../util/errors.js";
-import {
-  getHttpRetryDelay,
-  isRetryableStatus,
-  sleep,
-} from "../util/retry.js";
+import { getHttpRetryDelay, isRetryableStatus, sleep } from "../util/retry.js";
 import type {
   OAuthConnection,
   OAuthConnectionRequest,
@@ -27,6 +23,16 @@ export class ProviderUnreachableError extends BackendError {
   }
 }
 
+export class InsufficientBalanceError extends BackendError {
+  constructor(
+    message = "Your Vellum account balance is too low to use this managed OAuth connection. " +
+      "You can add funds or switch to using your own OAuth app.",
+  ) {
+    super(message);
+    this.name = "InsufficientBalanceError";
+  }
+}
+
 export interface PlatformOAuthConnectionOptions {
   id: string;
   provider: string;
@@ -93,6 +99,10 @@ export class PlatformOAuthConnection implements OAuthConnection {
         signal: req.signal,
       });
 
+      if (response.status === 402) {
+        throw new InsufficientBalanceError();
+      }
+
       if (response.status === 424) {
         throw new CredentialRequiredError();
       }

package/src/oauth/provider-serializer.ts

@@ -32,6 +32,7 @@ export interface SerializedProviderSummary {
   requires_client_secret: boolean;
   logo_url: string | null;
   supports_managed_mode: boolean;
+  managed_service_is_paid: boolean;
   feature_flag: string | null;
 }
 
@@ -86,8 +87,11 @@ function _serializeProvider(
     clientIdPlaceholder: row.clientIdPlaceholder ?? null,
     requiresClientSecret: !!(row.requiresClientSecret ?? 1),
     supportsManagedMode: !!row.managedServiceConfigKey,
+    managedServiceIsPaid: !!row.managedServiceIsPaid,
     defaultScopes: row.defaultScopes ? JSON.parse(row.defaultScopes) : [],
-    scopePolicy: row.scopePolicy ? JSON.parse(row.scopePolicy) : {},
+    availableScopes: row.availableScopes
+      ? JSON.parse(row.availableScopes)
+      : null,
     scopeSeparator: row.scopeSeparator,
     extraParams: authorizeParams ? JSON.parse(authorizeParams) : null,
     pingHeaders: row.pingHeaders ? JSON.parse(row.pingHeaders) : null,
@@ -140,6 +144,7 @@ export function serializeProviderSummary(
     requires_client_secret: !!(row.requiresClientSecret ?? 1),
     logo_url: row.logoUrl ?? null,
     supports_managed_mode: !!row.managedServiceConfigKey,
+    managed_service_is_paid: !!row.managedServiceIsPaid,
     feature_flag: row.featureFlag ?? null,
   };
 }