@vellumai/assistant 0.7.0 → 0.7.1

package/src/runtime/routes/types.ts

@@ -113,10 +113,10 @@ export interface RouteDefinition {
    */
   isPublic?: boolean;
   /**
-   * When true, the route requires scope-based policy enforcement that
-   * the HTTP server performs via `enforcePolicy()`. The IPC adapter
-   * excludes these routes until the gateway implements equivalent
-   * scope checking (ATL-315).
+   * When true, the route requires scope-based policy enforcement.
+   * The HTTP server enforces via `enforcePolicy()`. The IPC adapter
+   * includes the resolved policy in the route schema so the gateway's
+   * IPC proxy enforces equivalent scope/principal checks.
    */
   requirePolicyEnforcement?: boolean;
   /**

package/src/runtime/routes/upgrade-broadcast-routes.ts

@@ -12,7 +12,6 @@ import type {
 } from "../../daemon/message-types/upgrades.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -50,9 +49,7 @@ async function handleUpgradeBroadcast({ body }: RouteHandlerArgs) {
       expectedDowntimeSeconds: downtime,
     };
 
-    await assistantEventHub.publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message),
-    );
+    await assistantEventHub.publish(buildAssistantEvent(message));
 
     return { ok: true };
   }
@@ -71,9 +68,7 @@ async function handleUpgradeBroadcast({ body }: RouteHandlerArgs) {
       statusMessage,
     };
 
-    await assistantEventHub.publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message),
-    );
+    await assistantEventHub.publish(buildAssistantEvent(message));
 
     return { ok: true };
   }
@@ -114,9 +109,7 @@ async function handleUpgradeBroadcast({ body }: RouteHandlerArgs) {
         : {}),
     };
 
-    await assistantEventHub.publish(
-      buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, message),
-    );
+    await assistantEventHub.publish(buildAssistantEvent(message));
 
     return { ok: true };
   }

package/src/runtime/routes/usage-routes.ts

@@ -3,7 +3,8 @@
  *
  * GET /v1/usage/totals?from=&to=              — aggregate totals for a time range
  * GET /v1/usage/daily?from=&to=               — per-day buckets for a time range
- * GET /v1/usage/breakdown?from=&to=&groupBy=  — grouped breakdown (actor, provider, model, or conversation)
+ * GET /v1/usage/breakdown?from=&to=&groupBy=  — grouped breakdown
+ * GET /v1/usage/series?from=&to=&granularity=&groupBy= — grouped time-series buckets
  */
 
 import { z } from "zod";
@@ -11,14 +12,22 @@ import { z } from "zod";
 import {
   getUsageDayBuckets,
   getUsageGroupBreakdown,
+  getUsageGroupedSeries,
   getUsageHourBuckets,
   getUsageTotals,
+  type GroupByDimension,
+  USAGE_GROUP_BY_DIMENSIONS,
+  USAGE_SERIES_GROUP_BY_DIMENSIONS,
+  type UsageGranularity,
 } from "../../memory/llm-usage-store.js";
 import { validateTimezone } from "../../memory/usage-buckets.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-const VALID_GROUP_BY = new Set(["actor", "provider", "model", "conversation"]);
+const VALID_GROUP_BY = new Set<string>(USAGE_GROUP_BY_DIMENSIONS);
+const VALID_SERIES_GROUP_BY = new Set<string>(USAGE_SERIES_GROUP_BY_DIMENSIONS);
+const GROUP_BY_DESCRIPTION = USAGE_GROUP_BY_DIMENSIONS.join(", ");
+const SERIES_GROUP_BY_DESCRIPTION = USAGE_SERIES_GROUP_BY_DIMENSIONS.join(", ");
 
 function resolveTimezone(queryParams: Record<string, string>): string {
   const tz = queryParams.tz ?? "UTC";
@@ -88,20 +97,50 @@ function handleUsageBreakdown({ queryParams }: RouteHandlerArgs) {
   const groupBy = qp.groupBy;
   if (!groupBy) {
     throw new BadRequestError(
-      'Missing required query parameter: "groupBy" (one of: actor, provider, model, conversation)',
+      `Missing required query parameter: "groupBy" (one of: ${GROUP_BY_DESCRIPTION})`,
     );
   }
   if (!VALID_GROUP_BY.has(groupBy)) {
     throw new BadRequestError(
-      `Invalid "groupBy" value: "${groupBy}". Must be one of: actor, provider, model, conversation`,
+      `Invalid "groupBy" value: "${groupBy}". Must be one of: ${GROUP_BY_DESCRIPTION}`,
     );
   }
 
-  const breakdown = getUsageGroupBreakdown(
+  const breakdown = getUsageGroupBreakdown(range, groupBy as GroupByDimension);
+  return { breakdown };
+}
+
+function handleUsageSeries({ queryParams }: RouteHandlerArgs) {
+  const qp = queryParams ?? {};
+  const range = parseTimeRange(qp);
+  const granularity = qp.granularity ?? "daily";
+  if (granularity !== "daily" && granularity !== "hourly") {
+    throw new BadRequestError(
+      `Invalid "granularity" value: "${granularity}". Must be one of: daily, hourly`,
+    );
+  }
+
+  const groupBy = qp.groupBy;
+  if (!groupBy) {
+    throw new BadRequestError(
+      `Missing required query parameter: "groupBy" (one of: ${SERIES_GROUP_BY_DESCRIPTION})`,
+    );
+  }
+  if (!VALID_SERIES_GROUP_BY.has(groupBy)) {
+    throw new BadRequestError(
+      `Invalid "groupBy" value: "${groupBy}". Must be one of: ${SERIES_GROUP_BY_DESCRIPTION}`,
+    );
+  }
+
+  const tz = resolveTimezone(qp);
+  const buckets = getUsageGroupedSeries(
     range,
-    groupBy as "actor" | "provider" | "model" | "conversation",
+    groupBy as Exclude<GroupByDimension, "conversation">,
+    granularity as UsageGranularity,
+    tz,
+    { fillEmpty: true },
   );
-  return { breakdown };
+  return { buckets };
 }
 
 export const ROUTES: RouteDefinition[] = [
@@ -166,7 +205,7 @@ export const ROUTES: RouteDefinition[] = [
     method: "GET",
     summary: "Get usage breakdown",
     description:
-      "Return grouped usage breakdown (by actor, provider, model, or conversation).",
+      "Return grouped usage breakdown. Prefer call_site for user-facing task breakdowns; actor is a legacy/internal dimension.",
     tags: ["usage"],
     queryParams: [
       {
@@ -181,8 +220,7 @@ export const ROUTES: RouteDefinition[] = [
       },
       {
         name: "groupBy",
-        description:
-          "Group by: actor, provider, model, or conversation (required)",
+        description: `Group by: ${GROUP_BY_DESCRIPTION} (required)`,
       },
     ],
     responseBody: z.object({
@@ -190,4 +228,43 @@ export const ROUTES: RouteDefinition[] = [
     }),
     handler: handleUsageBreakdown,
   },
+  {
+    operationId: "usage_series",
+    endpoint: "usage/series",
+    method: "GET",
+    summary: "Get grouped usage series",
+    description:
+      "Return usage buckets with per-group values for stacked charts. Prefer call_site for user-facing task stacks.",
+    tags: ["usage"],
+    queryParams: [
+      {
+        name: "from",
+        type: "integer",
+        description: "Start epoch millis (required)",
+      },
+      {
+        name: "to",
+        type: "integer",
+        description: "End epoch millis (required)",
+      },
+      {
+        name: "granularity",
+        schema: { type: "string", enum: ["daily", "hourly"] },
+        description: 'Bucket granularity: "daily" (default) or "hourly"',
+      },
+      {
+        name: "groupBy",
+        description: `Group by: ${SERIES_GROUP_BY_DESCRIPTION} (required)`,
+      },
+      {
+        name: "tz",
+        description:
+          'IANA timezone identifier (e.g. "America/Los_Angeles"). Bucket boundaries and display labels are computed in this timezone. Defaults to "UTC".',
+      },
+    ],
+    responseBody: z.object({
+      buckets: z.array(z.unknown()).describe("Grouped usage bucket objects"),
+    }),
+    handler: handleUsageSeries,
+  },
 ];

package/src/runtime/routes/user-routes.ts

@@ -63,42 +63,28 @@ function synthesizeRequest(method: string, args: RouteHandlerArgs): Request {
 }
 
 /**
- * Decompose a Web API `Response` into the return types the route adapters
- * understand: plain objects for JSON, `RouteResponse` for everything else.
+ * Collect response headers into a plain record.
  */
-async function decomposeResponse(
-  response: Response,
-): Promise<RouteResponse | Record<string, unknown>> {
-  const contentType = response.headers.get("content-type") ?? "";
-
-  // JSON responses → return as plain object so both HTTP and IPC adapters
-  // can serialize natively.
-  if (contentType.includes("application/json")) {
-    const json = (await response.json()) as Record<string, unknown>;
-
-    // If the status is non-200, wrap in a RouteResponse so the adapter
-    // preserves the status code (plain object returns default to 200).
-    if (response.status !== 200) {
-      const headers: Record<string, string> = {};
-      response.headers.forEach((v, k) => {
-        headers[k] = v;
-      });
-      return new RouteResponse(JSON.stringify(json), headers, response.status);
-    }
-
-    return json;
-  }
-
-  // Non-JSON responses → wrap body + headers in a RouteResponse.
+function collectHeaders(response: Response): Record<string, string> {
   const headers: Record<string, string> = {};
   response.headers.forEach((v, k) => {
     headers[k] = v;
   });
-  return new RouteResponse(
-    response.body ?? new Uint8Array(0),
-    headers,
-    response.status,
-  );
+  return headers;
+}
+
+/**
+ * Decompose a Web API `Response` into a `RouteResponse` that the route
+ * adapters (HTTP and IPC) can handle.
+ *
+ * Always wraps in `RouteResponse` so that status codes, custom headers
+ * (CORS, Cache-Control, etc.), and null bodies (204/304) are preserved
+ * faithfully. The body stream is passed through as-is — no
+ * parse/stringify round-trip.
+ */
+function decomposeResponse(response: Response): RouteResponse {
+  const headers = collectHeaders(response);
+  return new RouteResponse(response.body, headers, response.status);
 }
 
 /**

package/src/runtime/routes/work-items-routes.ts

@@ -36,7 +36,6 @@ import {
 } from "../../work-items/work-item-store.js";
 import { buildAssistantEvent } from "../assistant-event.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import {
   BadRequestError,
   ConflictError,
@@ -52,9 +51,7 @@ const log = getLogger("work-items-routes");
 // ---------------------------------------------------------------------------
 
 function publishEvent(msg: ServerMessage): void {
-  void assistantEventHub.publish(
-    buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, msg),
-  );
+  void assistantEventHub.publish(buildAssistantEvent(msg));
 }
 
 function broadcastWorkItemStatus(id: string): void {

package/src/runtime/services/__tests__/analyze-conversation.test.ts

@@ -190,7 +190,7 @@ describe("analyzeConversation", () => {
     expect(currentConversation.runAgentLoop).toHaveBeenCalledWith(
       expect.any(String),
       "msg-1",
-      expect.any(Function),
+      undefined,
       expect.objectContaining({
         isInteractive: false,
         isUserMessage: true,
@@ -364,7 +364,7 @@ describe("analyzeConversation", () => {
     expect(currentConversation.runAgentLoop).toHaveBeenCalledWith(
       expect.any(String),
       "msg-1",
-      expect.any(Function),
+      undefined,
       expect.objectContaining({ callSite: "analyzeConversation" }),
     );
   });

package/src/runtime/services/analyze-conversation.ts

@@ -21,7 +21,6 @@
  * when no override is set).
  */
 import { getOrCreateConversation } from "../../daemon/conversation-store.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
 import {
   AUTO_ANALYSIS_GROUP_ID,
   AUTO_ANALYSIS_SOURCE,
@@ -36,9 +35,10 @@ import {
 } from "../../memory/conversation-crud.js";
 import { resolveConversationId } from "../../memory/conversation-key-store.js";
 import { getLogger } from "../../util/logger.js";
-import { buildAssistantEvent } from "../assistant-event.js";
-import { assistantEventHub } from "../assistant-event-hub.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "../assistant-event-hub.js";
 import {
   buildAutoAnalysisPrompt,
   neutralizeTranscriptSentinel,
@@ -243,21 +243,11 @@ export async function analyzeConversation(
   }
 
   const hasLiveSubscriber = assistantEventHub.hasSubscribersForEvent({
-    assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
     conversationId: analysisConversationId,
   });
 
-  // j. Build onEvent using inline hub publisher
-  const onEvent = (msg: ServerMessage) => {
-    assistantEventHub.publish(
-      buildAssistantEvent(
-        DAEMON_INTERNAL_ASSISTANT_ID,
-        msg,
-        analysisConversationId,
-      ),
-    );
-  };
-  analysisConversation.updateClient(onEvent, !hasLiveSubscriber);
+  // j. Wire broadcastMessage as the event publisher
+  analysisConversation.updateClient(broadcastMessage, !hasLiveSubscriber);
 
   // k. Set up processing state (required by runAgentLoop guard)
   analysisConversation.processing = true;
@@ -268,7 +258,7 @@ export async function analyzeConversation(
   // routes the per-call provider config through `resolveCallSiteConfig`
   // against `llm.callSites.analyzeConversation`.
   analysisConversation
-    .runAgentLoop(prompt, messageId, onEvent, {
+    .runAgentLoop(prompt, messageId, undefined, {
       isInteractive: false,
       isUserMessage: true,
       callSite: "analyzeConversation",

package/src/runtime/services/conversation-serializer.ts

@@ -27,9 +27,7 @@ import { getBindingsForConversations } from "../../memory/external-conversation-
 // Helpers
 // ---------------------------------------------------------------------------
 
-export function buildAssistantAttention(
-  attentionState: AttentionState | undefined,
-):
+function buildAssistantAttention(attentionState: AttentionState | undefined):
   | {
       hasUnseenLatestAssistantMessage: boolean;
       latestAssistantMessageAt?: number;
@@ -65,7 +63,7 @@ export function buildAssistantAttention(
   };
 }
 
-export function buildForkParent(
+function buildForkParent(
   conversation: ConversationRow,
   parentCache: Map<string, ConversationRow | null>,
 ): { conversationId: string; messageId: string; title: string } | undefined {

package/src/runtime/verification-outbound-actions.ts

@@ -476,7 +476,7 @@ function startOutboundVoice(
  * Deliver a verification Slack DM via the Slack Web API directly.
  * Returns a promise that resolves when the delivery attempt completes.
  */
-export async function deliverVerificationSlackAsync(
+async function deliverVerificationSlackAsync(
   userId: string,
   text: string,
   assistantId: string,

package/src/runtime/verification-rate-limiter.ts

@@ -7,7 +7,7 @@ const DEFAULT_MAX_FAILURES = 3;
 const DEFAULT_WINDOW_MS = 5 * 60_000; // 5 minutes
 const MAX_TRACKED_IDENTITIES = 10_000;
 
-export class VerificationRateLimiter {
+class VerificationRateLimiter {
   private failures = new Map<string, number[]>();
   private readonly maxFailures: number;
   private readonly windowMs: number;

package/src/schedule/schedule-store.ts

@@ -66,22 +66,6 @@ export function isValidCronExpression(expr: string): boolean {
   }
 }
 
-export function computeNextRunAt(
-  cronExpression: string,
-  timezone?: string | null,
-): number {
-  const cron = new Cron(cronExpression, {
-    timezone: timezone ?? undefined,
-  });
-  const next = cron.nextRun();
-  if (!next) {
-    throw new Error(
-      `Schedule expression "${cronExpression}" has no upcoming runs`,
-    );
-  }
-  return next.getTime();
-}
-
 export function createSchedule(params: {
   name: string;
   cronExpression?: string | null;