@vellumai/assistant 0.7.0 → 0.7.2

package/src/messaging/providers/slack/render-transcript.ts

@@ -58,6 +58,18 @@ export interface RenderOptions {
 
 const DEFAULT_MAX_REACTIONS = 5;
 
+export interface RenderedSlackTranscript {
+  /** Rendered messages paired with the Slack source timestamp they represent. */
+  readonly renderedMessages: readonly RenderedSlackTranscriptMessage[];
+  /** Convenience projection of `renderedMessages[].message`. */
+  readonly messages: Message[];
+}
+
+export interface RenderedSlackTranscriptMessage {
+  readonly message: Message;
+  readonly sourceChannelTs: string | null;
+}
+
 /**
  * Replayable Anthropic content-block types that we preserve verbatim from a
  * persisted row when rendering the Slack chronological transcript.
@@ -146,6 +158,30 @@ function formatEpochMs(ms: number): string {
   return `${mo}/${da}/${yy} ${hh}:${mm}`;
 }
 
+function renderSlackFileMarkers(
+  files: SlackMessageMetadata["slackFiles"],
+): string {
+  if (!files || files.length === 0) return "";
+  return files
+    .map((file) => {
+      const name = file.name.replace(/\s+/g, " ").trim();
+      const mime = file.mimetype?.replace(/\s+/g, " ").trim();
+      return mime
+        ? `[attached file: ${name}, ${mime}]`
+        : `[attached file: ${name}]`;
+    })
+    .join(" ");
+}
+
+function appendSlackFileMarkers(
+  content: string,
+  files: SlackMessageMetadata["slackFiles"],
+): string {
+  const markers = renderSlackFileMarkers(files);
+  if (!markers) return content;
+  return content.length > 0 ? `${content} ${markers}` : markers;
+}
+
 /**
  * Sort key for chronological ordering.
  *
@@ -162,6 +198,25 @@ function sortKey(msg: RenderableSlackMessage): number {
   return msg.createdAt / 1000;
 }
 
+export function compareSlackTs(a: string, b: string): number {
+  const aNum = Number.parseFloat(a);
+  const bNum = Number.parseFloat(b);
+  if (Number.isFinite(aNum) && Number.isFinite(bNum) && aNum !== bNum) {
+    return aNum - bNum;
+  }
+  return a.localeCompare(b);
+}
+
+export function isSlackTsAfter(ts: string, watermarkTs: string): boolean {
+  return compareSlackTs(ts, watermarkTs) > 0;
+}
+
+function maxNullableSlackTs(a: string | null, b: string | null): string | null {
+  if (a === null) return b;
+  if (b === null) return a;
+  return compareSlackTs(a, b) >= 0 ? a : b;
+}
+
 /**
  * Render a single non-reaction message (post-upgrade or legacy) as one
  * tagged line.
@@ -197,7 +252,7 @@ function sortKey(msg: RenderableSlackMessage): number {
 function renderMessage(msg: RenderableSlackMessage): string {
   if (msg.role === "assistant") {
     if (msg.metadata?.deletedAt !== undefined) return "[deleted]";
-    return msg.content;
+    return appendSlackFileMarkers(msg.content, msg.metadata?.slackFiles);
   }
 
   const meta = msg.metadata;
@@ -222,7 +277,7 @@ function renderMessage(msg: RenderableSlackMessage): string {
   if (meta.editedAt !== undefined) {
     head += `, edited ${formatEpochMs(meta.editedAt)}`;
   }
-  head += `]: ${msg.content}`;
+  head += `]: ${appendSlackFileMarkers(msg.content, meta.slackFiles)}`;
   return head;
 }
 
@@ -342,7 +397,16 @@ export function renderSlackTranscript(
   messages: RenderableSlackMessage[],
   opts?: RenderOptions,
 ): Message[] {
-  if (messages.length === 0) return [];
+  return renderSlackTranscriptWithProvenance(messages, opts).messages;
+}
+
+export function renderSlackTranscriptWithProvenance(
+  messages: RenderableSlackMessage[],
+  opts?: RenderOptions,
+): RenderedSlackTranscript {
+  if (messages.length === 0) {
+    return { renderedMessages: [], messages: [] };
+  }
 
   const maxReactions = Math.max(
     1,
@@ -364,23 +428,37 @@ export function renderSlackTranscript(
   // reaches an event that is not an overflowing reaction for that target.
   const overflowAccumulator = new Map<
     string,
-    { excess: number; role: "user" | "assistant" }
+    {
+      excess: number;
+      role: "user" | "assistant";
+      sourceChannelTs: string | null;
+    }
   >();
 
   const trailerMessage = (
     target: string,
-    acc: { excess: number; role: "user" | "assistant" },
-  ): Message => ({
-    role: acc.role,
-    content: [
-      {
-        type: "text" as const,
-        text: `[…and ${acc.excess} more ${acc.excess === 1 ? "reaction" : "reactions"} to ${parentAlias(target)}]`,
-      },
-    ],
+    acc: {
+      excess: number;
+      role: "user" | "assistant";
+      sourceChannelTs: string | null;
+    },
+  ): RenderedSlackTranscriptMessage => ({
+    message: {
+      role: acc.role,
+      content: [
+        {
+          type: "text" as const,
+          text: `[…and ${acc.excess} more ${acc.excess === 1 ? "reaction" : "reactions"} to ${parentAlias(target)}]`,
+        },
+      ],
+    },
+    sourceChannelTs: acc.sourceChannelTs,
   });
 
-  const flushOverflowExcept = (out: Message[], keepTarget: string | null) => {
+  const flushOverflowExcept = (
+    out: RenderedSlackTranscriptMessage[],
+    keepTarget: string | null,
+  ) => {
     for (const target of Array.from(overflowAccumulator.keys())) {
       if (target === keepTarget) continue;
       const acc = overflowAccumulator.get(target)!;
@@ -389,7 +467,7 @@ export function renderSlackTranscript(
     }
   };
 
-  const out: Message[] = [];
+  const out: RenderedSlackTranscriptMessage[] = [];
   for (const m of sorted) {
     const meta = m.metadata;
     if (meta?.eventKind === "reaction" && meta.reaction) {
@@ -403,8 +481,11 @@ export function renderSlackTranscript(
         const line = renderReaction(m);
         if (line !== null) {
           out.push({
-            role: m.role,
-            content: [{ type: "text" as const, text: line }],
+            message: {
+              role: m.role,
+              content: [{ type: "text" as const, text: line }],
+            },
+            sourceChannelTs: meta.channelTs,
           });
         }
       } else {
@@ -414,8 +495,13 @@ export function renderSlackTranscript(
         const acc = overflowAccumulator.get(target) ?? {
           excess: 0,
           role: m.role,
+          sourceChannelTs: null,
         };
         acc.excess += 1;
+        acc.sourceChannelTs = maxNullableSlackTs(
+          acc.sourceChannelTs,
+          meta.channelTs,
+        );
         overflowAccumulator.set(target, acc);
       }
       continue;
@@ -426,15 +512,22 @@ export function renderSlackTranscript(
     const blocks = buildMessageContentBlocks(m, tagLine);
     if (blocks.length === 0) continue;
     out.push({
-      role: m.role,
-      content: blocks,
+      message: {
+        role: m.role,
+        content: blocks,
+      },
+      sourceChannelTs: meta?.channelTs ?? null,
     });
   }
 
   // End of the walk: flush any still-open overflow windows.
   flushOverflowExcept(out, null);
 
-  return filterOrphanToolPairs(out);
+  const filtered = filterOrphanToolPairs(out);
+  return {
+    renderedMessages: filtered,
+    messages: filtered.map((entry) => entry.message),
+  };
 }
 
 /**
@@ -459,18 +552,21 @@ export function renderSlackTranscript(
  * emitted as `{role, content: []}` — empty-content messages are also
  * rejected by the provider.
  */
-function filterOrphanToolPairs(messages: Message[]): Message[] {
+function filterOrphanToolPairs(
+  entries: RenderedSlackTranscriptMessage[],
+): RenderedSlackTranscriptMessage[] {
   const produced = new Set<string>();
   const consumed = new Set<string>();
-  for (const msg of messages) {
+  for (const { message: msg } of entries) {
     for (const b of msg.content) {
       if (b.type === "tool_use") produced.add(b.id);
       else if (b.type === "tool_result" || b.type === "web_search_tool_result")
         consumed.add(b.tool_use_id);
     }
   }
-  const out: Message[] = [];
-  for (const msg of messages) {
+  const out: RenderedSlackTranscriptMessage[] = [];
+  for (const entry of entries) {
+    const msg = entry.message;
     const kept: ContentBlock[] = [];
     for (const b of msg.content) {
       if (b.type === "tool_use" && !consumed.has(b.id)) continue;
@@ -481,7 +577,12 @@ function filterOrphanToolPairs(messages: Message[]): Message[] {
         continue;
       kept.push(b);
     }
-    if (kept.length > 0) out.push({ role: msg.role, content: kept });
+    if (kept.length > 0) {
+      out.push({
+        message: { role: msg.role, content: kept },
+        sourceChannelTs: entry.sourceChannelTs,
+      });
+    }
   }
   return out;
 }

package/src/messaging/providers/slack/types.ts

@@ -59,6 +59,7 @@ export interface SlackConversationHistoryResponse extends SlackApiResponse {
 export interface SlackConversationRepliesResponse extends SlackApiResponse {
   messages: SlackMessage[];
   has_more: boolean;
+  response_metadata?: { next_cursor?: string };
 }
 
 export interface SlackUser {
@@ -75,11 +76,6 @@ export interface SlackUser {
   deleted?: boolean;
 }
 
-export interface SlackUsersListResponse extends SlackApiResponse {
-  members: SlackUser[];
-  response_metadata?: { next_cursor?: string };
-}
-
 export interface SlackUserInfoResponse extends SlackApiResponse {
   user: SlackUser;
 }
@@ -109,35 +105,8 @@ export interface SlackSearchMatch {
   thread_ts?: string;
 }
 
-export interface SlackConversationInfoResponse extends SlackApiResponse {
-  channel: SlackConversation;
-}
-
 export interface SlackConversationsOpenResponse extends SlackApiResponse {
   channel: { id: string };
 }
 
-export type SlackReactionAddResponse = SlackApiResponse;
-
-export type SlackConversationJoinResponse = SlackApiResponse & {
-  channel?: SlackConversation;
-};
-
-export type SlackConversationLeaveResponse = SlackApiResponse;
-
-export interface SlackChatDeleteResponse extends SlackApiResponse {
-  channel: string;
-  ts: string;
-}
-
-export interface SlackChatUpdateResponse extends SlackApiResponse {
-  channel: string;
-  ts: string;
-  text: string;
-}
-
 export type SlackConversationMarkResponse = SlackApiResponse;
-
-export interface SlackPostEphemeralResponse extends SlackApiResponse {
-  message_ts: string;
-}

package/src/notifications/README.md

@@ -133,7 +133,7 @@ The system produces **three distinct copy outputs** per notification:
 
 | Output                    | Purpose                                          | Verbosity                |
 | ------------------------- | ------------------------------------------------ | ------------------------ |
-| `title` + `body`          | Native notification popup (macOS/iOS banner)     | Short and glanceable     |
+| `title` + `body`          | Native notification popup (macOS banner)         | Short and glanceable     |
 | `deliveryText`            | Channel-native chat message text (Telegram)      | Natural chat phrasing    |
 | Conversation seed message | Opening message in the notification conversation | Richer and context-aware |
 
@@ -185,7 +185,7 @@ Reminder. Take out the trash. Action required.
 
 ## Conversation Surfacing via `notification_conversation_created` Event (Creation-Only)
 
-The `notification_conversation_created` SSE event is emitted **only when a brand-new conversation is actually created** by the broadcaster. Reused conversations do not trigger this event — the macOS/iOS client already knows about the conversation from the original creation.
+The `notification_conversation_created` SSE event is emitted **only when a brand-new conversation is actually created** by the broadcaster. Reused conversations do not trigger this event — the macOS client already knows about the conversation from the original creation.
 
 This is enforced in `broadcaster.ts` by gating the event emission on `pairing.createdNewConversation === true`:
 
@@ -214,7 +214,7 @@ The SSE event payload:
 }
 ```
 
-The macOS/iOS client listens for this event and surfaces the conversation in the sidebar, enabling deep-link navigation to the notification conversation.
+The macOS client listens for this event and surfaces the conversation in the sidebar, enabling deep-link navigation to the notification conversation.
 
 ### Per-Dispatch Conversation Callback
 
@@ -223,7 +223,7 @@ The macOS/iOS client listens for this event and surfaces the conversation in the
 **Important distinction between the two callbacks:**
 
 - **Per-dispatch `options.onConversationCreated`**: Fires for **both** new and reused vellum conversation pairings. Callers like `dispatchGuardianQuestion` rely on this to create delivery bookkeeping rows before `emitNotificationSignal()` returns, regardless of whether the conversation was newly created or reused.
-- **Class-level `this.onConversationCreated` (SSE broadcast)**: Fires **only** when a brand-new conversation is created (`createdNewConversation === true && strategy === 'start_new_conversation'`). This emits the `notification_conversation_created` SSE event so macOS/iOS clients surface the new conversation in the sidebar. Reused conversations do not trigger this event because the client already knows about the conversation.
+- **Class-level `this.onConversationCreated` (SSE broadcast)**: Fires **only** when a brand-new conversation is created (`createdNewConversation === true && strategy === 'start_new_conversation'`). This emits the `notification_conversation_created` SSE event so macOS clients surface the new conversation in the sidebar. Reused conversations do not trigger this event because the client already knows about the conversation.
 
 ## Schedule Routing Metadata and Trigger-Time Enforcement
 
@@ -295,7 +295,7 @@ Local SSE via the daemon's broadcast mechanism. The `VellumAdapter` emits a `not
 - `title` and `body` -- rendered notification copy
 - `deepLinkMetadata` -- optional metadata for navigating to the relevant context (e.g. `{ conversationId }`)
 
-The macOS/iOS client posts a native `UNUserNotificationCenter` notification from this payload. When the user taps the notification, the client uses `deepLinkMetadata` to navigate to the relevant conversation.
+The macOS client posts a native `UNUserNotificationCenter` notification from this payload. When the user taps the notification, the client uses `deepLinkMetadata` to navigate to the relevant conversation.
 
 ### Telegram (when guardian binding exists)
 
@@ -480,7 +480,7 @@ Three SQLite tables form the audit chain:
 
 ### Client Delivery Ack
 
-For vellum (macOS/iOS) deliveries, the audit trail now extends past the SSE broadcast to the actual OS notification post. The `notification_intent` message carries an optional `deliveryId` that the client echoes back in a `notification_intent_result` ack after `UNUserNotificationCenter.add()` completes (or fails).
+For vellum (macOS) deliveries, the audit trail now extends past the SSE broadcast to the actual OS notification post. The `notification_intent` message carries an optional `deliveryId` that the client echoes back in a `notification_intent_result` ack after `UNUserNotificationCenter.add()` completes (or fails).
 
 The ack populates three columns on `notification_deliveries`:
 
@@ -541,10 +541,10 @@ Preferences are sanitized against prompt injection (angle brackets replaced with
 The decision engine and preference extractor pick their per-call LLM config
 from the unified `llm` block. Override defaults by setting either of:
 
-| Key                                  | Type    | Default        | Description                                                                 |
-| ------------------------------------ | ------- | -------------- | --------------------------------------------------------------------------- |
-| `llm.callSites.notificationDecision` | object  | _(unset)_      | Provider/model/effort/etc. override for the decision engine call site       |
-| `llm.callSites.preferenceExtraction` | object  | _(unset)_      | Provider/model/effort/etc. override for the preference extractor call site  |
+| Key                                  | Type   | Default   | Description                                                                |
+| ------------------------------------ | ------ | --------- | -------------------------------------------------------------------------- |
+| `llm.callSites.notificationDecision` | object | _(unset)_ | Provider/model/effort/etc. override for the decision engine call site      |
+| `llm.callSites.preferenceExtraction` | object | _(unset)_ | Provider/model/effort/etc. override for the preference extractor call site |
 
 When a call site override is unset, the resolver falls back to `llm.default`.
 

package/src/notifications/broadcaster.ts

@@ -211,7 +211,7 @@ export class NotificationBroadcaster {
       );
 
       // For the vellum channel, merge the conversationId into deep-link metadata
-      // so the macOS/iOS client can navigate directly to the notification conversation.
+      // so the macOS client can navigate directly to the notification conversation.
       let deepLinkTarget = decision.deepLinkTarget;
       if (channel === "vellum" && pairing.conversationId) {
         deepLinkTarget = {

package/src/notifications/guardian-question-mode.ts

@@ -6,12 +6,12 @@
  * fields like `toolName`.
  */
 
-export type GuardianQuestionRequestKind =
+type GuardianQuestionRequestKind =
   | "pending_question"
   | "tool_approval"
   | "tool_grant_request"
   | "access_request";
-export type GuardianQuestionInstructionMode = "approval" | "answer";
+type GuardianQuestionInstructionMode = "approval" | "answer";
 
 interface GuardianRequestKindModeConfig {
   defaultMode: GuardianQuestionInstructionMode;
@@ -48,12 +48,12 @@ interface GuardianQuestionPayloadBaseWithDiscriminator extends GuardianQuestionP
   [key: string]: unknown;
 }
 
-export interface GuardianRequestModeInput {
+interface GuardianRequestModeInput {
   kind: unknown;
   toolName?: unknown;
 }
 
-export interface GuardianRequestTextInput {
+interface GuardianRequestTextInput {
   requestCode: string;
   questionText?: string | null;
   toolName?: string | null;
@@ -136,7 +136,7 @@ export type GuardianQuestionPayload =
   | ToolGrantGuardianPayload
   | AccessRequestGuardianPayload;
 
-export interface GuardianQuestionModeResolution {
+interface GuardianQuestionModeResolution {
   mode: GuardianQuestionInstructionMode;
   requestKind: GuardianQuestionRequestKind | null;
 }

package/src/oauth/connect-orchestrator.ts

@@ -19,6 +19,7 @@
  * - Running identity verifiers
  */
 
+import { emitPostConnectNudge } from "../home/post-connect-feed.js";
 import type { TokenEndpointAuthMethod } from "../security/oauth2.js";
 import { prepareOAuth2Flow, startOAuth2Flow } from "../security/oauth2.js";
 import { getLogger } from "../util/logger.js";
@@ -250,6 +251,7 @@ export async function orchestrateOAuthConnect(
               },
               "Deferred OAuth2 flow completed — tokens stored",
             );
+            void emitPostConnectNudge(options.service);
             options.onDeferredComplete?.({
               success: true,
               service: options.service,
@@ -371,6 +373,8 @@ export async function orchestrateOAuthConnect(
       "orchestrateOAuthConnect: tokens stored, connect complete",
     );
 
+    void emitPostConnectNudge(options.service);
+
     return {
       success: true,
       deferred: false,

package/src/oauth/connection-resolver.test.ts

@@ -39,6 +39,14 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async () => mockAccessToken,
 }));
 
+mock.module("./credential-token-resolver.js", () => ({
+  getConnectionAccessTokenResult: async () => ({
+    value: mockAccessToken,
+    unreachable: false,
+    key: "mock-key",
+  }),
+}));
+
 mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
 }));

package/src/oauth/connection-resolver.ts

@@ -1,15 +1,14 @@
-import { getIsPlatform } from "../config/env-registry.js";
-import { getConfig, getNestedValue, loadRawConfig } from "../config/loader.js";
+import { getConfig } from "../config/loader.js";
 import {
   getServiceMode,
   type Services,
   ServicesSchema,
 } from "../config/schemas/services.js";
 import { VellumPlatformClient } from "../platform/client.js";
-import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
 import { BYOOAuthConnection } from "./byo-connection.js";
 import type { OAuthConnection } from "./connection.js";
+import { getConnectionAccessTokenResult } from "./credential-token-resolver.js";
 import { getActiveConnection, getProvider } from "./oauth-store.js";
 import { PlatformOAuthConnection } from "./platform-connection.js";
 
@@ -52,15 +51,7 @@ export async function resolveOAuthConnection(
 
   if (managedKey && managedKey in ServicesSchema.shape) {
     const services: Services = getConfig().services;
-    const explicitMode = getServiceMode(services, managedKey as keyof Services);
-    // Treat as managed when explicitly configured OR when on a platform
-    // instance and the user hasn't explicitly opted into "your-own".
-    const effectivelyManaged =
-      explicitMode === "managed" ||
-      (getIsPlatform() &&
-        getNestedValue(loadRawConfig(), `services.${managedKey}.mode`) ===
-          undefined);
-    if (effectivelyManaged) {
+    if (getServiceMode(services, managedKey as keyof Services) === "managed") {
       const client = await VellumPlatformClient.create();
       if (!client || !client.platformAssistantId) {
         const detail = !client
@@ -105,10 +96,11 @@ export async function resolveOAuthConnection(
     );
   }
 
-  const accessToken = await getSecureKeyAsync(
-    `oauth_connection/${conn.id}/access_token`,
-  );
-  if (!accessToken) {
+  const tokenResult = await getConnectionAccessTokenResult({
+    provider,
+    connectionId: conn.id,
+  });
+  if (!tokenResult.value) {
     throw new Error(
       `OAuth connection for "${provider}" exists but has no access token. Re-authorize with \`assistant oauth connect ${provider}\`.`,
     );

package/src/oauth/credential-token-resolver.ts

@@ -0,0 +1,95 @@
+/**
+ * Centralized access-token key resolution for OAuth and manual-token providers.
+ *
+ * All code that needs to read or check the presence of a provider's access
+ * token should go through {@link getConnectionAccessTokenResult} rather than
+ * inlining provider-specific path logic. This ensures that `oauth status`,
+ * `oauth ping`, credential health checks, and runtime token lookups all
+ * agree on where the access token lives.
+ *
+ * Manual-token providers (e.g. slack_channel, telegram) store their primary
+ * token under `credential/<provider>/<field>` via the generic credential
+ * store, while standard OAuth providers use `oauth_connection/<id>/access_token`.
+ */
+
+import { oauthConnectionAccessTokenPath } from "@vellumai/credential-storage";
+
+import { credentialKey } from "../security/credential-key.js";
+import {
+  getSecureKeyResultAsync,
+  type SecureKeyResult,
+} from "../security/secure-keys.js";
+
+// ── Types ─────────────────────────────────────────────────────────────
+
+export interface ConnectionAccessTokenResult {
+  /** The access token value, or undefined if not found / backend unreachable. */
+  value: string | undefined;
+  /** True when the credential backend is temporarily unreachable. */
+  unreachable: boolean;
+  /** The secure-store key that was resolved for this provider + connection. */
+  key: string;
+}
+
+// ── Helpers ──────────────────────────────────────────────────────────
+
+/**
+ * Return the secure-store key holding the primary access token for a
+ * manual-token provider, or null for OAuth providers whose tokens live at
+ * `oauth_connection/<id>/access_token`.
+ *
+ * Manual-token providers store their tokens under `credential/<provider>/<field>`
+ * via the generic credential store, so any code that validates tokens for these
+ * providers (e.g. credential-health checks) must resolve the path through here
+ * rather than assuming the OAuth access-token path.
+ */
+function manualTokenAccessCredentialKey(provider: string): string | null {
+  switch (provider) {
+    case "slack_channel":
+      return credentialKey("slack_channel", "bot_token");
+    case "telegram":
+      return credentialKey("telegram", "bot_token");
+    default:
+      return null;
+  }
+}
+
+/**
+ * Resolve the secure-store key for a provider's access token.
+ *
+ * - `slack_channel` -> `credential/slack_channel/bot_token`
+ * - `telegram`      -> `credential/telegram/bot_token`
+ * - all normal OAuth -> `oauth_connection/<connectionId>/access_token`
+ */
+export function resolveAccessTokenKey(
+  provider: string,
+  connectionId: string,
+): string {
+  return (
+    manualTokenAccessCredentialKey(provider) ??
+    oauthConnectionAccessTokenPath(connectionId)
+  );
+}
+
+// ── Public API ───────────────────────────────────────────────────────
+
+/**
+ * Look up the access token for a provider/connection pair, resolving the
+ * correct secure-store key automatically.
+ *
+ * Returns the token value, whether the backend was unreachable, and the
+ * key that was used — giving callers everything they need to diagnose
+ * token-path mismatches.
+ */
+export async function getConnectionAccessTokenResult(opts: {
+  provider: string;
+  connectionId: string;
+}): Promise<ConnectionAccessTokenResult> {
+  const key = resolveAccessTokenKey(opts.provider, opts.connectionId);
+  const result: SecureKeyResult = await getSecureKeyResultAsync(key);
+  return {
+    value: result.value,
+    unreachable: result.unreachable,
+    key,
+  };
+}