@vellumai/assistant 0.8.5 → 0.8.7

package/src/runtime/routes/app-management-routes.ts

@@ -49,6 +49,8 @@ import {
 import { createSharedAppLink } from "../../memory/shared-app-links-store.js";
 import { computeContentId } from "../../util/content-id.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { publishAppsChanged } from "../sync/resource-sync-events.js";
 import {
   BadRequestError,
   NotFoundError,
@@ -62,6 +64,12 @@ const log = getLogger("app-management-routes");
 // Helpers
 // ---------------------------------------------------------------------------
 
+function getOriginClientId(
+  headers: RouteHandlerArgs["headers"],
+): string | undefined {
+  return headers?.["x-vellum-client-id"]?.trim() || undefined;
+}
+
 function getSharedAppsDir(): string {
   return join(
     homedir(),
@@ -565,14 +573,16 @@ async function handleImportBundle({ rawBody, headers }: RouteHandlerArgs) {
       "Request body is required — upload a .vbundle file",
     );
   }
-  return importBundle(rawBody, headers ?? {});
+  const result = await importBundle(rawBody, headers ?? {});
+  publishAppsChanged(getOriginClientId(headers));
+  return result;
 }
 
 function handleListSharedApps() {
   return { apps: listSharedApps() };
 }
 
-function handleForkSharedApp({ body }: RouteHandlerArgs) {
+function handleForkSharedApp({ body, headers }: RouteHandlerArgs) {
   if (!body?.uuid) {
     throw new BadRequestError("uuid is required");
   }
@@ -580,10 +590,11 @@ function handleForkSharedApp({ body }: RouteHandlerArgs) {
   if (!result.success) {
     throw new BadRequestError(result.error);
   }
+  publishAppsChanged(getOriginClientId(headers));
   return result;
 }
 
-async function handleInstallGalleryApp({ body }: RouteHandlerArgs) {
+async function handleInstallGalleryApp({ body, headers }: RouteHandlerArgs) {
   if (!body?.galleryAppId) {
     throw new BadRequestError("galleryAppId is required");
   }
@@ -591,6 +602,7 @@ async function handleInstallGalleryApp({ body }: RouteHandlerArgs) {
   if (!result.success) {
     throw new BadRequestError(result.error);
   }
+  publishAppsChanged(getOriginClientId(headers));
   return result;
 }
 
@@ -694,8 +706,9 @@ async function handleOpenApp({ pathParams }: RouteHandlerArgs) {
   return { appId: app.id, dirName, name: app.name, html };
 }
 
-function handleDeleteApp({ pathParams }: RouteHandlerArgs) {
+function handleDeleteApp({ pathParams, headers }: RouteHandlerArgs) {
   deleteApp(pathParams?.id as string);
+  publishAppsChanged(getOriginClientId(headers));
   return { success: true };
 }
 
@@ -773,7 +786,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_list",
     endpoint: "apps",
     method: "GET",
-    policyKey: "apps",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListApps,
     summary: "List apps",
     description: "Return all locally installed apps.",
@@ -786,14 +802,27 @@ export const ROUTES: RouteDefinition[] = [
       },
     ],
     responseBody: z.object({
-      apps: z.array(z.unknown()).describe("Array of app summary objects"),
+      apps: z.array(
+        z.object({
+          id: z.string(),
+          name: z.string(),
+          description: z.string().optional(),
+          icon: z.string().optional(),
+          createdAt: z.number(),
+          version: z.string(),
+          contentId: z.string(),
+        }),
+      ),
     }),
   },
   {
     operationId: "apps_open_bundle",
     endpoint: "apps/open-bundle",
     method: "POST",
-    policyKey: "apps/open-bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleOpenBundle,
     summary: "Open a .vbundle file",
     description:
@@ -802,25 +831,62 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: z.object({
       filePath: z.string().describe("Absolute path to the .vbundle file"),
     }),
+    responseBody: z.object({
+      manifest: z.object({}).passthrough(),
+      scanResult: z.object({
+        passed: z.boolean(),
+        blocked: z.array(z.string()),
+        warnings: z.array(z.string()),
+      }),
+      signatureResult: z.object({
+        trustTier: z.string(),
+        signerKeyId: z.string().optional(),
+        signerDisplayName: z.string().optional(),
+        signerAccount: z.string().optional(),
+      }),
+      bundleSizeBytes: z.number(),
+    }),
   },
   {
     operationId: "apps_shared_list",
     endpoint: "apps/shared",
     method: "GET",
-    policyKey: "apps/shared-list",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListSharedApps,
     summary: "List shared apps",
     description: "Return all apps available via cloud share links.",
     tags: ["apps"],
     responseBody: z.object({
-      apps: z.array(z.unknown()).describe("Array of shared app objects"),
+      apps: z.array(
+        z.object({
+          uuid: z.string(),
+          name: z.string(),
+          description: z.string().optional(),
+          icon: z.string().optional(),
+          preview: z.string().optional(),
+          entry: z.string(),
+          trustTier: z.string(),
+          signerDisplayName: z.string().optional(),
+          bundleSizeBytes: z.number(),
+          installedAt: z.string(),
+          version: z.string().optional(),
+          contentId: z.string().optional(),
+          updateAvailable: z.boolean().optional(),
+        }),
+      ),
     }),
   },
   {
     operationId: "apps_fork",
     endpoint: "apps/fork",
     method: "POST",
-    policyKey: "apps/fork",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleForkSharedApp,
     summary: "Fork a shared app",
     description: "Create a local copy of a shared app by its UUID.",
@@ -828,36 +894,76 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: z.object({
       uuid: z.string().describe("UUID of the shared app to fork"),
     }),
+    responseBody: z.object({
+      success: z.literal(true),
+      appId: z.string(),
+      name: z.string(),
+    }),
   },
   {
     operationId: "apps_gallery_install",
     endpoint: "apps/gallery/install",
     method: "POST",
-    policyKey: "apps/gallery/install",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleInstallGalleryApp,
     summary: "Install a gallery app",
     description: "Install an app from the built-in gallery by its ID.",
     tags: ["apps"],
     requestBody: z.object({ galleryAppId: z.string() }),
+    responseBody: z.object({
+      success: z.literal(true),
+      appId: z.string(),
+      name: z.string(),
+    }),
   },
   {
     operationId: "apps_gallery_list",
     endpoint: "apps/gallery",
     method: "GET",
-    policyKey: "apps/gallery",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListGallery,
     summary: "List gallery apps",
     description: "Return the built-in app gallery catalog.",
     tags: ["apps"],
     responseBody: z.object({
-      gallery: z.array(z.unknown()).describe("Gallery app entries"),
+      gallery: z.object({
+        version: z.number(),
+        updatedAt: z.string(),
+        categories: z.array(
+          z.object({
+            id: z.string(),
+            name: z.string(),
+            icon: z.string(),
+          }),
+        ),
+        apps: z.array(
+          z.object({
+            id: z.string(),
+            name: z.string(),
+            description: z.string(),
+            icon: z.string(),
+            category: z.string(),
+            version: z.string(),
+            featured: z.boolean().optional(),
+          }),
+        ),
+      }),
     }),
   },
   {
     operationId: "apps_import_bundle",
     endpoint: "apps/import-bundle",
     method: "POST",
-    policyKey: "apps/import-bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleImportBundle,
     summary: "Import a .vbundle file",
     description:
@@ -885,7 +991,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_sign_bundle",
     endpoint: "apps/sign-bundle",
     method: "POST",
-    policyKey: "apps/sign-bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSignBundle,
     summary: "Sign an app bundle",
     description:
@@ -897,17 +1006,27 @@ export const ROUTES: RouteDefinition[] = [
       keyId: z.string().optional(),
       publicKey: z.string().optional(),
     }),
+    responseBody: z.object({
+      signed: z.boolean().optional(),
+      signatureJson: z.object({}).passthrough().optional(),
+      payload: z.string().optional(),
+      message: z.string().optional(),
+    }),
   },
   {
     operationId: "apps_signing_identity",
     endpoint: "apps/signing-identity",
     method: "GET",
-    policyKey: "apps/signing-identity",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSigningIdentity,
     summary: "Get signing identity",
     description:
       "Return signing identity info. Signing is managed client-side over HTTP.",
     tags: ["apps"],
+    responseBody: z.object({ message: z.string() }),
   },
 
   // Parameterized `apps/:id/*` routes — must follow all literal routes.
@@ -916,7 +1035,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_data_query",
     endpoint: "apps/:id/data",
     method: "GET",
-    policyKey: "apps/data",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleQueryAppData,
     summary: "Query app data",
     description: "Read records from an app's local data store.",
@@ -927,12 +1049,19 @@ export const ROUTES: RouteDefinition[] = [
         type: "string",
       },
     ],
+    responseBody: z.object({
+      success: z.boolean(),
+      result: z.unknown(),
+    }),
   },
   {
     operationId: "apps_data_mutate",
     endpoint: "apps/:id/data",
     method: "POST",
-    policyKey: "apps/data",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleMutateAppData,
     summary: "Mutate app data",
     description:
@@ -943,12 +1072,19 @@ export const ROUTES: RouteDefinition[] = [
       recordId: z.string(),
       data: z.object({}).passthrough(),
     }),
+    responseBody: z.object({
+      success: z.boolean(),
+      result: z.unknown(),
+    }),
   },
   {
     operationId: "apps_open",
     endpoint: "apps/:id/open",
     method: "POST",
-    policyKey: "apps/open",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleOpenApp,
     summary: "Open an app",
     description: "Compile (if needed) and return the app's HTML for rendering.",
@@ -964,27 +1100,41 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_delete",
     endpoint: "apps/:id/delete",
     method: "POST",
-    policyKey: "apps/delete",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleDeleteApp,
     summary: "Delete an app",
     description: "Permanently remove an app and its data.",
     tags: ["apps"],
+    responseBody: z.object({ success: z.boolean() }),
   },
   {
     operationId: "apps_preview_get",
     endpoint: "apps/:id/preview",
     method: "GET",
-    policyKey: "apps/preview",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetPreview,
     summary: "Get app preview",
     description: "Return the preview image or HTML for an app.",
     tags: ["apps"],
+    responseBody: z.object({
+      appId: z.string(),
+      preview: z.string().nullable(),
+    }),
   },
   {
     operationId: "apps_preview_update",
     endpoint: "apps/:id/preview",
     method: "PUT",
-    policyKey: "apps/preview",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleUpdatePreview,
     summary: "Update app preview",
     description: "Set a new preview image or HTML for an app.",
@@ -992,12 +1142,19 @@ export const ROUTES: RouteDefinition[] = [
     requestBody: z.object({
       preview: z.string().describe("Base64-encoded image or HTML string"),
     }),
+    responseBody: z.object({
+      success: z.boolean(),
+      appId: z.string(),
+    }),
   },
   {
     operationId: "apps_history",
     endpoint: "apps/:id/history",
     method: "GET",
-    policyKey: "apps/history",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetHistory,
     summary: "Get app version history",
     description: "Return the git commit history of an app.",
@@ -1005,14 +1162,23 @@ export const ROUTES: RouteDefinition[] = [
     queryParams: [{ name: "limit", type: "number" }],
     responseBody: z.object({
       appId: z.string(),
-      versions: z.array(z.unknown()),
+      versions: z.array(
+        z.object({
+          commitHash: z.string(),
+          message: z.string(),
+          timestamp: z.number(),
+        }),
+      ),
     }),
   },
   {
     operationId: "apps_diff",
     endpoint: "apps/:id/diff",
     method: "GET",
-    policyKey: "apps/diff",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetDiff,
     summary: "Get app diff",
     description: "Return a git diff between two commits for an app.",
@@ -1021,23 +1187,34 @@ export const ROUTES: RouteDefinition[] = [
       { name: "fromCommit", type: "string", required: true },
       { name: "toCommit", type: "string" },
     ],
+    responseBody: z.object({
+      appId: z.string(),
+      diff: z.string(),
+    }),
   },
   {
     operationId: "apps_restore",
     endpoint: "apps/:id/restore",
     method: "POST",
-    policyKey: "apps/restore",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleRestore,
     summary: "Restore app version",
     description: "Restore an app to a previous git commit.",
     tags: ["apps"],
     requestBody: z.object({ commitHash: z.string() }),
+    responseBody: z.object({ success: z.boolean() }),
   },
   {
     operationId: "apps_bundle",
     endpoint: "apps/:id/bundle",
     method: "POST",
-    policyKey: "apps/bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleBundle,
     summary: "Bundle an app",
     description: "Package an app into a distributable .vbundle archive.",
@@ -1053,7 +1230,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_share_cloud",
     endpoint: "apps/:id/share-cloud",
     method: "POST",
-    policyKey: "apps/share-cloud",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleShareCloud,
     summary: "Share app to cloud",
     description: "Package and upload an app to the cloud share service.",

package/src/runtime/routes/app-routes.ts

@@ -21,6 +21,7 @@ import {
   incrementDownloadCount,
 } from "../../memory/shared-app-links-store.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError, RouteError } from "./errors.js";
 import type {
   ResponseHeaderArgs,
@@ -328,7 +329,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "pages_serve",
     endpoint: "pages/:appId",
     method: "GET",
-    policyKey: "pages",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Serve app page",
     description: "Render and serve a shareable app page as HTML.",
     tags: ["apps"],
@@ -339,7 +343,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_dist_file",
     endpoint: "apps/:appId/dist/:filename",
     method: "GET",
-    policyKey: "apps/dist",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Serve app dist file",
     description:
       "Serve a static asset from an app's compiled dist/ directory.",
@@ -356,6 +363,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_share",
     endpoint: "apps/share",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Share an app",
     description: "Upload a zip app bundle and create a shareable link.",
     tags: ["apps"],
@@ -370,7 +381,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_metadata",
     endpoint: "apps/shared/:token/metadata",
     method: "GET",
-    policyKey: "apps/shared/metadata",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get shared app metadata",
     description: "Return metadata for a shared app bundle.",
     tags: ["apps"],
@@ -386,7 +400,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_download",
     endpoint: "apps/shared/:token",
     method: "GET",
-    policyKey: "apps/shared",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Download shared app",
     description: "Download a shared app bundle as a zip file.",
     tags: ["apps"],
@@ -400,7 +417,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_delete",
     endpoint: "apps/shared/:token",
     method: "DELETE",
-    policyKey: "apps/shared",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete shared app",
     description: "Remove a shared app link.",
     tags: ["apps"],

package/src/runtime/routes/approval-routes.ts

@@ -13,6 +13,7 @@ import { findConversation } from "../../daemon/conversation-store.js";
 import { getConversationByKey } from "../../memory/conversation-key-store.js";
 import type { UserDecision } from "../../permissions/types.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import * as pendingInteractions from "../pending-interactions.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -96,11 +97,10 @@ function handleConfirm({ body }: RouteHandlerArgs) {
   conversation.handleConfirmationResponse(
     requestId,
     effectiveDecision as UserDecision,
-    selectedPattern,
-    selectedScope,
-    undefined,
     {
-      source: "button",
+      selectedPattern,
+      selectedScope,
+      emissionContext: { source: "button" },
     },
   );
 
@@ -233,6 +233,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "confirm",
     endpoint: "confirm",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleConfirm,
     requireGuardian: true,
     summary: "Resolve a pending confirmation",
@@ -258,6 +262,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "secret",
     endpoint: "secret",
     method: "POST",
+    policy: {
+      requiredScopes: ["approval.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSecret,
     requireGuardian: true,
     summary: "Resolve a pending secret request",
@@ -279,6 +287,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "pending_interactions",
     endpoint: "pending-interactions",
     method: "GET",
+    policy: {
+      requiredScopes: ["approval.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListPendingInteractions,
     summary: "List pending interactions",
     description:

package/src/runtime/routes/attachment-routes.ts

@@ -27,6 +27,7 @@ import {
   validateAttachmentUpload,
 } from "../../memory/attachments-store.js";
 import { getWorkspaceDir } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS, LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   ConflictError,
@@ -653,7 +654,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_content",
     endpoint: "attachments/:id/content",
     method: "GET",
-    policyKey: "attachments/content",
+    policy: {
+      requiredScopes: ["attachments.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get attachment content",
     description:
       "Serve raw file bytes for an attachment. Supports Range headers.",
@@ -668,6 +672,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_delete",
     endpoint: "attachments",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["attachments.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete attachment",
     description: "Delete an attachment by ID.",
     tags: ["attachments"],
@@ -681,6 +689,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_get",
     endpoint: "attachments/:id",
     method: "GET",
+    policy: {
+      requiredScopes: ["attachments.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get attachment metadata",
     description: "Return metadata and optional base64 data for an attachment.",
     tags: ["attachments"],
@@ -699,6 +711,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_upload",
     endpoint: "attachments",
     method: "POST",
+    policy: {
+      requiredScopes: ["attachments.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Upload attachment",
     description:
       "Upload an attachment. Supports application/json (base64 data or file path reference), multipart/form-data (file + filename + mimeType fields), and application/octet-stream (raw bytes with filename and mimeType query params).",
@@ -731,6 +747,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_register",
     endpoint: "attachments/register",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Register a file-backed attachment",
     description:
       "Register an on-disk file as a file-backed attachment. The file must be within the workspace directory and must remain on disk for the lifetime of the attachment.",
@@ -758,6 +778,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "attachment_lookup",
     endpoint: "attachments/lookup",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Look up attachment by source path",
     description:
       "Search for a previously registered attachment by its original source path, scoped to a conversation.",