@vellumai/assistant 0.8.5 → 0.8.7

package/src/runtime/routes/document-comments-routes.ts

@@ -17,6 +17,7 @@ import {
 } from "../../documents/document-comments-store.js";
 import { getLogger } from "../../util/logger.js";
 import { broadcastMessage } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -35,7 +36,11 @@ const listQuerySchema = z.object({
 
 const createBodySchema = z.object({
   content: z.string().min(1).describe("Comment text content"),
-  author: z.literal("user").optional().default("user").describe("Comment author"),
+  author: z
+    .literal("user")
+    .optional()
+    .default("user")
+    .describe("Comment author"),
   anchorStart: z
     .number()
     .nullable()
@@ -68,6 +73,33 @@ const updateBodySchema = z
     message: "At least one of status or content must be provided",
   });
 
+// ---------------------------------------------------------------------------
+// Response schema
+// ---------------------------------------------------------------------------
+
+/**
+ * Wire shape of a stored comment, mirroring the `CommentRecord` returned by
+ * the store layer. Shared by the list, create, and update responses so the
+ * generated client and OpenAPI spec describe the full comment rather than an
+ * erased `unknown`.
+ */
+const documentCommentSchema = z.object({
+  id: z.string(),
+  surfaceId: z.string(),
+  conversationId: z.string(),
+  author: z.string(),
+  content: z.string(),
+  anchorStart: z.number().nullable(),
+  anchorEnd: z.number().nullable(),
+  anchorText: z.string().nullable(),
+  parentCommentId: z.string().nullable(),
+  status: z.enum(["open", "resolved"]),
+  resolvedBy: z.string().nullable(),
+  resolvedAt: z.number().nullable(),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -77,8 +109,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listDocumentComments",
     endpoint: "documents/:id/comments",
     method: "GET",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List comments for a document",
     description:
       "Return comments for a document, optionally filtered by status.",
@@ -91,7 +125,7 @@ export const ROUTES: RouteDefinition[] = [
       },
     ],
     responseBody: z.object({
-      comments: z.array(z.unknown()).describe("Comment records"),
+      comments: z.array(documentCommentSchema).describe("Comment records"),
     }),
     handler: ({ pathParams, queryParams }) => {
       const parsed = listQuerySchema.safeParse(queryParams ?? {});
@@ -108,22 +142,15 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "createDocumentComment",
     endpoint: "documents/:id/comments",
     method: "POST",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create a comment on a document",
     description: "Add a new comment to a document.",
     tags: ["documents"],
     requestBody: createBodySchema,
-    responseBody: z.object({
-      id: z.string(),
-      surfaceId: z.string(),
-      conversationId: z.string(),
-      author: z.string(),
-      content: z.string(),
-      status: z.string(),
-      createdAt: z.number(),
-      updatedAt: z.number(),
-    }),
+    responseBody: documentCommentSchema,
     handler: ({ pathParams, body }) => {
       const parsed = createBodySchema.safeParse(body ?? {});
       if (!parsed.success) {
@@ -181,19 +208,12 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "updateDocumentComment",
     endpoint: "documents/:id/comments/:commentId",
     method: "PATCH",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: null,
     summary: "Update a document comment",
     description: "Update the status or content of a comment.",
     tags: ["documents"],
     requestBody: updateBodySchema,
-    responseBody: z.object({
-      id: z.string(),
-      surfaceId: z.string(),
-      content: z.string(),
-      status: z.string(),
-      updatedAt: z.number(),
-    }),
+    responseBody: documentCommentSchema,
     handler: ({ pathParams, body }) => {
       const parsed = updateBodySchema.safeParse(body ?? {});
       if (!parsed.success) {
@@ -253,8 +273,7 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "deleteDocumentComment",
     endpoint: "documents/:id/comments/:commentId",
     method: "DELETE",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: null,
     summary: "Delete a document comment",
     description: "Permanently delete a comment.",
     tags: ["documents"],

package/src/runtime/routes/documents-routes.ts

@@ -14,6 +14,7 @@ import {
 } from "../../documents/document-store.js";
 import { rawAll } from "../../memory/raw-query.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { renderMarkdownToPDF } from "./document-pdf-renderer.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
@@ -69,8 +70,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listDocuments",
     endpoint: "documents",
     method: "GET",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List documents",
     description: "Return all documents, optionally filtered by conversation.",
     tags: ["documents"],
@@ -82,7 +85,16 @@ export const ROUTES: RouteDefinition[] = [
       },
     ],
     responseBody: z.object({
-      documents: z.array(z.unknown()).describe("Document summary objects"),
+      documents: z.array(
+        z.object({
+          surfaceId: z.string(),
+          conversationId: z.string(),
+          title: z.string(),
+          wordCount: z.number(),
+          createdAt: z.number(),
+          updatedAt: z.number(),
+        }),
+      ),
     }),
     handler: ({ queryParams }) => {
       const conversationId = queryParams?.conversationId ?? undefined;
@@ -97,8 +109,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getDocument",
     endpoint: "documents/:id",
     method: "GET",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get a document",
     description: "Return a single document by surface ID.",
     tags: ["documents"],
@@ -125,8 +139,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "saveDocument",
     endpoint: "documents",
     method: "POST",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Save a document",
     description: "Create or upsert a document (by surfaceId).",
     tags: ["documents"],
@@ -186,8 +202,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "linkDocumentConversation",
     endpoint: "documents/:id/conversations",
     method: "POST",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Link a document to a conversation",
     description:
       "Associate a document with a conversation so the assistant sees it as context.",
@@ -218,8 +236,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "exportDocumentPDF",
     endpoint: "documents/:id/pdf",
     method: "GET",
-    policyKey: "documents",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Export a document as PDF",
     description: "Render a document to PDF and return the binary content.",
     tags: ["documents"],

package/src/runtime/routes/domain-routes.ts

@@ -12,11 +12,26 @@ import {
   setNestedValue,
 } from "../../config/loader.js";
 import { VellumPlatformClient } from "../../platform/client.js";
+import { getLogger } from "../../util/logger.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, RouteError, UnauthorizedError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
+const log = getLogger("domain-routes");
+
 // ── Helpers ───────────────────────────────────────────────────────────
 
+interface DomainListResponse {
+  next?: string | null;
+  results: {
+    id: string;
+    subdomain?: string;
+    domain?: string;
+    created_at?: string;
+    created?: string;
+  }[];
+}
+
 async function requireClient(): Promise<VellumPlatformClient> {
   const client = await VellumPlatformClient.create();
   if (!client) {
@@ -32,6 +47,25 @@ async function requireClient(): Promise<VellumPlatformClient> {
   return client;
 }
 
+async function fetchDomains(
+  client: VellumPlatformClient,
+): Promise<DomainListResponse> {
+  const response = await client.fetch(
+    `/v1/assistants/${client.platformAssistantId}/domains/`,
+  );
+
+  if (!response.ok) {
+    const respBody = (await response.json().catch(() => ({}))) as Record<
+      string,
+      unknown
+    >;
+    const detail = respBody.detail ?? `HTTP ${response.status}`;
+    throw new RouteError(String(detail), "LIST_FAILED", response.status);
+  }
+
+  return (await response.json()) as DomainListResponse;
+}
+
 // ── Handlers ──────────────────────────────────────────────────────────
 
 async function handleDomainRegister({ body = {} }: RouteHandlerArgs) {
@@ -106,33 +140,7 @@ async function handleDomainStatus(_args: RouteHandlerArgs) {
   const client = await requireClient();
   const apexDomain = getApexDomain();
 
-  const response = await client.fetch(
-    `/v1/assistants/${client.platformAssistantId}/domains/`,
-  );
-
-  if (!response.ok) {
-    const respBody = (await response.json().catch(() => ({}))) as Record<
-      string,
-      unknown
-    >;
-    const detail = respBody.detail ?? `HTTP ${response.status}`;
-    throw new RouteError(
-      String(detail),
-      "LIST_FAILED",
-      response.status,
-    );
-  }
-
-  const data = (await response.json()) as {
-    results: {
-      id: string;
-      subdomain?: string;
-      domain?: string;
-      created_at?: string;
-      created?: string;
-    }[];
-  };
-
+  const data = await fetchDomains(client);
   const domains = data.results ?? [];
 
   // Sync subdomain to config if not already cached
@@ -163,8 +171,21 @@ async function handleDomainVerificationStatus({
   }
   const client = await requireClient();
 
+  const { results, next } = await fetchDomains(client);
+  if (next) {
+    log.error(
+      { extra: { domain_id, next } },
+      "Domain list is paginated; ownership check may produce false negatives",
+    );
+  }
+  if (!results?.some((d) => d.id === domain_id)) {
+    throw new BadRequestError(
+      "domain_id is not registered for this assistant",
+    );
+  }
+
   const response = await client.fetch(
-    `/v1/assistants/${client.platformAssistantId}/domains/${domain_id}/verification-status/`,
+    `/v1/assistants/${client.platformAssistantId}/domains/${encodeURIComponent(domain_id)}/verification-status/`,
   );
 
   if (!response.ok) {
@@ -194,6 +215,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "domain_register",
     endpoint: "domain/register",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleDomainRegister,
     summary: "Register a subdomain for this assistant",
     tags: ["domain"],
@@ -202,6 +227,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "domain_status",
     endpoint: "domain/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleDomainStatus,
     summary: "Show domain registration and health",
     tags: ["domain"],
@@ -210,6 +239,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "domain_verification_status",
     endpoint: "domain/verification-status",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleDomainVerificationStatus,
     summary: "Get live DNS verification status for a domain",
     tags: ["domain"],

package/src/runtime/routes/email-routes.ts

@@ -9,6 +9,7 @@ import { z } from "zod";
 
 import { markdownToEmailHtml } from "../../email/html-renderer.js";
 import { VellumPlatformClient } from "../../platform/client.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   NotFoundError,
@@ -419,6 +420,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_register",
     endpoint: "email/register",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailRegister,
     summary: "Register an email address",
     description:
@@ -440,6 +445,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_unregister",
     endpoint: "email/unregister",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailUnregister,
     summary: "Unregister the email address",
     description:
@@ -453,6 +462,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_status",
     endpoint: "email/status",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailStatus,
     summary: "Get email address status and usage",
     description:
@@ -475,6 +488,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_list",
     endpoint: "email/list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailList,
     summary: "List email messages",
     description:
@@ -509,6 +526,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_download",
     endpoint: "email/download",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailDownload,
     summary: "Download a specific email message",
     description: "Download a specific email message by ID.",
@@ -527,6 +548,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_send",
     endpoint: "email/send",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailSend,
     summary: "Send an email",
     description:
@@ -553,6 +578,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_attachment_list",
     endpoint: "email/attachment-list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailAttachmentList,
     summary: "List attachments for an email message",
     description:
@@ -583,6 +612,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "email_attachment_get",
     endpoint: "email/attachment-get",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     handler: handleEmailAttachmentGet,
     summary: "Stream-download an email attachment",
     description:

package/src/runtime/routes/events-routes.ts

@@ -39,6 +39,9 @@ import {
   AssistantEventHub,
   assistantEventHub,
 } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS, GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
+import type { ReplaySubscriber } from "../conversation-stream-state.js";
+import { getReplayWindow } from "../conversation-stream-state.js";
 import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
 import {
   BadRequestError,
@@ -263,19 +266,32 @@ export function handleSubscribeAssistantEvents(
 
   const rawConversationId = queryParams?.conversationId;
   const rawConversationKey = queryParams?.conversationKey;
-  if (
-    "conversationId" in (queryParams ?? {}) &&
-    !rawConversationId?.trim()
-  ) {
+  const rawLastSeenSeq = queryParams?.lastSeenSeq;
+  if ("conversationId" in (queryParams ?? {}) && !rawConversationId?.trim()) {
     throw new BadRequestError("conversationId must not be empty");
   }
-  if (
-    "conversationKey" in (queryParams ?? {}) &&
-    !rawConversationKey?.trim()
-  ) {
+  if ("conversationKey" in (queryParams ?? {}) && !rawConversationKey?.trim()) {
     throw new BadRequestError("conversationKey must not be empty");
   }
 
+  // Parse the optional reconnect cursor. We accept any non-negative integer
+  // -- including 0, which is the natural cursor for a client that has not
+  // yet observed any event in this conversation but still wants its full
+  // ring buffer replayed (as opposed to omitting the param entirely, which
+  // means "no replay attempt, just connect live").
+  let lastSeenSeq: number | null = null;
+  if (rawLastSeenSeq != null) {
+    const trimmed = rawLastSeenSeq.trim();
+    if (trimmed === "") {
+      throw new BadRequestError("lastSeenSeq must not be empty");
+    }
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+      throw new BadRequestError("lastSeenSeq must be a non-negative integer");
+    }
+    lastSeenSeq = parsed;
+  }
+
   // ── Client identity from headers ──────────────────────────────────────
   const rawClientId = headers?.["x-vellum-client-id"];
   const rawInterfaceId = headers?.["x-vellum-interface-id"];
@@ -371,9 +387,37 @@ export function handleSubscribeAssistantEvents(
     }
   }
 
+  // Tracks the highest seq enqueued during the synchronous replay drain.
+  // Live events that race in with seq <= this watermark are dropped to
+  // avoid double-delivery -- broadcastMessage stamps and rings BEFORE
+  // calling publish, so any in-flight event mid-replay is already in the
+  // replay window we just drained.
+  let highWaterReplaySeq = -1;
+
+  // Per-conversation subscriber-filtered sequence counters. Incremented
+  // for each conversation-scoped event this specific subscriber receives
+  // (after capability/client/interface targeting), producing a gap-free
+  // sequence from the subscriber's perspective. Clients use `clientSeq`
+  // for gap detection instead of the global `seq` to avoid false
+  // positives from targeted events they never receive.
+  const clientSeqCounters = new Map<string, number>();
+  function nextClientSeqFor(conversationId: string): number {
+    const next = (clientSeqCounters.get(conversationId) ?? 0) + 1;
+    clientSeqCounters.set(conversationId, next);
+    return next;
+  }
+
   const callback: AssistantEventCallback = (event) => {
     const controller = controllerRef;
     if (!controller) return;
+    if (
+      event.seq != null &&
+      highWaterReplaySeq >= 0 &&
+      event.seq <= highWaterReplaySeq
+    ) {
+      // Already delivered via replay; skip the duplicate.
+      return;
+    }
     try {
       if (controller.desiredSize != null && controller.desiredSize <= 0) {
         shedReporter("callback_backpressure", instrumentation);
@@ -381,7 +425,11 @@ export function handleSubscribeAssistantEvents(
         cleanup();
         return;
       }
-      controller.enqueue(encoder.encode(formatSseFrame(event)));
+      const frame =
+        event.conversationId != null && event.seq != null
+          ? { ...event, clientSeq: nextClientSeqFor(event.conversationId) }
+          : event;
+      controller.enqueue(encoder.encode(formatSseFrame(frame)));
       instrumentation.eventsDelivered += 1;
     } catch {
       sub.dispose();
@@ -431,6 +479,50 @@ export function handleSubscribeAssistantEvents(
           return;
         }
 
+        // Reconnect replay: when the caller passed lastSeenSeq and the
+        // subscription is scoped to a single conversation, deliver any
+        // buffered events the client missed before the first heartbeat.
+        //
+        // If the cursor is older than the ring's oldest entry,
+        // `getReplayWindow` returns `null`. We do not surface that to
+        // the client over the wire -- the connection just goes live.
+        // The client detects the gap from the seq jump on its first
+        // live event and refetches via the existing messages API.
+        if (lastSeenSeq != null && filter.conversationId) {
+          const replaySubscriber: ReplaySubscriber =
+            clientId && interfaceId
+              ? {
+                  type: "client",
+                  clientId,
+                  interfaceId,
+                  capabilities: ALL_CAPABILITIES.filter((cap) =>
+                    supportsHostProxy(interfaceId, cap),
+                  ),
+                }
+              : { type: "process" };
+          const window = getReplayWindow(
+            filter.conversationId,
+            lastSeenSeq,
+            replaySubscriber,
+          );
+          if (window !== null) {
+            for (const replayed of window) {
+              const frame =
+                replayed.conversationId != null && replayed.seq != null
+                  ? {
+                      ...replayed,
+                      clientSeq: nextClientSeqFor(replayed.conversationId),
+                    }
+                  : replayed;
+              controller.enqueue(encoder.encode(formatSseFrame(frame)));
+              instrumentation.eventsDelivered += 1;
+              if (replayed.seq != null && replayed.seq > highWaterReplaySeq) {
+                highWaterReplaySeq = replayed.seq;
+              }
+            }
+          }
+        }
+
         controller.enqueue(encoder.encode(formatSseHeartbeat()));
         instrumentation.heartbeatsSent += 1;
 
@@ -486,6 +578,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "emit_event",
     endpoint: "events/emit",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Emit an assistant event",
     description:
       "Trigger an in-process assistant event by kind. Used by the gateway after owning a write that the assistant runtime would normally emit.",
@@ -504,6 +600,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "subscribe_assistant_events",
     endpoint: "events",
     method: "GET",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Subscribe to assistant events",
     description: "Stream assistant events as Server-Sent Events (SSE).",
     tags: ["events"],
@@ -518,6 +618,11 @@ export const ROUTES: RouteDefinition[] = [
         description:
           "Scope to a single conversation by an external key (non-vellum channels) or the web idempotency key. Materializes a row on first use. Ignored when conversationId is also provided.",
       },
+      {
+        name: "lastSeenSeq",
+        description:
+          "Optional reconnect cursor: the highest per-conversation event seq the client has already applied. When set together with a conversation scope, the daemon replays any buffered events with seq > lastSeenSeq before going live. If the cursor is older than the ring buffer's oldest entry the connection simply goes live; the client is expected to detect the gap from the next event's seq and refetch via the messages API. Must be a non-negative integer.",
+      },
     ],
     responseHeaders: {
       "Content-Type": "text/event-stream",

package/src/runtime/routes/filing-routes.ts

@@ -12,6 +12,7 @@ import { z } from "zod";
 import { getConfig } from "../../config/loader.js";
 import { FilingService } from "../../filing/filing-service.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -30,8 +31,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getFilingConfig",
     endpoint: "filing/config",
     method: "GET",
-    policyKey: "filing",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get filing config",
     description: "Return the current filing schedule configuration.",
     tags: ["filing"],
@@ -64,8 +67,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "runFilingNow",
     endpoint: "filing/run-now",
     method: "POST",
-    policyKey: "filing",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Run filing now",
     description: "Trigger an immediate filing run.",
     tags: ["filing"],