@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/background-job-runner.ts

@@ -248,26 +248,23 @@ export async function runBackgroundJob(
         conversation.id,
         "user",
         opts.assistantSandwich.preamble,
-        undefined,
         { skipIndexing: true },
       );
       await addMessage(
         conversation.id,
         "assistant",
         opts.assistantSandwich.content,
-        undefined,
         { skipIndexing: true },
       );
       await addMessage(
         conversation.id,
         "user",
         opts.assistantSandwich.postamble,
-        undefined,
         { skipIndexing: true },
       );
     }
 
-    const work = processMessage(conversation.id, opts.prompt, undefined, {
+    const work = processMessage(conversation.id, opts.prompt, {
       trustContext: opts.trustContext,
       callSite: opts.callSite,
     });

package/src/runtime/btw-sidechain.ts

@@ -89,7 +89,9 @@ export async function runBtwSidechain(
   let hadTextDeltas = false;
 
   try {
-    const response = await provider.sendMessage(messages, tools, systemPrompt, {
+    const response = await provider.sendMessage(messages, {
+      tools,
+      systemPrompt,
       config: {
         max_tokens: params.maxTokens ?? 1024,
         tool_choice: { type: "none" },

package/src/runtime/channel-approvals.ts

@@ -9,7 +9,7 @@
  *   3. Consume user decisions and apply them to the underlying session
  */
 
-import { findConversation } from "../daemon/conversation-store.js";
+import { findConversation } from "../daemon/conversation-registry.js";
 import type { UserDecision } from "../permissions/types.js";
 import { composeApprovalMessage } from "./approval-message-composer.js";
 import type {
@@ -170,20 +170,9 @@ export function handleChannelDecision(
   const conversation = findConversation(resolved.conversationId);
   if (!conversation) return { applied: false };
 
-  if (decisionContext === undefined) {
-    conversation.handleConfirmationResponse(
-      info.requestId,
-      userDecision,
-    );
-  } else {
-    conversation.handleConfirmationResponse(
-      info.requestId,
-      userDecision,
-      undefined,
-      undefined,
-      decisionContext,
-    );
-  }
+  conversation.handleConfirmationResponse(info.requestId, userDecision, {
+    decisionContext,
+  });
 
   return {
     applied: true,

package/src/runtime/channel-invite-transport.ts

@@ -13,8 +13,6 @@
  */
 
 import type { ChannelId } from "../channels/types.js";
-import { getConfig } from "../config/loader.js";
-import { isEmailEnabled } from "../email/feature-gate.js";
 import { emailInviteAdapter } from "./channel-invite-transports/email.js";
 import { slackInviteAdapter } from "./channel-invite-transports/slack.js";
 import { telegramInviteAdapter } from "./channel-invite-transports/telegram.js";
@@ -24,7 +22,10 @@ import { whatsappInviteAdapter } from "./channel-invite-transports/whatsapp.js";
 // Types
 // ---------------------------------------------------------------------------
 import type { ChannelInviteAdapter } from "./channel-invite-types.js";
-export type { ChannelInviteAdapter, InviteShareLink } from "./channel-invite-types.js";
+export type {
+  ChannelInviteAdapter,
+  InviteShareLink,
+} from "./channel-invite-types.js";
 
 // ---------------------------------------------------------------------------
 // Registry
@@ -95,9 +96,7 @@ export async function resolveAdapterHandle(
 /** Create a registry instance with built-in adapters registered. */
 export function createInviteAdapterRegistry(): InviteAdapterRegistry {
   const registry = new InviteAdapterRegistry();
-  if (isEmailEnabled(getConfig())) {
-    registry.register(emailInviteAdapter);
-  }
+  registry.register(emailInviteAdapter);
   registry.register(slackInviteAdapter);
   registry.register(telegramInviteAdapter);
   registry.register(voiceInviteAdapter);

package/src/runtime/channel-readiness-service.ts

@@ -7,8 +7,7 @@ import { resolveTwilioPhoneNumber } from "../calls/twilio-config.js";
 import { hasTwilioCredentials } from "../calls/twilio-rest.js";
 import { getChannelInvitePolicy } from "../channels/config.js";
 import { getIsPlatform } from "../config/env-registry.js";
-import { getConfig, getNestedValue, loadRawConfig } from "../config/loader.js";
-import { isEmailEnabled } from "../email/feature-gate.js";
+import { getNestedValue, loadRawConfig } from "../config/loader.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { resolveWhatsAppDisplayNumber } from "./channel-invite-transports/whatsapp.js";
@@ -513,9 +512,7 @@ export function createReadinessService(): ChannelReadinessService {
   const service = new ChannelReadinessService();
   service.registerProbe(voiceProbe);
   service.registerProbe(telegramProbe);
-  if (isEmailEnabled(getConfig())) {
-    service.registerProbe(emailProbe);
-  }
+  service.registerProbe(emailProbe);
   service.registerProbe(whatsappProbe);
   service.registerProbe(slackProbe);
   return service;

package/src/runtime/channel-retry-sweep.ts

@@ -298,26 +298,22 @@ export async function sweepFailedEvents(
 
     let userMessageId: string | undefined;
     try {
-      const result = await processMessage(
-        event.conversationId,
-        content,
+      const result = await processMessage(event.conversationId, content, {
         attachmentIds,
-        {
-          transport: {
-            channelId: sourceChannel,
-            hints: metadataHints.length > 0 ? metadataHints : undefined,
-            uxBrief: metadataUxBrief,
-            chatType: metadataChatType,
-          },
-          assistantId,
-          trustContext,
-          isInteractive:
-            resolveRoutingStateFromRuntime(trustContext).promptWaitingAllowed,
-          onEvent: observeAgentEvent,
+        transport: {
+          channelId: sourceChannel,
+          hints: metadataHints.length > 0 ? metadataHints : undefined,
+          uxBrief: metadataUxBrief,
+          chatType: metadataChatType,
         },
+        assistantId,
+        trustContext,
+        isInteractive:
+          resolveRoutingStateFromRuntime(trustContext).promptWaitingAllowed,
+        onEvent: observeAgentEvent,
         sourceChannel,
         sourceInterface,
-      );
+      });
       userMessageId = result.messageId;
       linkMessage(event.id, userMessageId);
       markProcessed(event.id);

package/src/runtime/http-router.ts

@@ -12,13 +12,19 @@
 
 import type { z } from "zod";
 
-import { enforcePolicy, getPolicy } from "./auth/route-policy.js";
+import type { RoutePolicy } from "./auth/route-policy.js";
+import { enforcePolicy } from "./auth/route-policy.js";
 import type { AuthContext } from "./auth/types.js";
 import { httpError } from "./http-errors.js";
 import { withErrorHandling } from "./middleware/error-handler.js";
 import { routeDefinitionsToHTTPRoutes } from "./routes/http-adapter.js";
 import { ROUTES } from "./routes/index.js";
-import type { RouteLoggingConfig, RoutePathParam } from "./routes/types.js";
+import type {
+  RouteLoggingConfig,
+  RoutePathParam,
+  RouteRequestBody,
+  RouteResponseBody,
+} from "./routes/types.js";
 
 // ---------------------------------------------------------------------------
 // Route definition types
@@ -63,17 +69,6 @@ export interface RouteAdditionalResponse {
   schema?: RouteBodySchema | Record<string, unknown>;
 }
 
-/**
- * Request-body variant keyed by Content-Type. Use this when an endpoint
- * accepts multiple body shapes (e.g. `application/octet-stream` OR
- * `application/json`). For the common single-JSON case, use `requestBody`.
- */
-export interface RouteRequestBodyVariant {
-  contentType: string;
-  /** Zod schema or plain JSON Schema fragment. Plain objects are embedded verbatim. */
-  schema: RouteBodySchema | Record<string, unknown>;
-}
-
 /**
  * A single route entry in the declarative table.
  *
@@ -82,14 +77,15 @@ export interface RouteRequestBodyVariant {
  *   catch-all params that match across slashes (e.g. `interfaces/:path*`).
  * - `method`: HTTP method (GET, POST, DELETE, PATCH, PUT).
  * - `handler`: Async function that produces the Response.
- * - `policyKey`: Override the policy lookup key. When omitted the router
- *   derives it from the endpoint pattern (stripping param segments).
+ * - `policy`: Scope + principal-type policy for this route, or `null`
+ *   when the route is intentionally unprotected. See
+ *   `runtime/auth/route-policy.ts` for the type.
  */
 export interface HTTPRouteDefinition {
   endpoint: string;
   method: string;
   handler: (ctx: RouteContext) => Promise<Response> | Response;
-  policyKey?: string;
+  policy: RoutePolicy | null;
 
   /** Stable identifier used as the IPC method name when served over both transports. */
   operationId?: string;
@@ -108,17 +104,18 @@ export interface HTTPRouteDefinition {
   tags?: string[];
   /** Query parameter definitions for the operation. */
   queryParams?: RouteQueryParam[];
-  /** Zod schema for the request body (POST/PUT/PATCH/DELETE). */
-  requestBody?: RouteBodySchema;
   /**
-   * Alternate request-body variants keyed by Content-Type. When set,
-   * overrides `requestBody` in the generated OpenAPI spec — use this for
-   * endpoints that accept multiple body shapes on the same URL (e.g.
-   * raw bytes OR JSON URL).
+   * Request body for POST/PUT/PATCH/DELETE. A bare Zod schema is advertised
+   * as `application/json`; use the `{ contentType, schema }` form for non-JSON
+   * bodies (e.g. a raw `application/octet-stream` upload).
    */
-  requestBodies?: RouteRequestBodyVariant[];
-  /** Zod schema for the success response body. */
-  responseBody?: RouteBodySchema;
+  requestBody?: RouteRequestBody;
+  /**
+   * Success response body. A bare Zod schema is advertised as
+   * `application/json`; use the `{ contentType, schema }` form for non-JSON
+   * responses (e.g. a binary `application/octet-stream` download).
+   */
+  responseBody?: RouteResponseBody;
   /**
    * HTTP status code for the documented success response. Defaults to 200.
    * Set to "202" for async endpoints that enqueue a job and return
@@ -143,8 +140,6 @@ interface CompiledRoute {
   def: HTTPRouteDefinition;
   regex: RegExp;
   paramNames: string[];
-  /** Policy key used for enforcePolicy() lookups. */
-  resolvedPolicyKey: string;
 }
 
 // ---------------------------------------------------------------------------
@@ -228,13 +223,14 @@ export class HttpRouter {
         }
       }
 
-      // Enforce route-level scope/principal policy.
-      // Try method-specific key first (e.g. "messages:POST"), then plain key.
-      const methodKey = `${compiled.resolvedPolicyKey}:${req.method}`;
-      const policyKey = getPolicy(methodKey)
-        ? methodKey
-        : compiled.resolvedPolicyKey;
-      const policyDenied = enforcePolicy(policyKey, authContext);
+      // Enforce route-level scope/principal policy. The policy
+      // travels with the RouteDefinition itself — no side-registry
+      // lookup, no derivation, no key mismatch.
+      const policyDenied = enforcePolicy(
+        compiled.def.endpoint,
+        compiled.def.policy,
+        authContext,
+      );
       if (policyDenied) return policyDenied;
 
       return withErrorHandling(endpoint, () =>
@@ -265,21 +261,22 @@ const PARAM_TYPE_PATTERNS: Record<string, string> = {
 };
 
 /**
- * Compile a route definition into a regex + param list + policy key.
+ * Compile a route definition into a regex + param list.
  *
  * Endpoint patterns like `calls/:id/cancel` become:
  *   regex: /^calls\/([^/]+)\/cancel$/
  *   paramNames: ["id"]
- *   resolvedPolicyKey: "calls/cancel" (params stripped)
  *
  * When the route declares `pathParams` with a `type` constraint (e.g.
  * `{ name: "id", type: "uuid" }`), the capture group is narrowed to
  * only match values of that type. This prevents parameterized routes
  * from shadowing literal sibling routes regardless of declaration order.
+ *
+ * Policies are declared inline on the RouteDefinition itself —
+ * no derivation, no lookup key.
  */
 function compileRoute(def: HTTPRouteDefinition): CompiledRoute {
   const paramNames: string[] = [];
-  const policySegments: string[] = [];
 
   // Build a lookup for typed path params.
   const paramTypeMap = new Map<string, string>();
@@ -306,18 +303,13 @@ function compileRoute(def: HTTPRouteDefinition): CompiledRoute {
         const typePattern = PARAM_TYPE_PATTERNS[paramTypeMap.get(name) ?? ""];
         return typePattern ? `(${typePattern})` : "([^/]+)";
       }
-      policySegments.push(segment);
       return escapeRegex(segment);
     })
     .join("\\/");
 
   const regex = new RegExp(`^${regexSource}$`);
 
-  // If the definition specifies a policyKey, use it. Otherwise derive from
-  // the non-param segments (e.g. `calls/:id/cancel` -> `calls/cancel`).
-  const resolvedPolicyKey = def.policyKey ?? policySegments.join("/");
-
-  return { def, regex, paramNames, resolvedPolicyKey };
+  return { def, regex, paramNames };
 }
 
 function escapeRegex(str: string): string {

package/src/runtime/http-types.ts

@@ -1,6 +1,10 @@
 /**
  * Shared types for the runtime HTTP server and its route handlers.
  */
+import type {
+  ConversationMessage,
+  ConversationMessageAttachment,
+} from "../api/responses/conversation-message.js";
 import type { ChannelId, InterfaceId } from "../channels/types.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { Conversation } from "../daemon/conversation.js";
@@ -85,8 +89,7 @@ export interface RuntimeMessageConversationOptions {
   /**
    * Optional LLM call-site identifier. Channel ingress and other inbound paths
    * may pass this so the daemon's per-call provider config picks up the right
-   * profile via `resolveCallSiteConfig`. PRs 7-11 wire individual call-site
-   * literals into specific call paths.
+   * profile via `resolveCallSiteConfig`.
    */
   callSite?: LLMCallSite;
   /**
@@ -96,15 +99,18 @@ export interface RuntimeMessageConversationOptions {
    * chronological renderer to consume.
    */
   slackInbound?: SlackInboundMessageMetadata;
+  /** IDs of user-uploaded attachments to resolve and include in the turn. */
+  attachmentIds?: string[];
+  /** Originating channel (e.g. "slack", "telegram"). Defaults to "vellum". */
+  sourceChannel?: ChannelId;
+  /** Originating interface (e.g. "cli", "web"). Defaults to "web". */
+  sourceInterface?: InterfaceId;
 }
 
 export type MessageProcessor = (
   conversationId: string,
   content: string,
-  attachmentIds?: string[],
   options?: RuntimeMessageConversationOptions,
-  sourceChannel?: ChannelId,
-  sourceInterface?: InterfaceId,
 ) => Promise<{ messageId: string; assistantMessageId?: string }>;
 
 /**
@@ -135,70 +141,16 @@ export interface RuntimeHttpServerOptions {
   hostname?: string;
 }
 
-export interface RuntimeAttachmentMetadata {
-  id: string;
-  filename: string;
-  mimeType: string;
-  sizeBytes: number;
-  kind: string;
-  data?: string;
-  thumbnailData?: string;
-  fileBacked?: boolean;
-}
+/**
+ * Structured attachment metadata returned on a history row. Canonical wire
+ * shape lives in `@vellumai/assistant-api`; aliased here so route modules can
+ * keep importing the runtime-local name.
+ */
+export type RuntimeAttachmentMetadata = ConversationMessageAttachment;
 
-export interface RuntimeMessagePayload {
-  id: string;
-  role: string;
-  content: string;
-  timestamp: string;
-  attachments: RuntimeAttachmentMetadata[];
-  toolCalls?: Array<{
-    name: string;
-    input: Record<string, unknown>;
-    result?: string;
-    isError?: boolean;
-    riskLevel?: string;
-    riskReason?: string;
-    autoApproved?: boolean;
-    approvalMode?: string;
-    approvalReason?: string;
-    riskThreshold?: string;
-  }>;
-  surfaces?: Array<{
-    surfaceId: string;
-    surfaceType: string;
-    title?: string;
-    data: Record<string, unknown>;
-    actions?: unknown[];
-    display?: string;
-  }>;
-  textSegments?: string[];
-  thinkingSegments?: string[];
-  contentOrder?: string[];
-  subagentNotification?: {
-    subagentId: string;
-    label: string;
-    status: string;
-    error?: string;
-    conversationId?: string;
-    objective?: string;
-  };
-  slackMessage?: {
-    channelId: string;
-    channelName?: string;
-    channelTs: string;
-    threadTs?: string;
-    sender?: {
-      displayName?: string;
-      externalUserId?: string;
-    };
-    messageLink?: {
-      appUrl?: string;
-      webUrl?: string;
-    };
-    threadLink?: {
-      appUrl?: string;
-      webUrl?: string;
-    };
-  };
-}
+/**
+ * The daemon's history-row payload. Canonical wire contract lives in
+ * `@vellumai/assistant-api` (`responses/conversation-message.ts`) so the
+ * producer and every consumer (web, CLI, evals) derive from one source.
+ */
+export type RuntimeMessagePayload = ConversationMessage;

package/src/runtime/interactive-ui.ts

@@ -30,7 +30,7 @@
  *     `"timed_out"`.
  */
 
-import { findConversation } from "../daemon/conversation-store.js";
+import { findConversation } from "../daemon/conversation-registry.js";
 import { showStandaloneSurface } from "../daemon/conversation-surfaces.js";
 import { getLogger } from "../util/logger.js";
 import { mintDecisionToken } from "./decision-token.js";

package/src/runtime/invite-instruction-generator.ts

@@ -70,7 +70,9 @@ export async function generateInviteInstruction(params: {
     ? `Send ${contact} this link: ${params.shareUrl} — or tell them to message me${handle} with the code below.`
     : `Tell ${contact} to message me${handle} with the code below.`;
 
-  const resolved = await resolveConfiguredProvider("inviteInstructionGenerator");
+  const resolved = await resolveConfiguredProvider(
+    "inviteInstructionGenerator",
+  );
   if (!resolved) {
     log.debug(
       "No provider available for invite instruction generation, using fallback",
@@ -121,8 +123,6 @@ export async function generateInviteInstruction(params: {
 
     const response = await resolved.provider.sendMessage(
       [userMessage(prompt)],
-      undefined,
-      undefined,
       { signal, config: { callSite: "inviteInstructionGenerator" } },
     );
 

package/src/runtime/pending-interactions.ts

@@ -18,14 +18,14 @@
  * resolve the interaction.
  */
 
-import type { InteractionResolutionState } from "../daemon/message-types/messages.js";
+import type { InteractionResolutionState } from "../api/events/interaction-resolved.js";
 import type { UserDecision } from "../permissions/types.js";
 import { getLogger } from "../util/logger.js";
 import { broadcastMessage } from "./assistant-event-hub.js";
 
 const log = getLogger("pending-interactions");
 
-export type { InteractionResolutionState } from "../daemon/message-types/messages.js";
+export type { InteractionResolutionState } from "../api/events/interaction-resolved.js";
 
 export interface ConfirmationDetails {
   toolName: string;
@@ -38,6 +38,7 @@ export interface ConfirmationDetails {
     pattern: string;
   }>;
   scopeOptions: Array<{ label: string; scope: string }>;
+  directoryScopeOptions?: Array<{ label: string; scope: string }>;
   persistentDecisionsAllowed?: boolean;
   /** ACP tool kind from the agent (e.g. "read", "edit", "execute"). */
   acpToolKind?: string;