@vellumai/assistant 0.8.6 → 0.8.7

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -265,29 +265,25 @@ export function processChannelMessageInBackground(
 
       let userMessageId: string | undefined;
       try {
-        const result = await processMessage(
-          conversationId,
-          content,
+        const result = await processMessage(conversationId, content, {
           attachmentIds,
-          {
-            transport: {
-              channelId: sourceChannel,
-              hints: metadataHints.length > 0 ? metadataHints : undefined,
-              uxBrief: metadataUxBrief,
-              chatType,
-              ...(clientTimezone ? { clientTimezone } : {}),
-            },
-            assistantId,
-            trustContext: trustCtx,
-            isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
-            ...(displayContent !== undefined ? { displayContent } : {}),
-            ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
-            ...(slackInbound ? { slackInbound } : {}),
-            onEvent: observeAgentEvent,
+          transport: {
+            channelId: sourceChannel,
+            hints: metadataHints.length > 0 ? metadataHints : undefined,
+            uxBrief: metadataUxBrief,
+            chatType,
+            ...(clientTimezone ? { clientTimezone } : {}),
           },
+          assistantId,
+          trustContext: trustCtx,
+          isInteractive: resolveRoutingState(trustCtx).promptWaitingAllowed,
+          ...(displayContent !== undefined ? { displayContent } : {}),
+          ...(cmdIntent ? { commandIntent: cmdIntent } : {}),
+          ...(slackInbound ? { slackInbound } : {}),
+          onEvent: observeAgentEvent,
           sourceChannel,
           sourceInterface,
-        );
+        });
         userMessageId = result.messageId;
         linkMessage(eventId, userMessageId);
         markProcessed(eventId);

package/src/runtime/routes/inference-profile-session-routes.ts

@@ -8,6 +8,7 @@
 
 import { z } from "zod";
 
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import {
   closeInferenceProfileSession,
@@ -65,7 +66,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_profile_open",
     endpoint: "conversations/inference-profile-session",
     method: "POST",
-    policyKey: "conversations/inference-profile-session/open",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Open an inference-profile session",
     description:
       "Open (or replace) a session-backed inference-profile override for a conversation. " +
@@ -97,7 +101,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_profile_close",
     endpoint: "conversations/inference-profile-session/close",
     method: "POST",
-    policyKey: "conversations/inference-profile-session/close",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Close an inference-profile session",
     description:
       "Close the active session-backed inference-profile override for a conversation. " +
@@ -122,7 +129,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_profile_list",
     endpoint: "conversations/inference-profile-sessions",
     method: "GET",
-    policyKey: "conversations/inference-profile-sessions",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List active inference-profile sessions",
     description:
       "List all active (non-expired) session-backed inference-profile overrides, " +

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -35,6 +35,7 @@ import {
   resolveHostAddresses,
   resolveRequestAddress,
 } from "../../tools/network/url-safety.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -422,7 +423,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_list",
     endpoint: "inference/provider-connections",
     method: "GET",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List provider connections",
     description:
       "Return all provider connections. Optionally filter by provider with ?provider=<name>.",
@@ -443,7 +447,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_get",
     endpoint: "inference/provider-connections/:name",
     method: "GET",
-    policyKey: "inference/provider-connections/detail",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get a provider connection",
     description: "Return a single provider connection by name.",
     tags: ["inference"],
@@ -456,7 +463,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_create",
     endpoint: "inference/provider-connections",
     method: "POST",
-    policyKey: "inference/provider-connections",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create a provider connection",
     description:
       "Create a new named provider connection. Fails with 409 if a connection with this name already exists.",
@@ -481,7 +491,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_update",
     endpoint: "inference/provider-connections/:name",
     method: "PATCH",
-    policyKey: "inference/provider-connections/detail",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update a provider connection",
     description:
       "Update an existing connection. Cannot rename or change the provider. For managed connections (anthropic-managed, openai-managed, gemini-managed) the auth is locked to platform; label remains editable.",
@@ -507,7 +520,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_provider_connections_delete",
     endpoint: "inference/provider-connections/:name",
     method: "DELETE",
-    policyKey: "inference/provider-connections/detail",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Delete a provider connection",
     description:
       "Delete a provider connection. Fails with 400 for managed connections (anthropic-managed, openai-managed, gemini-managed) which are re-seeded on boot. Fails with 409 if any profile or call-site references the connection.",

package/src/runtime/routes/inference-send-routes.ts

@@ -13,6 +13,7 @@ import {
   getConfiguredProvider,
   userMessage,
 } from "../../providers/provider-send-message.js";
+import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
@@ -55,18 +56,14 @@ async function handleInferenceSend({ body = {} }: RouteHandlerArgs) {
     );
   }
 
-  const response = await provider.sendMessage(
-    [userMessage(message)],
-    undefined,
+  const response = await provider.sendMessage([userMessage(message)], {
     systemPrompt,
-    {
-      config: {
-        callSite: "inference",
-        max_tokens: maxTokens,
-        model,
-      },
+    config: {
+      callSite: "inference",
+      max_tokens: maxTokens,
+      model,
     },
-  );
+  });
 
   const text = extractAllText(response);
 
@@ -89,7 +86,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inference_send",
     endpoint: "inference/send",
     method: "POST",
-    policyKey: "inference/send",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Send a message to the configured LLM",
     description:
       "Send a user message to the configured LLM provider and return the model response. " +

package/src/runtime/routes/integrations/a2a.ts

@@ -10,6 +10,8 @@
  * POST   /v1/integrations/a2a/invite/accept   — self-hosted broker: orchestrate complete + redeem
  */
 
+import { z } from "zod";
+
 import { isA2AEnabled } from "../../../a2a/feature-gate.js";
 import { getConfig } from "../../../config/loader.js";
 import {
@@ -21,6 +23,10 @@ import {
   redeemA2AInvite,
   setA2AConfig,
 } from "../../../daemon/handlers/config-a2a.js";
+import {
+  ACTOR_PRINCIPALS,
+  GATEWAY_PRINCIPALS,
+} from "../../auth/route-policy.js";
 import { BadGatewayError, BadRequestError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -221,74 +227,91 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_a2a_config_get",
     endpoint: "integrations/a2a/config",
     method: "GET",
+    policy: null,
     summary: "Get A2A config",
     description: "Check current A2A channel configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetA2AConfig(),
   },
   {
     operationId: "integrations_a2a_config_post",
     endpoint: "integrations/a2a/config",
     method: "POST",
+    policy: null,
     summary: "Enable A2A channel",
     description: "Enable the A2A channel for inter-assistant communication.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleSetA2AConfig(),
   },
   {
     operationId: "integrations_a2a_config_delete",
     endpoint: "integrations/a2a/config",
     method: "DELETE",
+    policy: null,
     summary: "Disable A2A channel",
     description: "Disable the A2A channel.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearA2AConfig(),
   },
   {
     operationId: "integrations_a2a_invite_post",
     endpoint: "integrations/a2a/invite",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create A2A invite",
     description:
       "Create a shareable A2A invite token for link-based contact creation.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleCreateA2AInvite,
+    responseBody: z.object({
+      success: z.boolean(),
+      inviteId: z.string().optional(),
+      token: z.string().optional(),
+      expiresAt: z.number().optional(),
+      senderGatewayUrl: z.string().optional(),
+      error: z.string().optional(),
+    }),
   },
   {
     operationId: "integrations_a2a_invite_complete_post",
     endpoint: "integrations/a2a/invite/complete",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Complete A2A invite (sender side)",
     description:
       "Called by the platform to finalize the sender side of a link-based A2A connection.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleCompleteA2AInvite,
   },
   {
     operationId: "integrations_a2a_invite_redeem_post",
     endpoint: "integrations/a2a/invite/redeem",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Redeem A2A invite (receiver side)",
     description:
       "Called by the platform to create a trusted contact on the receiver side of a link-based A2A connection.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleRedeemA2AInvite,
   },
   {
     operationId: "integrations_a2a_invite_accept_post",
     endpoint: "integrations/a2a/invite/accept",
     method: "POST",
+    policy: null,
     summary: "Accept A2A invite (self-hosted broker)",
     description:
       "Orchestrate cross-daemon invite acceptance for self-hosted deployments. Calls the sender's invite/complete, then creates a local contact via invite/redeem.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleAcceptA2AInvite,
   },
 ];

package/src/runtime/routes/integrations/slack/channel.ts

@@ -6,11 +6,14 @@
  * DELETE /v1/integrations/slack/channel/config        — clear credentials
  */
 
+import { z } from "zod";
+
 import {
   clearSlackChannelConfig,
   getSlackChannelConfig,
   setSlackChannelConfig,
 } from "../../../../daemon/handlers/config-slack-channel.js";
+import { ACTOR_PRINCIPALS } from "../../../auth/route-policy.js";
 import { BadRequestError } from "../../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../../types.js";
 
@@ -52,30 +55,43 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_slack_channel_config_get",
     endpoint: "integrations/slack/channel/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Slack channel config",
     description: "Check current Slack channel configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetSlackChannelConfig(),
   },
   {
     operationId: "integrations_slack_channel_config_post",
     endpoint: "integrations/slack/channel/config",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Slack channel config",
     description: "Validate and store Slack channel credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetSlackChannelConfig,
+    requestBody: z.object({
+      botToken: z.string().describe("Slack bot token"),
+      appToken: z.string().describe("Slack app-level token"),
+    }),
   },
   {
     operationId: "integrations_slack_channel_config_delete",
     endpoint: "integrations/slack/channel/config",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Slack channel config",
     description: "Clear stored Slack channel credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearSlackChannelConfig(),
   },
 ];

package/src/runtime/routes/integrations/slack/share.ts

@@ -13,6 +13,7 @@ import {
 } from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
 import { getLogger } from "../../../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../../../auth/route-policy.js";
 import {
   BadRequestError,
   InternalError,
@@ -197,20 +198,26 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "slack_channels_get",
     endpoint: "slack/channels",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List Slack channels",
     description: "List Slack channels, groups, and DMs for the channel picker.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleListSlackChannels(),
   },
   {
     operationId: "slack_share_post",
     endpoint: "slack/share",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Share to Slack channel",
     description: "Post an app link directly to a Slack channel.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleShareToSlackChannel,
   },
 ];

package/src/runtime/routes/integrations/telegram.ts

@@ -8,6 +8,8 @@
  * POST   /v1/integrations/telegram/setup    — composite: set config + register commands
  */
 
+import { z } from "zod";
+
 import {
   clearTelegramConfig,
   getTelegramConfig,
@@ -15,6 +17,7 @@ import {
   setTelegramConfig,
   setupTelegram,
 } from "../../../daemon/handlers/config-telegram.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
 import { BadRequestError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -31,8 +34,7 @@ async function handleSetTelegramConfig({ body = {} }: RouteHandlerArgs) {
   const result = await setTelegramConfig(botToken);
   if (!result.success) {
     throw new BadRequestError(
-      (result as { error?: string }).error ??
-        "Failed to set Telegram config",
+      (result as { error?: string }).error ?? "Failed to set Telegram config",
     );
   }
   return result;
@@ -49,8 +51,7 @@ async function handleSetTelegramCommands({ body = {} }: RouteHandlerArgs) {
   const result = await setTelegramCommands(commands);
   if (!result.success) {
     throw new BadRequestError(
-      (result as { error?: string }).error ??
-        "Failed to set Telegram commands",
+      (result as { error?: string }).error ?? "Failed to set Telegram commands",
     );
   }
   return result;
@@ -79,50 +80,68 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_telegram_config_get",
     endpoint: "integrations/telegram/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Telegram config",
     description: "Check current Telegram bot configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetTelegramConfig(),
   },
   {
     operationId: "integrations_telegram_config_post",
     endpoint: "integrations/telegram/config",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Telegram config",
     description: "Set bot token and configure webhook.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTelegramConfig,
+    requestBody: z.object({
+      botToken: z.string().describe("Telegram bot token"),
+    }),
   },
   {
     operationId: "integrations_telegram_config_delete",
     endpoint: "integrations/telegram/config",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Telegram config",
     description: "Clear credentials and deregister webhook.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearTelegramConfig(),
   },
   {
     operationId: "integrations_telegram_commands_post",
     endpoint: "integrations/telegram/commands",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Register Telegram commands",
     description: "Register bot commands with the Telegram API.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTelegramCommands,
   },
   {
     operationId: "integrations_telegram_setup_post",
     endpoint: "integrations/telegram/setup",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Setup Telegram",
     description: "Composite: set config + register commands.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetupTelegram,
   },
 ];

package/src/runtime/routes/integrations/twilio.ts

@@ -10,6 +10,8 @@
  * POST   /v1/integrations/twilio/numbers/release                     — release a phone number
  */
 
+import { z } from "zod";
+
 import {
   getTwilioCredentials,
   hasTwilioCredentials,
@@ -30,6 +32,7 @@ import {
   deleteCredentialMetadata,
   upsertCredentialMetadata,
 } from "../../../tools/credentials/metadata-store.js";
+import { ACTOR_PRINCIPALS } from "../../auth/route-policy.js";
 import { BadRequestError, InternalError } from "../errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
 
@@ -352,70 +355,95 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_twilio_config_get",
     endpoint: "integrations/twilio/config",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get Twilio config",
     description: "Return current Twilio configuration status.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleGetTwilioConfig(),
   },
   {
     operationId: "integrations_twilio_credentials_post",
     endpoint: "integrations/twilio/credentials",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Set Twilio credentials",
     description: "Validate and store Twilio account SID and auth token.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleSetTwilioCredentials,
+    requestBody: z.object({
+      accountSid: z.string().describe("Twilio account SID"),
+      authToken: z.string().describe("Twilio auth token"),
+    }),
   },
   {
     operationId: "integrations_twilio_credentials_delete",
     endpoint: "integrations/twilio/credentials",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Clear Twilio credentials",
     description: "Remove stored Twilio credentials.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleClearTwilioCredentials(),
   },
   {
     operationId: "integrations_twilio_numbers_get",
     endpoint: "integrations/twilio/numbers",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List Twilio numbers",
     description: "List phone numbers on the Twilio account.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: () => handleListTwilioNumbers(),
   },
   {
     operationId: "integrations_twilio_numbers_provision_post",
     endpoint: "integrations/twilio/numbers/provision",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Provision Twilio number",
     description: "Search for and provision a new phone number.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleProvisionTwilioNumber,
   },
   {
     operationId: "integrations_twilio_numbers_assign_post",
     endpoint: "integrations/twilio/numbers/assign",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Assign Twilio number",
     description: "Assign an existing phone number to this assistant.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleAssignTwilioNumber,
   },
   {
     operationId: "integrations_twilio_numbers_release_post",
     endpoint: "integrations/twilio/numbers/release",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Release Twilio number",
     description: "Release a phone number back to Twilio.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     handler: handleReleaseTwilioNumber,
   },
 ];