@vellumai/assistant 0.8.6 → 0.8.7

package/src/__tests__/llm-request-log-turn-query.test.ts

@@ -65,10 +65,10 @@ describe("getRequestLogsByMessageId — turn-aware query", () => {
 
   test("single message, single log: backward compat — returns 1 log", async () => {
     const conv = createConversation("single-msg");
-    await addMessage(conv.id, "user", "Hello", undefined, {
+    await addMessage(conv.id, "user", "Hello", {
       skipIndexing: true,
     });
-    const a1 = await addMessage(conv.id, "assistant", "Hi!", undefined, {
+    const a1 = await addMessage(conv.id, "assistant", "Hi!", {
       skipIndexing: true,
     });
 
@@ -86,33 +86,25 @@ describe("getRequestLogsByMessageId — turn-aware query", () => {
     const conv = createConversation("multi-step");
 
     // user → A1 (+ log1) → tool_result → A2 (+ log2)
-    await addMessage(conv.id, "user", "Do the task", undefined, {
+    await addMessage(conv.id, "user", "Do the task", {
       skipIndexing: true,
     });
 
     // First LLM call → A1
     recordRequestLog(conv.id, '{"step":1}', '{"tool_use":"bash"}');
-    const a1 = await addMessage(
-      conv.id,
-      "assistant",
-      "Using tool...",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a1 = await addMessage(conv.id, "assistant", "Using tool...", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(conv.id, a1.id);
 
     // tool_result user message
-    await addMessage(
-      conv.id,
-      "user",
-      toolResultContent(["tool-1"]),
-      undefined,
-      { skipIndexing: true },
-    );
+    await addMessage(conv.id, "user", toolResultContent(["tool-1"]), {
+      skipIndexing: true,
+    });
 
     // Second LLM call → A2
     recordRequestLog(conv.id, '{"step":2}', '{"result":"done"}');
-    const a2 = await addMessage(conv.id, "assistant", "All done!", undefined, {
+    const a2 = await addMessage(conv.id, "assistant", "All done!", {
       skipIndexing: true,
     });
     backfillMessageIdOnLogs(conv.id, a2.id);
@@ -130,36 +122,24 @@ describe("getRequestLogsByMessageId — turn-aware query", () => {
     const source = createConversation("source-conv");
 
     // Build a multi-step turn in the source conversation
-    await addMessage(source.id, "user", "Original task", undefined, {
+    await addMessage(source.id, "user", "Original task", {
       skipIndexing: true,
     });
 
     recordRequestLog(source.id, '{"step":1}', '{"tool":"bash"}');
-    const a1 = await addMessage(
-      source.id,
-      "assistant",
-      "Using tool...",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a1 = await addMessage(source.id, "assistant", "Using tool...", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(source.id, a1.id);
 
-    await addMessage(
-      source.id,
-      "user",
-      toolResultContent(["tool-1"]),
-      undefined,
-      { skipIndexing: true },
-    );
+    await addMessage(source.id, "user", toolResultContent(["tool-1"]), {
+      skipIndexing: true,
+    });
 
     recordRequestLog(source.id, '{"step":2}', '{"result":"ok"}');
-    const a2 = await addMessage(
-      source.id,
-      "assistant",
-      "Done with source!",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a2 = await addMessage(source.id, "assistant", "Done with source!", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(source.id, a2.id);
 
     // Fork the conversation
@@ -183,49 +163,33 @@ describe("getRequestLogsByMessageId — turn-aware query", () => {
     const conv = createConversation("two-turns");
 
     // First turn: user → A1 (+ log1)
-    await addMessage(conv.id, "user", "First question", undefined, {
+    await addMessage(conv.id, "user", "First question", {
       skipIndexing: true,
     });
     recordRequestLog(conv.id, '{"turn":1}', '{"answer":"first"}');
-    const a1 = await addMessage(
-      conv.id,
-      "assistant",
-      "First answer",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a1 = await addMessage(conv.id, "assistant", "First answer", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(conv.id, a1.id);
 
     // Second turn: user → A2 (+ log2) → tool_result → A3 (+ log3)
-    await addMessage(conv.id, "user", "Second question", undefined, {
+    await addMessage(conv.id, "user", "Second question", {
       skipIndexing: true,
     });
     recordRequestLog(conv.id, '{"turn":2,"step":1}', '{"tool":"bash"}');
-    const a2 = await addMessage(
-      conv.id,
-      "assistant",
-      "Using tool...",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a2 = await addMessage(conv.id, "assistant", "Using tool...", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(conv.id, a2.id);
 
-    await addMessage(
-      conv.id,
-      "user",
-      toolResultContent(["tool-2"]),
-      undefined,
-      { skipIndexing: true },
-    );
+    await addMessage(conv.id, "user", toolResultContent(["tool-2"]), {
+      skipIndexing: true,
+    });
 
     recordRequestLog(conv.id, '{"turn":2,"step":2}', '{"result":"done"}');
-    const a3 = await addMessage(
-      conv.id,
-      "assistant",
-      "Second done!",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a3 = await addMessage(conv.id, "assistant", "Second done!", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(conv.id, a3.id);
 
     // Query second turn → should only return logs for A2 and A3, NOT A1
@@ -468,33 +432,25 @@ describe("getRequestLogsByMessageId — turn-aware query", () => {
     const conv = createConversation("relink-test");
 
     // Simulate multi-step turn: user → A1 (+ log1) → tool_result → A2 (+ log2)
-    await addMessage(conv.id, "user", "Do the task", undefined, {
+    await addMessage(conv.id, "user", "Do the task", {
       skipIndexing: true,
     });
 
     // First LLM call → A1 (tool_use response)
     recordRequestLog(conv.id, '{"step":1}', '{"tool_use":"bash"}');
-    const a1 = await addMessage(
-      conv.id,
-      "assistant",
-      "Using tool...",
-      undefined,
-      { skipIndexing: true },
-    );
+    const a1 = await addMessage(conv.id, "assistant", "Using tool...", {
+      skipIndexing: true,
+    });
     backfillMessageIdOnLogs(conv.id, a1.id);
 
     // tool_result user message
-    await addMessage(
-      conv.id,
-      "user",
-      toolResultContent(["tool-1"]),
-      undefined,
-      { skipIndexing: true },
-    );
+    await addMessage(conv.id, "user", toolResultContent(["tool-1"]), {
+      skipIndexing: true,
+    });
 
     // Second LLM call → A2 (text response)
     recordRequestLog(conv.id, '{"step":2}', '{"result":"done"}');
-    const a2 = await addMessage(conv.id, "assistant", "All done!", undefined, {
+    const a2 = await addMessage(conv.id, "assistant", "All done!", {
       skipIndexing: true,
     });
     backfillMessageIdOnLogs(conv.id, a2.id);

package/src/__tests__/llm-resolver.test.ts

@@ -556,6 +556,29 @@ describe("resolveCallSiteConfig", () => {
     expect(resolved.effort).toBe("low");
   });
 
+  test("empty-state greeting defaults to the balanced profile", () => {
+    const llm = LLMSchema.parse({
+      default: fullDefault,
+      profiles: {
+        balanced: {
+          model: "claude-sonnet-4-7",
+          effort: "medium",
+        },
+        "cost-optimized": {
+          model: "claude-haiku-4-5-20251001",
+          effort: "low",
+        },
+      },
+    });
+
+    expect(resolveDefaultProfileKey("emptyStateGreeting", llm)).toBe(
+      "balanced",
+    );
+    const resolved = resolveCallSiteConfig("emptyStateGreeting", llm);
+    expect(resolved.model).toBe("claude-sonnet-4-7");
+    expect(resolved.effort).toBe("medium");
+  });
+
   test("explicit callSites config overrides CALL_SITE_DEFAULTS", () => {
     const llm = LLMSchema.parse({
       default: fullDefault,
@@ -1226,50 +1249,3 @@ describe("resolveDefaultProfileKey", () => {
     expect(resolveDefaultProfileKey("mainAgent", llm)).toBe("balanced");
   });
 });
-
-describe("memory v3 call sites resolve through the standard resolver", () => {
-  const llm = LLMSchema.parse({
-    default: fullDefault,
-    profiles: {
-      balanced: { provider: "anthropic", model: "claude-sonnet-4-7" },
-      "cost-optimized": {
-        provider: "anthropic",
-        model: "claude-haiku-4-5-20251001",
-      },
-    },
-  });
-
-  test("memoryV3Filter and memoryV3Descent resolve to the cost-optimized profile", () => {
-    expect(resolveDefaultProfileKey("memoryV3Filter", llm)).toBe(
-      "cost-optimized",
-    );
-    expect(resolveDefaultProfileKey("memoryV3Descent", llm)).toBe(
-      "cost-optimized",
-    );
-    expect(resolveCallSiteConfig("memoryV3Filter", llm).model).toBe(
-      "claude-haiku-4-5-20251001",
-    );
-    expect(resolveCallSiteConfig("memoryV3Descent", llm).model).toBe(
-      "claude-haiku-4-5-20251001",
-    );
-  });
-
-  test("memoryV3Gate resolves to the balanced (capable) profile", () => {
-    expect(resolveDefaultProfileKey("memoryV3Gate", llm)).toBe("balanced");
-    expect(resolveCallSiteConfig("memoryV3Gate", llm).model).toBe(
-      "claude-sonnet-4-7",
-    );
-  });
-
-  test("v3 call sites are addressable as call-site override keys", () => {
-    const overridden = LLMSchema.parse({
-      default: fullDefault,
-      callSites: {
-        memoryV3Gate: { model: "claude-opus-4-7" },
-      },
-    });
-    expect(resolveCallSiteConfig("memoryV3Gate", overridden).model).toBe(
-      "claude-opus-4-7",
-    );
-  });
-});

package/src/__tests__/llm-usage-store.test.ts

@@ -1458,3 +1458,48 @@ describe("queryUnreportedUsageEvents", () => {
     expect(events[0].rawUsage).toEqual(rawUsage);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Record-time assistantVersion stamping (May 2026 telemetry honesty fix)
+//
+// Events buffered while the assistant is offline must remember the binary
+// that was running when they were recorded, not the one that finally
+// uploads them. recordUsageEvent stamps APP_VERSION at insert time and the
+// query must return it so the reporter can put it on the wire.
+// ---------------------------------------------------------------------------
+
+describe("recordUsageEvent — assistantVersion stamping", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run(`DELETE FROM llm_usage_events`);
+  });
+
+  test("stamps APP_VERSION on the returned event", async () => {
+    const { APP_VERSION } = await import("../version.js");
+    const event = recordUsageEvent(makeInput(), pricedResult);
+    expect(event.assistantVersion).toBe(APP_VERSION);
+  });
+
+  test("persists assistantVersion and queryUnreportedUsageEvents returns it", async () => {
+    const { APP_VERSION } = await import("../version.js");
+    insertEventAt(1000);
+    const [event] = queryUnreportedUsageEvents(0, undefined, 100);
+    expect(event).toBeDefined();
+    expect(event.assistantVersion).toBe(APP_VERSION);
+  });
+
+  test("legacy rows (null assistant_version column) round-trip as null", () => {
+    // Simulate a row that was persisted before migration 267 ran by
+    // inserting one through recordUsageEvent and then nulling the
+    // column out. This mirrors what production rows look like before
+    // the migration backfills `null`s; the reporter must accept them
+    // and let the platform fall back to the envelope's version.
+    insertEventAt(1000);
+    const db = getDb();
+    db.run(`UPDATE llm_usage_events SET assistant_version = NULL`);
+
+    const [event] = queryUnreportedUsageEvents(0, undefined, 100);
+    expect(event).toBeDefined();
+    expect(event.assistantVersion).toBeNull();
+  });
+});

package/src/__tests__/log-export-routes.test.ts

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import {
   existsSync,
+  mkdirSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -26,6 +27,7 @@ import { initializeDb } from "../memory/db-init.js";
 import { llmUsageEvents } from "../memory/schema.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { ROUTES } from "../runtime/routes/log-export-routes.js";
+import { getLogsDir } from "../util/platform.js";
 
 initializeDb();
 
@@ -136,6 +138,63 @@ describe("POST /v1/export - connected clients", () => {
   });
 });
 
+describe("POST /v1/export - conversation-scoped daemon logs", () => {
+  test("retains the full daily assistant log even when lines are not tagged with the conversationId", async () => {
+    /**
+     * Tests that a conversation-scoped export keeps the full daily assistant
+     * log so agent-loop failures logged without the conversationId stay
+     * visible, while still emitting the conversation-filtered index.
+     */
+
+    // GIVEN a daily assistant log with a line that mentions the conversation
+    // AND an agent-loop failure line that does NOT — the kind that
+    // conversationId grepping would drop
+    const conversationId = "conv-export-log-retention";
+    const today = new Date().toISOString().slice(0, 10);
+    const logsDir = getLogsDir();
+    mkdirSync(logsDir, { recursive: true });
+    const logFileName = `assistant-${today}.log`;
+    const logPath = join(logsDir, logFileName);
+    const taggedLine = `[agent] processing turn for ${conversationId}`;
+    const untaggedErrorLine =
+      "[agent] ERROR agent loop failed: stream aborted before first token";
+    writeFileSync(logPath, `${taggedLine}\n${untaggedErrorLine}\n`, "utf-8");
+
+    try {
+      // WHEN we run a conversation-scoped export
+      const result = await exportRoute.handler({ body: { conversationId } });
+
+      // THEN the archive is produced
+      expect(result).toBeInstanceOf(Uint8Array);
+
+      const dir = await extractArchive(result as Uint8Array);
+      try {
+        // AND the full daily log is retained, including the untagged failure
+        const exportedLogPath = join(dir, "daemon-logs", logFileName);
+        expect(existsSync(exportedLogPath)).toBe(true);
+        const exportedLog = readFileSync(exportedLogPath, "utf-8");
+        expect(exportedLog).toContain(untaggedErrorLine);
+        expect(exportedLog).toContain(taggedLine);
+
+        // AND the conversation-filtered slice still exists as a quick index
+        const filteredPath = join(
+          dir,
+          "daemon-logs",
+          "conversation-filtered.jsonl",
+        );
+        expect(existsSync(filteredPath)).toBe(true);
+        const filtered = readFileSync(filteredPath, "utf-8");
+        expect(filtered).toContain(taggedLine);
+        expect(filtered).not.toContain(untaggedErrorLine);
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    } finally {
+      rmSync(logPath, { force: true });
+    }
+  });
+});
+
 describe("POST /v1/export - LLM usage events", () => {
   test("full export includes usage attribution columns", async () => {
     const db = getDb();

package/src/__tests__/managed-skill-lifecycle.test.ts

@@ -87,7 +87,7 @@ import {
   seedV2SkillEntries,
 } from "../memory/v2/skill-store.js";
 import { executeDeleteManagedSkill } from "../tools/skills/delete-managed.js";
-import { SkillLoadTool } from "../tools/skills/load.js";
+import { skillLoadTool } from "../tools/skills/load.js";
 import { executeScaffoldManagedSkill } from "../tools/skills/scaffold-managed.js";
 import type { ToolContext } from "../tools/types.js";
 
@@ -136,9 +136,6 @@ Run the custom lifecycle verification procedure.
     expect(catalogSkill!.source).toBe("managed");
     expect(catalogSkill!.displayName).toBe("E2E Custom Skill");
 
-    const skillLoadTool = new (SkillLoadTool as any)() as InstanceType<
-      typeof SkillLoadTool
-    >;
     const loadResult = await skillLoadTool.execute(
       { skill: skillId },
       makeContext(),
@@ -280,10 +277,6 @@ Run the custom lifecycle verification procedure.
   test("scaffold → skill_load chain: literal tool execution", async () => {
     const ctx = makeContext();
 
-    const skillLoadTool = new (SkillLoadTool as any)() as InstanceType<
-      typeof SkillLoadTool
-    >;
-
     // Step 1: Scaffold a skill directly
     const scaffoldResult = await executeScaffoldManagedSkill(
       {

package/src/__tests__/mcp-auth-routes.test.ts

@@ -24,19 +24,24 @@ mock.module("../mcp/mcp-auth-state.js", () => ({
   getMcpAuthState: mockGetMcpAuthState,
 }));
 
-mock.module("../config/loader.js", () => ({
-  loadRawConfig: () => ({
-    mcp: {
-      servers: {
-        "my-server": {
-          transport: { type: "sse", url: "https://mcp.example.com" },
-          enabled: true,
-          defaultRiskLevel: "high",
-        },
+const mockConfig = {
+  mcp: {
+    servers: {
+      "my-server": {
+        transport: { type: "sse", url: "https://mcp.example.com" },
+        enabled: true,
+        defaultRiskLevel: "high",
       },
     },
-  }),
+  },
+};
+mock.module("../config/loader.js", () => ({
+  loadRawConfig: () => mockConfig,
   saveRawConfig: () => {},
+  // route-policy → config/env transitively imports `getConfig`; stub it
+  // here so the mock surface matches what consumers expect.
+  getConfig: () => mockConfig,
+  getConfigReadOnly: () => mockConfig,
 }));
 
 mock.module("../util/logger.js", () => ({

package/src/__tests__/mcp-health-check.test.ts

@@ -18,23 +18,28 @@ mock.module("../mcp/client.js", () => ({
   },
 }));
 
-mock.module("../config/loader.js", () => ({
-  loadRawConfig: () => ({
-    mcp: {
-      servers: {
-        test: {
-          transport: {
-            type: "streamable-http",
-            url: "https://example.com/mcp",
-          },
-          enabled: true,
-          defaultRiskLevel: "high",
-          maxTools: 20,
+const mockConfig = {
+  mcp: {
+    servers: {
+      test: {
+        transport: {
+          type: "streamable-http",
+          url: "https://example.com/mcp",
         },
+        enabled: true,
+        defaultRiskLevel: "high",
+        maxTools: 20,
       },
     },
-  }),
+  },
+};
+mock.module("../config/loader.js", () => ({
+  loadRawConfig: () => mockConfig,
   saveRawConfig: () => {},
+  // route-policy → config/env transitively imports `getConfig`; stub it
+  // here so the mock surface matches what consumers expect.
+  getConfig: () => mockConfig,
+  getConfigReadOnly: () => mockConfig,
 }));
 
 mock.module("../daemon/mcp-reload-service.js", () => ({

package/src/__tests__/memory-retrieval-pipeline.test.ts

@@ -29,7 +29,7 @@ import {
   type DefaultMemoryRetrievalDeps,
   defaultMemoryRetrievalPlugin,
   runDefaultMemoryRetrieval,
-} from "../plugins/defaults/memory-retrieval.js";
+} from "../plugins/defaults/memory-retrieval/register.js";
 import { DEFAULT_TIMEOUTS, runPipeline } from "../plugins/pipeline.js";
 import {
   getMiddlewaresFor,

package/src/__tests__/memory-v2-static-injector.test.ts

@@ -15,7 +15,7 @@
 
 import { describe, expect, test } from "bun:test";
 
-import { defaultInjectorsPlugin } from "../plugins/defaults/injectors.js";
+import { defaultInjectorsPlugin } from "../plugins/defaults/injectors/register.js";
 import type { Injector, TurnContext } from "../plugins/types.js";
 
 function findInjector(name: string): Injector {

package/src/__tests__/messaging-send-tool.test.ts

@@ -48,8 +48,10 @@ const addMessageMock = mock(
     conversationId: string,
     role: string,
     content: string,
-    _metadata?: Record<string, unknown>,
-    _opts?: { skipIndexing?: boolean },
+    _options?: {
+      metadata?: Record<string, unknown>;
+      skipIndexing?: boolean;
+    },
   ) => ({
     id: "xpost-msg-1",
     conversationId,
@@ -197,8 +199,10 @@ describe("messaging-send tool", () => {
       "bound-conv-99",
       "assistant",
       JSON.stringify([{ type: "text", text: "hello from A" }]),
-      { automated: true, crossPostedFrom: "conv-A" },
-      { skipIndexing: true },
+      {
+        metadata: { automated: true, crossPostedFrom: "conv-A" },
+        skipIndexing: true,
+      },
     );
     expect(syncMessageToDiskMock).toHaveBeenCalledWith(
       "bound-conv-99",

package/src/__tests__/migration-export-http.test.ts

@@ -500,10 +500,10 @@ describe("export config sanitization", () => {
 
 describe("route policy registration", () => {
   test("migrations/export policy requires settings.write scope", async () => {
-    const { getPolicy } = await import("../runtime/auth/route-policy.js");
-    const policy = getPolicy("migrations/export");
+    const { ROUTES } = await import("../runtime/routes/index.js");
+    const policy = (ROUTES.find((r) => r.endpoint === "migrations/export")?.policy ?? null);
 
-    expect(policy).toBeDefined();
+    expect(policy).not.toBeNull();
     expect(policy?.requiredScopes).toContain("settings.write");
     expect(policy?.allowedPrincipalTypes).toContain("actor");
     expect(policy?.allowedPrincipalTypes).toContain("svc_gateway");
@@ -511,10 +511,10 @@ describe("route policy registration", () => {
   });
 
   test("migrations/validate policy is still registered", async () => {
-    const { getPolicy } = await import("../runtime/auth/route-policy.js");
-    const policy = getPolicy("migrations/validate");
+    const { ROUTES } = await import("../runtime/routes/index.js");
+    const policy = (ROUTES.find((r) => r.endpoint === "migrations/validate")?.policy ?? null);
 
-    expect(policy).toBeDefined();
+    expect(policy).not.toBeNull();
     expect(policy?.requiredScopes).toContain("settings.read");
   });
 });
@@ -525,10 +525,10 @@ describe("route policy registration", () => {
 
 describe("auth policy shape", () => {
   test("export policy requires settings.write and would deny without it", async () => {
-    const { getPolicy } = await import("../runtime/auth/route-policy.js");
-    const policy = getPolicy("migrations/export");
+    const { ROUTES } = await import("../runtime/routes/index.js");
+    const policy = (ROUTES.find((r) => r.endpoint === "migrations/export")?.policy ?? null);
 
-    expect(policy).toBeDefined();
+    expect(policy).not.toBeNull();
     // Verify the policy shape means a caller without settings.write would be denied
     expect(policy!.requiredScopes).toEqual(["settings.write"]);
     // Verify only the expected principal types are allowed
@@ -539,9 +539,9 @@ describe("auth policy shape", () => {
   });
 
   test("export policy differs from validate policy on scopes (validate is read-only)", async () => {
-    const { getPolicy } = await import("../runtime/auth/route-policy.js");
-    const exportPolicy = getPolicy("migrations/export");
-    const validatePolicy = getPolicy("migrations/validate");
+    const { ROUTES } = await import("../runtime/routes/index.js");
+    const exportPolicy = (ROUTES.find((r) => r.endpoint === "migrations/export")?.policy ?? null);
+    const validatePolicy = (ROUTES.find((r) => r.endpoint === "migrations/validate")?.policy ?? null);
 
     // validate is read-only so requires settings.read; export requires settings.write
     expect(exportPolicy!.requiredScopes).toEqual(["settings.write"]);

package/src/__tests__/migration-import-commit-http.test.ts

@@ -1129,10 +1129,10 @@ describe("commitImport — config sanitization", () => {
 
 describe("route policy registration", () => {
   test("migrations/import policy requires settings.write scope", async () => {
-    const { getPolicy } = await import("../runtime/auth/route-policy.js");
-    const policy = getPolicy("migrations/import");
+    const { ROUTES } = await import("../runtime/routes/index.js");
+    const policy = (ROUTES.find((r) => r.endpoint === "migrations/import")?.policy ?? null);
 
-    expect(policy).toBeDefined();
+    expect(policy).not.toBeNull();
     expect(policy?.requiredScopes).toContain("settings.write");
     expect(policy?.allowedPrincipalTypes).toContain("actor");
     expect(policy?.allowedPrincipalTypes).toContain("svc_gateway");
@@ -1140,11 +1140,11 @@ describe("route policy registration", () => {
   });
 
   test("import policy matches export/preflight but differs from validate on scopes", async () => {
-    const { getPolicy } = await import("../runtime/auth/route-policy.js");
-    const importPolicy = getPolicy("migrations/import");
-    const validatePolicy = getPolicy("migrations/validate");
-    const exportPolicy = getPolicy("migrations/export");
-    const preflightPolicy = getPolicy("migrations/import-preflight");
+    const { ROUTES } = await import("../runtime/routes/index.js");
+    const importPolicy = (ROUTES.find((r) => r.endpoint === "migrations/import")?.policy ?? null);
+    const validatePolicy = (ROUTES.find((r) => r.endpoint === "migrations/validate")?.policy ?? null);
+    const exportPolicy = (ROUTES.find((r) => r.endpoint === "migrations/export")?.policy ?? null);
+    const preflightPolicy = (ROUTES.find((r) => r.endpoint === "migrations/import-preflight")?.policy ?? null);
 
     // import, export, and preflight all require settings.write
     expect(importPolicy!.requiredScopes).toEqual(exportPolicy!.requiredScopes);