@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/runtime/routes/__tests__/plugins-routes.test.ts

@@ -60,6 +60,11 @@ import {
   PluginDetailsNotFoundError,
   type PluginDetailsOptions,
 } from "../../../cli/lib/plugin-details.js";
+import {
+  DEFAULT_PIN_HISTORY_LIMIT,
+  type PluginPinHistoryEntry,
+  PluginPinHistoryError,
+} from "../../../cli/lib/plugin-pin-history.js";
 import type {
   PluginCatalog,
   PluginSearchMatch,
@@ -202,6 +207,27 @@ mock.module("../../../cli/lib/diff-plugin.js", () => ({
   diffPlugin: diffSpy,
 }));
 
+// Mock the pin-history lib: the GitHub commit-history walk is covered by
+// plugin-pin-history.test.ts; the routes only forward the name, validate a pin
+// against the resolved history, and map errors.
+const listPinHistorySpy = mock(
+  async (..._args: unknown[]): Promise<PluginPinHistoryEntry[]> => {
+    throw new Error("listPinHistorySpy default impl not configured");
+  },
+);
+const resolvePinSpy = mock(
+  async (..._args: unknown[]): Promise<PluginPinHistoryEntry | null> => {
+    throw new Error("resolvePinSpy default impl not configured");
+  },
+);
+
+mock.module("../../../cli/lib/plugin-pin-history.js", () => ({
+  DEFAULT_PIN_HISTORY_LIMIT,
+  PluginPinHistoryError,
+  listPinHistory: listPinHistorySpy,
+  resolvePinToMarketplaceCommit: resolvePinSpy,
+}));
+
 import {
   BadRequestError,
   ConflictError,
@@ -224,6 +250,7 @@ const uninstallHandler = findHandler("plugins_uninstall");
 const getHandler = findHandler("plugins_get");
 const installHandler = findHandler("plugins_install");
 const inspectHandler = findHandler("plugins_inspect");
+const versionsHandler = findHandler("plugins_versions");
 const upgradeHandler = findHandler("plugins_upgrade");
 const diffHandler = findHandler("plugins_diff");
 
@@ -828,6 +855,7 @@ async function invokeInstall(args: RouteHandlerArgs = {}): Promise<{
 describe("POST /v1/plugins/install", () => {
   beforeEach(() => {
     installSpy.mockReset();
+    resolvePinSpy.mockReset();
   });
 
   test("forwards name/force and shapes the result, pinning ref to the default", async () => {
@@ -954,6 +982,121 @@ describe("POST /v1/plugins/install", () => {
     expect(caught).toBeInstanceOf(InternalError);
     expect((caught as Error).message).toContain("ECONNRESET");
   });
+
+  test("a reviewed pin installs from the marketplace commit that introduced it", async () => {
+    // GIVEN a pin that resolves to a marketplace commit in the reviewed history
+    resolvePinSpy.mockImplementation(async () => ({
+      pin: "a".repeat(40),
+      marketplaceCommit: "f".repeat(40),
+      promotedAt: "2026-06-01T00:00:00.000Z",
+      current: false,
+    }));
+    installSpy.mockImplementation(async (opts) => ({
+      name: opts.name,
+      target: `/workspace/.vellum/plugins/${opts.name}`,
+      fileCount: 7,
+      ref: opts.ref ?? "main",
+      commit: "a".repeat(40),
+      committedAt: null,
+    }));
+
+    const result = await invokeInstall({
+      body: { name: "caveman", pin: "a".repeat(40) },
+    });
+
+    // THEN the install reads the manifest at the resolving marketplace commit,
+    // not the default branch
+    expect(installSpy.mock.calls[0]?.[0]).toEqual({
+      name: "caveman",
+      ref: "f".repeat(40),
+      force: undefined,
+    });
+    expect(result.ref).toBe("f".repeat(40));
+  });
+
+  test("an unreviewed pin is refused as a BadRequest before installing", async () => {
+    resolvePinSpy.mockImplementation(async () => null);
+
+    await expect(
+      invokeInstall({ body: { name: "caveman", pin: "b".repeat(40) } }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(installSpy).not.toHaveBeenCalled();
+  });
+
+  test("a pin-history read failure surfaces as ServiceUnavailable (503)", async () => {
+    resolvePinSpy.mockImplementation(async () => {
+      throw new PluginPinHistoryError("HTTP 403");
+    });
+
+    await expect(
+      invokeInstall({ body: { name: "caveman", pin: "c".repeat(40) } }),
+    ).rejects.toBeInstanceOf(ServiceUnavailableError);
+    expect(installSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe("GET /v1/plugins/:name/versions", () => {
+  beforeEach(() => {
+    listPinHistorySpy.mockReset();
+  });
+
+  test("returns the resolved pin history", async () => {
+    const history: PluginPinHistoryEntry[] = [
+      {
+        pin: "c".repeat(40),
+        marketplaceCommit: "3".repeat(40),
+        promotedAt: "2026-06-10T00:00:00.000Z",
+        current: true,
+      },
+      {
+        pin: "a".repeat(40),
+        marketplaceCommit: "1".repeat(40),
+        promotedAt: "2026-06-01T00:00:00.000Z",
+        current: false,
+      },
+    ];
+    listPinHistorySpy.mockImplementation(async () => history);
+
+    const result = await versionsHandler({ pathParams: { name: "level-up" } });
+    expect(result).toEqual(history);
+  });
+
+  test("forwards a positive limit to the lib", async () => {
+    listPinHistorySpy.mockImplementation(async () => []);
+    await versionsHandler({
+      pathParams: { name: "level-up" },
+      queryParams: { limit: "3" },
+    });
+    expect(listPinHistorySpy.mock.calls[0]?.[2]).toEqual({ limit: 3 });
+  });
+
+  test("rejects a non-positive limit as BadRequest before calling the lib", async () => {
+    await expect(
+      versionsHandler({
+        pathParams: { name: "level-up" },
+        queryParams: { limit: "0" },
+      }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(listPinHistorySpy).not.toHaveBeenCalled();
+  });
+
+  test("InvalidPluginNameError → BadRequestError (400)", async () => {
+    listPinHistorySpy.mockImplementation(async () => {
+      throw new InvalidPluginNameError("../escape");
+    });
+    await expect(
+      versionsHandler({ pathParams: { name: "../escape" } }),
+    ).rejects.toBeInstanceOf(BadRequestError);
+  });
+
+  test("PluginPinHistoryError → ServiceUnavailableError (503)", async () => {
+    listPinHistorySpy.mockImplementation(async () => {
+      throw new PluginPinHistoryError("HTTP 429");
+    });
+    await expect(
+      versionsHandler({ pathParams: { name: "level-up" } }),
+    ).rejects.toBeInstanceOf(ServiceUnavailableError);
+  });
 });
 
 function inspection(

package/src/runtime/routes/__tests__/retrospective-routes.test.ts

@@ -38,7 +38,7 @@ import { rawRun } from "../../../memory/raw-query.js";
 import { ROUTES } from "../retrospective-routes.js";
 import type { RouteDefinition } from "../types.js";
 
-initializeDb();
+await initializeDb();
 
 let workspaceDir: string;
 let origWorkspaceDir: string | undefined;

package/src/runtime/routes/__tests__/slack-channel-routes.test.ts

@@ -39,7 +39,7 @@ import {
 import { ROUTES } from "../slack-channel-routes.js";
 import type { RouteDefinition } from "../types.js";
 
-initializeDb();
+await initializeDb();
 
 interface ResolveResponse {
   channelId: string;

package/src/runtime/routes/__tests__/surface-action-routes.test.ts

@@ -25,6 +25,7 @@ interface StubConversation {
   handleSurfaceActionThrows?: Error;
   handleSurfaceUndoCalled?: boolean;
   handleSurfaceUndoThrows?: Error;
+  trustContext?: { trustClass: string; sourceChannel: string };
   surfaceActionCalls: Array<{
     surfaceId: string;
     actionId: string;
@@ -42,6 +43,47 @@ const findBySurfaceCalls: string[] = [];
 const getOrCreateCalls: string[] = [];
 const rawGetCalls: Array<{ sql: string; params: unknown[] }> = [];
 
+// Gateway guardian-delivery list (shared by the route's dev-bypass lookup and
+// the local-principal-trust mapper): null = unreachable, [] = no guardian.
+let mockGuardianList: Array<Record<string, unknown>> | null = [];
+let httpAuthDisabled = false;
+
+// Stub for the shared reset-drift helper. The route under test only consumes
+// its result (a guardian TrustContext or null); the gate itself is covered in
+// runtime/__tests__/guardian-vellum-migration.test.ts. Tests set
+// `mockReResolve` per case and read `reResolveCalls` to assert routing.
+const reResolveCalls: string[] = [];
+let mockReResolve: { trustClass: string; sourceChannel: string } | null = null;
+
+mock.module("../../../contacts/guardian-delivery-reader.js", () => ({
+  getGuardianDelivery: (_input?: { channelTypes?: string[] }) =>
+    Promise.resolve(mockGuardianList),
+  peekCachedGuardianDelivery: () => mockGuardianList ?? undefined,
+  guardianForChannel: (
+    list: Array<Record<string, unknown>>,
+    channelType: string,
+  ) => list.find((g) => g.channelType === channelType && g.status === "active"),
+}));
+
+mock.module("../../../contacts/contact-store.js", () => ({
+  findGuardianForChannel: (_channelType: string) => null,
+  findContactByAddress: () => null,
+}));
+
+mock.module("../../../config/env.js", () => ({
+  isHttpAuthDisabled: () => httpAuthDisabled,
+}));
+
+mock.module("../../guardian-vellum-migration.js", () => ({
+  reResolveTrustOnResetDrift: async (
+    incomingPrincipalId: string,
+    _sourceChannel: string,
+  ) => {
+    reResolveCalls.push(incomingPrincipalId);
+    return mockReResolve;
+  },
+}));
+
 mock.module("../../../daemon/conversation-registry.js", () => ({
   findConversation: (id: string) => {
     findConvCalls.push(id);
@@ -115,6 +157,9 @@ function makeStub(id: string): StubConversation {
       stub.handleSurfaceUndoCalled = true;
       if (stub.handleSurfaceUndoThrows) throw stub.handleSurfaceUndoThrows;
     },
+    setTrustContext: (ctx: { trustClass: string; sourceChannel: string }) => {
+      stub.trustContext = ctx;
+    },
   });
   return stub;
 }
@@ -132,6 +177,10 @@ beforeEach(() => {
   findBySurfaceCalls.length = 0;
   getOrCreateCalls.length = 0;
   rawGetCalls.length = 0;
+  mockGuardianList = [];
+  httpAuthDisabled = false;
+  reResolveCalls.length = 0;
+  mockReResolve = null;
 });
 
 // ---------------------------------------------------------------------------
@@ -335,6 +384,120 @@ describe("triggerSurfaceAction handler", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Trust context resolution
+// ---------------------------------------------------------------------------
+
+const GUARDIAN_PRINCIPAL = "principal-guardian";
+// Daemon-minted vellum-principal-* ids: the DB-reset drift signature. The
+// gateway rebinds to a fresh id while the client still holds a JWT for the old.
+const VELLUM_PRINCIPAL_OLD = "vellum-principal-old";
+const VELLUM_PRINCIPAL_NEW = "vellum-principal-new";
+
+function guardianDelivery(principalId: string): Record<string, unknown> {
+  return {
+    channelType: "vellum",
+    contactId: "contact-1",
+    principalId,
+    address: "guardian-address",
+    externalChatId: "guardian-chat",
+    status: "active",
+  };
+}
+
+// A guardian TrustContext the stubbed helper hands back on a recovered drift.
+function guardianCtx(): { trustClass: string; sourceChannel: string } {
+  return { trustClass: "guardian", sourceChannel: "vellum" };
+}
+
+describe("triggerSurfaceAction trust context", () => {
+  test("guardian principal → guardian from the gateway binding, helper not called", async () => {
+    mockGuardianList = [guardianDelivery(GUARDIAN_PRINCIPAL)];
+    const live = makeStub("conv-guardian");
+    memoryBySurface = live;
+
+    const handler = findHandler("triggerSurfaceAction");
+    await handler({
+      body: { surfaceId: "surf-g", actionId: "act-g" },
+      headers: { "x-vellum-actor-principal-id": GUARDIAN_PRINCIPAL },
+    });
+
+    expect(live.trustContext?.trustClass).toBe("guardian");
+    expect(live.trustContext?.sourceChannel).toBe("vellum");
+    // First-pass resolve already granted guardian, so the drift helper is skipped.
+    expect(reResolveCalls).toEqual([]);
+  });
+
+  test("unknown principal: helper consulted, null result stays unknown (fail closed)", async () => {
+    mockGuardianList = [guardianDelivery(GUARDIAN_PRINCIPAL)];
+    mockReResolve = null;
+    const live = makeStub("conv-unknown");
+    memoryBySurface = live;
+
+    const handler = findHandler("triggerSurfaceAction");
+    await handler({
+      body: { surfaceId: "surf-u", actionId: "act-u" },
+      headers: { "x-vellum-actor-principal-id": VELLUM_PRINCIPAL_OLD },
+    });
+
+    expect(reResolveCalls).toEqual([VELLUM_PRINCIPAL_OLD]);
+    expect(live.trustContext?.trustClass).toBe("unknown");
+  });
+
+  test("reset drift: helper returns guardian → route adopts it", async () => {
+    mockGuardianList = [guardianDelivery(VELLUM_PRINCIPAL_NEW)];
+    mockReResolve = guardianCtx();
+    const live = makeStub("conv-drift");
+    memoryBySurface = live;
+
+    const handler = findHandler("triggerSurfaceAction");
+    await handler({
+      body: { surfaceId: "surf-d", actionId: "act-d" },
+      headers: { "x-vellum-actor-principal-id": VELLUM_PRINCIPAL_OLD },
+    });
+
+    expect(reResolveCalls).toEqual([VELLUM_PRINCIPAL_OLD]);
+    expect(live.trustContext?.trustClass).toBe("guardian");
+  });
+
+  test("dev-bypass resolves the real guardian principal from the gateway, helper not called", async () => {
+    httpAuthDisabled = true;
+    mockGuardianList = [guardianDelivery(GUARDIAN_PRINCIPAL)];
+    const live = makeStub("conv-dev");
+    memoryBySurface = live;
+
+    const handler = findHandler("triggerSurfaceAction");
+    await handler({
+      body: { surfaceId: "surf-dev", actionId: "act-dev" },
+      headers: { "x-vellum-actor-principal-id": "dev-bypass" },
+    });
+
+    // The synthetic dev-bypass principal is translated to the real guardian,
+    // yielding a guardian trust context without consulting the drift helper.
+    expect(live.trustContext?.trustClass).toBe("guardian");
+    expect(reResolveCalls).toEqual([]);
+  });
+
+  test("dev-bypass with an empty gateway: helper null result → unknown (fail closed)", async () => {
+    httpAuthDisabled = true;
+    // The gateway has no active binding, so dev-bypass cannot translate to a
+    // real guardian; the first-pass resolve is unknown and the helper, returning
+    // null, leaves trust unknown.
+    mockGuardianList = [];
+    mockReResolve = null;
+    const live = makeStub("conv-dev-fallback");
+    memoryBySurface = live;
+
+    const handler = findHandler("triggerSurfaceAction");
+    await handler({
+      body: { surfaceId: "surf-devf", actionId: "act-devf" },
+      headers: { "x-vellum-actor-principal-id": "dev-bypass" },
+    });
+
+    expect(live.trustContext?.trustClass).toBe("unknown");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // undoSurfaceAction
 // ---------------------------------------------------------------------------

package/src/runtime/routes/acp-routes-list.test.ts

@@ -46,6 +46,10 @@ mock.module("../../memory/db-connection.js", () => {
     getDb: () => builder,
     getSqlite: () => ({ __stub: true }),
     getSqliteFrom: () => ({ __stub: true }),
+    getMemoryDb: () => builder,
+    getMemorySqlite: () => ({ __stub: true }),
+    getLogsDb: () => builder,
+    getLogsSqlite: () => ({ __stub: true }),
     resetDb: () => {},
   };
 });

package/src/runtime/routes/acp-routes.test.ts

@@ -127,8 +127,7 @@ mock.module("../../tools/credentials/metadata-store.js", () => ({
     const existing = metadataStore.get(key);
     metadataStore.set(key, {
       allowedTools: policy?.allowedTools ?? existing?.allowedTools ?? [],
-      usageDescription:
-        policy?.usageDescription ?? existing?.usageDescription,
+      usageDescription: policy?.usageDescription ?? existing?.usageDescription,
     });
     return {
       credentialId: `cred-${key}`,
@@ -533,8 +532,8 @@ function listRows(): RowSnapshot[] {
 }
 
 describe("DELETE /v1/acp/sessions?status=completed", () => {
-  beforeAll(() => {
-    initializeDb();
+  beforeAll(async () => {
+    await initializeDb();
   });
 
   beforeEach(() => {
@@ -687,8 +686,8 @@ function insertHistoryRow(opts: {
 }
 
 describe("DELETE /v1/acp/sessions/:id", () => {
-  beforeAll(() => {
-    initializeDb();
+  beforeAll(async () => {
+    await initializeDb();
   });
 
   beforeEach(() => {

package/src/runtime/routes/attachment-routes.ts

@@ -117,15 +117,30 @@ export function resolveAllowedFileBackedAttachmentPath(
 /** 100 MB — maximum file size for binary uploads (multipart / octet-stream). */
 const MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
 
+/**
+ * Canonical attachment metadata shape, shared by the upload and get-by-id route
+ * response schemas so the generated client type is a single source of truth
+ * (camelCase, matching the rest of the daemon API and the get-by-id response).
+ */
+export const attachmentMetadataSchema = z.object({
+  id: z.string(),
+  filename: z.string(),
+  mimeType: z.string(),
+  sizeBytes: z.number(),
+  kind: z.string(),
+});
+
 /**
  * Build the standard JSON success payload for an uploaded attachment.
  */
-function attachmentPayload(attachment: StoredAttachment) {
+function attachmentPayload(
+  attachment: StoredAttachment,
+): z.infer<typeof attachmentMetadataSchema> {
   return {
     id: attachment.id,
-    original_filename: attachment.originalFilename,
-    mime_type: attachment.mimeType,
-    size_bytes: attachment.sizeBytes,
+    filename: attachment.originalFilename,
+    mimeType: attachment.mimeType,
+    sizeBytes: attachment.sizeBytes,
     kind: attachment.kind,
   };
 }
@@ -700,12 +715,7 @@ export const ROUTES: RouteDefinition[] = [
     summary: "Get attachment metadata",
     description: "Return metadata and optional base64 data for an attachment.",
     tags: ["attachments"],
-    responseBody: z.object({
-      id: z.string(),
-      filename: z.string(),
-      mimeType: z.string(),
-      sizeBytes: z.number(),
-      kind: z.string(),
+    responseBody: attachmentMetadataSchema.extend({
       data: z.string().describe("Base64-encoded content").nullable(),
       fileBacked: z.boolean().optional(),
     }),
@@ -745,13 +755,7 @@ export const ROUTES: RouteDefinition[] = [
         required: ["file", "filename", "mimeType"],
       },
     },
-    responseBody: z.object({
-      id: z.string(),
-      original_filename: z.string(),
-      mime_type: z.string(),
-      size_bytes: z.number(),
-      kind: z.string(),
-    }),
+    responseBody: attachmentMetadataSchema,
     handler: handleUploadAttachmentRoute,
   },
   {

package/src/runtime/routes/browser-routes.ts

@@ -19,6 +19,7 @@ import {
 import { findConversation } from "../../daemon/conversation-registry.js";
 import type { ContentBlock } from "../../providers/types.js";
 import { LOCAL_PRINCIPALS } from "../auth/route-policy.js";
+import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Param validation ─────────────────────────────────────────────────
@@ -64,7 +65,10 @@ function extractScreenshots(
 
 // ── Handler ──────────────────────────────────────────────────────────
 
-async function handleBrowserExecute({ body = {} }: RouteHandlerArgs) {
+async function handleBrowserExecute({
+  body = {},
+  headers = {},
+}: RouteHandlerArgs) {
   const { operation, input, sessionId, conversationId } =
     BrowserExecuteParams.parse(body);
 
@@ -79,6 +83,19 @@ async function handleBrowserExecute({ body = {} }: RouteHandlerArgs) {
     ? conversationId!
     : browserCliConversationKey(sessionId);
 
+  // Actor principal lets host-browser routing enforce same-actor ownership.
+  // A live conversation's turn actor owns the request (e.g. a nested-bash
+  // browser call inherits the conversation's actor), so it wins over the
+  // request header — which over IPC may carry a synthetic local-guardian id
+  // injected for header-less local callers. Resolve through the local-guardian
+  // translation so the value matches the actorPrincipalId host_browser clients
+  // register with (dev-bypass otherwise mismatches).
+  const headerActor =
+    headers["x-vellum-actor-principal-id"]?.trim() || undefined;
+  const sourceActorPrincipalId = await resolveActorPrincipalIdForLocalGuardian(
+    conversation?.getTurnActorPrincipalId() ?? headerActor,
+  );
+
   const result = await executeBrowserOperation(
     operation as BrowserOperation,
     input,
@@ -87,6 +104,7 @@ async function handleBrowserExecute({ body = {} }: RouteHandlerArgs) {
       conversationId: resolvedConversationId,
       trustClass: conversation?.trustContext?.trustClass ?? "unknown",
       transportInterface: conversation?.transportInterface,
+      sourceActorPrincipalId,
     },
   );
 

package/src/runtime/routes/canonical-guardian-expiry-sweep.ts

@@ -7,15 +7,11 @@
  * even when no follow-up traffic arrives from either the guardian or the
  * requester.
  *
- * Complements the existing sweeps:
- *   - `calls/guardian-action-sweep.ts` — voice call guardian action expiry
- *   - `runtime/routes/guardian-expiry-sweep.ts` — channel guardian approval expiry
- *
- * Unlike those sweeps, this one operates on the unified canonical domain
- * (`canonical_guardian_requests`) and does not need to auto-deny pending
- * interactions or deliver channel notices — the canonical request status
- * transition is the single source of truth, and consumers (resolvers,
- * clients polling prompts) observe the expired status directly.
+ * This sweep operates on the unified canonical domain
+ * (`canonical_guardian_requests`) and does not auto-deny pending interactions
+ * or deliver channel notices — the canonical request status transition is the
+ * single source of truth, and consumers (resolvers, clients polling prompts)
+ * observe the expired status directly.
  */
 
 import { withdrawGuardianRequestCards } from "../../approvals/guardian-card-withdrawal.js";

package/src/runtime/routes/channel-verification-routes.ts

@@ -6,6 +6,17 @@
  * DELETE /v1/channel-verification-sessions         — cancel all active sessions (inbound + outbound)
  * POST   /v1/channel-verification-sessions/revoke  — cancel all sessions and revoke binding
  * GET    /v1/channel-verification-sessions/status   — check guardian binding status
+ *
+ * Source-of-truth split:
+ * - Verification SESSION state (pending sessions, codes, resend, rate-limit) is assistant-owned.
+ * - The channel-verified OUTCOME (status / verifiedAt / verifiedVia) is gateway-owned, written
+ *   in-process by the HTTP guardian-attest handler (`ContactStore.markChannelVerified`) and by the
+ *   inbound code-match path (`gateway/src/verification/text-verification.ts`).
+ * - The revoke/downgrade OUTCOME is relayed from the daemon via
+ *   `ipcCallPersistent("mark_channel_revoked", …)` to `ContactStore.markChannelRevoked`.
+ * - The `mark_channel_verified` IPC method exists as the daemon/CLI relay surface (symmetric with
+ *   `mark_channel_revoked`) but has no caller: the trusted-contact CLI path sends codes only, and the
+ *   outcome arrives via the inbound code-match path.
  */
 
 import { z } from "zod";
@@ -168,7 +179,7 @@ export async function handleCreateVerificationSession({
   }
 
   // Inbound challenge path
-  const result = createInboundChallenge(channel, rebind, conversationId);
+  const result = await createInboundChallenge(channel, rebind, conversationId);
   if (!result.success) {
     throw new BadRequestError(
       (result as { message?: string }).message ??
@@ -263,7 +274,7 @@ async function handleRevokeVerificationBinding({
 }: RouteHandlerArgs) {
   const { channel } = body as { channel?: ChannelId };
 
-  const result = revokeVerificationForChannel(channel);
+  const result = await revokeVerificationForChannel(channel);
   if (!result.success) {
     throw new BadRequestError(
       (result as { message?: string }).message ?? "Revocation failed",