@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/runtime/routes/contact-routes.ts

@@ -8,36 +8,53 @@
  * they don't shadow more-specific sub-paths like contacts/invites.
  */
 
+import {
+  GetContactIpcResponseSchema,
+  ListContactsIpcResponseSchema,
+  UpdateContactChannelIpcResponseSchema,
+} from "@vellumai/gateway-client/gateway-ipc-contracts";
+import { IpcCallError } from "@vellumai/gateway-client/ipc-client";
 import { z } from "zod";
 
 import {
   getAssistantContactMetadata,
-  getChannelById,
   getContact,
   listContacts,
   mergeContacts,
   searchContacts,
-  updateChannelStatus,
 } from "../../contacts/contact-store.js";
-import type {
-  ChannelPolicy,
-  ChannelStatus,
-  ContactRole,
-  ContactType,
-} from "../../contacts/types.js";
+import type { ContactRole, ContactType } from "../../contacts/types.js";
+import { ipcCallPersistent } from "../../ipc/gateway-client.js";
 import { resolveGuardianName } from "../../prompts/user-reference.js";
+import { getLogger } from "../../util/logger.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
-  createIngressInvite,
-  listIngressInvites,
   redeemIngressInvite,
   redeemVoiceInviteCode,
-  revokeIngressInvite,
   triggerInviteCall,
 } from "../invite-service.js";
-import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
+import { BadRequestError, NotFoundError, RouteError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
+const log = getLogger("contact-routes");
+
+/**
+ * Re-throw a relayed gateway `IpcCallError` as a `RouteError` so the IPC/HTTP
+ * adapters honor its statusCode/errorCode (4xx surfaces as 4xx, not a generic
+ * 500). Non-IpcCallError throws propagate unchanged.
+ */
+function rethrowGatewayError(err: unknown): never {
+  if (err instanceof IpcCallError) {
+    throw new RouteError(
+      err.message,
+      err.errorCode ?? "INTERNAL_ERROR",
+      err.statusCode ?? 500,
+      err.errorDetails,
+    );
+  }
+  throw err;
+}
+
 function withGuardianNameOverride<
   T extends { role: string; displayName: string },
 >(contact: T): T {
@@ -76,31 +93,10 @@ function prepareContactResponse<
 
 const VALID_CONTACT_TYPES: readonly ContactType[] = ["human", "assistant"];
 
-const VALID_CHANNEL_STATUSES: readonly ChannelStatus[] = [
-  "active",
-  "pending",
-  "revoked",
-  "blocked",
-  "unverified",
-];
-const VALID_CHANNEL_POLICIES: readonly ChannelPolicy[] = [
-  "allow",
-  "deny",
-  "escalate",
-];
-
 function isContactType(value: string): value is ContactType {
   return (VALID_CONTACT_TYPES as readonly string[]).includes(value);
 }
 
-function isChannelStatus(value: string): value is ChannelStatus {
-  return (VALID_CHANNEL_STATUSES as readonly string[]).includes(value);
-}
-
-function isChannelPolicy(value: string): value is ChannelPolicy {
-  return (VALID_CHANNEL_POLICIES as readonly string[]).includes(value);
-}
-
 // ---------------------------------------------------------------------------
 // Response schemas (drive OpenAPI spec → codegen → typed SDK)
 // ---------------------------------------------------------------------------
@@ -132,6 +128,8 @@ const contactSchema = z.object({
   contactType: z.string().nullable().optional(),
   lastInteraction: z.number().nullable().optional(),
   interactionCount: z.number(),
+  createdAt: z.number(),
+  updatedAt: z.number(),
   channels: z.array(contactChannelSchema),
 });
 
@@ -139,7 +137,40 @@ const contactSchema = z.object({
 // Contact handlers (transport-agnostic)
 // ---------------------------------------------------------------------------
 
-function handleListContacts(queryParams: Record<string, string>) {
+/**
+ * Relay a non-search contact list read to the gateway (source of truth for ACL
+ * fields), falling back to the assistant DB on IPC failure. Shared by the GET
+ * `contacts` list and the `search_contacts` no-filter case so both serve
+ * gateway-sourced data consistently.
+ */
+async function relayListContacts(
+  limit: number,
+  role: ContactRole | undefined,
+) {
+  try {
+    const result = await ipcCallPersistent("contacts_list_rich", {
+      limit,
+      ...(role ? { role } : {}),
+    });
+    const { contacts } = ListContactsIpcResponseSchema.parse(result);
+    return {
+      ok: true,
+      contacts: contacts.map(prepareContactResponse),
+    };
+  } catch (err) {
+    log.warn(
+      { err },
+      "relayListContacts: gateway relay failed; falling back to assistant DB",
+    );
+    const contacts = listContacts(limit, role);
+    return {
+      ok: true,
+      contacts: contacts.map(prepareContactResponse),
+    };
+  }
+}
+
+export async function handleListContacts(queryParams: Record<string, string>) {
   const limit = Number(queryParams.limit ?? 50);
   const role = (queryParams.role as ContactRole) || undefined;
   const contactTypeParam = queryParams.contactType;
@@ -157,7 +188,11 @@ function handleListContacts(queryParams: Record<string, string>) {
     ? (contactTypeParam as ContactType)
     : undefined;
 
+  // True search stays daemon-native: gateway-native search is design-blocked.
   if (query || channelAddress || channelType) {
+    log.debug(
+      "handleListContacts: search served daemon-native (gateway-native search is design-blocked)",
+    );
     const contacts = searchContacts({
       query,
       channelAddress,
@@ -172,105 +207,175 @@ function handleListContacts(queryParams: Record<string, string>) {
     };
   }
 
-  const contacts = listContacts(limit, role, contactType);
-  return {
-    ok: true,
-    contacts: contacts.map(prepareContactResponse),
-  };
+  // contactType is assistant-owned: serve daemon-native so it's filtered in SQL
+  // BEFORE the limit. The gateway relay filtered it AFTER its limit, which
+  // under-returned (and returned empty on an assistant-DB outage, since the
+  // soft-fail map dropped every row). Mirrors the search boundary.
+  if (contactType) {
+    log.debug(
+      "handleListContacts: contactType-filtered read served daemon-native (gateway-native contactType filtering is design-blocked, pending ACL classification)",
+    );
+    const contacts = listContacts(limit, role, contactType);
+    return {
+      ok: true,
+      contacts: contacts.map(prepareContactResponse),
+    };
+  }
+
+  return relayListContacts(limit, role);
 }
 
-function handleGetContact(contactId: string) {
-  const contact = getContact(contactId);
-  if (!contact) {
-    throw new NotFoundError(`Contact "${contactId}" not found`);
+export async function handleGetContact(contactId: string) {
+  try {
+    const result = await ipcCallPersistent("contacts_get_rich", { contactId });
+    // The gateway returns null (no `contact`) on a clean not-found.
+    if (!result || (result as { contact?: unknown }).contact === undefined) {
+      throw new NotFoundError(`Contact "${contactId}" not found`);
+    }
+    const { contact, assistantMetadata } =
+      GetContactIpcResponseSchema.parse(result);
+    return {
+      ok: true,
+      contact: prepareContactResponse(contact),
+      assistantMetadata: assistantMetadata ?? undefined,
+    };
+  } catch (err) {
+    // A clean not-found is a real 404 — don't fall back or mask it.
+    if (err instanceof NotFoundError) throw err;
+    log.warn(
+      { err, contactId },
+      "handleGetContact: gateway relay failed; falling back to assistant DB",
+    );
+    const contact = getContact(contactId);
+    if (!contact) {
+      throw new NotFoundError(`Contact "${contactId}" not found`);
+    }
+    const assistantMeta =
+      contact.contactType === "assistant"
+        ? getAssistantContactMetadata(contact.id)
+        : undefined;
+    return {
+      ok: true,
+      contact: prepareContactResponse(contact),
+      assistantMetadata: assistantMeta ?? undefined,
+    };
   }
-  const assistantMeta =
-    contact.contactType === "assistant"
-      ? getAssistantContactMetadata(contact.id)
-      : undefined;
-  return {
-    ok: true,
-    contact: prepareContactResponse(contact),
-    assistantMetadata: assistantMeta ?? undefined,
-  };
 }
 
 // ---------------------------------------------------------------------------
 // Invite handlers (transport-agnostic)
 // ---------------------------------------------------------------------------
 
-export function handleListInvites({ queryParams = {} }: RouteHandlerArgs) {
-  const result = listIngressInvites({
-    sourceChannel: queryParams.sourceChannel,
-    status: queryParams.status,
-  });
+// The gateway owns the canonical invite write path. These CLI handlers relay
+// to the gateway IPC methods via `ipcCallPersistent`; the assistant DB is
+// written only by the gateway. (Redemption stays daemon-local — see the redeem route.)
 
-  if (!result.ok) {
-    throw new BadRequestError(result.error);
+// The invite-CREATE relay needs a generous timeout: the gateway's `invites_mint`
+// handler calls `createIngressInvite` → `generateInviteInstruction`, which can spend
+// up to GENERATION_TIMEOUT_MS (~5s) waiting on an LLM before falling back. The default
+// 5s persistent-IPC timeout can fire mid-mint, so the caller sees a spurious failure
+// even though the gateway is still writing the invite. 30s safely exceeds the inner
+// ~5s fallback plus IPC overhead on both nested hops. (List/revoke keep the default.)
+const INVITE_CREATE_RELAY_TIMEOUT_MS = 30_000;
+
+export async function handleListInvites({ queryParams = {} }: RouteHandlerArgs) {
+  try {
+    const result = (await ipcCallPersistent("invites_list", {
+      ...(queryParams.sourceChannel
+        ? { sourceChannel: queryParams.sourceChannel }
+        : {}),
+      ...(queryParams.status ? { status: queryParams.status } : {}),
+    })) as { invites: Array<Record<string, unknown>> };
+    return { ok: true, invites: result.invites };
+  } catch (err) {
+    rethrowGatewayError(err);
   }
-  return { ok: true, invites: result.data };
 }
 
 export async function handleCreateInvite({ body = {} }: RouteHandlerArgs) {
-  const result = await createIngressInvite({
-    sourceChannel: body.sourceChannel as string | undefined,
-    note: body.note as string | undefined,
-    maxUses: body.maxUses as number | undefined,
-    expiresInMs: body.expiresInMs as number | undefined,
-    contactName: body.contactName as string | undefined,
-    expectedExternalUserId: body.expectedExternalUserId as string | undefined,
-    voiceCodeDigits: body.voiceCodeDigits as number | undefined,
-    friendName: body.friendName as string | undefined,
-    guardianName: body.guardianName as string | undefined,
-    contactId: body.contactId as string,
-  });
-
-  if (!result.ok) {
-    throw new BadRequestError(result.error);
+  try {
+    const result = (await ipcCallPersistent(
+      "invites_create",
+      {
+        contactId: body.contactId as string,
+        sourceChannel: body.sourceChannel as string | undefined,
+        note: body.note as string | undefined,
+        maxUses: body.maxUses as number | undefined,
+        expiresInMs: body.expiresInMs as number | undefined,
+        expectedExternalUserId: body.expectedExternalUserId as
+          | string
+          | undefined,
+      },
+      INVITE_CREATE_RELAY_TIMEOUT_MS,
+    )) as { invite: Record<string, unknown>; rawToken?: string };
+    return {
+      ok: true,
+      invite: result.invite,
+      ...(result.rawToken ? { rawToken: result.rawToken } : {}),
+    };
+  } catch (err) {
+    rethrowGatewayError(err);
   }
-  return { ok: true, invite: result.data };
 }
 
-export function handleRevokeInvite({ pathParams = {} }: RouteHandlerArgs) {
-  const result = revokeIngressInvite(pathParams.id);
-
-  if (!result.ok) {
-    throw new NotFoundError(result.error);
+export async function handleRevokeInvite({ pathParams = {} }: RouteHandlerArgs) {
+  try {
+    const result = (await ipcCallPersistent("invites_revoke", {
+      id: pathParams.id,
+    })) as { invite: Record<string, unknown> };
+    return { ok: true, invite: result.invite };
+  } catch (err) {
+    rethrowGatewayError(err);
   }
-  return { ok: true, invite: result.data };
 }
 
-export async function handleRedeemInvite({ body = {} }: RouteHandlerArgs) {
-  if (body.code != null) {
-    const callerExternalUserId = body.callerExternalUserId as
-      | string
-      | undefined;
-    const code = body.code as string | undefined;
-
-    if (!callerExternalUserId || !code) {
-      throw new BadRequestError("callerExternalUserId and code are required");
-    }
+/**
+ * Redeem a voice invite code.
+ *
+ * Backs the HTTP `invites_redeem` route (voice path) and the IPC-only
+ * `invites_redeem_voice` method. Wraps the identity-bound
+ * `redeemVoiceInviteCode` path.
+ */
+export async function handleRedeemVoiceInvite({
+  body = {},
+}: RouteHandlerArgs) {
+  const callerExternalUserId = body.callerExternalUserId as string | undefined;
+  const code = body.code as string | undefined;
 
-    const result = redeemVoiceInviteCode({
-      assistantId: body.assistantId as string | undefined,
-      callerExternalUserId,
-      sourceChannel: "phone",
-      code,
-    });
+  if (!callerExternalUserId || !code) {
+    throw new BadRequestError("callerExternalUserId and code are required");
+  }
 
-    if (!result.ok) {
-      throw new BadRequestError(result.reason);
-    }
+  const result = await redeemVoiceInviteCode({
+    assistantId: body.assistantId as string | undefined,
+    callerExternalUserId,
+    sourceChannel: "phone",
+    code,
+  });
 
-    return {
-      ok: true,
-      type: result.type,
-      memberId: result.memberId,
-      ...(result.type === "redeemed" ? { inviteId: result.inviteId } : {}),
-    };
+  if (!result.ok) {
+    throw new BadRequestError(result.reason);
   }
 
-  const result = redeemIngressInvite({
+  return {
+    ok: true,
+    type: result.type,
+    memberId: result.memberId,
+    ...(result.type === "redeemed" ? { inviteId: result.inviteId } : {}),
+  };
+}
+
+/**
+ * Redeem a token invite.
+ *
+ * Backs the HTTP `invites_redeem` route (token path) and the IPC-only
+ * `invites_redeem_token` method. Wraps the generic `redeemIngressInvite`
+ * token path.
+ */
+export async function handleRedeemTokenInvite({
+  body = {},
+}: RouteHandlerArgs) {
+  const result = await redeemIngressInvite({
     token: body.token as string | undefined,
     externalUserId: body.externalUserId as string | undefined,
     externalChatId: body.externalChatId as string | undefined,
@@ -280,9 +385,23 @@ export async function handleRedeemInvite({ body = {} }: RouteHandlerArgs) {
   if (!result.ok) {
     throw new BadRequestError(result.error);
   }
-  return { ok: true, invite: result.data };
+  // Surface the redemption `type` so the gateway can skip mirroring an
+  // `already_member` redeem (which consumes no invite use).
+  return { ok: true, invite: result.data.invite, type: result.data.type };
+}
+
+export async function handleRedeemInvite(args: RouteHandlerArgs) {
+  const body = args.body ?? {};
+  if (body.code != null) {
+    return handleRedeemVoiceInvite(args);
+  }
+  return handleRedeemTokenInvite(args);
 }
 
+// Stays daemon-local by design (like invites_redeem): the gateway's call path
+// validates its row then delegates the actual provider call to THIS handler via
+// ipcCallAssistant("invites_trigger_call"). Relaying back would loop
+// gateway→assistant→gateway. The provider call is a daemon capability.
 export async function handleTriggerInviteCall({
   pathParams = {},
 }: RouteHandlerArgs) {
@@ -408,17 +527,18 @@ export const ROUTES: RouteDefinition[] = [
       note: z.string().describe("Optional note").optional(),
       maxUses: z.number().describe("Max redemptions").optional(),
       expiresInMs: z.number().describe("Expiry duration in ms").optional(),
-      contactName: z.string().describe("Contact display name").optional(),
       expectedExternalUserId: z
         .string()
         .describe("Expected user ID (E.164 for phone)")
         .optional(),
-      friendName: z.string().describe("Friend name for the invite").optional(),
-      guardianName: z.string().describe("Guardian name").optional(),
     }),
     responseBody: z.object({
       ok: z.boolean(),
       invite: z.object({}).passthrough().describe("Created invite"),
+      rawToken: z
+        .string()
+        .optional()
+        .describe("One-time raw invite token (returned at creation only)"),
     }),
     additionalResponses: {
       "400": {
@@ -427,6 +547,9 @@ export const ROUTES: RouteDefinition[] = [
     },
   },
   {
+    // Stays daemon-local by design: redemption is an inbound-channel path (not
+    // a CLI ACL surface), and the assistant redemption service already claims
+    // the gateway row by id via record_invite_redemption — relaying would loop.
     operationId: "invites_redeem",
     endpoint: "contacts/invites/redeem",
     method: "POST",
@@ -524,7 +647,7 @@ export const ROUTES: RouteDefinition[] = [
       limit: z.number().optional(),
     }),
     responseBody: z.array(contactSchema),
-    handler: ({ body = {} }: RouteHandlerArgs) => {
+    handler: async ({ body = {} }: RouteHandlerArgs) => {
       const parsed = z
         .object({
           query: z.string().optional(),
@@ -533,6 +656,23 @@ export const ROUTES: RouteDefinition[] = [
           limit: z.number().optional(),
         })
         .parse(body);
+
+      const hasFilter =
+        Boolean(parsed.query?.trim()) ||
+        Boolean(parsed.channelAddress) ||
+        Boolean(parsed.channelType);
+
+      // No-filter "search" is a list read — relay to the gateway so it returns
+      // the same source-of-truth data as `contacts list`.
+      if (!hasFilter) {
+        const { contacts } = await relayListContacts(parsed.limit ?? 50, undefined);
+        return contacts;
+      }
+
+      // True search stays daemon-native: gateway-native search is design-blocked.
+      log.debug(
+        "search_contacts: search served daemon-native (gateway-native search is design-blocked)",
+      );
       return searchContacts(parsed).map(prepareContactResponse);
     },
   },
@@ -636,62 +776,33 @@ function handleMergeContactsRoute(args: RouteHandlerArgs) {
   }
 }
 
-function handleUpdateContactChannelRoute(args: RouteHandlerArgs) {
-  const channelId = args.pathParams!.contactChannelId;
+/**
+ * Relay the channel status/policy update to the gateway-native handler.
+ *
+ * The gateway DB is the source of truth: it owns validation, the
+ * revoke-of-blocked guard, the assistant-side channel-ID backward-compat
+ * resolution, the assistant-DB mirror, and the `contacts_changed` emit. This
+ * daemon handler writes NOTHING to the assistant DB directly — it forwards the
+ * raw channel ID + body and returns the gateway response verbatim. No fallback:
+ * an unexpected relay failure surfaces as an error (never a silent second
+ * write).
+ */
+export async function handleUpdateContactChannelRoute(args: RouteHandlerArgs) {
   const body = (args.body ?? {}) as {
     status?: string;
     policy?: string;
     reason?: string;
   };
 
-  if (body.status !== undefined && !isChannelStatus(body.status)) {
-    throw new BadRequestError(
-      `Invalid status "${body.status}". Must be one of: ${VALID_CHANNEL_STATUSES.join(", ")}`,
-    );
-  }
-
-  if (body.policy !== undefined && !isChannelPolicy(body.policy)) {
-    throw new BadRequestError(
-      `Invalid policy "${body.policy}". Must be one of: ${VALID_CHANNEL_POLICIES.join(", ")}`,
-    );
-  }
-
-  if (body.status === "revoked") {
-    const existing = getChannelById(channelId);
-    if (!existing) {
-      throw new NotFoundError(`Channel "${channelId}" not found`);
-    }
-    if (existing.status === "blocked") {
-      throw new ConflictError(
-        "Cannot revoke a blocked channel. Unblock it first or leave it blocked.",
-      );
-    }
-  }
-
-  const updated = updateChannelStatus(channelId, {
-    status: body.status,
-    policy: body.policy,
-    revokedReason:
-      body.status !== undefined
-        ? body.status === "revoked"
-          ? (body.reason ?? null)
-          : null
-        : undefined,
-    blockedReason:
-      body.status !== undefined
-        ? body.status === "blocked"
-          ? (body.reason ?? null)
-          : null
-        : undefined,
-  });
-
-  if (!updated) {
-    throw new NotFoundError(`Channel "${channelId}" not found`);
+  try {
+    const result = await ipcCallPersistent("update_contact_channel", {
+      contactChannelId: args.pathParams!.contactChannelId,
+      ...(body.status !== undefined ? { status: body.status } : {}),
+      ...(body.policy !== undefined ? { policy: body.policy } : {}),
+      ...(body.reason !== undefined ? { reason: body.reason } : {}),
+    });
+    return UpdateContactChannelIpcResponseSchema.parse(result);
+  } catch (err) {
+    rethrowGatewayError(err);
   }
-
-  const parentContact = getContact(updated.contactId);
-  return {
-    ok: true,
-    contact: parentContact ? prepareContactResponse(parentContact) : undefined,
-  };
 }

package/src/runtime/routes/conversation-query-routes.ts

@@ -85,7 +85,10 @@ import { PROVIDER_CATALOG } from "../../providers/model-catalog.js";
 import { initializeProviders } from "../../providers/registry.js";
 import { credentialKey } from "../../security/credential-key.js";
 import { validateAllowlistFile } from "../../security/secret-allowlist.js";
-import { resolvePricingForUsage } from "../../util/pricing.js";
+import {
+  resolvePricingForUsage,
+  usesAnthropicPricingRules,
+} from "../../util/pricing.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import {
   type LlmContextSummary,
@@ -212,10 +215,17 @@ function attachEstimatedCost(summary: LlmContextSummary): LlmContextSummary {
 
   const cacheCreation = summary.cacheCreationInputTokens ?? 0;
   const cacheRead = summary.cacheReadInputTokens ?? 0;
-  const directInputTokens = Math.max(
-    inputTokens - cacheCreation - cacheRead,
-    0,
-  );
+  // `inputTokens` carries provider-shape-dependent cache accounting. Anthropic
+  // Messages responses (native and OpenRouter `anthropic/*`) report `input_tokens`
+  // already net of cache — cache-creation/read are separate, additive buckets —
+  // so the full-rate portion IS `inputTokens`. OpenAI/Gemini report a total
+  // prompt-token count with cached tokens as a subset, so the full-rate portion
+  // is the total minus cache. `usesAnthropicPricingRules` selects the same
+  // response shapes the pricing layer treats as Anthropic (keyed on the stored
+  // transport provider + model), so it also distinguishes the cache accounting.
+  const directInputTokens = usesAnthropicPricingRules(provider, model)
+    ? Math.max(inputTokens, 0)
+    : Math.max(inputTokens - cacheCreation - cacheRead, 0);
 
   const result = resolvePricingForUsage(provider, model, {
     directInputTokens,