@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/__tests__/channel-guardian.test.ts

@@ -63,6 +63,52 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
   },
 }));
 
+// Gateway relay mock — the revoke path relays the ACL downgrade over IPC and
+// validates the response; return a well-formed mark_channel_revoked result.
+mock.module("../ipc/gateway-client.js", () => ({
+  ipcCallPersistent: async (
+    _method: string,
+    params?: Record<string, unknown>,
+  ) => ({
+    ok: true,
+    didWrite: true,
+    channel: {
+      id: (params?.contactChannelId as string) ?? "ch1",
+      contactId: "c1",
+      type: "phone",
+      address: "addr",
+      status: "revoked",
+      revokedReason: (params?.reason as string) ?? null,
+    },
+  }),
+}));
+
+// Guardian-delivery reader mock — the inbound challenge guard reads guardian
+// existence from the gateway. Derive the list from the local binding state so
+// the gateway-backed presence guard mirrors the DB the rest of the test sets up.
+const resolveGuardianList = async (input?: { channelTypes?: string[] }) => {
+  const { findGuardianForChannel } = await import(
+    "../contacts/contact-store.js"
+  );
+  const channels = input?.channelTypes ?? [];
+  return channels
+    .map((channelType) => {
+      const found = findGuardianForChannel(channelType);
+      return found ? { channelType, status: "active" } : null;
+    })
+    .filter((g): g is { channelType: string; status: string } => g !== null);
+};
+
+mock.module("../contacts/guardian-delivery-reader.js", () => ({
+  getGuardianDelivery: resolveGuardianList,
+  getGuardianDeliveryFresh: resolveGuardianList,
+  guardianForChannel: (
+    list: Array<{ channelType: string; status: string }>,
+    channelType: string,
+  ) =>
+    list.find((g) => g.channelType === channelType && g.status === "active"),
+}));
+
 import { handleChannelVerificationSession } from "../daemon/handlers/config-channels.js";
 import type {
   ChannelVerificationSessionRequest,
@@ -84,12 +130,6 @@ import {
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { upsertBinding as upsertExternalBinding } from "../memory/external-conversation-store.js";
-import {
-  createApprovalRequest,
-  getPendingApprovalByGuardianChat,
-  getPendingApprovalForRequest,
-  updateApprovalDecision,
-} from "../memory/guardian-approvals.js";
 import {
   getRateLimit,
   recordInvalidAttempt,
@@ -133,7 +173,6 @@ afterAll(() => {
 function resetTables(): void {
   const db = getDb();
   db.run("DELETE FROM channel_verification_sessions");
-  db.run("DELETE FROM channel_guardian_approval_requests");
   db.run("DELETE FROM channel_guardian_rate_limits");
   db.run("DELETE FROM contact_channels");
   db.run("DELETE FROM contacts");
@@ -564,251 +603,6 @@ describe("guardian identity check", () => {
 // 5. Approval Request CRUD (Store)
 // ═══════════════════════════════════════════════════════════════════════════
 
-describe("guardian approval request CRUD", () => {
-  beforeEach(() => {
-    resetTables();
-  });
-
-  test("createApprovalRequest creates a pending request", () => {
-    const request = createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      riskLevel: "high",
-      reason: "Executing rm command",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    expect(request.id).toBeDefined();
-    expect(request.runId).toBe("run-1");
-    expect(request.requestId).toBe("req-1");
-    expect(request.status).toBe("pending");
-    expect(request.toolName).toBe("shell");
-    expect(request.riskLevel).toBe("high");
-    expect(request.reason).toBe("Executing rm command");
-    expect(request.decidedByExternalUserId).toBeNull();
-  });
-
-  test("getPendingApprovalForRequest returns the pending request", () => {
-    createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    const found = getPendingApprovalForRequest("req-1");
-    expect(found).not.toBeNull();
-    expect(found!.requestId).toBe("req-1");
-    expect(found!.status).toBe("pending");
-  });
-
-  test("getPendingApprovalForRequest returns null when no pending request exists", () => {
-    const found = getPendingApprovalForRequest("req-nonexistent");
-    expect(found).toBeNull();
-  });
-
-  test("getPendingApprovalByGuardianChat returns pending request for guardian chat", () => {
-    createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    const found = getPendingApprovalByGuardianChat("telegram", "chat-42");
-    expect(found).not.toBeNull();
-    expect(found!.guardianChatId).toBe("chat-42");
-  });
-
-  test("getPendingApprovalByGuardianChat returns null for wrong channel", () => {
-    createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    const found = getPendingApprovalByGuardianChat("slack", "chat-42");
-    expect(found).toBeNull();
-  });
-
-  test("updateApprovalDecision updates status to approved", () => {
-    const request = createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    updateApprovalDecision(request.id, {
-      status: "approved",
-      decidedByExternalUserId: "user-42",
-    });
-
-    // After approval, getPendingApprovalForRequest should return null
-    const found = getPendingApprovalForRequest("req-1");
-    expect(found).toBeNull();
-  });
-
-  test("updateApprovalDecision updates status to denied", () => {
-    const request = createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    updateApprovalDecision(request.id, {
-      status: "denied",
-      decidedByExternalUserId: "user-42",
-    });
-
-    const found = getPendingApprovalForRequest("req-1");
-    expect(found).toBeNull();
-  });
-
-  test("multiple approval requests for different runs are independent", () => {
-    createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    createApprovalRequest({
-      runId: "run-2",
-      requestId: "req-2",
-      conversationId: "conv-2",
-      channel: "telegram",
-      requesterExternalUserId: "user-88",
-      requesterChatId: "chat-88",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "browser",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    const found1 = getPendingApprovalForRequest("req-1");
-    const found2 = getPendingApprovalForRequest("req-2");
-    expect(found1).not.toBeNull();
-    expect(found2).not.toBeNull();
-    expect(found1!.toolName).toBe("shell");
-    expect(found2!.toolName).toBe("browser");
-  });
-
-  test("createApprovalRequest works for voice channel", () => {
-    const request = createApprovalRequest({
-      runId: "run-voice-1",
-      requestId: "req-voice-1",
-      conversationId: "conv-voice-1",
-      channel: "phone",
-      requesterExternalUserId: "phone-user-99",
-      requesterChatId: "voice-chat-99",
-      guardianExternalUserId: "phone-user-42",
-      guardianChatId: "voice-chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    expect(request.id).toBeDefined();
-    expect(request.runId).toBe("run-voice-1");
-    expect(request.requestId).toBe("req-voice-1");
-    expect(request.channel).toBe("phone");
-    expect(request.status).toBe("pending");
-
-    const found = getPendingApprovalForRequest("req-voice-1");
-    expect(found).not.toBeNull();
-    expect(found!.channel).toBe("phone");
-  });
-
-  test("getPendingApprovalByGuardianChat works for voice channel", () => {
-    createApprovalRequest({
-      runId: "run-voice-2",
-      requestId: "req-voice-2",
-      conversationId: "conv-voice-2",
-      channel: "phone",
-      requesterExternalUserId: "phone-user-99",
-      requesterChatId: "voice-chat-99",
-      guardianExternalUserId: "phone-user-42",
-      guardianChatId: "voice-chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    const found = getPendingApprovalByGuardianChat("phone", "voice-chat-42");
-    expect(found).not.toBeNull();
-    expect(found!.channel).toBe("phone");
-
-    // Should not find it under a different channel
-    const notFound = getPendingApprovalByGuardianChat(
-      "telegram",
-      "voice-chat-42",
-    );
-    expect(notFound).toBeNull();
-  });
-
-  test("createApprovalRequest with optional fields omitted defaults to null", () => {
-    const request = createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    expect(request.riskLevel).toBeNull();
-    expect(request.reason).toBeNull();
-  });
-});
-
 // ═══════════════════════════════════════════════════════════════════════════
 // 6. Verification Rate Limiting (Store)
 // ═══════════════════════════════════════════════════════════════════════════
@@ -1204,64 +998,6 @@ describe("channel-scoped guardian resolution", () => {
 // 9. Assistant-scoped approval request lookups
 // ═══════════════════════════════════════════════════════════════════════════
 
-describe("assistant-scoped approval request lookups", () => {
-  beforeEach(() => {
-    resetTables();
-  });
-
-  test("createApprovalRequest no longer exposes assistantId on the returned interface", () => {
-    const req = createApprovalRequest({
-      runId: "run-1",
-      requestId: "req-1",
-      conversationId: "conv-1",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-    // assistantId is no longer on the public interface
-    expect(req.id).toBeDefined();
-    expect(req.toolName).toBe("shell");
-  });
-
-  test("approval requests from different conversations are independent", () => {
-    createApprovalRequest({
-      runId: "run-A",
-      requestId: "req-A",
-      conversationId: "conv-A",
-      channel: "telegram",
-      requesterExternalUserId: "user-99",
-      requesterChatId: "chat-99",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "shell",
-      expiresAt: Date.now() + 300_000,
-    });
-    createApprovalRequest({
-      runId: "run-B",
-      requestId: "req-B",
-      conversationId: "conv-B",
-      channel: "telegram",
-      requesterExternalUserId: "user-88",
-      requesterChatId: "chat-88",
-      guardianExternalUserId: "user-42",
-      guardianChatId: "chat-42",
-      toolName: "browser",
-      expiresAt: Date.now() + 300_000,
-    });
-
-    const foundA = getPendingApprovalForRequest("req-A");
-    const foundB = getPendingApprovalForRequest("req-B");
-    expect(foundA).not.toBeNull();
-    expect(foundB).not.toBeNull();
-    expect(foundA!.toolName).toBe("shell");
-    expect(foundB!.toolName).toBe("browser");
-  });
-});
-
 // ═══════════════════════════════════════════════════════════════════════════
 // 10. HTTP handler — channel-aware guardian status response
 // ═══════════════════════════════════════════════════════════════════════════
@@ -2588,24 +2324,20 @@ describe("outbound voice verification", () => {
   test("resend_outbound before cooldown is rejected", async () => {
     // Start an outbound session first
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     // Immediately try to resend (before cooldown)
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2616,14 +2348,12 @@ describe("outbound voice verification", () => {
   test("resend_outbound after cooldown succeeds and increments sendCount", async () => {
     // Start an outbound session
     const { lastResponse: startResp } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     const startResponse = startResp();
     expect(startResponse!.success).toBe(true);
@@ -2640,13 +2370,11 @@ describe("outbound voice verification", () => {
 
     // Now resend should succeed
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2658,14 +2386,12 @@ describe("outbound voice verification", () => {
   test("resend_outbound exceeding max sends is rejected", async () => {
     // Start an outbound session
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     // Set the send count to MAX_SENDS_PER_SESSION and nextResendAt to the past
     const session = serviceFindActiveSession("phone");
@@ -2679,13 +2405,11 @@ describe("outbound voice verification", () => {
 
     // Resend should be rejected due to max sends
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2696,14 +2420,12 @@ describe("outbound voice verification", () => {
   test("cancel_outbound revokes active session", async () => {
     // Start an outbound session
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     // Verify session exists
     const sessionBefore = serviceFindActiveSession("phone");
@@ -2711,13 +2433,11 @@ describe("outbound voice verification", () => {
 
     // Cancel it
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "cancel_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "cancel_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2780,14 +2500,12 @@ describe("outbound voice verification", () => {
 
   test("start_outbound succeeds for email channel", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "email",
-        destination: "user@example.com",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "email",
+      destination: "user@example.com",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2797,14 +2515,12 @@ describe("outbound voice verification", () => {
 
   test("create_session without destination falls through to inbound challenge", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        // no destination — unified create_session creates an inbound challenge
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      // no destination — unified create_session creates an inbound challenge
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2814,14 +2530,12 @@ describe("outbound voice verification", () => {
 
   test("start_outbound rejects unparseable phone number", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "not-a-phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "not-a-phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2831,14 +2545,12 @@ describe("outbound voice verification", () => {
 
   test("start_outbound normalizes formatted phone number for voice", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "(555) 123-4567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "(555) 123-4567",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2863,13 +2575,11 @@ describe("outbound voice verification", () => {
 
   test("cancel_session succeeds even when no active session (idempotent)", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "cancel_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "cancel_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2888,14 +2598,12 @@ describe("outbound Telegram verification", () => {
 
   test("start_outbound for telegram with handle returns deep link URL, no outbound message", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "@someuser",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "@someuser",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2921,14 +2629,12 @@ describe("outbound Telegram verification", () => {
 
   test("start_outbound for telegram with handle (no @ prefix) returns deep link", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "someuser",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "someuser",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2941,14 +2647,12 @@ describe("outbound Telegram verification", () => {
 
   test("start_outbound for telegram with known chat ID sends message, no deep link", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "123456789",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "123456789",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -2980,14 +2684,12 @@ describe("outbound Telegram verification", () => {
     mockBotUsername = undefined;
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "@someuser",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "@someuser",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3004,15 +2706,13 @@ describe("outbound Telegram verification", () => {
     });
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "@newuser",
-        rebind: false,
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "@newuser",
+      rebind: false,
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3166,14 +2866,12 @@ describe("outbound Telegram verification", () => {
   test("resend_outbound for telegram works with known chat ID", async () => {
     // Start an outbound session with a known chat ID
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "123456789",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "123456789",
+    });
 
     // Fast-forward the cooldown
     const session = serviceFindActiveSession("telegram");
@@ -3186,13 +2884,11 @@ describe("outbound Telegram verification", () => {
     );
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "telegram",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "telegram",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3208,23 +2904,19 @@ describe("outbound Telegram verification", () => {
   test("resend_outbound for pending_bootstrap session is rejected", async () => {
     // Start an outbound session with a handle (pending_bootstrap)
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "@someuser",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "@someuser",
+    });
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "telegram",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "telegram",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3235,26 +2927,22 @@ describe("outbound Telegram verification", () => {
   test("cancel_outbound for telegram revokes session", async () => {
     // Start an outbound session
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "123456789",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "123456789",
+    });
 
     const session = serviceFindActiveSession("telegram");
     expect(session).not.toBeNull();
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "cancel_session",
-        channel: "telegram",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "cancel_session",
+      channel: "telegram",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3295,13 +2983,11 @@ describe("outbound Telegram verification", () => {
 
   test("create_session for telegram without destination falls through to inbound challenge", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3312,14 +2998,12 @@ describe("outbound Telegram verification", () => {
   test("rate limits apply to telegram outbound (per-session send cap)", async () => {
     // Start an outbound session with a known chat ID
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "123456789",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "123456789",
+    });
 
     // Set the send count to MAX_SENDS_PER_SESSION and nextResendAt to the past
     const session = serviceFindActiveSession("telegram");
@@ -3333,13 +3017,11 @@ describe("outbound Telegram verification", () => {
 
     // Resend should be rejected due to max sends
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "telegram",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "telegram",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3350,24 +3032,20 @@ describe("outbound Telegram verification", () => {
   test("rate limits apply to telegram outbound (cooldown)", async () => {
     // Start an outbound session with a known chat ID
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "123456789",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "123456789",
+    });
 
     // Immediately try to resend (before cooldown)
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "telegram",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "telegram",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3387,14 +3065,12 @@ describe("outbound voice verification", () => {
 
   test("start_outbound for voice creates session with 6-digit code and initiates call", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3427,14 +3103,12 @@ describe("outbound voice verification", () => {
 
   test("start_outbound for voice rejects unparseable phone number", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "not-a-phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "not-a-phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3444,14 +3118,12 @@ describe("outbound voice verification", () => {
 
   test("start_outbound for voice normalizes formatted phone number", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "555-123-4567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "555-123-4567",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3485,15 +3157,13 @@ describe("outbound voice verification", () => {
     });
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15559876543",
-        rebind: false,
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15559876543",
+      rebind: false,
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3504,24 +3174,20 @@ describe("outbound voice verification", () => {
   test("resend_outbound for voice initiates a new call with cooldown check", async () => {
     // Start an outbound session first
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     // Immediately try to resend (before cooldown)
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3532,24 +3198,20 @@ describe("outbound voice verification", () => {
   test("cancel_outbound for voice cancels session", async () => {
     // Start an outbound session first
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     // Cancel the session
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "cancel_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "cancel_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3583,14 +3245,12 @@ describe("outbound voice verification", () => {
     }
 
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3600,13 +3260,11 @@ describe("outbound voice verification", () => {
 
   test("create_session for voice without destination falls through to inbound challenge", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3634,14 +3292,12 @@ describe("M1–M4 hardening coverage", () => {
 
   test("start_outbound for voice response includes secret", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3656,14 +3312,12 @@ describe("M1–M4 hardening coverage", () => {
   test("resend_outbound for voice response includes secret", async () => {
     // Start a session first
     broadcastedMessages.length = 0;
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "phone",
-        destination: "+15551234567",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "phone",
+      destination: "+15551234567",
+    });
 
     // Move past cooldown
     const session = serviceFindActiveSession("phone");
@@ -3677,13 +3331,11 @@ describe("M1–M4 hardening coverage", () => {
 
     // Resend
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "resend_session",
-        channel: "phone",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "resend_session",
+      channel: "phone",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();
@@ -3697,14 +3349,12 @@ describe("M1–M4 hardening coverage", () => {
 
   test("start_outbound for Telegram bootstrap (handle) does NOT return secret", async () => {
     const { lastResponse } = createResponseReader();
-    await handleChannelVerificationSession(
-      {
-        type: "channel_verification_session",
-        action: "create_session",
-        channel: "telegram",
-        destination: "@someuser",
-      },
-    );
+    await handleChannelVerificationSession({
+      type: "channel_verification_session",
+      action: "create_session",
+      channel: "telegram",
+      destination: "@someuser",
+    });
 
     const resp = lastResponse();
     expect(resp).not.toBeNull();