@vellumai/assistant 0.10.0 → 0.10.1-staging.1

package/src/__tests__/invite-routes-http.test.ts

@@ -37,58 +37,37 @@ mock.module("../calls/call-domain.js", () => ({
 import { upsertContact } from "../contacts/contact-store.js";
 import { getSqlite } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
+import { revokeInvite } from "../memory/invite-store.js";
 import {
-  handleCreateInvite as _handleCreateInvite,
-  handleListInvites as _handleListInvites,
-  handleRedeemInvite as _handleRedeemInvite,
-  handleRevokeInvite as _handleRevokeInvite,
-  handleTriggerInviteCall as _handleTriggerInviteCall,
-} from "../runtime/routes/contact-routes.js";
+  createIngressInvite,
+  triggerInviteCall,
+} from "../runtime/invite-service.js";
+import { handleRedeemInvite as _handleRedeemInvite } from "../runtime/routes/contact-routes.js";
 import { RouteError } from "../runtime/routes/errors.js";
 
 /**
- * Compatibility wrappers: translate old handler call signatures into the new
- * RouteHandlerArgs pattern and wrap the result in a Response-like object so
- * existing test assertions (res.status / res.json()) keep working.
+ * The CLI/HTTP create/list/revoke/trigger route handlers relay to the gateway
+ * (see invite-relay-routes.test.ts). The assistant-native invite logic the
+ * gateway invokes via `invites_mint` + its native handlers is exercised here
+ * against the assistant DB through the `invite-service` functions. Redemption
+ * stays daemon-local and is driven through the route handler.
  */
 function fakeResponse(body: unknown, status = 200) {
   return { status, json: async () => body };
 }
 
 async function handleCreateInvite(req: Request) {
-  const body = (await req.json()) as Record<string, unknown>;
-  try {
-    const result = await _handleCreateInvite({ body });
-    return fakeResponse(result, 201);
-  } catch (err) {
-    if (err instanceof RouteError)
-      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
-    throw err;
-  }
-}
-
-function handleListInvites(url: URL) {
-  const queryParams: Record<string, string> = {};
-  for (const [k, v] of url.searchParams.entries()) queryParams[k] = v;
-  try {
-    const result = _handleListInvites({ queryParams });
-    return fakeResponse(result);
-  } catch (err) {
-    if (err instanceof RouteError)
-      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
-    throw err;
-  }
-}
-
-function handleRevokeInvite(inviteId: string) {
-  try {
-    const result = _handleRevokeInvite({ pathParams: { id: inviteId } });
-    return fakeResponse(result);
-  } catch (err) {
-    if (err instanceof RouteError)
-      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
-    throw err;
-  }
+  const body = (await req.json()) as Record<string, string | number>;
+  const result = await createIngressInvite({
+    sourceChannel: body.sourceChannel as string | undefined,
+    note: body.note as string | undefined,
+    maxUses: body.maxUses as number | undefined,
+    expiresInMs: body.expiresInMs as number | undefined,
+    expectedExternalUserId: body.expectedExternalUserId as string | undefined,
+    contactId: body.contactId as string,
+  });
+  if (!result.ok) return fakeResponse({ ok: false, error: result.error }, 400);
+  return fakeResponse({ ok: true, invite: result.data }, 201);
 }
 
 async function handleRedeemInvite(req: Request) {
@@ -104,19 +83,12 @@ async function handleRedeemInvite(req: Request) {
 }
 
 async function handleTriggerInviteCall(inviteId: string) {
-  try {
-    const result = await _handleTriggerInviteCall({
-      pathParams: { id: inviteId },
-    });
-    return fakeResponse(result);
-  } catch (err) {
-    if (err instanceof RouteError)
-      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
-    throw err;
-  }
+  const result = await triggerInviteCall(inviteId);
+  if (!result.ok) return fakeResponse({ ok: false, error: result.error }, 400);
+  return fakeResponse({ ok: true, callSid: result.data.callSid });
 }
 
-initializeDb();
+await initializeDb();
 
 /** Create a throwaway contact and return its ID, for use as the invite's contactId. */
 function createTargetContact(displayName = "Test Contact"): string {
@@ -210,66 +182,6 @@ describe("ingress invite HTTP routes", () => {
     expect(body.error).toContain("sourceChannel");
   });
 
-  test("GET /v1/contacts/invites — lists invites", async () => {
-    // Create two invites
-    await handleCreateInvite(
-      new Request("http://localhost/v1/contacts/invites", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          sourceChannel: "telegram",
-          contactId: createTargetContact(),
-        }),
-      }),
-    );
-    await handleCreateInvite(
-      new Request("http://localhost/v1/contacts/invites", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          sourceChannel: "telegram",
-          contactId: createTargetContact(),
-        }),
-      }),
-    );
-
-    const url = new URL("http://localhost/v1/contacts/invites");
-    const res = handleListInvites(url);
-    const body = (await res.json()) as Record<string, unknown>;
-
-    expect(res.status).toBe(200);
-    expect(body.ok).toBe(true);
-    expect(Array.isArray(body.invites)).toBe(true);
-    expect((body.invites as unknown[]).length).toBe(2);
-  });
-
-  test("DELETE /v1/contacts/invites/:id — revokes an invite", async () => {
-    const createRes = await handleCreateInvite(
-      new Request("http://localhost/v1/contacts/invites", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          sourceChannel: "telegram",
-          contactId: createTargetContact(),
-        }),
-      }),
-    );
-    const created = (await createRes.json()) as { invite: { id: string } };
-
-    const res = handleRevokeInvite(created.invite.id);
-    const body = (await res.json()) as Record<string, unknown>;
-
-    expect(res.status).toBe(200);
-    expect(body.ok).toBe(true);
-    const invite = body.invite as Record<string, unknown>;
-    expect(invite.status).toBe("revoked");
-  });
-
-  test("DELETE /v1/contacts/invites/:id — not found returns 404", () => {
-    const res = handleRevokeInvite("nonexistent-id");
-    expect(res.status).toBe(404);
-  });
-
   test("POST /v1/contacts/invites/redeem — redeems an invite", async () => {
     // Create an invite first
     const createRes = await handleCreateInvite(
@@ -359,12 +271,9 @@ describe("ingress service shared logic", () => {
     };
     expect(created.invite.status).toBe("active");
 
-    const revokeRes = handleRevokeInvite(created.invite.id);
-    const revoked = (await revokeRes.json()) as {
-      invite: { id: string; status: string };
-    };
-    expect(revoked.invite.status).toBe("revoked");
-    expect(revoked.invite.id).toBe(created.invite.id);
+    const revoked = revokeInvite(created.invite.id);
+    expect(revoked?.status).toBe("revoked");
+    expect(revoked?.id).toBe(created.invite.id);
   });
 });
 
@@ -381,10 +290,8 @@ describe("voice invite HTTP routes", () => {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
-        contactId: createTargetContact(),
+        contactId: createTargetContact("Alice"),
         expectedExternalUserId: "+15551234567",
-        friendName: "Alice",
-        guardianName: "Bob",
         maxUses: 3,
       }),
     });
@@ -407,9 +314,8 @@ describe("voice invite HTTP routes", () => {
     expect(invite.voiceCodeDigits).toBe(6);
     // expectedExternalUserId should be recorded
     expect(invite.expectedExternalUserId).toBe("+15551234567");
-    // friendName and guardianName should be recorded
+    // friendName is mirrored from the bound contact's displayName, not a flag
     expect(invite.friendName).toBe("Alice");
-    expect(invite.guardianName).toBe("Bob");
   });
 
   test("voice invite creation requires expectedExternalUserId", async () => {
@@ -419,8 +325,6 @@ describe("voice invite HTTP routes", () => {
       body: JSON.stringify({
         sourceChannel: "phone",
         contactId: createTargetContact(),
-        friendName: "Alice",
-        guardianName: "Bob",
       }),
     });
 
@@ -440,8 +344,6 @@ describe("voice invite HTTP routes", () => {
         sourceChannel: "phone",
         contactId: createTargetContact(),
         expectedExternalUserId: "not-a-phone-number",
-        friendName: "Alice",
-        guardianName: "Bob",
       }),
     });
 
@@ -453,46 +355,6 @@ describe("voice invite HTTP routes", () => {
     expect(body.error).toContain("E.164");
   });
 
-  test("voice invite creation requires friendName", async () => {
-    const req = new Request("http://localhost/v1/contacts/invites", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        sourceChannel: "phone",
-        contactId: createTargetContact(),
-        expectedExternalUserId: "+15551234567",
-        guardianName: "Bob",
-      }),
-    });
-
-    const res = await handleCreateInvite(req);
-    const body = (await res.json()) as Record<string, unknown>;
-
-    expect(res.status).toBe(400);
-    expect(body.ok).toBe(false);
-    expect(body.error).toContain("friendName");
-  });
-
-  test("voice invite creation requires guardianName", async () => {
-    const req = new Request("http://localhost/v1/contacts/invites", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        sourceChannel: "phone",
-        contactId: createTargetContact(),
-        expectedExternalUserId: "+15551234567",
-        friendName: "Alice",
-      }),
-    });
-
-    const res = await handleCreateInvite(req);
-    const body = (await res.json()) as Record<string, unknown>;
-
-    expect(res.status).toBe(400);
-    expect(body.ok).toBe(false);
-    expect(body.error).toContain("guardianName");
-  });
-
   test("voiceCodeDigits is always 6 — custom values are ignored", async () => {
     const req = new Request("http://localhost/v1/contacts/invites", {
       method: "POST",
@@ -501,8 +363,6 @@ describe("voice invite HTTP routes", () => {
         sourceChannel: "phone",
         contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
-        friendName: "Alice",
-        guardianName: "Bob",
         voiceCodeDigits: 8,
       }),
     });
@@ -525,8 +385,6 @@ describe("voice invite HTTP routes", () => {
         sourceChannel: "phone",
         contactId: createTargetContact(),
         expectedExternalUserId: "+15551234567",
-        friendName: "Alice",
-        guardianName: "Bob",
       }),
     });
 
@@ -550,8 +408,6 @@ describe("voice invite HTTP routes", () => {
           sourceChannel: "phone",
           contactId: createTargetContact(),
           expectedExternalUserId: "+15551234567",
-          friendName: "Alice",
-          guardianName: "Bob",
           maxUses: 1,
         }),
       }),
@@ -608,8 +464,6 @@ describe("voice invite HTTP routes", () => {
           sourceChannel: "phone",
           contactId: createTargetContact(),
           expectedExternalUserId: "+15551234567",
-          friendName: "Alice",
-          guardianName: "Bob",
           maxUses: 1,
         }),
       }),
@@ -631,16 +485,14 @@ describe("voice invite HTTP routes", () => {
     expect(body.ok).toBe(false);
   });
 
-  test("voice invite creation returns guardianInstruction with friend name", async () => {
+  test("voice invite creation returns guardianInstruction with the contact's first name", async () => {
     const req = new Request("http://localhost/v1/contacts/invites", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         sourceChannel: "phone",
-        contactId: createTargetContact(),
+        contactId: createTargetContact("Carolina Flaherty"),
         expectedExternalUserId: "+15551234567",
-        friendName: "Alice",
-        guardianName: "Bob",
       }),
     });
 
@@ -650,8 +502,9 @@ describe("voice invite HTTP routes", () => {
     expect(res.status).toBe(201);
     expect(body.ok).toBe(true);
     const invite = body.invite as Record<string, unknown>;
+    // First-token of the contact's displayName is used in the instruction
     expect(invite.guardianInstruction).toBe(
-      "Alice will need this code when they answer. Share it with them first.",
+      "Carolina will need this code when they answer. Share it with them first.",
     );
   });
 });
@@ -675,8 +528,6 @@ describe("POST /v1/contacts/invites/:id/call", () => {
           sourceChannel: "phone",
           contactId: createTargetContact(),
           expectedExternalUserId: "+15551234567",
-          friendName: "Alice",
-          guardianName: "Bob",
         }),
       }),
     );
@@ -708,15 +559,13 @@ describe("POST /v1/contacts/invites/:id/call", () => {
           sourceChannel: "phone",
           contactId: createTargetContact(),
           expectedExternalUserId: "+15551234567",
-          friendName: "Alice",
-          guardianName: "Bob",
         }),
       }),
     );
     const created = (await createRes.json()) as { invite: { id: string } };
 
     // Revoke the invite
-    handleRevokeInvite(created.invite.id);
+    revokeInvite(created.invite.id);
 
     const res = await handleTriggerInviteCall(created.invite.id);
     const body = (await res.json()) as Record<string, unknown>;

package/src/__tests__/invite-service-ipc.test.ts

@@ -0,0 +1,287 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// Prevent ensureTelegramBotUsernameResolved() from reading real credentials
+// and calling the Telegram API.
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async () => undefined,
+  setSecureKeyAsync: async () => {},
+  deleteSecureKeyAsync: async () => {},
+}));
+
+// The redemption service now claims the gateway-canonical row over IPC before
+// mutating. Default the claim to consumed (updated:true) so these assistant-side
+// handler tests exercise the happy redemption path.
+mock.module("../ipc/gateway-client.js", () => ({
+  ipcCallPersistent: async (method: string) => {
+    if (method === "record_invite_redemption") {
+      return { ok: true, updated: true, mirrored: true };
+    }
+    return undefined;
+  },
+}));
+
+import { upsertContact } from "../contacts/contact-store.js";
+import { handleMintInvite } from "../ipc/routes/invite-ipc-routes.js";
+import { getSqlite } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+import {
+  createInvite,
+  findById,
+  hashToken,
+} from "../memory/invite-store.js";
+import {
+  handleRedeemTokenInvite,
+  handleRedeemVoiceInvite,
+} from "../runtime/routes/contact-routes.js";
+import { generateVoiceCode, hashVoiceCode } from "../util/voice-code.js";
+
+await initializeDb();
+
+function resetTables() {
+  getSqlite().run("DELETE FROM assistant_ingress_invites");
+  getSqlite().run("DELETE FROM contact_channels");
+  getSqlite().run("DELETE FROM contacts");
+}
+
+/** Create a throwaway contact and return its ID, for use as the invite's contactId. */
+function createTargetContact(displayName = "Target Contact"): string {
+  return upsertContact({ displayName, role: "contact" }).id;
+}
+
+describe("handleMintInvite (invites_mint)", () => {
+  beforeEach(resetTables);
+
+  test("returns rawToken + gateway projection and persists the assistant row", async () => {
+    const contactId = createTargetContact();
+
+    const result = (await handleMintInvite({
+      body: { sourceChannel: "telegram", contactId, maxUses: 3 },
+    })) as {
+      ok: boolean;
+      invite: { id: string; token?: string };
+      rawToken?: string;
+      gateway: {
+        id: string;
+        inviteCodeHash: string;
+        sourceChannel: string;
+        contactId: string;
+        note: string | null;
+        maxUses: number;
+        expiresAt: number;
+      };
+    };
+
+    expect(result.ok).toBe(true);
+    expect(result.rawToken).toBeDefined();
+    expect(typeof result.rawToken).toBe("string");
+
+    // Gateway projection carries exactly the mirrored fields.
+    expect(result.gateway).toEqual({
+      id: result.invite.id,
+      inviteCodeHash: expect.any(String),
+      sourceChannel: "telegram",
+      contactId,
+      note: null,
+      maxUses: 3,
+      expiresAt: expect.any(Number),
+    });
+
+    // The assistant row is persisted and only the token hash is stored.
+    const row = findById(result.invite.id);
+    expect(row).not.toBeNull();
+    expect(row!.contactId).toBe(contactId);
+    expect(row!.tokenHash).toBe(hashToken(result.rawToken!));
+    expect(row!.inviteCodeHash).toBe(result.gateway.inviteCodeHash);
+  });
+
+  test("voice mint does not expose a raw token but persists voice fields", async () => {
+    const contactId = createTargetContact();
+
+    const result = (await handleMintInvite({
+      body: {
+        sourceChannel: "phone",
+        contactId,
+        expectedExternalUserId: "+12025550100",
+      },
+    })) as {
+      ok: boolean;
+      invite: { id: string; voiceCode?: string };
+      rawToken?: string;
+      gateway: { sourceChannel: string; inviteCodeHash: string };
+    };
+
+    expect(result.ok).toBe(true);
+    // Voice invites never expose the generic redemption token.
+    expect(result.rawToken).toBeUndefined();
+    expect(result.gateway.sourceChannel).toBe("phone");
+
+    const row = findById(result.invite.id);
+    expect(row).not.toBeNull();
+    expect(row!.expectedExternalUserId).toBe("+12025550100");
+    expect(row!.voiceCodeHash).toBeTruthy();
+    // Voice invites have no non-voice inviteCodeHash; the gateway projection
+    // mirrors the voice code hash instead so the NOT NULL mirror constraint holds.
+    expect(row!.inviteCodeHash).toBeNull();
+    expect(row!.voiceCodeHash).toBe(result.gateway.inviteCodeHash);
+  });
+
+  test("returns a 400 when required params are missing", async () => {
+    await expect(
+      handleMintInvite({ body: { contactId: createTargetContact() } }),
+    ).rejects.toThrow();
+  });
+});
+
+describe("handleRedeemTokenInvite (invites_redeem_token)", () => {
+  beforeEach(resetTables);
+
+  test("redeems a valid token and returns the invite shape", async () => {
+    const contactId = createTargetContact();
+    const { rawToken, invite } = createInvite({
+      sourceChannel: "telegram",
+      contactId,
+      maxUses: 1,
+    });
+
+    const result = (await handleRedeemTokenInvite({
+      body: {
+        token: rawToken,
+        sourceChannel: "telegram",
+        externalUserId: "user-1",
+      },
+    })) as { ok: boolean; invite: { id: string }; type: string };
+
+    expect(result.ok).toBe(true);
+    expect(result.invite.id).toBe(invite.id);
+    expect(result.type).toBe("redeemed");
+  });
+
+  test("surfaces type 'already_member' when an existing contact reopens the link", async () => {
+    const contactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId,
+      maxUses: 2,
+    });
+
+    // First redeem makes the caller an active contact.
+    await handleRedeemTokenInvite({
+      body: {
+        token: rawToken,
+        sourceChannel: "telegram",
+        externalUserId: "user-1",
+      },
+    });
+
+    // Second redeem by the SAME caller is a no-op membership-wise: it must
+    // surface type "already_member" so the gateway skips consuming a use.
+    const again = (await handleRedeemTokenInvite({
+      body: {
+        token: rawToken,
+        sourceChannel: "telegram",
+        externalUserId: "user-1",
+      },
+    })) as { ok: boolean; type: string };
+
+    expect(again.ok).toBe(true);
+    expect(again.type).toBe("already_member");
+  });
+
+  test("rejects a bogus token with a 400", async () => {
+    await expect(
+      handleRedeemTokenInvite({
+        body: {
+          token: "totally-bogus-token",
+          sourceChannel: "telegram",
+          externalUserId: "user-1",
+        },
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("rejects redemption on the wrong channel", async () => {
+    const contactId = createTargetContact();
+    const { rawToken } = createInvite({
+      sourceChannel: "telegram",
+      contactId,
+      maxUses: 1,
+    });
+
+    await expect(
+      handleRedeemTokenInvite({
+        body: {
+          token: rawToken,
+          sourceChannel: "phone",
+          externalUserId: "user-1",
+        },
+      }),
+    ).rejects.toThrow();
+  });
+});
+
+describe("handleRedeemVoiceInvite (invites_redeem_voice)", () => {
+  beforeEach(resetTables);
+
+  /** Create a voice invite with a known code; return the invite + plaintext code. */
+  function createVoiceInvite(callerPhone = "+12025550100") {
+    const code = generateVoiceCode(6);
+    const { invite } = createInvite({
+      sourceChannel: "phone",
+      contactId: createTargetContact(),
+      maxUses: 1,
+      expectedExternalUserId: callerPhone,
+      voiceCodeHash: hashVoiceCode(code),
+      voiceCodeDigits: 6,
+    });
+    return { invite, code };
+  }
+
+  test("redeems a valid voice code and returns the documented shape", async () => {
+    const phone = "+12025550100";
+    const { invite, code } = createVoiceInvite(phone);
+
+    const result = (await handleRedeemVoiceInvite({
+      body: { callerExternalUserId: phone, code },
+    })) as {
+      ok: boolean;
+      type: string;
+      memberId: string;
+      inviteId?: string;
+    };
+
+    expect(result).toEqual({
+      ok: true,
+      type: "redeemed",
+      memberId: expect.any(String),
+      inviteId: invite.id,
+    });
+  });
+
+  test("wrong caller identity is rejected with a 400", async () => {
+    const { code } = createVoiceInvite("+12025550100");
+
+    await expect(
+      handleRedeemVoiceInvite({
+        body: { callerExternalUserId: "+12025550101", code },
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("missing callerExternalUserId or code is rejected with a 400", async () => {
+    await expect(
+      handleRedeemVoiceInvite({ body: { code: "123456" } }),
+    ).rejects.toThrow();
+    await expect(
+      handleRedeemVoiceInvite({
+        body: { callerExternalUserId: "+12025550100" },
+      }),
+    ).rejects.toThrow();
+  });
+});

package/src/__tests__/jobs-store-qdrant-breaker.test.ts

@@ -15,7 +15,7 @@ mock.module("../config/loader.js", () => ({
 
 import { eq } from "drizzle-orm";
 
-import { getDb } from "../memory/db-connection.js";
+import { getMemoryDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import {
   claimMemoryJobs,
@@ -29,12 +29,12 @@ import {
 import { memoryJobs } from "../memory/schema.js";
 
 describe("claimMemoryJobs with Qdrant circuit breaker", () => {
-  beforeAll(() => {
-    initializeDb();
+  beforeAll(async () => {
+    await initializeDb();
   });
 
   beforeEach(() => {
-    const db = getDb();
+    const db = getMemoryDb()!;
     db.run("DELETE FROM memory_jobs");
     _resetQdrantBreaker();
   });
@@ -149,7 +149,7 @@ describe("claimMemoryJobs with Qdrant circuit breaker", () => {
     expect(embedClaimed).toHaveLength(2);
 
     // Remaining 10 jobs should still be pending.
-    const db = getDb();
+    const db = getMemoryDb()!;
     const pendingRows = db
       .select()
       .from(memoryJobs)