@vellumai/assistant 0.10.2 → 0.10.3-dev.202606252046.9075fd5

package/src/runtime/channel-verification-service.ts

@@ -9,8 +9,12 @@
 import { createHash, randomBytes } from "crypto";
 import { v4 as uuid } from "uuid";
 
-import { findGuardianForChannel } from "../contacts/contact-store.js";
 import { revokeGuardianBinding } from "../contacts/contacts-write.js";
+import {
+  getGuardianDelivery,
+  getGuardianDeliveryFresh,
+  guardianForChannel,
+} from "../contacts/guardian-delivery-reader.js";
 import type {
   GuardianBinding,
   IdentityBindingStatus,
@@ -319,50 +323,71 @@ export function validateAndConsumeVerification(
 
 /**
  * Look up the active guardian binding for a given assistant and channel.
- * Reads from the contacts table via findGuardianForChannel and
- * synthesizes a GuardianBinding-shaped object.
- * Returns null when no contacts match.
+ * Reads the gateway-owned GuardianDelivery and synthesizes a
+ * GuardianBinding-shaped object. Returns null when no guardian is bound or
+ * the gateway is unreachable.
  */
-export function getGuardianBinding(
+export async function getGuardianBinding(
   assistantId: string,
   channel: string,
-): GuardianBinding | null {
-  const result = findGuardianForChannel(channel);
-  if (result) {
-    return {
-      id: result.channel.id,
-      assistantId,
-      channel,
-      guardianExternalUserId: result.channel.address,
-      guardianDeliveryChatId: result.channel.externalChatId ?? "",
-      guardianPrincipalId: result.contact.principalId ?? "",
-      status: "active" as const,
-      verifiedAt: result.channel.verifiedAt ?? 0,
-      verifiedVia: result.channel.verifiedVia ?? "",
-      metadataJson: null,
-      createdAt: result.channel.createdAt,
-      updatedAt: result.channel.updatedAt ?? result.channel.createdAt,
-    };
-  }
+): Promise<GuardianBinding | null> {
+  const list = await getGuardianDelivery({ channelTypes: [channel] });
+  const delivery = list ? guardianForChannel(list, channel) : undefined;
+  if (!delivery) return null;
 
-  return null;
+  const now = Date.now();
+  return {
+    id: delivery.contactId,
+    assistantId,
+    channel,
+    guardianExternalUserId: delivery.address,
+    guardianDeliveryChatId: delivery.externalChatId ?? "",
+    guardianPrincipalId: delivery.principalId ?? "",
+    status: "active" as const,
+    verifiedAt: delivery.verifiedAt ?? 0,
+    // verifiedVia is not carried on the delivery contract; a bound guardian
+    // is verified by definition.
+    verifiedVia: "verified",
+    metadataJson: null,
+    createdAt: now,
+    updatedAt: now,
+  };
+}
+
+/**
+ * Gateway-backed guardian-existence check: is a guardian already bound for
+ * this channel? Presence-only idempotency guard, NOT an ACL-field read.
+ *
+ * Null-list fail direction: a `null` from the gateway (unreachable / malformed)
+ * is "unknown" — returns `true` so an unreachable gateway is treated as
+ * already-bound. Callers gate session creation on a falsy result, so this
+ * blocks a new binding on a transient miss rather than spuriously creating a
+ * second one.
+ */
+export async function isGuardianBoundForChannel(
+  channel: string,
+): Promise<boolean> {
+  // Existence guards read fresh because gateway-side binding writes don't
+  // invalidate the daemon cache.
+  const list = await getGuardianDeliveryFresh({ channelTypes: [channel] });
+  if (list === null) return true;
+  return !!guardianForChannel(list, channel);
 }
 
 /**
  * Check whether the given external user is the active guardian for
  * the specified assistant and channel.
  */
-export function isGuardian(
+export async function isGuardian(
   assistantId: string,
   channel: string,
   address: string,
-): boolean {
-  const result = findGuardianForChannel(channel);
-  if (result) {
-    return result.channel.address.toLowerCase() === address.toLowerCase();
-  }
+): Promise<boolean> {
+  const list = await getGuardianDelivery({ channelTypes: [channel] });
+  const delivery = list ? guardianForChannel(list, channel) : undefined;
+  if (!delivery) return false;
 
-  return false;
+  return delivery.address.toLowerCase() === address.toLowerCase();
 }
 
 /**

package/src/runtime/confirmation-request-guardian-bridge.ts

@@ -70,9 +70,9 @@ export type BridgeConfirmationRequestResult =
  *
  * Fire-and-forget safe: notification emission errors are logged but not propagated.
  */
-export function bridgeConfirmationRequestToGuardian(
+export async function bridgeConfirmationRequestToGuardian(
   params: BridgeConfirmationRequestParams,
-): BridgeConfirmationRequestResult {
+): Promise<BridgeConfirmationRequestResult> {
   const {
     canonicalRequest,
     trustContext,
@@ -100,7 +100,7 @@ export function bridgeConfirmationRequestToGuardian(
   }
 
   const sourceChannel = trustContext.sourceChannel;
-  const binding = getGuardianBinding(assistantId, sourceChannel);
+  const binding = await getGuardianBinding(assistantId, sourceChannel);
   if (!binding) {
     log.debug(
       { sourceChannel, assistantId },

package/src/runtime/guardian-vellum-migration.ts

@@ -7,11 +7,22 @@
  * assistant-side since it reacts to incoming JWT principals.
  */
 
+import type { ChannelId } from "../channels/types.js";
 import {
-  findGuardianForChannel,
+  findContactByAddress,
   updateContactPrincipalAndChannel,
 } from "../contacts/contact-store.js";
+import {
+  getGuardianDelivery,
+  guardianForChannel,
+} from "../contacts/guardian-delivery-reader.js";
+import type { TrustContext } from "../daemon/trust-context.js";
 import { getLogger } from "../util/logger.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "./assistant-scope.js";
+import {
+  resolveTrustContext,
+  withSourceChannel,
+} from "./trust-context-resolver.js";
 
 const log = getLogger("guardian-vellum-migration");
 
@@ -31,22 +42,43 @@ const log = getLogger("guardian-vellum-migration");
  * minted by this daemon's signing key.
  *
  * Returns true if healing occurred, false otherwise.
+ *
+ * The gateway binding supplies the authoritative principal; the local
+ * assistant-mirror row is repaired to match the JWT principal because the
+ * /v1/messages trust path still resolves against the local mirror in this
+ * plan. A stale mirror must be repaired or valid guardians stay `unknown`.
  */
-export function healGuardianBindingDrift(incomingPrincipalId: string): boolean {
+export async function healGuardianBindingDrift(
+  incomingPrincipalId: string,
+): Promise<boolean> {
   if (!incomingPrincipalId.startsWith("vellum-principal-")) {
     return false;
   }
 
-  const guardianResult = findGuardianForChannel("vellum");
-  if (!guardianResult) return false;
+  const guardians = await getGuardianDelivery({ channelTypes: ["vellum"] });
+  if (!guardians) return false;
+  const guardian = guardianForChannel(guardians, "vellum");
+  if (!guardian) return false;
 
-  const currentPrincipalId = guardianResult.contact.principalId;
+  const currentPrincipalId = guardian.principalId;
+  // Only repair auto-generated principals — never overwrite a real one.
   if (!currentPrincipalId?.startsWith("vellum-principal-")) return false;
+  // No-op when the principal already matches the JWT principal.
   if (currentPrincipalId === incomingPrincipalId) return false;
 
+  // Resolve the assistant-mirror row to repair so local trust resolution
+  // converges on the JWT principal. The gateway delivery supplies the guardian
+  // identity (channel + address) but not the local channel UUID write target,
+  // so resolve that locally by the guardian's vellum-channel address.
+  const localContact = findContactByAddress("vellum", guardian.address);
+  const localChannel = localContact?.channels.find(
+    (c) => c.type === "vellum",
+  );
+  if (!localContact || !localChannel) return false;
+
   const updated = updateContactPrincipalAndChannel(
-    guardianResult.contact.id,
-    guardianResult.channel.id,
+    localContact.id,
+    localChannel.id,
     incomingPrincipalId,
   );
 
@@ -66,8 +98,37 @@ export function healGuardianBindingDrift(incomingPrincipalId: string): boolean {
       oldPrincipalId: currentPrincipalId,
       newPrincipalId: incomingPrincipalId,
     },
-    "Healed vellum guardian binding drift — updated principalId to match JWT actor",
+    "Healed vellum guardian binding drift — updated local mirror principalId to match JWT actor",
   );
 
   return true;
 }
+
+/**
+ * Re-resolve trust from the local mirror only for the narrow vellum-principal
+ * reset-drift case; null when it isn't drift (caller keeps the gateway verdict).
+ */
+export async function reResolveTrustOnResetDrift(
+  incomingPrincipalId: string,
+  sourceChannel: ChannelId,
+): Promise<TrustContext | null> {
+  const guardians = await getGuardianDelivery({ channelTypes: ["vellum"] });
+  const gatewayPrincipal = guardians
+    ? guardianForChannel(guardians, "vellum")?.principalId
+    : undefined;
+  const isResetDrift =
+    incomingPrincipalId.startsWith("vellum-principal-") &&
+    !!gatewayPrincipal?.startsWith("vellum-principal-") &&
+    gatewayPrincipal !== incomingPrincipalId;
+  if (!isResetDrift) return null;
+  await healGuardianBindingDrift(incomingPrincipalId);
+  return withSourceChannel(
+    sourceChannel,
+    resolveTrustContext({
+      assistantId: DAEMON_INTERNAL_ASSISTANT_ID,
+      sourceChannel: "vellum",
+      conversationExternalId: "local",
+      actorExternalId: incomingPrincipalId,
+    }),
+  );
+}