@vellumai/assistant 0.10.3-staging.2 → 0.10.4-staging.1

package/src/contacts/__tests__/contacts-write-revoke-relay.test.ts

@@ -40,14 +40,13 @@ mock.module("../../ipc/gateway-client.js", () => ({
 }));
 
 
-// Local-mirror primitive.
+// Local resolver primitive — resolves the native contact/channel by id; the
+// gateway owns the ACL downgrade, so it takes no reason and mutates nothing.
 const revokeMemberResult: ContactWriteResult = {
   contact: { id: "c1" } as ContactWriteResult["contact"],
-  channel: { id: "ch1", status: "revoked" } as ContactWriteResult["channel"],
+  channel: { id: "ch1" } as ContactWriteResult["channel"],
 };
-const revokeMemberMock = mock((_memberId: string, _reason?: string) =>
-  revokeMemberResult,
-);
+const revokeMemberMock = mock((_memberId: string) => revokeMemberResult);
 const actualContactsWrite = await import("../contacts-write.js");
 mock.module("../contacts-write.js", () => ({
   ...actualContactsWrite,
@@ -75,7 +74,7 @@ describe("revokeMemberChannel gateway-first relay", () => {
       },
     ]);
     expect(revokeMemberMock).toHaveBeenCalledTimes(1);
-    expect(revokeMemberMock).toHaveBeenCalledWith("ch1", "removed");
+    expect(revokeMemberMock).toHaveBeenCalledWith("ch1");
     expect(result).toBe(revokeMemberResult);
   });
 
@@ -83,8 +82,8 @@ describe("revokeMemberChannel gateway-first relay", () => {
     await revokeMemberChannel("c1:ch1");
 
     expect(ipcCalls[0]?.params?.contactChannelId).toBe("ch1");
-    // The local mirror still receives the original composite id it accepts.
-    expect(revokeMemberMock).toHaveBeenCalledWith("c1:ch1", undefined);
+    // The local resolver still receives the original composite id it accepts.
+    expect(revokeMemberMock).toHaveBeenCalledWith("c1:ch1");
   });
 
   test("always relays — never skips based on local mirror status", async () => {

package/src/contacts/__tests__/member-write-relay.test.ts

@@ -48,7 +48,7 @@ mock.module("../../ipc/gateway-client.js", () => ({
 // Local-mirror primitive.
 const localResult: ContactWriteResult = {
   contact: { id: "c1" } as ContactWriteResult["contact"],
-  channel: { id: "ch1", status: "active" } as ContactWriteResult["channel"],
+  channel: { id: "ch1" } as ContactWriteResult["channel"],
 };
 let mirrorCallOrder = -1;
 const upsertContactChannelMock = mock(
@@ -108,6 +108,32 @@ describe("activateMemberChannel gateway-first relay", () => {
     // The local mirror ran AFTER the gateway relay.
     expect(mirrorCallOrder).toBe(1);
     expect(upsertContactChannelMock).toHaveBeenCalledTimes(1);
+
+    // The local mirror persists identity/INFO only — no ACL columns. The
+    // gateway owns status/policy/verification.
+    const mirrorArgs = upsertContactChannelMock.mock.calls[0]![0] as Record<
+      string,
+      unknown
+    >;
+    expect(mirrorArgs).toEqual({
+      sourceChannel: "telegram",
+      externalUserId: "user-1",
+      externalChatId: "chat-1",
+      displayName: "Mom",
+      username: undefined,
+      inviteId: "inv-1",
+      contactId: "target-mom",
+    });
+    for (const aclKey of [
+      "status",
+      "policy",
+      "role",
+      "verifiedAt",
+      "verifiedVia",
+    ]) {
+      expect(aclKey in mirrorArgs).toBe(false);
+    }
+
     expect(result).toEqual({
       status: "activated",
       memberId: "ch1",
@@ -115,7 +141,7 @@ describe("activateMemberChannel gateway-first relay", () => {
     });
   });
 
-  test("fails open and still mirrors locally when the gateway relay throws", async () => {
+  test("fails closed and skips the local mirror when the gateway relay throws", async () => {
     ipcThrows = true;
 
     const result = await activateMemberChannel({
@@ -126,12 +152,10 @@ describe("activateMemberChannel gateway-first relay", () => {
     });
 
     expect(ipcCalls).toHaveLength(1);
-    expect(upsertContactChannelMock).toHaveBeenCalledTimes(1);
-    expect(result).toEqual({
-      status: "activated",
-      memberId: "ch1",
-      member: localResult,
-    });
+    // Identity-only mirror would land at the schema-default unverified status, so
+    // a failed gateway write must not report success off it.
+    expect(upsertContactChannelMock).not.toHaveBeenCalled();
+    expect(result).toEqual({ status: "refused" });
   });
 
   test("returns the gateway channel id when the gateway verifies but the local mirror throws", async () => {
@@ -155,7 +179,7 @@ describe("activateMemberChannel gateway-first relay", () => {
     });
   });
 
-  test("refuses when the gateway throws AND the local mirror yields no row", async () => {
+  test("refuses when the gateway throws even if the local mirror would have thrown", async () => {
     ipcThrows = true;
     upsertContactChannelMock.mockImplementation(() => {
       throw new Error("local mirror exploded");
@@ -167,8 +191,8 @@ describe("activateMemberChannel gateway-first relay", () => {
       externalChatId: "chat-1",
     });
 
-    // No gateway channel (relay threw) and no local mirror: no stable id, so the
-    // caller maps this to a non-redeemed outcome rather than crashing.
+    // Fail-closed: a thrown gateway write refuses before the mirror is touched.
+    expect(upsertContactChannelMock).not.toHaveBeenCalled();
     expect(result).toEqual({ status: "refused" });
   });
 

package/src/contacts/contact-store.ts

@@ -1,4 +1,4 @@
-import { and, asc, desc, eq, isNotNull, like, sql } from "drizzle-orm";
+import { and, asc, desc, eq, like, sql } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import type { ChannelId } from "../channels/types.js";
@@ -96,13 +96,12 @@ function parseContact(row: typeof contacts.$inferSelect): Contact {
     id: row.id,
     displayName: row.displayName,
     notes: row.notes,
+    role: row.role,
     lastInteraction: null,
     interactionCount: 0,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
-    role: row.role as Contact["role"],
-    contactType: (row.contactType as Contact["contactType"]) ?? "human",
-    principalId: row.principalId,
+    contactType: row.contactType,
     userFile: row.userFile ?? null,
   };
 }
@@ -117,13 +116,7 @@ function parseChannel(
     address: row.address,
     isPrimary: row.isPrimary,
     externalChatId: row.externalChatId,
-    status: row.status as ContactChannel["status"],
-    policy: row.policy as ContactChannel["policy"],
-    verifiedAt: row.verifiedAt,
-    verifiedVia: row.verifiedVia,
     inviteId: row.inviteId,
-    revokedReason: row.revokedReason,
-    blockedReason: row.blockedReason,
     lastSeenAt: row.lastSeenAt,
     interactionCount: row.interactionCount,
     lastInteraction: row.lastInteraction,
@@ -145,6 +138,8 @@ function getChannelsForContact(contactId: string): ContactChannel[] {
 
 function withChannels(contact: Contact): ContactWithChannels {
   const channels = getChannelsForContact(contact.id);
+  // INFO telemetry aggregated from channel rows (not ACL): sum interaction
+  // counts, take the most recent interaction across channels.
   const interactionCount = channels.reduce(
     (sum, ch) => sum + ch.interactionCount,
     0,
@@ -225,7 +220,6 @@ export function upsertContact(params: {
   notes?: string | null;
   role?: ContactRole;
   contactType?: ContactType;
-  principalId?: string | null;
   userFile?: string | null;
   channels?: SyncChannelData[];
   /** When true, conflicting channels on other contacts are reassigned to this
@@ -260,11 +254,8 @@ export function upsertContact(params: {
         updatedAt: now,
       };
       if (params.notes !== undefined) updateSet.notes = params.notes;
-      if (params.role !== undefined) updateSet.role = params.role;
       if (params.contactType !== undefined)
         updateSet.contactType = params.contactType;
-      if (params.principalId !== undefined)
-        updateSet.principalId = params.principalId;
       if (params.userFile !== undefined) updateSet.userFile = params.userFile;
 
       db.update(contacts)
@@ -298,11 +289,8 @@ export function upsertContact(params: {
           updatedAt: now,
         };
         if (params.notes !== undefined) updateSet.notes = params.notes;
-        if (params.role !== undefined) updateSet.role = params.role;
         if (params.contactType !== undefined)
           updateSet.contactType = params.contactType;
-        if (params.principalId !== undefined)
-          updateSet.principalId = params.principalId;
         if (params.userFile !== undefined) updateSet.userFile = params.userFile;
 
         db.update(contacts)
@@ -319,35 +307,16 @@ export function upsertContact(params: {
 
   // Create new contact
   contactId = contactId ?? uuid();
-  // Sibling contacts sharing a principal_id must share a user_file so every
-  // channel for one principal resolves to the same persona + journal slug.
-  let resolvedUserFile: string | null;
-  if (params.userFile !== undefined) {
-    resolvedUserFile = params.userFile;
-  } else if (params.principalId) {
-    const sibling = db
-      .select({ userFile: contacts.userFile })
-      .from(contacts)
-      .where(
-        and(
-          eq(contacts.principalId, params.principalId),
-          isNotNull(contacts.userFile),
-        ),
-      )
-      .get();
-    resolvedUserFile =
-      sibling?.userFile ?? generateUserFileSlug(params.displayName);
-  } else {
-    resolvedUserFile = generateUserFileSlug(params.displayName);
-  }
+  const resolvedUserFile =
+    params.userFile !== undefined
+      ? params.userFile
+      : generateUserFileSlug(params.displayName);
   db.insert(contacts)
     .values({
       id: contactId,
       displayName: params.displayName,
       notes: params.notes ?? null,
-      role: params.role ?? "contact",
       contactType: params.contactType ?? "human",
-      principalId: params.principalId ?? null,
       userFile: resolvedUserFile,
       createdAt: now,
       updatedAt: now,
@@ -396,27 +365,12 @@ function syncChannels(
       .get();
 
     if (existing) {
-      // Preserve guardian blocks: if the channel is blocked, do not overwrite
-      // its status/policy — mirrors the guard in the cross-contact reassignment
-      // path so a blocked channel cannot be unblocked via a same-contact sync.
-      const isBlocked = existing.status === "blocked";
-
       const updateSet: Record<string, unknown> = {};
       // Self-heal legacy lowercased addresses to canonical form.
       if (existing.address !== ch.address) updateSet.address = ch.address;
       if (ch.isPrimary !== undefined) updateSet.isPrimary = ch.isPrimary;
       if (ch.externalChatId !== undefined)
         updateSet.externalChatId = ch.externalChatId;
-      if (!isBlocked) {
-        if (ch.status !== undefined) updateSet.status = ch.status;
-        if (ch.policy !== undefined) updateSet.policy = ch.policy;
-        if (ch.revokedReason !== undefined)
-          updateSet.revokedReason = ch.revokedReason;
-        if (ch.blockedReason !== undefined)
-          updateSet.blockedReason = ch.blockedReason;
-      }
-      if (ch.verifiedAt !== undefined) updateSet.verifiedAt = ch.verifiedAt;
-      if (ch.verifiedVia !== undefined) updateSet.verifiedVia = ch.verifiedVia;
       if (ch.inviteId !== undefined) updateSet.inviteId = ch.inviteId;
 
       if (Object.keys(updateSet).length > 0) {
@@ -434,11 +388,6 @@ function syncChannels(
 
     if (conflicting) {
       if (reassignConflicting) {
-        // Preserve guardian blocks: if the existing channel is blocked, do not
-        // overwrite its status/policy — a valid invite must not bypass an
-        // explicit guardian block on a different contact.
-        const isBlocked = conflicting.status === "blocked";
-
         // Reassign the channel to the target contact. Used by invite redemption
         // to bind a redeemer's existing channel identity to the invite's target.
         const reassignSet: Record<string, unknown> = {
@@ -447,17 +396,6 @@ function syncChannels(
         };
         if (ch.externalChatId !== undefined)
           reassignSet.externalChatId = ch.externalChatId;
-        if (!isBlocked) {
-          if (ch.status !== undefined) reassignSet.status = ch.status;
-          if (ch.policy !== undefined) reassignSet.policy = ch.policy;
-          if (ch.revokedReason !== undefined)
-            reassignSet.revokedReason = ch.revokedReason;
-          if (ch.blockedReason !== undefined)
-            reassignSet.blockedReason = ch.blockedReason;
-        }
-        if (ch.verifiedAt !== undefined) reassignSet.verifiedAt = ch.verifiedAt;
-        if (ch.verifiedVia !== undefined)
-          reassignSet.verifiedVia = ch.verifiedVia;
         if (ch.inviteId !== undefined) reassignSet.inviteId = ch.inviteId;
 
         db.update(contactChannels)
@@ -478,10 +416,6 @@ function syncChannels(
         address: ch.address,
         isPrimary: ch.isPrimary ?? false,
         externalChatId: ch.externalChatId ?? null,
-        status: ch.status ?? "unverified",
-        policy: ch.policy ?? "allow",
-        verifiedAt: ch.verifiedAt ?? null,
-        verifiedVia: ch.verifiedVia ?? null,
         inviteId: ch.inviteId ?? null,
         createdAt: now,
         updatedAt: now,
@@ -494,7 +428,6 @@ export function searchContacts(params: {
   query?: string;
   channelAddress?: string;
   channelType?: string;
-  role?: ContactRole;
   contactType?: ContactType;
   limit?: number;
 }): ContactWithChannels[] {
@@ -534,7 +467,6 @@ export function searchContacts(params: {
       const contact = getContactInternal(id);
       if (
         contact &&
-        (!params.role || contact.role === params.role) &&
         (!params.contactType || contact.contactType === params.contactType) &&
         (!sanitizedQuery ||
           (contact.displayName &&
@@ -564,7 +496,6 @@ export function searchContacts(params: {
       const contact = getContactInternal(id);
       if (
         contact &&
-        (!params.role || contact.role === params.role) &&
         (!params.contactType || contact.contactType === params.contactType)
       ) {
         results.push(contact);
@@ -577,14 +508,11 @@ export function searchContacts(params: {
   const conditions = [];
   if (params.query) {
     const sanitized = escapeLike(params.query);
-    if (!sanitized && !params.role && !params.contactType) return [];
+    if (!sanitized && !params.contactType) return [];
     if (sanitized) {
       conditions.push(like(contacts.displayName, `%${sanitized}%`));
     }
   }
-  if (params.role) {
-    conditions.push(eq(contacts.role, params.role));
-  }
   if (params.contactType) {
     conditions.push(eq(contacts.contactType, params.contactType));
   }
@@ -633,20 +561,16 @@ export function searchContacts(params: {
 
 export function listContacts(
   limit = 50,
-  role?: ContactRole,
   contactType?: ContactType,
   opts?: { uncapped?: boolean },
 ): ContactWithChannels[] {
   const db = getDb();
   const effectiveLimit = opts?.uncapped ? limit : Math.min(limit, 200);
-  const conditions = [];
-  if (role) conditions.push(eq(contacts.role, role));
-  if (contactType) conditions.push(eq(contacts.contactType, contactType));
   const rows = db
     .select()
     .from(contacts)
-    .where(conditions.length === 1 ? conditions[0] : and(...conditions))
-    .orderBy(sql`${contacts.role} = 'guardian' DESC`, desc(contacts.updatedAt))
+    .where(contactType ? eq(contacts.contactType, contactType) : undefined)
+    .orderBy(desc(contacts.updatedAt))
     .limit(effectiveLimit)
     .all();
   return rows.map((r) => withChannels(parseContact(r)));
@@ -758,7 +682,8 @@ export function findContactByAddress(
 /**
  * Find a contact by channel external chat ID. Fallback for callers that only
  * have a chat ID (no user-level address) — matches by (type, externalChatId).
- * No unique constraint exists on externalChatId, so ORDER BY is needed.
+ * No unique constraint exists on externalChatId, so ORDER BY is needed for a
+ * deterministic pick; channel ranking (status) is owned by the gateway now.
  */
 function findContactByChannelExternalChatId(
   channelType: string,
@@ -774,14 +699,7 @@ function findContactByChannelExternalChatId(
         eq(contactChannels.externalChatId, externalChatId),
       ),
     )
-    .orderBy(
-      sql`CASE ${contactChannels.status}
-        WHEN 'active' THEN 0
-        WHEN 'unverified' THEN 1
-        ELSE 2
-      END`,
-      desc(contactChannels.updatedAt),
-    )
+    .orderBy(desc(contactChannels.updatedAt), desc(contactChannels.createdAt))
     .get();
   if (!channel) return null;
   return getContactInternal(channel.contactId);
@@ -830,131 +748,10 @@ export function findContactChannel(params: {
 }
 
 /**
- * Find the guardian contact and their specific channel entry for a given channel type.
- * This is the contacts-based equivalent of getGuardianBinding(assistantId, channel).
- * Returns null if no guardian contact has a channel of the specified type.
- */
-export function findGuardianForChannel(
-  channelType: string,
-): { contact: Contact; channel: ContactChannel } | null {
-  const db = getDb();
-  const conditions = [
-    eq(contacts.role, "guardian"),
-    eq(contactChannels.type, channelType),
-    eq(contactChannels.status, "active"),
-  ];
-  const rows = db
-    .select({
-      contact: contacts,
-      channel: contactChannels,
-    })
-    .from(contacts)
-    .innerJoin(contactChannels, eq(contacts.id, contactChannels.contactId))
-    .where(and(...conditions))
-    .orderBy(desc(contactChannels.verifiedAt))
-    .limit(1)
-    .all();
-
-  if (rows.length === 0) return null;
-  const row = rows[0];
-  return {
-    contact: parseContact(row.contact),
-    channel: parseChannel(row.channel),
-  };
-}
-
-/**
- * List all active channels for guardian contacts.
- * This is the contacts-based equivalent of listActiveBindingsByAssistant(assistantId).
- * Joins contacts+channels with status='active' in a single query so we never
- * pick a guardian that has no active channels.
- * Returns channels ordered by most-recently-verified first.
- */
-export function listGuardianChannels(): {
-  contact: Contact;
-  channels: ContactChannel[];
-} | null {
-  const db = getDb();
-  const rows = db
-    .select({
-      contact: contacts,
-      channel: contactChannels,
-    })
-    .from(contacts)
-    .innerJoin(contactChannels, eq(contacts.id, contactChannels.contactId))
-    .where(
-      and(eq(contacts.role, "guardian"), eq(contactChannels.status, "active")),
-    )
-    .orderBy(desc(contactChannels.verifiedAt))
-    .all();
-
-  if (rows.length === 0) return null;
-
-  // Use the first row's contact (the guardian with the most-recently-verified
-  // active channel) and collect all active channels for that contact.
-  const guardian = parseContact(rows[0].contact);
-  const channels = rows
-    .filter((r) => r.contact.id === guardian.id)
-    .map((r) => parseChannel(r.channel));
-
-  return { contact: guardian, channels };
-}
-
-/**
- * Update a channel's access-control fields (status, policy, reasons).
- * Returns the updated channel, or null if the channel does not exist.
- */
-export function updateChannelStatus(
-  channelId: string,
-  params: {
-    status?: ChannelStatus;
-    policy?: ChannelPolicy;
-    revokedReason?: string | null;
-    blockedReason?: string | null;
-  },
-): ContactChannel | null {
-  const db = getDb();
-  const existing = db
-    .select()
-    .from(contactChannels)
-    .where(eq(contactChannels.id, channelId))
-    .get();
-
-  if (!existing) return null;
-
-  const updateSet: Record<string, unknown> = {};
-  if (params.status !== undefined) updateSet.status = params.status;
-  if (params.policy !== undefined) updateSet.policy = params.policy;
-  if (params.revokedReason !== undefined)
-    updateSet.revokedReason = params.revokedReason;
-  if (params.blockedReason !== undefined)
-    updateSet.blockedReason = params.blockedReason;
-
-  if (Object.keys(updateSet).length > 0) {
-    updateSet.updatedAt = Date.now();
-    db.update(contactChannels)
-      .set(updateSet)
-      .where(eq(contactChannels.id, channelId))
-      .run();
-
-    const updated = db
-      .select()
-      .from(contactChannels)
-      .where(eq(contactChannels.id, channelId))
-      .get();
-
-    const result = updated ? parseChannel(updated) : null;
-    emitContactChange();
-    return result;
-  }
-
-  return parseChannel(existing);
-}
-
-/**
- * Update a guardian contact's principalId and its channel's identity fields.
- * Used for healing guardian binding drift when the JWT principal no longer
- * matches the stored guardian binding after a DB reset.
+ * Heal a guardian channel's identity address when the JWT principal no longer
+ * matches the stored guardian binding after a DB reset. The principalId ACL
+ * column is gateway-owned and no longer written here; only the channel identity
+ * address is repaired.
  *
  * Returns false if the update would violate the unique (type, address)
  * constraint on contact_channels — e.g. when the incoming principal already
@@ -962,7 +759,7 @@ export function updateChannelStatus(
  * In that case the heal is skipped and trust stays `unknown`.
  */
 export function updateContactPrincipalAndChannel(
-  contactId: string,
+  _contactId: string,
   channelId: string,
   newPrincipalId: string,
 ): boolean {
@@ -983,20 +780,13 @@ export function updateContactPrincipalAndChannel(
     return false;
   }
 
-  db.transaction(() => {
-    db.update(contacts)
-      .set({ principalId: newPrincipalId, updatedAt: now })
-      .where(eq(contacts.id, contactId))
-      .run();
-
-    db.update(contactChannels)
-      .set({
-        address: newPrincipalId,
-        updatedAt: now,
-      })
-      .where(eq(contactChannels.id, channelId))
-      .run();
-  });
+  db.update(contactChannels)
+    .set({
+      address: newPrincipalId,
+      updatedAt: now,
+    })
+    .where(eq(contactChannels.id, channelId))
+    .run();
 
   emitContactChange();
   return true;