@vellumai/assistant 0.10.8 → 0.10.9-dev.202607152225.ec6fdbf

package/src/runtime/routes/inbound-stages/edit-intercept.ts

@@ -29,6 +29,7 @@ import {
   recordInbound,
 } from "../../../persistence/delivery-crud.js";
 import { enqueueLexicalIndexForMessage } from "../../../persistence/job-handlers/message-lexical.js";
+import { stringifyMessageContent } from "../../../persistence/message-content.js";
 import { safeParseRecord } from "../../../util/json.js";
 import { getLogger } from "../../../util/logger.js";
 
@@ -127,7 +128,10 @@ export async function handleEditIntercept(
     // authoritative previous text once the original row is located, so
     // this check lives after the lookup.
     const existingRow = getMessageById(original.messageId);
-    if (existingRow && existingRow.content === newContent) {
+    if (
+      existingRow &&
+      stringifyMessageContent(existingRow.content) === newContent
+    ) {
       log.debug(
         {
           assistantId,

package/src/runtime/routes/inbound-stages/guardian-activation-intercept.test.ts

@@ -60,15 +60,6 @@ mock.module("../../../notifications/emit-signal.js", () => ({
   },
 }));
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () => ({
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-  }),
-}));
-
 // Import after mocks are installed
 const { handleGuardianActivationIntercept } =
   await import("./guardian-activation-intercept.js");

package/src/runtime/routes/inbound-stages/guardian-activation-intercept.ts

@@ -99,7 +99,10 @@ export async function handleGuardianActivationIntercept(
   const guardianList = await getGuardianDeliveryFresh({
     channelTypes: [sourceChannel],
   });
-  if (guardianList === null || guardianForChannel(guardianList, sourceChannel)) {
+  if (
+    guardianList === null ||
+    guardianForChannel(guardianList, sourceChannel)
+  ) {
     return null;
   }
 

package/src/runtime/routes/inbound-stages/guardian-reply-intercept.test.ts

@@ -9,19 +9,10 @@ let mockIdentityRequests: { id: string }[] = [];
 let routeGuardianReplyCalls: unknown[] = [];
 let deliverChannelReplyCalls: unknown[][] = [];
 
-mock.module("../../../contacts/canonical-guardian-store.js", () => ({
-  listPendingCanonicalGuardianRequestsByDestinationChat: () =>
+mock.module("../../../channels/gateway-guardian-requests.js", () => ({
+  listPendingRequestsByDestinationOrEmpty: async () =>
     mockDeliveryScopedRequests,
-  listCanonicalGuardianRequests: () => mockIdentityRequests,
-}));
-
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () => ({
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-  }),
+  listGuardianRequestsOrEmpty: async () => mockIdentityRequests,
 }));
 
 mock.module("../../gateway-client.js", () => ({

package/src/runtime/routes/inbound-stages/guardian-reply-intercept.ts

@@ -1,6 +1,6 @@
 /**
- * Canonical guardian reply intercept stage: routes inbound messages from
- * guardian-class actors through the canonical decision pipeline before
+ * Guardian reply intercept stage: routes inbound messages from
+ * guardian-class actors through the guardian decision pipeline before
  * they reach the legacy approval interception or the agent loop.
  *
  * Handles deterministic callbacks (button presses), request code prefixes,
@@ -9,11 +9,11 @@
  * Extracted from inbound-message-handler.ts to keep the top-level handler
  * focused on orchestration.
  */
-import type { ChannelId } from "../../../channels/types.js";
 import {
-  listCanonicalGuardianRequests,
-  listPendingCanonicalGuardianRequestsByDestinationChat,
-} from "../../../contacts/canonical-guardian-store.js";
+  listGuardianRequestsOrEmpty,
+  listPendingRequestsByDestinationOrEmpty,
+} from "../../../channels/gateway-guardian-requests.js";
+import type { ChannelId } from "../../../channels/types.js";
 import { getLogger } from "../../../util/logger.js";
 import { deliverChannelReply } from "../../gateway-client.js";
 import {
@@ -60,7 +60,7 @@ export interface GuardianReplyInterceptResult {
 }
 
 /**
- * Route inbound guardian messages through the canonical decision pipeline.
+ * Route inbound guardian messages through the guardian decision pipeline.
  *
  * Returns a response if the message was consumed, or null to continue
  * the pipeline. Also signals whether legacy approval interception should
@@ -104,7 +104,7 @@ export async function handleGuardianReplyIntercept(
   }
 
   // Compute destination-scoped pending request hints so the router can
-  // discover canonical requests delivered to this chat even when the
+  // discover guardian requests delivered to this chat even when the
   // request lacks a guardianExternalUserId (e.g. voice-originated
   // pending_question requests).
   //
@@ -133,18 +133,20 @@ export async function handleGuardianReplyIntercept(
   const isReaction = callbackData?.startsWith("reaction:") === true;
   let pendingScope: GuardianPendingScope | undefined;
   if (!isReaction) {
+    // Hint reads degrade to empty on gateway failure: Slack then blocks the
+    // identity fallback (safe), other channels keep it (unchanged posture).
     const deliveryScopedPendingRequests =
-      listPendingCanonicalGuardianRequestsByDestinationChat(
-        sourceChannel,
-        conversationExternalId,
-      );
+      await listPendingRequestsByDestinationOrEmpty({
+        channel: sourceChannel,
+        chatId: conversationExternalId,
+      });
     if (deliveryScopedPendingRequests.length > 0) {
       const deliveryIds = new Set(
         deliveryScopedPendingRequests.map((r) => r.id),
       );
       // Also include identity-based pending requests so we don't hide them
       const identityId = canonicalSenderId ?? rawSenderId!;
-      const identityPending = listCanonicalGuardianRequests({
+      const identityPending = await listGuardianRequestsOrEmpty({
         status: "pending",
         guardianExternalUserId: identityId,
       });
@@ -199,7 +201,7 @@ export async function handleGuardianReplyIntercept(
       } catch (err) {
         log.error(
           { err, conversationExternalId },
-          "Failed to deliver canonical router reply",
+          "Failed to deliver guardian reply-router reply",
         );
       }
     }

package/src/runtime/routes/inbound-stages/reaction-intercept.test.ts

@@ -231,7 +231,10 @@ describe("reaction intercept consumes the stamped verdict directly", () => {
 
   test("contact verdict records the reaction; the decision pipeline self-gate ignores it", async () => {
     const result = await handleSlackReactionIntercept(
-      buildParams({ rawSenderId: MEMBER_USER_ID, trustVerdict: MEMBER_VERDICT }),
+      buildParams({
+        rawSenderId: MEMBER_USER_ID,
+        trustVerdict: MEMBER_VERDICT,
+      }),
     );
 
     // Dispatched with the contact class (guardian-reply-intercept self-gates
@@ -291,7 +294,10 @@ describe("reaction intercept consumes the stamped verdict directly", () => {
       }),
     );
     await handleSlackReactionIntercept(
-      buildParams({ rawSenderId: MEMBER_USER_ID, trustVerdict: MEMBER_VERDICT }),
+      buildParams({
+        rawSenderId: MEMBER_USER_ID,
+        trustVerdict: MEMBER_VERDICT,
+      }),
     );
 
     expect(ipcCalls).toEqual([]);

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -10,8 +10,8 @@
  *   - a stranger's reaction creates no conversation, binding, or transcript
  *     row — it is dropped as channel noise,
  *   - a known contact's reaction is recorded as an inline transcript signal,
- *   - a guardian's reaction on an approval card is routed through the canonical
- *     guardian decision pipeline (the same path as buttons and text replies).
+ *   - a guardian's reaction on an approval card is routed through the guardian
+ *     decision pipeline (the same path as buttons and text replies).
  *
  * The reactor's trust is read solely from the gateway-stamped verdict on
  * `sourceMetadata`; a missing/failed/contradictory verdict fails closed to
@@ -58,9 +58,13 @@ export function isSlackReactionEvent(body: {
   sourceChannel?: string;
   callbackData?: string;
 }): boolean {
-  if (body.sourceChannel !== "slack") return false;
+  if (body.sourceChannel !== "slack") {
+    return false;
+  }
   const cb = body.callbackData;
-  if (typeof cb !== "string") return false;
+  if (typeof cb !== "string") {
+    return false;
+  }
   return cb.startsWith("reaction:") || cb.startsWith("reaction_removed:");
 }
 
@@ -83,7 +87,9 @@ export function parseSlackReactionCallbackData(
   } else {
     return null;
   }
-  if (emoji.length === 0) return null;
+  if (emoji.length === 0) {
+    return null;
+  }
   return { op, emoji };
 }
 
@@ -226,7 +232,7 @@ export async function handleSlackReactionIntercept(
     });
   }
 
-  // Guardian approval-by-reaction → canonical decision pipeline, exactly like
+  // Guardian approval-by-reaction → guardian decision pipeline, exactly like
   // buttons and text replies. Only `reaction:` (added) expresses intent;
   // `reaction_removed:` never does. `handleGuardianReplyIntercept` self-gates
   // on `trustClass === "guardian"`, so a contact's reaction returns no response
@@ -318,7 +324,9 @@ async function persistSlackReactionAsMessage(params: {
   reactedMessageTs: string;
   duplicate: boolean;
 }): Promise<void> {
-  if (params.duplicate) return;
+  if (params.duplicate) {
+    return;
+  }
 
   const parsed = parseSlackReactionCallbackData(params.callbackData);
   if (!parsed) {

package/src/runtime/routes/inbound-stages/transcribe-audio.test.ts

@@ -41,15 +41,6 @@ mock.module("../../../stt/daemon-batch-transcriber.js", () => ({
   },
 }));
 
-mock.module("../../../util/logger.js", () => ({
-  getLogger: () => ({
-    debug: () => {},
-    info: () => {},
-    warn: () => {},
-    error: () => {},
-  }),
-}));
-
 // Import after mocks are installed
 const { tryTranscribeAudioAttachments } = await import("./transcribe-audio.js");
 

package/src/runtime/routes/index.ts

@@ -13,6 +13,7 @@ import { ROUTES as MEMORY_GRAPH_ROUTES } from "../../plugins/defaults/memory/rou
 import { ROUTES as MEMORY_ITEM_ROUTES } from "../../plugins/defaults/memory/routes/memory-item-routes.js";
 import { ROUTES as MEMORY_V2_ROUTES } from "../../plugins/defaults/memory/routes/memory-v2-routes.js";
 import { ROUTES as MEMORY_V3_ROUTES } from "../../plugins/defaults/memory/routes/memory-v3-routes.js";
+import { ROUTES as MEMORY_WORKER_ROUTES } from "../../plugins/defaults/memory/routes/memory-worker-routes.js";
 import { ROUTES as ACP_ROUTES } from "./acp-routes.js";
 import { ROUTES as APP_MANAGEMENT_ROUTES } from "./app-management-routes.js";
 import { ROUTES as APP_ROUTES } from "./app-routes.js";
@@ -67,6 +68,7 @@ import { ROUTES as EMAIL_ROUTES } from "./email-routes.js";
 import { ROUTES as EVENTS_ROUTES } from "./events-routes.js";
 import { ROUTES as FILING_ROUTES } from "./filing-routes.js";
 import { ROUTES as GATEWAY_LOG_ROUTES } from "./gateway-log-routes.js";
+import { ROUTES as GATEWAY_STATUS_ROUTES } from "./gateway-status-routes.js";
 import { ROUTES as GLOBAL_SEARCH_ROUTES } from "./global-search-routes.js";
 import { ROUTES as GROUP_ROUTES } from "./group-routes.js";
 import { ROUTES as GUARDIAN_ACTION_ROUTES } from "./guardian-action-routes.js";
@@ -101,7 +103,6 @@ import { ROUTES as INTERNAL_TWILIO_ROUTES } from "./internal-twilio-routes.js";
 import { ROUTES as LLM_CALL_SITES_ROUTES } from "./llm-call-sites-routes.js";
 import { ROUTES as LOG_EXPORT_ROUTES } from "./log-export-routes.js";
 import { ROUTES as MCP_AUTH_ROUTES } from "./mcp-auth-routes.js";
-import { ROUTES as MEMORY_WORKER_ROUTES } from "./memory-worker-routes.js";
 import { ROUTES as MESSAGES_LEXICAL_ROUTES } from "./messages-lexical-routes.js";
 import { ROUTES as MIGRATION_ROLLBACK_ROUTES } from "./migration-rollback-routes.js";
 import { ROUTES as MIGRATION_ROUTES } from "./migration-routes.js";
@@ -137,13 +138,13 @@ import { ROUTES as SUBAGENT_ROUTES } from "./subagents-routes.js";
 import { ROUTES as SUGGEST_TRUST_RULE_ROUTES } from "./suggest-trust-rule-routes.js";
 import { ROUTES as SURFACE_ACTION_ROUTES } from "./surface-action-routes.js";
 import { ROUTES as SURFACE_CONTENT_ROUTES } from "./surface-content-routes.js";
-import { ROUTES as TASK_ROUTES } from "./task-routes.js";
 import { ROUTES as TELEMETRY_ROUTES } from "./telemetry-routes.js";
 import { ROUTES as THEME_ROUTES } from "./theme-routes.js";
 import { ROUTES as TRUST_RULES_ROUTES } from "./trust-rules-routes.js";
 import { ROUTES as TTS_ROUTES } from "./tts-routes.js";
 import type { RouteDefinition } from "./types.js";
 import { ROUTES as UI_REQUEST_ROUTES } from "./ui-request-routes.js";
+import { ROUTES as UI_SNAPSHOT_ROUTES } from "./ui-snapshot-routes.js";
 import { ROUTES as UPGRADE_BROADCAST_ROUTES } from "./upgrade-broadcast-routes.js";
 import { ROUTES as USAGE_ROUTES } from "./usage-routes.js";
 import { ROUTES as USER_ROUTES } from "./user-routes.js";
@@ -151,7 +152,6 @@ import { ROUTES as USER_ROUTES_CLI } from "./user-routes-cli.js";
 import { ROUTES as WAKE_CONVERSATION_ROUTES } from "./wake-conversation-routes.js";
 import { ROUTES as WATCHER_ROUTES } from "./watcher-routes.js";
 import { ROUTES as WEBHOOK_ROUTES } from "./webhook-routes.js";
-import { ROUTES as WORK_ITEM_ROUTES } from "./work-items-routes.js";
 import { ROUTES as WORKFLOW_ROUTES } from "./workflow-routes.js";
 import { ROUTES as WORKSPACE_COMMIT_ROUTES } from "./workspace-commit-routes.js";
 import { ROUTES as WORKSPACE_ROUTES } from "./workspace-routes.js";
@@ -211,6 +211,7 @@ export const ROUTES: RouteDefinition[] = [
   ...EVENTS_ROUTES,
   ...FILING_ROUTES,
   ...GATEWAY_LOG_ROUTES,
+  ...GATEWAY_STATUS_ROUTES,
   ...GLOBAL_SEARCH_ROUTES,
   ...GROUP_ROUTES,
   ...GUARDIAN_ACTION_ROUTES,
@@ -284,16 +285,15 @@ export const ROUTES: RouteDefinition[] = [
   ...SURFACE_CONTENT_ROUTES,
   ...TELEGRAM_ROUTES,
   ...TWILIO_ROUTES,
-  ...TASK_ROUTES,
   ...TELEMETRY_ROUTES,
   ...THEME_ROUTES,
   ...TRUST_RULES_ROUTES,
   ...TTS_ROUTES,
   ...UI_REQUEST_ROUTES,
+  ...UI_SNAPSHOT_ROUTES,
   ...UPGRADE_BROADCAST_ROUTES,
   ...USAGE_ROUTES,
   ...VERCEL_ROUTES,
-  ...WORK_ITEM_ROUTES,
   ...WORKFLOW_ROUTES,
   ...WATCHER_ROUTES,
   ...WEBHOOK_ROUTES,

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -19,10 +19,12 @@ import { getIsPlatform } from "../../config/env-registry.js";
 import { getConfigReadOnly } from "../../config/loader.js";
 import { getDb } from "../../persistence/db-connection.js";
 import {
+  type Auth,
   AuthSchema,
   type ConnectionModel,
   ConnectionModelSchema,
   ConnectionProviderSchema,
+  deriveAuthForProvider,
   ProviderConnectionSchema,
   PROVIDERS_REQUIRING_BASE_URL_AND_MODELS,
   VALID_CONNECTION_PROVIDERS,
@@ -104,7 +106,9 @@ async function parseCustomProviderFields(
           throw new BadRequestError(`Invalid base_url: must be an http(s) URL`);
         }
       } catch (err) {
-        if (err instanceof BadRequestError) throw err;
+        if (err instanceof BadRequestError) {
+          throw err;
+        }
         throw new BadRequestError(
           `Invalid base_url: must be a valid http(s) URL`,
         );
@@ -159,6 +163,28 @@ async function parseCustomProviderFields(
   return out;
 }
 
+/**
+ * Derive the auth object for a body that omits `auth`, from the provider and
+ * the optional top-level `credential` field. Throws the 400s for the cases
+ * the derivation can't express: a malformed credential, or a provider that
+ * needs an API key when none was supplied.
+ */
+function deriveConnectionAuth(provider: string, credential: unknown): Auth {
+  if (
+    credential !== undefined &&
+    (typeof credential !== "string" || credential.length === 0)
+  ) {
+    throw new BadRequestError("credential must be a non-empty string");
+  }
+  const derived = deriveAuthForProvider(provider, credential);
+  if (!derived) {
+    throw new BadRequestError(
+      `Provider "${provider}" requires an API key. Pass "credential" (a vault credential key) or an explicit "auth" object.`,
+    );
+  }
+  return derived;
+}
+
 // ---------------------------------------------------------------------------
 // Handlers
 // ---------------------------------------------------------------------------
@@ -174,10 +200,14 @@ function handleListConnections({ queryParams = {} }: RouteHandlerArgs) {
 
 function handleGetConnection({ pathParams = {} }: RouteHandlerArgs) {
   const { name } = pathParams;
-  if (!name) throw new BadRequestError("name is required");
+  if (!name) {
+    throw new BadRequestError("name is required");
+  }
 
   const conn = getConnection(getDb(), name);
-  if (!conn) throw new NotFoundError(`Connection "${name}" not found.`);
+  if (!conn) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
 
   return conn;
 }
@@ -197,7 +227,9 @@ async function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Invalid provider "${String(provider)}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
     );
   }
-  const authResult = AuthSchema.safeParse(auth);
+  const authResult = AuthSchema.safeParse(
+    auth ?? deriveConnectionAuth(providerResult.data, body.credential),
+  );
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
@@ -258,12 +290,36 @@ async function handleUpdateConnection({
   body = {},
 }: RouteHandlerArgs) {
   const { name } = pathParams;
-  if (!name) throw new BadRequestError("name is required");
+  if (!name) {
+    throw new BadRequestError("name is required");
+  }
 
   const existing = getConnection(getDb(), name);
-  if (!existing) throw new NotFoundError(`Connection "${name}" not found.`);
+  if (!existing) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
 
-  const auth = body.auth;
+  // `auth` is optional: an explicit object wins; a bare `credential` rotates
+  // the key by re-deriving from the provider; omitting both leaves the stored
+  // auth untouched (so label-only edits never disturb e.g. an
+  // oauth_subscription connection).
+  if (
+    body.auth === undefined &&
+    body.credential !== undefined &&
+    existing.auth.type === "oauth_subscription"
+  ) {
+    // Derivation would silently flip the auth type to api_key. Rotating a
+    // subscription token goes through the ChatGPT sign-in routes; switching
+    // to key auth requires an explicit `auth` object.
+    throw new BadRequestError(
+      `Connection "${name}" uses subscription auth, which "credential" cannot rotate. Re-run the ChatGPT sign-in flow, or pass an explicit "auth" object to switch auth types.`,
+    );
+  }
+  const auth =
+    body.auth ??
+    (body.credential !== undefined
+      ? deriveConnectionAuth(existing.provider, body.credential)
+      : existing.auth);
   const authResult = AuthSchema.safeParse(auth);
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
@@ -323,9 +379,11 @@ async function handleUpdateConnection({
 
 function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   const { name } = pathParams;
-  if (!name) throw new BadRequestError("name is required");
+  if (!name) {
+    throw new BadRequestError("name is required");
+  }
 
-  // Existence check first so a stale `llm.default.provider_connection`
+  // Existence check first so a stale profile `provider_connection`
   // reference to a missing connection returns 404 (not 409).
   const existing = getConnection(getDb(), name);
   if (!existing) {
@@ -345,17 +403,6 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
 
   const config = getConfigReadOnly();
 
-  // llm.default carries provider_connection (LLMConfigBase).
-  if (
-    (config.llm?.default as Record<string, unknown> | undefined)
-      ?.provider_connection === name
-  ) {
-    throw new ConflictError(
-      `Connection "${name}" is referenced by llm.default. Update llm.default.provider_connection before deleting.`,
-      { referencedBy: ["llm.default"] },
-    );
-  }
-
   // llm.defaultProvider: guards both the resolved connection name (explicit
   // `connectionName` or the `<provider>-personal` convention) and the case
   // where the convention name is dangling but this is the last remaining
@@ -471,12 +518,13 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Create a provider connection",
     description:
-      "Create a new named provider connection. Fails with 409 if a connection with this name already exists.",
+      "Create a new named provider connection. When auth is omitted it is derived from the provider (keyless providers get none, vellum gets platform, everything else needs credential for api_key auth). Fails with 409 if a connection with this name already exists.",
     tags: ["inference"],
     requestBody: z.object({
       name: z.string().min(1),
       provider: ConnectionProviderSchema,
-      auth: AuthSchema,
+      auth: AuthSchema.optional(),
+      credential: z.string().min(1).optional(),
       label: z.string().min(1).optional(),
       base_url: z.string().url().nullable().optional(),
       models: z.array(ConnectionModelSchema).nullable().optional(),
@@ -499,11 +547,12 @@ export const ROUTES: RouteDefinition[] = [
     },
     summary: "Update a provider connection",
     description:
-      "Update an existing connection. Cannot rename or change the provider. For the Vellum-managed connection (vellum) the auth is locked to platform; label remains editable.",
+      "Update an existing connection. Cannot rename or change the provider. Omitting auth keeps the stored auth; passing credential alone rotates the key via provider-derived api_key auth. For the Vellum-managed connection (vellum) the auth is locked to platform; label remains editable.",
     tags: ["inference"],
     pathParams: [{ name: "name", description: "Connection name" }],
     requestBody: z.object({
-      auth: AuthSchema,
+      auth: AuthSchema.optional(),
+      credential: z.string().min(1).optional(),
       label: z.string().min(1).nullable().optional(),
       base_url: z.string().url().nullable().optional(),
       models: z.array(ConnectionModelSchema).nullable().optional(),

package/src/runtime/routes/inference-send-routes.ts

@@ -53,7 +53,7 @@ async function handleInferenceSend({ body = {} }: RouteHandlerArgs) {
   });
   if (!provider) {
     throw new BadRequestError(
-      "No LLM provider is configured. Run 'assistant config set llm.default.provider <provider>' to set one up.",
+      "No LLM provider is configured. Connect a provider (assistant credentials) or set llm.defaultProvider to choose one.",
     );
   }
 

package/src/runtime/routes/internal-telemetry-routes.ts

@@ -16,6 +16,7 @@
 
 import { z } from "zod";
 
+import { getCachedShareAnalytics } from "../../platform/consent-cache.js";
 import {
   type AuthFallbackCount,
   recordAuthFallbackCounts,
@@ -23,7 +24,7 @@ import {
 import { emitWatchdogEventDirect } from "../../telemetry/watchdog-direct-emit.js";
 import { getLogger } from "../../util/logger.js";
 import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
-import { BadRequestError } from "./errors.js";
+import { BadRequestError, ServiceUnavailableError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 const log = getLogger("internal-telemetry-routes");
@@ -60,7 +61,15 @@ function handleRecordAuthFallback({ body }: RouteHandlerArgs) {
 
   const recorded = recordAuthFallbackCounts(window_start, window_end, mapped);
   if (recorded === 0) {
-    // share_analytics consent off — counts dropped to honor the opt-out.
+    if (getCachedShareAnalytics()) {
+      // Consent is on but nothing was recorded (the body guarantees counts),
+      // so the telemetry DB is unavailable. Fail so the gateway's reporter
+      // merges the batch back and retries next flush instead of losing it.
+      throw new ServiceUnavailableError(
+        "Telemetry database unavailable; retry the auth-fallback batch",
+      );
+    }
+    // share_analytics consent is off: drop the counts to honor the opt-out.
     return { skipped: true };
   }
   log.debug({ recorded }, "Recorded auth-fallback counts");

package/src/runtime/routes/oauth-connect-routes.ts

@@ -128,9 +128,18 @@ async function handleOAuthConnectStart({
       onDeferredComplete: (r) => {
         if (!resolvedState) return;
         if (r.success) {
-          setOAuthConnectComplete(resolvedState, r.service, r.accountInfo, r.grantedScopes);
+          setOAuthConnectComplete(
+            resolvedState,
+            r.service,
+            r.accountInfo,
+            r.grantedScopes,
+          );
         } else {
-          setOAuthConnectError(resolvedState, r.service, r.error ?? "OAuth connect failed");
+          setOAuthConnectError(
+            resolvedState,
+            r.service,
+            r.error ?? "OAuth connect failed",
+          );
         }
       },
     });
@@ -166,19 +175,28 @@ function handleOAuthConnectStatus({
   const flowState = getOAuthConnectState(state);
 
   if (flowState === null) {
-    throw new NotFoundError(`No active OAuth connect flow for state "${state}"`);
+    throw new NotFoundError(
+      `No active OAuth connect flow for state "${state}"`,
+    );
   }
 
-  if (flowState.status === "pending") return { status: "pending", service: flowState.service };
+  if (flowState.status === "pending")
+    return { status: "pending", service: flowState.service };
   if (flowState.status === "complete") {
     return {
       status: "complete",
       service: flowState.service,
       ...(flowState.accountInfo ? { account_info: flowState.accountInfo } : {}),
-      ...(flowState.grantedScopes ? { granted_scopes: flowState.grantedScopes } : {}),
+      ...(flowState.grantedScopes
+        ? { granted_scopes: flowState.grantedScopes }
+        : {}),
     };
   }
-  return { status: "error", service: flowState.service, error: flowState.error };
+  return {
+    status: "error",
+    service: flowState.service,
+    error: flowState.error,
+  };
 }
 
 export const ROUTES: RouteDefinition[] = [
@@ -217,7 +235,9 @@ export const ROUTES: RouteDefinition[] = [
     tags: ["internal"],
     pathParams: [{ name: "state" }],
     additionalResponses: {
-      "404": { description: "No active OAuth connect flow for the given state token" },
+      "404": {
+        description: "No active OAuth connect flow for the given state token",
+      },
     },
     handler: handleOAuthConnectStatus,
   },