@vellumai/assistant 0.4.26 → 0.4.30

package/src/runtime/{ingress-service.ts → invite-service.ts}

@@ -1,39 +1,34 @@
 /**
- * Shared business logic for ingress member and invite management.
+ * Shared business logic for invite management.
  *
  * Extracted from the IPC handlers in daemon/handlers/config-inbox.ts so that
  * both the HTTP routes and the IPC handlers call the same logic.
+ *
+ * Member/contact operations have been migrated to the /v1/contacts and
+ * /v1/contacts/channels endpoints.
  */
 
-import { isChannelId } from '../channels/types.js';
+import { isChannelId } from "../channels/types.js";
 import {
   createInvite,
+  findByTokenHash,
+  hashToken,
   type IngressInvite,
   type InviteStatus,
   listInvites,
-  redeemInvite,
   revokeInvite,
-} from '../memory/ingress-invite-store.js';
-import {
-  blockMember,
-  type IngressMember,
-  listMembers,
-  type MemberPolicy,
-  type MemberStatus,
-  revokeMember,
-  upsertMember,
-} from '../memory/ingress-member-store.js';
-import { isValidE164 } from '../util/phone.js';
-import { generateVoiceCode, hashVoiceCode } from '../util/voice-code.js';
-import { getTransport } from './channel-invite-transport.js';
+} from "../memory/invite-store.js";
+import { isValidE164 } from "../util/phone.js";
+import { generateVoiceCode, hashVoiceCode } from "../util/voice-code.js";
+import { getTransport } from "./channel-invite-transport.js";
 import {
   type InviteRedemptionOutcome,
   redeemInvite as redeemInviteTyped,
   redeemVoiceInviteCode as redeemVoiceInviteCodeTyped,
   type VoiceRedemptionOutcome,
-} from './invite-redemption-service.js';
+} from "./invite-redemption-service.js";
 
-import './channel-invite-transports/telegram.js';
+import "./channel-invite-transports/telegram.js";
 
 // ---------------------------------------------------------------------------
 // Response shapes — used by both HTTP routes and IPC handlers
@@ -62,24 +57,14 @@ export interface InviteResponseData {
   createdAt: number;
 }
 
-export interface MemberResponseData {
-  id: string;
-  sourceChannel: string;
-  externalUserId?: string;
-  externalChatId?: string;
-  displayName?: string;
-  username?: string;
-  status: string;
-  policy: string;
-  lastSeenAt?: number;
-  createdAt: number;
-}
-
 // ---------------------------------------------------------------------------
 // Mappers
 // ---------------------------------------------------------------------------
 
-function buildSharePayload(sourceChannel: string, rawToken?: string): InviteResponseData['share'] | undefined {
+function buildSharePayload(
+  sourceChannel: string,
+  rawToken?: string,
+): InviteResponseData["share"] | undefined {
   if (!rawToken || !isChannelId(sourceChannel)) return undefined;
   const transport = getTransport(sourceChannel);
   if (!transport?.buildShareableInvite) return undefined;
@@ -96,7 +81,10 @@ function buildSharePayload(sourceChannel: string, rawToken?: string): InviteResp
   }
 }
 
-function inviteToResponse(inv: IngressInvite, opts?: { rawToken?: string; voiceCode?: string }): InviteResponseData {
+function inviteToResponse(
+  inv: IngressInvite,
+  opts?: { rawToken?: string; voiceCode?: string },
+): InviteResponseData {
   const share = buildSharePayload(inv.sourceChannel, opts?.rawToken);
   return {
     id: inv.id,
@@ -109,30 +97,19 @@ function inviteToResponse(inv: IngressInvite, opts?: { rawToken?: string; voiceC
     expiresAt: inv.expiresAt,
     status: inv.status,
     note: inv.note ?? undefined,
-    ...(inv.expectedExternalUserId ? { expectedExternalUserId: inv.expectedExternalUserId } : {}),
+    ...(inv.expectedExternalUserId
+      ? { expectedExternalUserId: inv.expectedExternalUserId }
+      : {}),
     ...(opts?.voiceCode ? { voiceCode: opts.voiceCode } : {}),
-    ...(inv.voiceCodeDigits != null ? { voiceCodeDigits: inv.voiceCodeDigits } : {}),
+    ...(inv.voiceCodeDigits != null
+      ? { voiceCodeDigits: inv.voiceCodeDigits }
+      : {}),
     ...(inv.friendName ? { friendName: inv.friendName } : {}),
     ...(inv.guardianName ? { guardianName: inv.guardianName } : {}),
     createdAt: inv.createdAt,
   };
 }
 
-export function memberToResponse(m: IngressMember): MemberResponseData {
-  return {
-    id: m.id,
-    sourceChannel: m.sourceChannel,
-    externalUserId: m.externalUserId ?? undefined,
-    externalChatId: m.externalChatId ?? undefined,
-    displayName: m.displayName ?? undefined,
-    username: m.username ?? undefined,
-    status: m.status,
-    policy: m.policy,
-    lastSeenAt: m.lastSeenAt ?? undefined,
-    createdAt: m.createdAt,
-  };
-}
-
 // ---------------------------------------------------------------------------
 // Result types
 // ---------------------------------------------------------------------------
@@ -157,7 +134,7 @@ export function createIngressInvite(params: {
   guardianName?: string;
 }): IngressResult<InviteResponseData> {
   if (!params.sourceChannel) {
-    return { ok: false, error: 'sourceChannel is required for create' };
+    return { ok: false, error: "sourceChannel is required for create" };
   }
 
   // For voice invites: generate a one-time numeric code, hash it, and pass
@@ -165,20 +142,30 @@ export function createIngressInvite(params: {
   // exactly once and never stored.
   let voiceCode: string | undefined;
   let voiceCodeHash: string | undefined;
-  const isVoice = params.sourceChannel === 'voice';
+  const isVoice = params.sourceChannel === "voice";
 
   if (isVoice) {
     if (!params.expectedExternalUserId) {
-      return { ok: false, error: 'expectedExternalUserId is required for voice invites' };
+      return {
+        ok: false,
+        error: "expectedExternalUserId is required for voice invites",
+      };
     }
     if (!isValidE164(params.expectedExternalUserId)) {
-      return { ok: false, error: 'expectedExternalUserId must be in E.164 format (e.g., +15551234567)' };
+      return {
+        ok: false,
+        error:
+          "expectedExternalUserId must be in E.164 format (e.g., +15551234567)",
+      };
     }
-    if (typeof params.friendName !== 'string' || !params.friendName.trim()) {
-      return { ok: false, error: 'friendName is required for voice invites' };
+    if (typeof params.friendName !== "string" || !params.friendName.trim()) {
+      return { ok: false, error: "friendName is required for voice invites" };
     }
-    if (typeof params.guardianName !== 'string' || !params.guardianName.trim()) {
-      return { ok: false, error: 'guardianName is required for voice invites' };
+    if (
+      typeof params.guardianName !== "string" ||
+      !params.guardianName.trim()
+    ) {
+      return { ok: false, error: "guardianName is required for voice invites" };
     }
     voiceCode = generateVoiceCode(6);
     voiceCodeHash = hashVoiceCode(voiceCode);
@@ -189,17 +176,25 @@ export function createIngressInvite(params: {
     note: params.note,
     maxUses: params.maxUses,
     expiresInMs: params.expiresInMs,
-    ...(isVoice ? {
-      expectedExternalUserId: params.expectedExternalUserId,
-      voiceCodeHash,
-      voiceCodeDigits: 6,
-      friendName: params.friendName,
-      guardianName: params.guardianName,
-    } : {}),
+    ...(isVoice
+      ? {
+          expectedExternalUserId: params.expectedExternalUserId,
+          voiceCodeHash,
+          voiceCodeDigits: 6,
+          friendName: params.friendName,
+          guardianName: params.guardianName,
+        }
+      : {}),
   });
   // Voice invites must not expose the token — callers must redeem via the
   // identity-bound voice code flow, not the generic token redemption path.
-  return { ok: true, data: inviteToResponse(invite, { rawToken: isVoice ? undefined : rawToken, voiceCode }) };
+  return {
+    ok: true,
+    data: inviteToResponse(invite, {
+      rawToken: isVoice ? undefined : rawToken,
+      voiceCode,
+    }),
+  };
 }
 
 export function listIngressInvites(params: {
@@ -216,13 +211,15 @@ export function listIngressInvites(params: {
   };
 }
 
-export function revokeIngressInvite(inviteId?: string): IngressResult<InviteResponseData> {
+export function revokeIngressInvite(
+  inviteId?: string,
+): IngressResult<InviteResponseData> {
   if (!inviteId) {
-    return { ok: false, error: 'inviteId is required for revoke' };
+    return { ok: false, error: "inviteId is required for revoke" };
   }
   const revoked = revokeInvite(inviteId);
   if (!revoked) {
-    return { ok: false, error: 'Invite not found or already revoked' };
+    return { ok: false, error: "Invite not found or already revoked" };
   }
   return { ok: true, data: inviteToResponse(revoked) };
 }
@@ -234,26 +231,43 @@ export function redeemIngressInvite(params: {
   sourceChannel?: string;
 }): IngressResult<InviteResponseData> {
   if (!params.token) {
-    return { ok: false, error: 'token is required for redeem' };
+    return { ok: false, error: "token is required for redeem" };
+  }
+  if (!params.sourceChannel) {
+    return { ok: false, error: "sourceChannel is required for redeem" };
   }
-  const result = redeemInvite({
+  const outcome = redeemInviteTyped({
     rawToken: params.token,
+    sourceChannel: params.sourceChannel,
     externalUserId: params.externalUserId,
     externalChatId: params.externalChatId,
-    sourceChannel: params.sourceChannel,
   });
-  if ('error' in result) {
-    return { ok: false, error: result.error };
+  if (!outcome.ok) {
+    return { ok: false, error: outcome.reason };
+  }
+  // For already_member, look up the invite by token hash to build the response
+  if (outcome.type === "already_member") {
+    const inv = findByTokenHash(hashToken(params.token));
+    if (!inv) {
+      return { ok: false, error: "Invite not found after redemption" };
+    }
+    return { ok: true, data: inviteToResponse(inv) };
+  }
+  // Look up the invite by token hash — same approach as the already_member path
+  // above. Using findByTokenHash avoids the pagination limit of listInvites.
+  const inv = findByTokenHash(hashToken(params.token));
+  if (!inv) {
+    return { ok: false, error: "Invite not found after redemption" };
   }
-  return { ok: true, data: inviteToResponse(result.invite) };
+  return { ok: true, data: inviteToResponse(inv) };
 }
 
 // ---------------------------------------------------------------------------
 // Typed invite redemption — preferred entry point for new callers
 // ---------------------------------------------------------------------------
 
-export { type InviteRedemptionOutcome } from './invite-redemption-service.js';
-export { type VoiceRedemptionOutcome } from './invite-redemption-service.js';
+export { type InviteRedemptionOutcome } from "./invite-redemption-service.js";
+export { type VoiceRedemptionOutcome } from "./invite-redemption-service.js";
 
 export function redeemIngressInviteTyped(params: {
   rawToken: string;
@@ -270,81 +284,8 @@ export function redeemIngressInviteTyped(params: {
 export function redeemVoiceInviteCode(params: {
   assistantId?: string;
   callerExternalUserId: string;
-  sourceChannel: 'voice';
+  sourceChannel: "voice";
   code: string;
 }): VoiceRedemptionOutcome {
   return redeemVoiceInviteCodeTyped(params);
 }
-
-// ---------------------------------------------------------------------------
-// Member operations
-// ---------------------------------------------------------------------------
-
-export function listIngressMembers(params: {
-  assistantId?: string;
-  sourceChannel?: string;
-  status?: string;
-  policy?: string;
-}): IngressResult<MemberResponseData[]> {
-  const members = listMembers({
-    assistantId: params.assistantId,
-    sourceChannel: params.sourceChannel,
-    status: params.status as MemberStatus | undefined,
-    policy: params.policy as MemberPolicy | undefined,
-  });
-  return {
-    ok: true,
-    data: members.map(memberToResponse),
-  };
-}
-
-export function upsertIngressMember(params: {
-  sourceChannel?: string;
-  externalUserId?: string;
-  externalChatId?: string;
-  displayName?: string;
-  username?: string;
-  policy?: string;
-  status?: string;
-  assistantId?: string;
-}): IngressResult<MemberResponseData> {
-  if (!params.sourceChannel) {
-    return { ok: false, error: 'sourceChannel is required for upsert' };
-  }
-  if (!params.externalUserId && !params.externalChatId) {
-    return { ok: false, error: 'At least one of externalUserId or externalChatId is required for upsert' };
-  }
-  const member = upsertMember({
-    assistantId: params.assistantId,
-    sourceChannel: params.sourceChannel,
-    externalUserId: params.externalUserId,
-    externalChatId: params.externalChatId,
-    displayName: params.displayName,
-    username: params.username,
-    policy: params.policy as MemberPolicy | undefined,
-    status: params.status as MemberStatus | undefined,
-  });
-  return { ok: true, data: memberToResponse(member) };
-}
-
-export function revokeIngressMember(memberId?: string, reason?: string): IngressResult<MemberResponseData> {
-  if (!memberId) {
-    return { ok: false, error: 'memberId is required for revoke' };
-  }
-  const revoked = revokeMember(memberId, reason);
-  if (!revoked) {
-    return { ok: false, error: 'Member not found or cannot be revoked' };
-  }
-  return { ok: true, data: memberToResponse(revoked) };
-}
-
-export function blockIngressMember(memberId?: string, reason?: string): IngressResult<MemberResponseData> {
-  if (!memberId) {
-    return { ok: false, error: 'memberId is required for block' };
-  }
-  const blocked = blockMember(memberId, reason);
-  if (!blocked) {
-    return { ok: false, error: 'Member not found or already blocked' };
-  }
-  return { ok: true, data: memberToResponse(blocked) };
-}

package/src/runtime/local-actor-identity.ts

@@ -6,28 +6,28 @@
  * deterministic local actor identity server-side by looking up the vellum
  * channel guardian binding.
  *
- * This routes IPC connections through the same `resolveGuardianContext`
+ * This routes IPC connections through the same `resolveTrustContext`
  * pathway used by HTTP channel ingress, producing equivalent
  * guardian-context behavior for the vellum channel.
  */
 
-import type { ChannelId } from '../channels/types.js';
-import { buildIpcAuthContext } from '../daemon/ipc-handler.js';
-import type { GuardianRuntimeContext } from '../daemon/session-runtime-assembly.js';
-import { getActiveBinding } from '../memory/guardian-bindings.js';
-import { getLogger } from '../util/logger.js';
-import { DAEMON_INTERNAL_ASSISTANT_ID } from './assistant-scope.js';
-import type { AuthContext } from './auth/types.js';
-import { resolveGuardianContext } from './guardian-context-resolver.js';
-import { ensureVellumGuardianBinding } from './guardian-vellum-migration.js';
+import type { ChannelId } from "../channels/types.js";
+import { findGuardianForChannel } from "../contacts/contact-store.js";
+import { buildIpcAuthContext } from "../daemon/ipc-handler.js";
+import type { TrustContext } from "../daemon/session-runtime-assembly.js";
+import { getLogger } from "../util/logger.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "./assistant-scope.js";
+import type { AuthContext } from "./auth/types.js";
+import { ensureVellumGuardianBinding } from "./guardian-vellum-migration.js";
+import { resolveTrustContext } from "./trust-context-resolver.js";
 
-const log = getLogger('local-actor-identity');
+const log = getLogger("local-actor-identity");
 
 /**
  * Resolve the guardian runtime context for a local IPC connection.
  *
  * Looks up the vellum guardian binding to obtain the `guardianPrincipalId`,
- * then passes it as the sender identity through `resolveGuardianContext` --
+ * then passes it as the sender identity through `resolveTrustContext` --
  * the same pathway HTTP channel routes use. This ensures IPC and HTTP
  * produce equivalent trust classification for the vellum channel.
  *
@@ -35,50 +35,49 @@ const log = getLogger('local-actor-identity');
  * bootstrap), falls back to a minimal guardian context so the local
  * user is not incorrectly denied.
  */
-export function resolveLocalIpcGuardianContext(
-  sourceChannel: ChannelId = 'vellum',
-): GuardianRuntimeContext {
+export function resolveLocalIpcTrustContext(
+  sourceChannel: ChannelId = "vellum",
+): TrustContext {
   const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
-  const binding = getActiveBinding(assistantId, 'vellum');
 
-  if (!binding) {
-    // No vellum binding yet (pre-bootstrap). Eagerly create one so
-    // downstream code that creates decisionable canonical requests
-    // (tool_approval, pending_question) always has a guardianPrincipalId
-    // available. Without this, createCanonicalGuardianRequest throws
-    // IntegrityError and the request is silently dropped.
-    log.debug('No vellum guardian binding found; bootstrapping binding for IPC');
-    const principalId = ensureVellumGuardianBinding(assistantId);
+  // Try contacts-first for the vellum guardian channel
+  const guardianResult = findGuardianForChannel("vellum", assistantId);
+  if (guardianResult && guardianResult.contact.principalId) {
+    const guardianPrincipalId = guardianResult.contact.principalId;
+    const trustCtx = resolveTrustContext({
+      assistantId,
+      sourceChannel: "vellum",
+      conversationExternalId: "local",
+      actorExternalId: guardianPrincipalId,
+    });
+    return { ...trustCtx, sourceChannel };
+  }
 
-    // Re-resolve through the shared pipeline now that the binding exists.
-    const guardianCtx = resolveGuardianContext({
+  // No guardian contact with a principalId — bootstrap via ensureVellumGuardianBinding
+  // to self-heal (creates the binding + contact if missing).
+  log.debug("No vellum guardian contact found; bootstrapping binding for IPC");
+  try {
+    const principalId = ensureVellumGuardianBinding(assistantId);
+    const trustCtx = resolveTrustContext({
       assistantId,
-      sourceChannel: 'vellum',
-      conversationExternalId: 'local',
+      sourceChannel: "vellum",
+      conversationExternalId: "local",
       actorExternalId: principalId,
     });
-    // Overlay the caller's actual sourceChannel onto the resolved context.
-    return { ...guardianCtx, sourceChannel };
+    return { ...trustCtx, sourceChannel };
+  } catch (err) {
+    log.warn(
+      { err },
+      "Self-heal ensureVellumGuardianBinding failed — falling back to minimal trust context",
+    );
+    const trustCtx = resolveTrustContext({
+      assistantId,
+      sourceChannel: "vellum",
+      conversationExternalId: "local",
+      actorExternalId: "local",
+    });
+    return { ...trustCtx, sourceChannel };
   }
-
-  const guardianPrincipalId = binding.guardianExternalUserId;
-
-  // Route through the shared trust resolution pipeline using 'vellum'
-  // as the channel for binding lookup. The guardianPrincipalId comes
-  // from the vellum binding, so the binding lookup must also target
-  // 'vellum' — otherwise resolveActorTrust would look up a different
-  // channel's binding (e.g. telegram/sms) and the IDs wouldn't match,
-  // causing a 'unknown' trust classification.
-  const guardianCtx = resolveGuardianContext({
-    assistantId,
-    sourceChannel: 'vellum',
-    conversationExternalId: 'local',
-    actorExternalId: guardianPrincipalId,
-  });
-
-  // Overlay the caller's actual sourceChannel onto the resolved context
-  // so downstream consumers see the correct channel provenance.
-  return { ...guardianCtx, sourceChannel };
 }
 
 /**
@@ -93,12 +92,31 @@ export function resolveLocalIpcGuardianContext(
 export function resolveLocalIpcAuthContext(sessionId: string): AuthContext {
   const authContext = buildIpcAuthContext(sessionId);
 
-  // Enrich with the guardian principal ID when a vellum binding exists,
-  // so downstream guardian resolution can use authContext.actorPrincipalId.
-  const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
-  const binding = getActiveBinding(assistantId, 'vellum');
-  if (binding) {
-    return { ...authContext, actorPrincipalId: binding.guardianExternalUserId };
+  // Enrich with the guardian principal ID from contacts-first path
+  const guardianResult = findGuardianForChannel(
+    "vellum",
+    authContext.assistantId,
+  );
+  if (guardianResult && guardianResult.contact.principalId) {
+    return {
+      ...authContext,
+      actorPrincipalId: guardianResult.contact.principalId,
+    };
+  }
+
+  // Self-heal: no guardian contact with principalId — bootstrap via
+  // ensureVellumGuardianBinding (mirrors resolveLocalIpcTrustContext).
+  try {
+    log.debug(
+      "No vellum guardian contact found; bootstrapping binding for IPC auth",
+    );
+    const principalId = ensureVellumGuardianBinding(authContext.assistantId);
+    return { ...authContext, actorPrincipalId: principalId };
+  } catch (err) {
+    log.warn(
+      { err },
+      "Self-heal ensureVellumGuardianBinding failed in auth context — returning without actorPrincipalId",
+    );
   }
 
   return authContext;

package/src/runtime/middleware/auth.ts

@@ -3,7 +3,7 @@
  * and gateway-origin verification.
  */
 
-import { timingSafeEqual } from 'node:crypto';
+import { timingSafeEqual } from "node:crypto";
 
 /**
  * Constant-time comparison of two bearer tokens to prevent timing attacks.
@@ -19,7 +19,9 @@ export function verifyBearerToken(provided: string, expected: string): boolean {
  * Check if a hostname is a loopback address.
  */
 export function isLoopbackHost(hostname: string): boolean {
-  return hostname === '127.0.0.1' || hostname === '::1' || hostname === 'localhost';
+  return (
+    hostname === "127.0.0.1" || hostname === "::1" || hostname === "localhost"
+  );
 }
 
 /**
@@ -39,9 +41,10 @@ export function isPrivateAddress(addr: string): boolean {
   const normalized = v4Mapped ? v4Mapped[1] : addr;
 
   // IPv4 checks
-  if (normalized.includes('.')) {
-    const parts = normalized.split('.').map(Number);
-    if (parts.length !== 4 || parts.some(p => isNaN(p) || p < 0 || p > 255)) return false;
+  if (normalized.includes(".")) {
+    const parts = normalized.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((p) => isNaN(p) || p < 0 || p > 255))
+      return false;
 
     // Loopback: 127.0.0.0/8
     if (parts[0] === 127) return true;
@@ -60,11 +63,11 @@ export function isPrivateAddress(addr: string): boolean {
   // IPv6 checks
   const lower = normalized.toLowerCase();
   // Loopback
-  if (lower === '::1') return true;
+  if (lower === "::1") return true;
   // Unique local: fc00::/7 (fc00:: through fdff::)
-  if (lower.startsWith('fc') || lower.startsWith('fd')) return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
   // Link-local: fe80::/10
-  if (lower.startsWith('fe80')) return true;
+  if (lower.startsWith("fe80")) return true;
 
   return false;
 }
@@ -79,7 +82,14 @@ export function isPrivateAddress(addr: string): boolean {
  * supports container/pod deployments (e.g. Kubernetes sidecars) where
  * gateway and runtime communicate over pod-internal private IPs.
  */
-export function isPrivateNetworkPeer(server: { requestIP(req: Request): { address: string; family: string; port: number } | null }, req: Request): boolean {
+export function isPrivateNetworkPeer(
+  server: {
+    requestIP(
+      req: Request,
+    ): { address: string; family: string; port: number } | null;
+  },
+  req: Request,
+): boolean {
   const ip = server.requestIP(req);
   if (!ip) return false;
   return isPrivateAddress(ip.address);
@@ -91,15 +101,16 @@ export function isPrivateNetworkPeer(server: { requestIP(req: Request): { addres
  * isPrivateAddress(), consistent with the isPrivateNetworkPeer check.
  */
 export function isPrivateNetworkOrigin(req: Request): boolean {
-  const origin = req.headers.get('origin');
+  const origin = req.headers.get("origin");
   // No origin header (e.g., server-initiated or same-origin) -- allow
   if (!origin) return true;
   try {
     const url = new URL(origin);
     const host = url.hostname;
-    if (host === 'localhost') return true;
+    if (host === "localhost") return true;
     // URL.hostname wraps IPv6 addresses in brackets (e.g. "[::1]") -- strip them
-    const rawHost = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    const rawHost =
+      host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
     return isPrivateAddress(rawHost);
   } catch {
     return false;
@@ -111,6 +122,6 @@ export function isPrivateNetworkOrigin(req: Request): boolean {
  * Returns the token string if present, or null.
  */
 export function extractBearerToken(req: Request): string | null {
-  const authHeader = req.headers.get('authorization');
-  return authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
+  const authHeader = req.headers.get("authorization");
+  return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
 }

package/src/runtime/middleware/error-handler.ts

@@ -2,11 +2,11 @@
  * Centralized error handling for runtime HTTP request dispatch.
  */
 
-import { ConfigError, IngressBlockedError } from '../../util/errors.js';
-import { getLogger } from '../../util/logger.js';
-import { httpError } from '../http-errors.js';
+import { ConfigError, IngressBlockedError } from "../../util/errors.js";
+import { getLogger } from "../../util/logger.js";
+import { httpError } from "../http-errors.js";
 
-const log = getLogger('runtime-http');
+const log = getLogger("runtime-http");
 
 /**
  * Wrap an async endpoint handler with standard error handling.
@@ -20,15 +20,19 @@ export async function withErrorHandling(
     return await handler();
   } catch (err) {
     if (err instanceof IngressBlockedError) {
-      log.warn({ endpoint, detectedTypes: err.detectedTypes }, 'Blocked HTTP request containing secrets');
-      return httpError('UNPROCESSABLE_ENTITY', err.message, 422);
+      log.warn(
+        { endpoint, detectedTypes: err.detectedTypes },
+        "Blocked HTTP request containing secrets",
+      );
+      return httpError("UNPROCESSABLE_ENTITY", err.message, 422);
     }
     if (err instanceof ConfigError) {
-      log.warn({ err, endpoint }, 'Runtime HTTP config error');
-      return httpError('UNPROCESSABLE_ENTITY', err.message, 422);
+      log.warn({ err, endpoint }, "Runtime HTTP config error");
+      return httpError("UNPROCESSABLE_ENTITY", err.message, 422);
     }
-    log.error({ err, endpoint }, 'Runtime HTTP handler error');
-    const message = err instanceof Error ? err.message : 'Internal server error';
-    return httpError('INTERNAL_ERROR', message, 500);
+    log.error({ err, endpoint }, "Runtime HTTP handler error");
+    const message =
+      err instanceof Error ? err.message : "Internal server error";
+    return httpError("INTERNAL_ERROR", message, 500);
   }
 }