@vellumai/assistant 0.4.30 → 0.4.32

package/src/runtime/http-types.ts

@@ -132,20 +132,6 @@ export type MessageProcessor = (
   sourceInterface?: InterfaceId,
 ) => Promise<{ messageId: string }>;
 
-/**
- * Non-blocking message processor that persists the user message and
- * starts the agent loop in the background, returning the messageId
- * immediately.
- */
-export type NonBlockingMessageProcessor = (
-  conversationId: string,
-  content: string,
-  attachmentIds?: string[],
-  options?: RuntimeMessageSessionOptions,
-  sourceChannel?: ChannelId,
-  sourceInterface?: InterfaceId,
-) => Promise<{ messageId: string }>;
-
 /**
  * Dependencies for the POST /v1/messages handler.
  *
@@ -171,8 +157,6 @@ export interface RuntimeHttpServerOptions {
   /** Legacy shared secret for pairing routes (not used for delivery or auth). */
   bearerToken?: string;
   processMessage?: MessageProcessor;
-  /** Non-blocking processor for POST /messages (persists + fires agent loop). */
-  persistAndProcessMessage?: NonBlockingMessageProcessor;
   /** Root directory for interface files on disk. */
   interfacesDir?: string;
   /** Daemon-injected generator for approval copy (provider-backed). */

package/src/runtime/middleware/auth.ts

@@ -3,18 +3,6 @@
  * and gateway-origin verification.
  */
 
-import { timingSafeEqual } from "node:crypto";
-
-/**
- * Constant-time comparison of two bearer tokens to prevent timing attacks.
- */
-export function verifyBearerToken(provided: string, expected: string): boolean {
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
-
 /**
  * Check if a hostname is a loopback address.
  */

package/src/runtime/routes/app-routes.ts

@@ -12,6 +12,7 @@ import { getApp } from "../../memory/app-store.js";
 import * as sharedAppLinksStore from "../../memory/shared-app-links-store.js";
 import { getLogger } from "../../util/logger.js";
 import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
 
 const log = getLogger("runtime-http");
 
@@ -199,3 +200,35 @@ export function handleDeleteSharedApp(shareToken: string): Response {
   }
   return Response.json({ success: true });
 }
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function appRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "apps/share",
+      method: "POST",
+      handler: async ({ req }) => handleShareApp(req),
+    },
+    {
+      endpoint: "apps/shared/:token/metadata",
+      method: "GET",
+      policyKey: "apps/shared/metadata",
+      handler: ({ params }) => handleGetSharedAppMetadata(params.token),
+    },
+    {
+      endpoint: "apps/shared/:token",
+      method: "GET",
+      policyKey: "apps/shared",
+      handler: ({ params }) => handleDownloadSharedApp(params.token),
+    },
+    {
+      endpoint: "apps/shared/:token",
+      method: "DELETE",
+      policyKey: "apps/shared",
+      handler: ({ params }) => handleDeleteSharedApp(params.token),
+    },
+  ];
+}

package/src/runtime/routes/approval-routes.ts

@@ -16,6 +16,7 @@ import { getLogger } from "../../util/logger.js";
 import { requireBoundGuardian } from "../auth/require-bound-guardian.js";
 import type { AuthContext } from "../auth/types.js";
 import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
 import * as pendingInteractions from "../pending-interactions.js";
 
 const log = getLogger("approval-routes");
@@ -317,3 +318,34 @@ export function handleListPendingInteractions(
       : null,
   });
 }
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function approvalRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "confirm",
+      method: "POST",
+      handler: async ({ req, authContext }) => handleConfirm(req, authContext),
+    },
+    {
+      endpoint: "secret",
+      method: "POST",
+      handler: async ({ req, authContext }) => handleSecret(req, authContext),
+    },
+    {
+      endpoint: "trust-rules",
+      method: "POST",
+      handler: async ({ req, authContext }) =>
+        handleTrustRule(req, authContext),
+    },
+    {
+      endpoint: "pending-interactions",
+      method: "GET",
+      handler: ({ url, authContext }) =>
+        handleListPendingInteractions(url, authContext),
+    },
+  ];
+}

package/src/runtime/routes/approval-strategies/guardian-callback-strategy.ts

@@ -297,7 +297,8 @@ async function handleCallbackDecision(params: {
   const result = applyGuardianDecision({
     approval: guardianApproval,
     decision: callbackDecision,
-    actorExternalUserId: actorExternalId,
+    actorPrincipalId: undefined, // Callback path — principal not available at this layer
+    actorExternalUserId: actorExternalId, // Channel-native ID (Telegram user ID, phone, etc.)
     actorChannel: sourceChannel,
   });
 
@@ -491,7 +492,8 @@ async function handleConversationalDecision(params: {
   const result = applyGuardianDecision({
     approval: targetApproval,
     decision: engineDecision,
-    actorExternalUserId: actorExternalId,
+    actorPrincipalId: undefined, // Callback path — principal not available at this layer
+    actorExternalUserId: actorExternalId, // Channel-native ID (Telegram user ID, phone, etc.)
     actorChannel: sourceChannel,
   });
 
@@ -675,7 +677,8 @@ async function handleLegacyDecision(params: {
     const result = applyGuardianDecision({
       approval: targetLegacyApproval,
       decision: legacyGuardianDecision,
-      actorExternalUserId: actorExternalId,
+      actorPrincipalId: undefined, // Callback path — principal not available at this layer
+      actorExternalUserId: actorExternalId, // Channel-native ID (Telegram user ID, phone, etc.)
       actorChannel: sourceChannel,
     });
 

package/src/runtime/routes/attachment-routes.ts

@@ -10,6 +10,7 @@ import {
   validateAttachmentUpload,
 } from "../../memory/attachments-store.js";
 import { httpError } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
 
 /** 30 MB — base64-encoded 20 MB attachment ≈ 27 MB plus JSON wrapper overhead. */
 const MAX_UPLOAD_BODY_BYTES = 30 * 1024 * 1024;
@@ -220,3 +221,34 @@ export function handleGetAttachmentContent(
     },
   });
 }
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function attachmentRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "attachments",
+      method: "POST",
+      handler: async ({ req }) => handleUploadAttachment(req),
+    },
+    {
+      endpoint: "attachments",
+      method: "DELETE",
+      handler: async ({ req }) => handleDeleteAttachment(req),
+    },
+    {
+      endpoint: "attachments/:id/content",
+      method: "GET",
+      policyKey: "attachments/content",
+      handler: ({ req, params }) => handleGetAttachmentContent(params.id, req),
+    },
+    {
+      endpoint: "attachments/:id",
+      method: "GET",
+      policyKey: "attachments",
+      handler: ({ params }) => handleGetAttachment(params.id),
+    },
+  ];
+}

package/src/runtime/routes/brain-graph-routes.ts

@@ -17,6 +17,7 @@ import {
   memoryItems,
 } from "../../memory/schema.js";
 import { resolveBundledDir } from "../../util/bundled-asset.js";
+import type { RouteDefinition } from "../http-router.js";
 
 function getLobeRegion(entityType: string): string {
   switch (entityType) {
@@ -236,3 +237,29 @@ export function handleServeBrainGraphUI(bearerToken?: string): Response {
     );
   }
 }
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function brainGraphRouteDefinitions(deps: {
+  mintUiPageToken: () => string;
+}): RouteDefinition[] {
+  return [
+    {
+      endpoint: "brain-graph",
+      method: "GET",
+      handler: () => handleGetBrainGraph(),
+    },
+    {
+      endpoint: "brain-graph-ui",
+      method: "GET",
+      handler: () => handleServeBrainGraphUI(deps.mintUiPageToken()),
+    },
+    {
+      endpoint: "home-base-ui",
+      method: "GET",
+      handler: () => handleServeHomeBaseUI(deps.mintUiPageToken()),
+    },
+  ];
+}

package/src/runtime/routes/call-routes.ts

@@ -19,6 +19,7 @@ import { getConfig } from "../../config/loader.js";
 import { VALID_CALLER_IDENTITY_MODES } from "../../config/schema.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { httpError, httpErrorCodeFromStatus } from "../http-errors.js";
+import type { RouteDefinition } from "../http-router.js";
 
 // ── Idempotency cache ─────────────────────────────────────────────────────────
 // Stores serialized 201 responses keyed by idempotencyKey for 5 minutes so
@@ -275,3 +276,43 @@ export async function handleInstructionCall(
 
   return Response.json({ ok: true });
 }
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function callRouteDefinitions(deps: {
+  assistantId: string;
+}): RouteDefinition[] {
+  return [
+    {
+      endpoint: "calls/start",
+      method: "POST",
+      handler: async ({ req }) => handleStartCall(req, deps.assistantId),
+    },
+    {
+      endpoint: "calls/:id/cancel",
+      method: "POST",
+      policyKey: "calls/cancel",
+      handler: async ({ req, params }) => handleCancelCall(req, params.id),
+    },
+    {
+      endpoint: "calls/:id/answer",
+      method: "POST",
+      policyKey: "calls/answer",
+      handler: async ({ req, params }) => handleAnswerCall(req, params.id),
+    },
+    {
+      endpoint: "calls/:id/instruction",
+      method: "POST",
+      policyKey: "calls/instruction",
+      handler: async ({ req, params }) => handleInstructionCall(req, params.id),
+    },
+    {
+      endpoint: "calls/:id",
+      method: "GET",
+      policyKey: "calls",
+      handler: ({ params }) => handleGetCallStatus(params.id),
+    },
+  ];
+}

package/src/runtime/routes/channel-readiness-routes.ts

@@ -7,6 +7,7 @@
 
 import type { ChannelId } from "../../channels/types.js";
 import { getReadinessService } from "../../daemon/handlers/config-channels.js";
+import type { RouteDefinition } from "../http-router.js";
 
 /**
  * GET /v1/channels/readiness
@@ -75,3 +76,22 @@ export async function handleRefreshChannelReadiness(
     })),
   });
 }
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function channelReadinessRouteDefinitions(): RouteDefinition[] {
+  return [
+    {
+      endpoint: "channels/readiness",
+      method: "GET",
+      handler: async ({ url }) => handleGetChannelReadiness(url),
+    },
+    {
+      endpoint: "channels/readiness/refresh",
+      method: "POST",
+      handler: async ({ req }) => handleRefreshChannelReadiness(req),
+    },
+  ];
+}

package/src/runtime/routes/channel-routes.ts

@@ -7,6 +7,25 @@
  * - channel-delivery-routes.ts — delivery ack, dead letters, reply delivery
  * - channel-guardian-routes.ts — guardian approval interception, expiry sweep
  */
+
+import type { RouteDefinition } from "../http-router.js";
+import type {
+  ApprovalConversationGenerator,
+  ApprovalCopyGenerator,
+  GuardianActionCopyGenerator,
+  GuardianFollowUpConversationGenerator,
+  MessageProcessor,
+} from "../http-types.js";
+import {
+  handleChannelDeliveryAck as _handleChannelDeliveryAck,
+  handleListDeadLetters as _handleListDeadLetters,
+  handleReplayDeadLetters as _handleReplayDeadLetters,
+} from "./channel-delivery-routes.js";
+import {
+  handleChannelInbound as _handleChannelInbound,
+  handleDeleteConversation as _handleDeleteConversation,
+} from "./channel-inbound-routes.js";
+
 export {
   handleChannelDeliveryAck,
   handleListDeadLetters,
@@ -25,3 +44,54 @@ export {
   _setTestPollMaxWait,
   type DenialReason,
 } from "./channel-route-shared.js";
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export function channelRouteDefinitions(deps: {
+  assistantId: string;
+  processMessage?: MessageProcessor;
+  approvalCopyGenerator?: ApprovalCopyGenerator;
+  approvalConversationGenerator?: ApprovalConversationGenerator;
+  guardianActionCopyGenerator?: GuardianActionCopyGenerator;
+  guardianFollowUpConversationGenerator?: GuardianFollowUpConversationGenerator;
+}): RouteDefinition[] {
+  return [
+    {
+      endpoint: "channels/conversation",
+      method: "DELETE",
+      handler: async ({ req }) =>
+        _handleDeleteConversation(req, deps.assistantId),
+    },
+    {
+      endpoint: "channels/inbound",
+      method: "POST",
+      handler: async ({ req }) =>
+        _handleChannelInbound(
+          req,
+          deps.processMessage,
+          deps.assistantId,
+          deps.approvalCopyGenerator,
+          deps.approvalConversationGenerator,
+          deps.guardianActionCopyGenerator,
+          deps.guardianFollowUpConversationGenerator,
+        ),
+    },
+    {
+      endpoint: "channels/delivery-ack",
+      method: "POST",
+      handler: async ({ req }) => _handleChannelDeliveryAck(req),
+    },
+    {
+      endpoint: "channels/dead-letters",
+      method: "GET",
+      handler: () => _handleListDeadLetters(),
+    },
+    {
+      endpoint: "channels/replay",
+      method: "POST",
+      handler: async ({ req }) => _handleReplayDeadLetters(req),
+    },
+  ];
+}