@vellumai/assistant 0.7.1 → 0.7.3

package/src/runtime/routes/__tests__/client-routes.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Tests for the GET /v1/clients (list_clients) route.
+ *
+ * Validates the same-user filter applied to client listings:
+ * - Caller sees only clients owned by their `actorPrincipalId`.
+ * - Clients with no stored `actorPrincipalId` are filtered out (fail-closed).
+ * - Dev-bypass mode (`isHttpAuthDisabled()`) returns all clients.
+ */
+
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Module mocks (must be set up before importing the route) ──────────────
+
+let fakeHttpAuthDisabled = false;
+
+mock.module("../../../config/env.js", () => ({
+  isHttpAuthDisabled: () => fakeHttpAuthDisabled,
+  hasUngatedHttpAuthDisabled: () => false,
+}));
+
+mock.module("../../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// ── Real imports (after mocks) ────────────────────────────────────────────
+
+import { assistantEventHub } from "../../assistant-event-hub.js";
+import { ROUTES } from "../client-routes.js";
+import type { RouteDefinition } from "../types.js";
+
+afterAll(() => {
+  mock.restore();
+});
+
+// ── Test helpers ──────────────────────────────────────────────────────────
+
+function findHandler(operationId: string): RouteDefinition["handler"] {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`Route ${operationId} not found`);
+  return route.handler;
+}
+
+type ListClientsResponse = {
+  clients: Array<{
+    clientId: string;
+    interfaceId: string;
+    capabilities: string[];
+    machineName?: string;
+    connectedAt: string;
+    lastActiveAt: string;
+  }>;
+};
+
+function registerClient(args: {
+  clientId: string;
+  actorPrincipalId?: string;
+}): void {
+  assistantEventHub.subscribe({
+    type: "client",
+    clientId: args.clientId,
+    interfaceId: "macos",
+    capabilities: ["host_bash", "host_file", "host_cu"],
+    actorPrincipalId: args.actorPrincipalId,
+    callback: () => {},
+  });
+}
+
+function clearHub(): void {
+  const ids = assistantEventHub.listClients().map((c) => c.clientId);
+  for (const id of ids) {
+    assistantEventHub.disposeClient(id);
+  }
+}
+
+// ── Tests ────────────────────────────────────────────────────────────────
+
+describe("list_clients route — same-user filter", () => {
+  beforeEach(() => {
+    fakeHttpAuthDisabled = false;
+    clearHub();
+  });
+
+  test("returns only clients owned by the calling actor", () => {
+    registerClient({ clientId: "client-A1", actorPrincipalId: "user-A" });
+    registerClient({ clientId: "client-A2", actorPrincipalId: "user-A" });
+    registerClient({ clientId: "client-B1", actorPrincipalId: "user-B" });
+
+    const handler = findHandler("list_clients");
+    const result = handler({
+      headers: { "x-vellum-actor-principal-id": "user-A" },
+    }) as ListClientsResponse;
+
+    const ids = result.clients.map((c) => c.clientId).sort();
+    expect(ids).toEqual(["client-A1", "client-A2"]);
+  });
+
+  test("filters out cross-user clients when listing as a different user", () => {
+    registerClient({ clientId: "client-A1", actorPrincipalId: "user-A" });
+    registerClient({ clientId: "client-B1", actorPrincipalId: "user-B" });
+
+    const handler = findHandler("list_clients");
+    const result = handler({
+      headers: { "x-vellum-actor-principal-id": "user-B" },
+    }) as ListClientsResponse;
+
+    const ids = result.clients.map((c) => c.clientId);
+    expect(ids).toEqual(["client-B1"]);
+  });
+
+  test("filters out clients with no stored actorPrincipalId (fail-closed)", () => {
+    registerClient({
+      clientId: "client-noprincipal",
+      actorPrincipalId: undefined,
+    });
+    registerClient({ clientId: "client-A1", actorPrincipalId: "user-A" });
+
+    const handler = findHandler("list_clients");
+    const result = handler({
+      headers: { "x-vellum-actor-principal-id": "user-A" },
+    }) as ListClientsResponse;
+
+    const ids = result.clients.map((c) => c.clientId);
+    expect(ids).toEqual(["client-A1"]);
+  });
+
+  test("filters out all clients when caller has no actorPrincipalId header (fail-closed)", () => {
+    registerClient({ clientId: "client-A1", actorPrincipalId: "user-A" });
+
+    const handler = findHandler("list_clients");
+    const result = handler({}) as ListClientsResponse;
+
+    expect(result.clients).toEqual([]);
+  });
+
+  test("dev-bypass mode returns all clients regardless of actor", () => {
+    fakeHttpAuthDisabled = true;
+    registerClient({ clientId: "client-A1", actorPrincipalId: "user-A" });
+    registerClient({ clientId: "client-B1", actorPrincipalId: "user-B" });
+    registerClient({
+      clientId: "client-noprincipal",
+      actorPrincipalId: undefined,
+    });
+
+    const handler = findHandler("list_clients");
+    const result = handler({
+      headers: { "x-vellum-actor-principal-id": "user-A" },
+    }) as ListClientsResponse;
+
+    const ids = result.clients.map((c) => c.clientId).sort();
+    expect(ids).toEqual(["client-A1", "client-B1", "client-noprincipal"]);
+  });
+});

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -10,7 +10,6 @@ mock.module("../../../util/logger.js", () => ({
 import {
   sampleConcepts as sharedSampleConcepts,
   sampleConfig,
-  sampleSkills,
 } from "../../../memory/__tests__/fixtures/memory-v2-activation-fixtures.js";
 
 let rawConfigFixture: Record<string, unknown> = {};
@@ -29,18 +28,20 @@ mock.module("../../../config/loader.js", () => ({
   },
 }));
 
+import type { ConversationCreateType } from "../../../memory/conversation-crud.js";
 import { getDb } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
 import {
   backfillMemoryV2ActivationMessageId,
   type MemoryV2ConceptRowRecord,
   type MemoryV2ConfigSnapshot,
-  type MemoryV2SkillRowRecord,
   recordMemoryV2ActivationLog,
 } from "../../../memory/memory-v2-activation-log-store.js";
 import {
+  conversations,
   llmRequestLogs,
   memoryV2ActivationLogs,
+  messages,
 } from "../../../memory/schema.js";
 import { ROUTES } from "../conversation-query-routes.js";
 
@@ -68,6 +69,40 @@ function clearTables(): void {
   const db = getDb();
   db.delete(llmRequestLogs).run();
   db.delete(memoryV2ActivationLogs).run();
+  db.delete(messages).run();
+  db.delete(conversations).run();
+}
+
+function seedConversationAndMessage(args: {
+  conversationId: string;
+  messageId: string;
+  source: string;
+  conversationType: ConversationCreateType;
+}): void {
+  const now = Date.now();
+  getDb()
+    .insert(conversations)
+    .values({
+      id: args.conversationId,
+      title: null,
+      createdAt: now,
+      updatedAt: now,
+      source: args.source,
+      conversationType: args.conversationType,
+      memoryScopeId: "default",
+    })
+    .run();
+  getDb()
+    .insert(messages)
+    .values({
+      id: args.messageId,
+      conversationId: args.conversationId,
+      role: "assistant",
+      content: "",
+      createdAt: now,
+      metadata: null,
+    })
+    .run();
 }
 
 function seedRequestLog(messageId: string, id: string): void {
@@ -116,7 +151,6 @@ describe("GET /v1/messages/:id/llm-context — memoryV2Activation", () => {
       turn: 4,
       mode: "per-turn",
       concepts: sampleConcepts,
-      skills: sampleSkills,
       config: sampleConfig,
     });
     backfillMemoryV2ActivationMessageId(conversationId, messageId);
@@ -126,7 +160,6 @@ describe("GET /v1/messages/:id/llm-context — memoryV2Activation", () => {
         turn: number;
         mode: "context-load" | "per-turn";
         concepts: MemoryV2ConceptRowRecord[];
-        skills: MemoryV2SkillRowRecord[];
         config: MemoryV2ConfigSnapshot;
       } | null;
       memoryRecall: unknown;
@@ -136,13 +169,73 @@ describe("GET /v1/messages/:id/llm-context — memoryV2Activation", () => {
     expect(body.memoryV2Activation!.turn).toBe(4);
     expect(body.memoryV2Activation!.mode).toBe("per-turn");
     expect(body.memoryV2Activation!.concepts).toEqual(sampleConcepts);
-    expect(body.memoryV2Activation!.skills).toEqual(sampleSkills);
     expect(body.memoryV2Activation!.config).toEqual(sampleConfig);
     // Backwards-compat: memoryRecall field still present.
     expect(body).toHaveProperty("memoryRecall");
   });
 });
 
+describe("GET /v1/messages/:id/llm-context — conversationKind", () => {
+  beforeEach(() => {
+    clearTables();
+  });
+
+  test("returns 'background_memory_consolidation' for memory_v2_consolidation source", async () => {
+    seedConversationAndMessage({
+      conversationId: "conv-mem-consol",
+      messageId: "msg-mem-consol",
+      source: "memory_v2_consolidation",
+      conversationType: "background",
+    });
+
+    const body = (await dispatchLlmContext("msg-mem-consol")) as {
+      conversationKind: string;
+      logs: unknown[];
+    };
+
+    expect(body.conversationKind).toBe("background_memory_consolidation");
+    expect(body.logs).toEqual([]);
+  });
+
+  test("returns 'background' for non-consolidation background conversations", async () => {
+    seedConversationAndMessage({
+      conversationId: "conv-bg",
+      messageId: "msg-bg",
+      source: "memory_consolidation",
+      conversationType: "background",
+    });
+
+    const body = (await dispatchLlmContext("msg-bg")) as {
+      conversationKind: string;
+    };
+
+    expect(body.conversationKind).toBe("background");
+  });
+
+  test("returns 'user' for standard conversations", async () => {
+    seedConversationAndMessage({
+      conversationId: "conv-user",
+      messageId: "msg-user",
+      source: "user",
+      conversationType: "standard",
+    });
+
+    const body = (await dispatchLlmContext("msg-user")) as {
+      conversationKind: string;
+    };
+
+    expect(body.conversationKind).toBe("user");
+  });
+
+  test("falls back to 'user' when the message can't be resolved", async () => {
+    const body = (await dispatchLlmContext("msg-missing")) as {
+      conversationKind: string;
+    };
+
+    expect(body.conversationKind).toBe("user");
+  });
+});
+
 describe("PUT /v1/config/llm/profiles/:name", () => {
   beforeEach(() => {
     savedRawConfig = null;

package/src/runtime/routes/__tests__/gateway-log-routes.test.ts

@@ -0,0 +1,242 @@
+/**
+ * Unit tests for the gateway_logs_tail IPC route handler.
+ *
+ * Covers:
+ * - Happy path: all params → correct URL with querystring
+ * - All params absent → URL with no querystring
+ * - Only n provided → querystring has only n
+ * - Gateway returns 500 with error body → Error thrown with error message
+ * - level: "INVALID" → ZodError (no gateway call)
+ * - n: 0 → ZodError (min 1 violation)
+ * - n: 1001 → ZodError (max 1000 violation)
+ * - module: "" → accepted (empty string passes zod string validation)
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { ZodError } from "zod";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be defined before importing the module under test
+// ---------------------------------------------------------------------------
+
+mock.module("../../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../../../config/env.js", () => ({
+  getGatewayInternalBaseUrl: () => "http://localhost:9999",
+}));
+
+// ---------------------------------------------------------------------------
+// Import the module under test AFTER mocks are set up
+// ---------------------------------------------------------------------------
+
+import { ROUTES } from "../gateway-log-routes.js";
+
+const gatewayLogsTailRoute = ROUTES.find(
+  (r) => r.operationId === "gateway_logs_tail",
+)!;
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeFetchMock(
+  status: number,
+  body: unknown,
+): ReturnType<typeof mock> {
+  return mock(async () => ({
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => body,
+  }));
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("gateway_logs_tail route", () => {
+  beforeEach(() => {
+    // Reset global fetch to avoid cross-test contamination
+    globalThis.fetch = undefined as unknown as typeof fetch;
+  });
+
+  test("route is registered with correct operationId, method, and endpoint", () => {
+    expect(gatewayLogsTailRoute).toBeDefined();
+    expect(gatewayLogsTailRoute.operationId).toBe("gateway_logs_tail");
+    expect(gatewayLogsTailRoute.method).toBe("GET");
+    expect(gatewayLogsTailRoute.endpoint).toBe("gateway/logs/tail");
+  });
+
+  describe("happy path — all params provided via body", () => {
+    test("calls gateway with correct URL including all query params", async () => {
+      const mockFetch = makeFetchMock(200, { entries: [] });
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await gatewayLogsTailRoute.handler({
+        body: { n: 5, level: "warn", module: "mcp" },
+      });
+
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const calledUrl = (mockFetch.mock.calls[0] as [string])[0];
+      expect(calledUrl).toBe(
+        "http://localhost:9999/v1/logs/tail?n=5&level=warn&module=mcp",
+      );
+    });
+
+    test("returns the parsed response body", async () => {
+      const responseBody = { entries: [{ msg: "hello", level: 40 }] };
+      globalThis.fetch = makeFetchMock(200, responseBody) as unknown as typeof fetch;
+
+      const result = await gatewayLogsTailRoute.handler({
+        body: { n: 5, level: "warn", module: "mcp" },
+      });
+
+      expect(result).toEqual(responseBody);
+    });
+  });
+
+  describe("all params absent", () => {
+    test("calls gateway URL with no querystring when body is empty", async () => {
+      const mockFetch = makeFetchMock(200, { entries: [] });
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await gatewayLogsTailRoute.handler({ body: {} });
+
+      const calledUrl = (mockFetch.mock.calls[0] as [string])[0];
+      expect(calledUrl).toBe("http://localhost:9999/v1/logs/tail");
+    });
+
+    test("calls gateway URL with no querystring when no args provided", async () => {
+      const mockFetch = makeFetchMock(200, { entries: [] });
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await gatewayLogsTailRoute.handler({});
+
+      const calledUrl = (mockFetch.mock.calls[0] as [string])[0];
+      expect(calledUrl).toBe("http://localhost:9999/v1/logs/tail");
+    });
+  });
+
+  describe("only n provided", () => {
+    test("querystring contains only n — no spurious level or module keys", async () => {
+      const mockFetch = makeFetchMock(200, { entries: [] });
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await gatewayLogsTailRoute.handler({ body: { n: 5 } });
+
+      const calledUrl = (mockFetch.mock.calls[0] as [string])[0];
+      expect(calledUrl).toBe("http://localhost:9999/v1/logs/tail?n=5");
+      expect(calledUrl).not.toContain("level");
+      expect(calledUrl).not.toContain("module");
+    });
+  });
+
+  describe("gateway error handling", () => {
+    test("gateway 500 with { error: 'disk error' } throws Error with that message", async () => {
+      globalThis.fetch = makeFetchMock(500, {
+        error: "disk error",
+      }) as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({ body: {} }),
+      ).rejects.toThrow("disk error");
+    });
+
+    test("gateway 500 with non-string error falls back to generic message", async () => {
+      globalThis.fetch = makeFetchMock(500, {
+        error: { nested: true },
+      }) as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({ body: {} }),
+      ).rejects.toThrow("Gateway request failed (500)");
+    });
+
+    test("gateway 500 with unparseable JSON falls back to generic message", async () => {
+      globalThis.fetch = mock(async () => ({
+        ok: false,
+        status: 500,
+        json: async () => {
+          throw new SyntaxError("Unexpected token");
+        },
+      })) as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({ body: {} }),
+      ).rejects.toThrow("Gateway request failed (500)");
+    });
+  });
+
+  describe("zod validation", () => {
+    test("level: 'INVALID' is rejected with ZodError before calling gateway", async () => {
+      const mockFetch = makeFetchMock(200, {});
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({
+          body: { level: "INVALID" },
+        }),
+      ).rejects.toBeInstanceOf(ZodError);
+
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
+
+    test("n: 0 is rejected with ZodError (min 1 violation)", async () => {
+      const mockFetch = makeFetchMock(200, {});
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({ body: { n: 0 } }),
+      ).rejects.toBeInstanceOf(ZodError);
+
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
+
+    test("n: 1001 is rejected with ZodError (max 1000 violation)", async () => {
+      const mockFetch = makeFetchMock(200, {});
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({ body: { n: 1001 } }),
+      ).rejects.toBeInstanceOf(ZodError);
+
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
+
+    test("module: '' is accepted (empty string passes zod string validation)", async () => {
+      const mockFetch = makeFetchMock(200, { entries: [] });
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      await expect(
+        gatewayLogsTailRoute.handler({ body: { module: "" } }),
+      ).resolves.toBeDefined();
+
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("queryParams source (HTTP GET path)", () => {
+    test("uses queryParams when provided (HTTP GET path) — string params", async () => {
+      const mockFetch = makeFetchMock(200, { entries: [] });
+      globalThis.fetch = mockFetch as unknown as typeof fetch;
+
+      // When queryParams has values, those take precedence over body.
+      // Only string-valued params (level, module) are valid from the HTTP layer;
+      // n is numeric and must come via IPC body.
+      await gatewayLogsTailRoute.handler({
+        queryParams: { level: "info", module: "cors" },
+        body: {},
+      });
+
+      const calledUrl = (mockFetch.mock.calls[0] as [string])[0];
+      expect(calledUrl).toContain("level=info");
+      expect(calledUrl).toContain("module=cors");
+    });
+  });
+});

package/src/runtime/routes/__tests__/heartbeat-routes.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Asserts `setHeartbeatConfig` persists only user-set heartbeat fields to
+ * `config.json` and surfaces the resolved (post-default) values via the
+ * response payload.
+ */
+
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { invalidateConfigCache } from "../../../config/loader.js";
+import { ROUTES } from "../heartbeat-routes.js";
+import type { RouteDefinition } from "../types.js";
+
+// ─── Module mocks ──────────────────────────────────────────────────────────
+
+// Stub the heartbeat service so the response-path's getInstance() returns
+// undefined (no scheduler running in tests).
+mock.module("../../../heartbeat/heartbeat-service.js", () => ({
+  HeartbeatService: {
+    getInstance: () => undefined,
+  },
+}));
+
+// ─── Setup ─────────────────────────────────────────────────────────────────
+
+let workspaceDir: string;
+let origWorkspaceDir: string | undefined;
+let configPath: string;
+
+function findHandler(operationId: string): RouteDefinition["handler"] {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`Route ${operationId} not found`);
+  return route.handler;
+}
+
+function readConfig(): Record<string, unknown> {
+  return JSON.parse(readFileSync(configPath, "utf-8"));
+}
+
+beforeEach(() => {
+  workspaceDir = mkdtempSync(join(tmpdir(), "vellum-hbr-"));
+  origWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+  process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+  configPath = join(workspaceDir, "config.json");
+  invalidateConfigCache();
+});
+
+afterEach(() => {
+  if (origWorkspaceDir === undefined) {
+    delete process.env.VELLUM_WORKSPACE_DIR;
+  } else {
+    process.env.VELLUM_WORKSPACE_DIR = origWorkspaceDir;
+  }
+  invalidateConfigCache();
+  try {
+    rmSync(workspaceDir, { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+});
+
+// ─── Tests ─────────────────────────────────────────────────────────────────
+
+describe("setHeartbeatConfig handler", () => {
+  test("persists only user-set fields when starting from a config with no heartbeat block", async () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify({ provider: "anthropic" }, null, 2) + "\n",
+    );
+
+    const handler = findHandler("updateHeartbeatConfig");
+    const result = (await handler({ body: { enabled: true } })) as {
+      enabled: boolean;
+      intervalMs: number;
+      activeHoursStart: number | null;
+      activeHoursEnd: number | null;
+      success: boolean;
+    };
+
+    // On-disk: only user-set heartbeat fields, no schema defaults baked in.
+    const onDisk = readConfig();
+    expect(onDisk).toEqual({
+      provider: "anthropic",
+      heartbeat: { enabled: true },
+    });
+
+    // Response: schema-default intervalMs surfaces, proving cache
+    // invalidation + getConfig() read picked up the new on-disk state.
+    expect(result.success).toBe(true);
+    expect(result.enabled).toBe(true);
+    expect(result.intervalMs).toBe(30 * 60_000);
+    expect(result.activeHoursStart).toBe(8);
+    expect(result.activeHoursEnd).toBe(22);
+  });
+
+  test("merges patch into existing heartbeat block instead of overwriting", async () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify({ heartbeat: { intervalMs: 60000 } }, null, 2) + "\n",
+    );
+
+    const handler = findHandler("updateHeartbeatConfig");
+    await handler({ body: { enabled: true } });
+
+    const onDisk = readConfig();
+    expect(onDisk).toEqual({
+      heartbeat: { intervalMs: 60000, enabled: true },
+    });
+  });
+});

package/src/runtime/routes/approval-interception-types.ts

@@ -0,0 +1,13 @@
+/**
+ * Types extracted from guardian-approval-interception.ts to break the
+ * interception ↔ guardian-text-engine-strategy cycle.
+ */
+
+export interface ApprovalInterceptionResult {
+  handled: boolean;
+  type?:
+    | "decision_applied"
+    | "assistant_turn"
+    | "guardian_decision_applied"
+    | "stale_ignored";
+}

package/src/runtime/routes/approval-strategies/guardian-text-engine-strategy.ts

@@ -17,7 +17,7 @@ import type {
   ApprovalConversationGenerator,
   ApprovalCopyGenerator,
 } from "../../http-types.js";
-import type { ApprovalInterceptionResult } from "../guardian-approval-interception.js";
+import type { ApprovalInterceptionResult } from "../approval-interception-types.js";
 import { deliverStaleApprovalReply } from "../guardian-approval-reply-helpers.js";
 
 const log = getLogger("runtime-http");