@vellumai/vellum-gateway 0.1.7

package/src/__tests__/config.test.ts

@@ -0,0 +1,236 @@
+import { writeFileSync, unlinkSync } from "node:fs";
+import { describe, test, expect } from "bun:test";
+import { loadConfig } from "../config.js";
+
+const BASE_ENV = {
+  TELEGRAM_BOT_TOKEN: "tok",
+  TELEGRAM_WEBHOOK_SECRET: "wh-sec",
+  ASSISTANT_RUNTIME_BASE_URL: "http://localhost:7821",
+};
+
+function withEnv(overrides: Record<string, string | undefined>, fn: () => void) {
+  const saved: Record<string, string | undefined> = {};
+  const allKeys = [
+    ...Object.keys(BASE_ENV),
+    ...Object.keys(overrides),
+    "GATEWAY_RUNTIME_PROXY_ENABLED",
+    "GATEWAY_RUNTIME_PROXY_REQUIRE_AUTH",
+    "RUNTIME_BEARER_TOKEN",
+    "RUNTIME_PROXY_BEARER_TOKEN",
+    "GATEWAY_ASSISTANT_ROUTING_JSON",
+    "GATEWAY_DEFAULT_ASSISTANT_ID",
+    "GATEWAY_UNMAPPED_POLICY",
+    "GATEWAY_PORT",
+    "GATEWAY_SHUTDOWN_DRAIN_MS",
+    "GATEWAY_RUNTIME_TIMEOUT_MS",
+    "GATEWAY_RUNTIME_MAX_RETRIES",
+    "GATEWAY_RUNTIME_INITIAL_BACKOFF_MS",
+    "GATEWAY_TELEGRAM_TIMEOUT_MS",
+    "GATEWAY_MAX_WEBHOOK_PAYLOAD_BYTES",
+    "GATEWAY_MAX_ATTACHMENT_BYTES",
+    "GATEWAY_MAX_ATTACHMENT_CONCURRENCY",
+    "VELLUM_HTTP_TOKEN_PATH",
+  ];
+
+  for (const key of allKeys) {
+    saved[key] = process.env[key];
+    delete process.env[key];
+  }
+
+  Object.assign(process.env, BASE_ENV, overrides);
+
+  try {
+    fn();
+  } finally {
+    for (const key of allKeys) {
+      if (saved[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = saved[key];
+      }
+    }
+  }
+}
+
+describe("config: Telegram-only default mode", () => {
+  test("proxy is disabled when GATEWAY_RUNTIME_PROXY_ENABLED is unset", () => {
+    withEnv({}, () => {
+      const config = loadConfig();
+      expect(config.runtimeProxyEnabled).toBe(false);
+    });
+  });
+
+  test("proxy is disabled when GATEWAY_RUNTIME_PROXY_ENABLED is explicitly false", () => {
+    withEnv({ GATEWAY_RUNTIME_PROXY_ENABLED: "false" }, () => {
+      const config = loadConfig();
+      expect(config.runtimeProxyEnabled).toBe(false);
+    });
+  });
+});
+
+describe("config: runtime proxy flags", () => {
+  test("proxy disabled by default", () => {
+    withEnv({ VELLUM_HTTP_TOKEN_PATH: "/nonexistent/http-token" }, () => {
+      const config = loadConfig();
+      expect(config.runtimeProxyEnabled).toBe(false);
+      expect(config.runtimeProxyRequireAuth).toBe(true);
+      expect(config.runtimeProxyBearerToken).toBeUndefined();
+    });
+  });
+
+  test("proxy enabled with auth and valid token", () => {
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        RUNTIME_PROXY_BEARER_TOKEN: "secret-key",
+      },
+      () => {
+        const config = loadConfig();
+        expect(config.runtimeProxyEnabled).toBe(true);
+        expect(config.runtimeProxyRequireAuth).toBe(true);
+        expect(config.runtimeProxyBearerToken).toBe("secret-key");
+      },
+    );
+  });
+
+  test("proxy enabled with auth disabled (no token needed)", () => {
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        GATEWAY_RUNTIME_PROXY_REQUIRE_AUTH: "false",
+        VELLUM_HTTP_TOKEN_PATH: "/nonexistent/http-token",
+      },
+      () => {
+        const config = loadConfig();
+        expect(config.runtimeProxyEnabled).toBe(true);
+        expect(config.runtimeProxyRequireAuth).toBe(false);
+        expect(config.runtimeProxyBearerToken).toBeUndefined();
+      },
+    );
+  });
+
+  test("proxy enabled with auth required but no token throws", () => {
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        GATEWAY_RUNTIME_PROXY_REQUIRE_AUTH: "true",
+        VELLUM_HTTP_TOKEN_PATH: "/nonexistent/http-token",
+      },
+      () => {
+        expect(() => loadConfig()).toThrow(
+          "RUNTIME_PROXY_BEARER_TOKEN is required when proxy is enabled with auth required",
+        );
+      },
+    );
+  });
+
+  test("proxy disabled ignores missing token even with auth required", () => {
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "false",
+        GATEWAY_RUNTIME_PROXY_REQUIRE_AUTH: "true",
+        VELLUM_HTTP_TOKEN_PATH: "/nonexistent/http-token",
+      },
+      () => {
+        const config = loadConfig();
+        expect(config.runtimeProxyEnabled).toBe(false);
+      },
+    );
+  });
+
+  test("proxy enabled defaults auth to required", () => {
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        RUNTIME_PROXY_BEARER_TOKEN: "my-token",
+        VELLUM_HTTP_TOKEN_PATH: "/nonexistent/http-token",
+      },
+      () => {
+        const config = loadConfig();
+        expect(config.runtimeProxyRequireAuth).toBe(true);
+      },
+    );
+  });
+
+  test("reads bearer token from http-token file when available", () => {
+    /** Verifies the gateway reads the daemon's http-token file for auth. */
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        VELLUM_HTTP_TOKEN_PATH: "/tmp/test-http-token",
+      },
+      () => {
+        // GIVEN an http-token file exists with a known token
+        writeFileSync("/tmp/test-http-token", "file-based-token\n");
+
+        // WHEN we load the config
+        const config = loadConfig();
+
+        // THEN the bearer token is read from the file (trimmed)
+        expect(config.runtimeProxyBearerToken).toBe("file-based-token");
+
+        // AND cleanup
+        unlinkSync("/tmp/test-http-token");
+      },
+    );
+  });
+
+  test("env var takes precedence over http-token file", () => {
+    /** Verifies that the env var is preferred over the http-token file. */
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        RUNTIME_PROXY_BEARER_TOKEN: "env-token",
+        VELLUM_HTTP_TOKEN_PATH: "/tmp/test-http-token-priority",
+      },
+      () => {
+        // GIVEN an http-token file exists with a different token than the env var
+        writeFileSync("/tmp/test-http-token-priority", "file-token");
+
+        // WHEN we load the config
+        const config = loadConfig();
+
+        // THEN the env var token takes precedence
+        expect(config.runtimeProxyBearerToken).toBe("env-token");
+
+        // AND cleanup
+        unlinkSync("/tmp/test-http-token-priority");
+      },
+    );
+  });
+
+  test("falls back to env var when http-token file is missing", () => {
+    /** Verifies fallback to RUNTIME_PROXY_BEARER_TOKEN env var. */
+    withEnv(
+      {
+        GATEWAY_RUNTIME_PROXY_ENABLED: "true",
+        RUNTIME_PROXY_BEARER_TOKEN: "env-fallback-token",
+        VELLUM_HTTP_TOKEN_PATH: "/nonexistent/http-token",
+      },
+      () => {
+        // GIVEN the http-token file does not exist
+        // WHEN we load the config
+        const config = loadConfig();
+
+        // THEN the env var token is used as fallback
+        expect(config.runtimeProxyBearerToken).toBe("env-fallback-token");
+      },
+    );
+  });
+});
+
+describe("config: runtime bearer token", () => {
+  test("runtimeBearerToken is undefined when RUNTIME_BEARER_TOKEN is unset", () => {
+    withEnv({}, () => {
+      const config = loadConfig();
+      expect(config.runtimeBearerToken).toBeUndefined();
+    });
+  });
+
+  test("runtimeBearerToken is set from RUNTIME_BEARER_TOKEN env var", () => {
+    withEnv({ RUNTIME_BEARER_TOKEN: "rt-secret" }, () => {
+      const config = loadConfig();
+      expect(config.runtimeBearerToken).toBe("rt-secret");
+    });
+  });
+});

package/src/__tests__/dedup-cache.test.ts

@@ -0,0 +1,101 @@
+import { describe, test, expect, beforeEach } from "bun:test";
+import { DedupCache } from "../dedup-cache.js";
+
+describe("DedupCache", () => {
+  let cache: DedupCache;
+
+  beforeEach(() => {
+    cache = new DedupCache(5_000, 100);
+  });
+
+  test("returns undefined for unseen update_id", () => {
+    expect(cache.get(123)).toBeUndefined();
+  });
+
+  test("returns cached entry after set", () => {
+    cache.set(100, '{"ok":true}', 200);
+    const hit = cache.get(100);
+    expect(hit).toEqual({ body: '{"ok":true}', status: 200 });
+  });
+
+  test("different update_ids are independent", () => {
+    cache.set(1, '{"a":1}', 200);
+    cache.set(2, '{"a":2}', 201);
+    expect(cache.get(1)?.body).toBe('{"a":1}');
+    expect(cache.get(2)?.body).toBe('{"a":2}');
+    expect(cache.get(3)).toBeUndefined();
+  });
+
+  test("expired entries are not returned", () => {
+    // Use a 1ms TTL so entries expire immediately
+    const shortCache = new DedupCache(1, 100);
+    shortCache.set(42, '{"ok":true}', 200);
+
+    // Wait for the entry to expire
+    const start = Date.now();
+    while (Date.now() - start < 5) {
+      // busy-wait
+    }
+
+    expect(shortCache.get(42)).toBeUndefined();
+  });
+
+  test("evicts oldest entry when at max capacity", () => {
+    const tinyCache = new DedupCache(60_000, 3);
+    tinyCache.set(1, "a", 200);
+    tinyCache.set(2, "b", 200);
+    tinyCache.set(3, "c", 200);
+    expect(tinyCache.size).toBe(3);
+
+    // Adding a 4th should evict the oldest (1)
+    tinyCache.set(4, "d", 200);
+    expect(tinyCache.size).toBe(3);
+    expect(tinyCache.get(1)).toBeUndefined();
+    expect(tinyCache.get(4)?.body).toBe("d");
+  });
+
+  test("size reflects current entries", () => {
+    expect(cache.size).toBe(0);
+    cache.set(1, "x", 200);
+    expect(cache.size).toBe(1);
+    cache.set(2, "y", 200);
+    expect(cache.size).toBe(2);
+  });
+
+  test("reserve returns true for unseen update_id and populates cache", () => {
+    expect(cache.reserve(50)).toBe(true);
+    expect(cache.size).toBe(1);
+    const hit = cache.get(50);
+    expect(hit).toBeDefined();
+    expect(hit!.status).toBe(200);
+  });
+
+  test("reserve returns false for already-reserved update_id", () => {
+    cache.reserve(60);
+    expect(cache.reserve(60)).toBe(false);
+  });
+
+  test("reserve returns false for already-cached update_id", () => {
+    cache.set(70, '{"done":true}', 200);
+    expect(cache.reserve(70)).toBe(false);
+  });
+
+  test("set overwrites a reserved entry with the final response", () => {
+    cache.reserve(80);
+    cache.set(80, '{"final":true}', 201);
+    const hit = cache.get(80);
+    expect(hit).toEqual({ body: '{"final":true}', status: 201 });
+  });
+
+  test("reserve succeeds after a reserved entry expires", () => {
+    const shortCache = new DedupCache(1, 100);
+    shortCache.reserve(90);
+
+    const start = Date.now();
+    while (Date.now() - start < 5) {
+      // busy-wait for expiry
+    }
+
+    expect(shortCache.reserve(90)).toBe(true);
+  });
+});

package/src/__tests__/load-guards.test.ts

@@ -0,0 +1,86 @@
+import { describe, test, expect } from "bun:test";
+import { createTelegramWebhookHandler } from "../http/routes/telegram-webhook.js";
+import type { GatewayConfig } from "../config.js";
+
+function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
+  return {
+    telegramBotToken: "tok",
+    telegramWebhookSecret: "wh-sec",
+    telegramApiBaseUrl: "https://api.telegram.org",
+    assistantRuntimeBaseUrl: "http://localhost:7821",
+    routingEntries: [],
+    defaultAssistantId: undefined,
+    unmappedPolicy: "reject",
+    port: 7830,
+    runtimeBearerToken: undefined,
+    runtimeProxyEnabled: false,
+    runtimeProxyRequireAuth: true,
+    runtimeProxyBearerToken: undefined,
+    shutdownDrainMs: 5000,
+    runtimeTimeoutMs: 30000,
+    runtimeMaxRetries: 2,
+    runtimeInitialBackoffMs: 500,
+    telegramInitialBackoffMs: 1000,
+    telegramMaxRetries: 3,
+    telegramTimeoutMs: 15000,
+    maxWebhookPayloadBytes: 256, // very small for testing
+    logFile: { dir: undefined, retentionDays: 30 },
+    maxAttachmentBytes: 20971520,
+    maxAttachmentConcurrency: 3,
+    ...overrides,
+  };
+}
+
+describe("payload size guard", () => {
+  test("returns 413 when content-length exceeds limit", async () => {
+    const handler = createTelegramWebhookHandler(makeConfig());
+    const body = JSON.stringify({ data: "x".repeat(300) });
+    const req = new Request("http://localhost:7830/webhooks/telegram", {
+      method: "POST",
+      body,
+      headers: {
+        "content-type": "application/json",
+        "content-length": String(body.length),
+        "x-telegram-bot-api-secret-token": "wh-sec",
+      },
+    });
+    const res = await handler(req);
+    expect(res.status).toBe(413);
+    const json = await res.json();
+    expect(json.error).toBe("Payload too large");
+  });
+
+  test("returns 413 when body exceeds limit even without content-length", async () => {
+    const handler = createTelegramWebhookHandler(makeConfig());
+    const body = JSON.stringify({ data: "x".repeat(300) });
+    const req = new Request("http://localhost:7830/webhooks/telegram", {
+      method: "POST",
+      body,
+      headers: {
+        "content-type": "application/json",
+        "x-telegram-bot-api-secret-token": "wh-sec",
+      },
+    });
+    const res = await handler(req);
+    expect(res.status).toBe(413);
+  });
+
+  test("accepts payload within limit", async () => {
+    const handler = createTelegramWebhookHandler(
+      makeConfig({ maxWebhookPayloadBytes: 10000 }),
+    );
+    const body = JSON.stringify({ update_id: 1, message: { text: "hi", chat: { id: 1, type: "private" }, from: { id: 1 }, message_id: 1 } });
+    const req = new Request("http://localhost:7830/webhooks/telegram", {
+      method: "POST",
+      body,
+      headers: {
+        "content-type": "application/json",
+        "content-length": String(body.length),
+        "x-telegram-bot-api-secret-token": "wh-sec",
+      },
+    });
+    const res = await handler(req);
+    // Will fail downstream (routing reject) but should NOT be 413
+    expect(res.status).not.toBe(413);
+  });
+});

package/src/__tests__/probes.test.ts

@@ -0,0 +1,94 @@
+import { describe, test, expect, afterAll } from "bun:test";
+
+const PORT = 19831;
+
+const env: Record<string, string> = {
+  TELEGRAM_BOT_TOKEN: "test-tok",
+  TELEGRAM_WEBHOOK_SECRET: "wh-sec",
+  ASSISTANT_RUNTIME_BASE_URL: "http://localhost:7821",
+  GATEWAY_PORT: String(PORT),
+};
+
+const saved: Record<string, string | undefined> = {};
+for (const [k, v] of Object.entries(env)) {
+  saved[k] = process.env[k];
+  process.env[k] = v;
+}
+saved["GATEWAY_RUNTIME_PROXY_ENABLED"] = process.env.GATEWAY_RUNTIME_PROXY_ENABLED;
+delete process.env.GATEWAY_RUNTIME_PROXY_ENABLED;
+
+const { loadConfig } = await import("../config.js");
+const { createTelegramWebhookHandler } = await import(
+  "../http/routes/telegram-webhook.js"
+);
+
+const config = loadConfig();
+
+const handleTelegramWebhook = createTelegramWebhookHandler(
+  config,
+  async () => {},
+);
+
+let draining = false;
+
+const server = Bun.serve({
+  port: PORT,
+  async fetch(req) {
+    const url = new URL(req.url);
+
+    if (url.pathname === "/healthz") {
+      return Response.json({ status: "ok" });
+    }
+
+    if (url.pathname === "/readyz") {
+      if (draining) {
+        return Response.json({ status: "draining" }, { status: 503 });
+      }
+      return Response.json({ status: "ok" });
+    }
+
+    if (url.pathname === "/webhooks/telegram") {
+      return handleTelegramWebhook(req);
+    }
+
+    return Response.json({ error: "Not found" }, { status: 404 });
+  },
+});
+
+afterAll(() => {
+  server.stop(true);
+  for (const [k, v] of Object.entries(saved)) {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  }
+});
+
+describe("/healthz", () => {
+  test("returns 200 with ok status", async () => {
+    const res = await fetch(`http://localhost:${PORT}/healthz`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.status).toBe("ok");
+  });
+});
+
+describe("/readyz", () => {
+  test("returns 200 when not draining", async () => {
+    const res = await fetch(`http://localhost:${PORT}/readyz`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.status).toBe("ok");
+  });
+
+  test("returns 503 when draining", async () => {
+    draining = true;
+    try {
+      const res = await fetch(`http://localhost:${PORT}/readyz`);
+      expect(res.status).toBe(503);
+      const body = await res.json();
+      expect(body.status).toBe("draining");
+    } finally {
+      draining = false;
+    }
+  });
+});

package/src/__tests__/reply-path.test.ts

@@ -0,0 +1,51 @@
+import { describe, test, expect } from "bun:test";
+import {
+  buildTelegramTransportMetadata,
+  TELEGRAM_CHANNEL_TRANSPORT_HINTS,
+  TELEGRAM_CHANNEL_TRANSPORT_UX_BRIEF,
+} from "../http/routes/telegram-webhook.js";
+import { splitText } from "../telegram/send.js";
+
+describe("splitText", () => {
+  test("returns single chunk for short text", () => {
+    const chunks = splitText("Hello!");
+    expect(chunks).toEqual(["Hello!"]);
+  });
+
+  test("returns single chunk for exactly max length", () => {
+    const text = "x".repeat(4000);
+    const chunks = splitText(text);
+    expect(chunks).toHaveLength(1);
+    expect(chunks[0]).toBe(text);
+  });
+
+  test("splits text exceeding max length", () => {
+    const text = "x".repeat(8500);
+    const chunks = splitText(text);
+    expect(chunks).toHaveLength(3);
+    expect(chunks[0]).toHaveLength(4000);
+    expect(chunks[1]).toHaveLength(4000);
+    expect(chunks[2]).toHaveLength(500);
+    expect(chunks.join("")).toBe(text);
+  });
+
+  test("handles empty string", () => {
+    const chunks = splitText("");
+    expect(chunks).toEqual([""]);
+  });
+});
+
+describe("telegram onboarding transport metadata", () => {
+  test("publishes deterministic channel-safe hints", () => {
+    const metadata = buildTelegramTransportMetadata();
+    expect(metadata.hints).toEqual([...TELEGRAM_CHANNEL_TRANSPORT_HINTS]);
+    expect(metadata.hints).toContain("defer-dashboard-only-tasks");
+  });
+
+  test("publishes explicit dashboard deferral UX brief", () => {
+    const metadata = buildTelegramTransportMetadata();
+    expect(metadata.uxBrief).toBe(TELEGRAM_CHANNEL_TRANSPORT_UX_BRIEF);
+    expect(metadata.uxBrief.toLowerCase()).toContain("defer");
+    expect(metadata.uxBrief.toLowerCase()).toContain("dashboard");
+  });
+});

package/src/__tests__/resolve-assistant.test.ts

@@ -0,0 +1,118 @@
+import { describe, test, expect } from "bun:test";
+import { resolveAssistant, isRejection } from "../routing/resolve-assistant.js";
+import type { GatewayConfig } from "../config.js";
+
+function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
+  return {
+    telegramBotToken: "tok",
+    telegramWebhookSecret: "wh-ver",
+    telegramApiBaseUrl: "https://api.telegram.org",
+    assistantRuntimeBaseUrl: "http://localhost:7821",
+    routingEntries: [],
+    defaultAssistantId: undefined,
+    unmappedPolicy: "reject",
+    port: 7830,
+    runtimeBearerToken: undefined,
+    runtimeProxyEnabled: false,
+    runtimeProxyRequireAuth: true,
+    runtimeProxyBearerToken: undefined,
+    shutdownDrainMs: 5000,
+    runtimeTimeoutMs: 30000,
+    runtimeMaxRetries: 2,
+    runtimeInitialBackoffMs: 500,
+    telegramInitialBackoffMs: 1000,
+    telegramMaxRetries: 3,
+    telegramTimeoutMs: 15000,
+    maxWebhookPayloadBytes: 1048576,
+    logFile: { dir: undefined, retentionDays: 30 },
+    maxAttachmentBytes: 20971520,
+    maxAttachmentConcurrency: 3,
+    ...overrides,
+  };
+}
+
+describe("resolveAssistant", () => {
+  test("resolves by chat_id match", () => {
+    const config = makeConfig({
+      routingEntries: [
+        { type: "chat_id", key: "99001", assistantId: "assistant-a" },
+        { type: "user_id", key: "55001", assistantId: "assistant-b" },
+      ],
+    });
+
+    const result = resolveAssistant(config, "99001", "55001");
+    expect(isRejection(result)).toBe(false);
+    if (!isRejection(result)) {
+      expect(result.assistantId).toBe("assistant-a");
+      expect(result.routeSource).toBe("chat_id");
+    }
+  });
+
+  test("falls back to user_id when chat_id does not match", () => {
+    const config = makeConfig({
+      routingEntries: [
+        { type: "chat_id", key: "99999", assistantId: "assistant-a" },
+        { type: "user_id", key: "55001", assistantId: "assistant-b" },
+      ],
+    });
+
+    const result = resolveAssistant(config, "99001", "55001");
+    expect(isRejection(result)).toBe(false);
+    if (!isRejection(result)) {
+      expect(result.assistantId).toBe("assistant-b");
+      expect(result.routeSource).toBe("user_id");
+    }
+  });
+
+  test("falls back to default policy when no explicit match", () => {
+    const config = makeConfig({
+      unmappedPolicy: "default",
+      defaultAssistantId: "assistant-default",
+    });
+
+    const result = resolveAssistant(config, "99001", "55001");
+    expect(isRejection(result)).toBe(false);
+    if (!isRejection(result)) {
+      expect(result.assistantId).toBe("assistant-default");
+      expect(result.routeSource).toBe("default");
+    }
+  });
+
+  test("rejects when policy is reject and no match", () => {
+    const config = makeConfig({
+      unmappedPolicy: "reject",
+    });
+
+    const result = resolveAssistant(config, "99001", "55001");
+    expect(isRejection(result)).toBe(true);
+    if (isRejection(result)) {
+      expect(result.reason).toContain("No route configured");
+    }
+  });
+
+  test("chat_id takes priority over user_id for same assistant", () => {
+    const config = makeConfig({
+      routingEntries: [
+        { type: "user_id", key: "55001", assistantId: "assistant-user" },
+        { type: "chat_id", key: "99001", assistantId: "assistant-chat" },
+      ],
+    });
+
+    const result = resolveAssistant(config, "99001", "55001");
+    expect(isRejection(result)).toBe(false);
+    if (!isRejection(result)) {
+      expect(result.assistantId).toBe("assistant-chat");
+      expect(result.routeSource).toBe("chat_id");
+    }
+  });
+
+  test("rejects with default policy but no default assistant configured", () => {
+    const config = makeConfig({
+      unmappedPolicy: "default",
+      defaultAssistantId: undefined,
+    });
+
+    const result = resolveAssistant(config, "99001", "55001");
+    expect(isRejection(result)).toBe(true);
+  });
+});