@vellumai/vellum-gateway 0.4.6 → 0.4.7

package/ARCHITECTURE.md

@@ -88,6 +88,9 @@ Guardian verification endpoints are exposed directly by the gateway and forwarde
 | POST | `/v1/integrations/guardian/outbound/start` |
 | POST | `/v1/integrations/guardian/outbound/resend` |
 | POST | `/v1/integrations/guardian/outbound/cancel` |
+| POST | `/v1/integrations/guardian/vellum/refresh` |
+
+The `/vellum/refresh` endpoint is the only public ingress for rotating actor + refresh token credentials. Clients must call this through the gateway; the runtime endpoint is not directly exposed. The gateway validates the caller's bearer token and forwards to the runtime, which handles refresh token validation, rotation, and replay detection (see [`assistant/ARCHITECTURE.md`](../assistant/ARCHITECTURE.md) for refresh token lifecycle details).
 
 **Authentication boundary:**
 

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "type": "module",
+  "exports": {
+    "./twilio/verify": "./src/twilio/verify.ts",
+    "./package.json": "./package.json"
+  },
   "scripts": {
     "dev": "bun run --watch src/index.ts",
     "dev:proxy": "GATEWAY_RUNTIME_PROXY_ENABLED=true GATEWAY_RUNTIME_PROXY_REQUIRE_AUTH=false bun run --watch src/index.ts",

package/src/http/routes/guardian-control-plane-proxy.ts

@@ -107,5 +107,13 @@ export function createGuardianControlPlaneProxyHandler(config: GatewayConfig) {
     async handleCancelGuardianOutbound(req: Request): Promise<Response> {
       return proxyToRuntime(req, "/v1/integrations/guardian/outbound/cancel", "");
     },
+
+    async handleGuardianVellumBootstrap(req: Request): Promise<Response> {
+      return proxyToRuntime(req, "/v1/integrations/guardian/vellum/bootstrap", "");
+    },
+
+    async handleGuardianRefresh(req: Request): Promise<Response> {
+      return proxyToRuntime(req, "/v1/integrations/guardian/vellum/refresh", "");
+    },
   };
 }

package/src/index.ts

@@ -522,6 +522,13 @@ function main() {
         }
       }
 
+      // ── Guardian vellum bootstrap (actor token) ──
+      if (url.pathname === "/v1/integrations/guardian/vellum/bootstrap" && req.method === "POST") {
+        const authError = requireRuntimeBearerAuth();
+        if (authError) return authError;
+        return guardianControlPlaneProxy.handleGuardianVellumBootstrap(tracedReq);
+      }
+
       // ── Guardian verification control-plane proxy ──
       if (
         (url.pathname === "/v1/integrations/guardian/challenge" && req.method === "POST")
@@ -548,6 +555,13 @@ function main() {
         return guardianControlPlaneProxy.handleCancelGuardianOutbound(tracedReq);
       }
 
+      // ── Guardian vellum refresh proxy ──
+      if (url.pathname === "/v1/integrations/guardian/vellum/refresh" && req.method === "POST") {
+        const authError = requireRuntimeBearerAuth();
+        if (authError) return authError;
+        return guardianControlPlaneProxy.handleGuardianRefresh(tracedReq);
+      }
+
       // ── Twilio integration control-plane proxy ──
       if (
         (url.pathname === "/v1/integrations/twilio/config" && req.method === "GET")

package/src/twilio/verify.ts

@@ -1,7 +1,7 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 /**
- * Validates a Twilio X-Twilio-Signature header using HMAC-SHA1.
+ * Compute a Twilio-compatible HMAC-SHA1 signature.
  *
  * Algorithm (from Twilio docs):
  * 1. Take the full URL of the request.
@@ -9,25 +9,35 @@ import { createHmac, timingSafeEqual } from "node:crypto";
  * 3. Concatenate the URL with each key-value pair (key + value, no delimiters).
  * 4. HMAC-SHA1 the result using the auth token as the key.
  * 5. Base64-encode the hash.
- * 6. Compare to the X-Twilio-Signature header value.
  */
-export function verifyTwilioSignature(
+export function computeTwilioSignature(
   url: string,
   params: Record<string, string>,
-  signature: string,
   authToken: string,
-): boolean {
+): string {
   const sortedKeys = Object.keys(params).sort();
   let data = url;
   for (const key of sortedKeys) {
     data += key + params[key];
   }
 
-  const computed = createHmac("sha1", authToken)
+  return createHmac("sha1", authToken)
     .update(data)
     .digest("base64");
+}
+
+/**
+ * Verify a Twilio X-Twilio-Signature header using HMAC-SHA1 with
+ * constant-time comparison to prevent timing attacks.
+ */
+export function verifyTwilioSignature(
+  url: string,
+  params: Record<string, string>,
+  signature: string,
+  authToken: string,
+): boolean {
+  const computed = computeTwilioSignature(url, params, authToken);
 
-  // Constant-time comparison to prevent timing attacks
   const a = Buffer.from(computed);
   const b = Buffer.from(signature);
   if (a.length !== b.length) return false;