@vellumai/vellum-gateway 0.7.0 → 0.7.2

package/src/config-file-utils.ts

@@ -0,0 +1,124 @@
+import { randomBytes } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+
+import { getWorkspaceDir } from "./credential-reader.js";
+
+export const CONFIG_FILENAME = "config.json";
+
+/**
+ * Serializes config writes so concurrent config mutations don't race on
+ * read-modify-write. Each write awaits the previous one before proceeding.
+ *
+ * This chain is shared across all gateway config mutations to prevent
+ * concurrent writes to the same config.json from overwriting each other's
+ * changes.
+ */
+let configWriteChain: Promise<void> = Promise.resolve();
+
+/**
+ * Enqueue a write operation onto the shared config write chain.
+ * The callback runs only after all previously enqueued writes have finished.
+ */
+export function enqueueConfigWrite(
+  fn: () => void | Promise<void>,
+): Promise<void> {
+  const run = configWriteChain.then(fn);
+  configWriteChain = run.catch(() => {});
+  return run;
+}
+
+export type ConfigMutationResult<T> =
+  | { ok: true; value: T }
+  | { ok: false; reason: "malformed"; detail: string };
+
+export function mutateConfigFile<T>(
+  mutate: (data: Record<string, unknown>) => T,
+  options?: {
+    shouldWrite?: (value: T) => boolean;
+    onWritten?: () => void;
+  },
+): Promise<ConfigMutationResult<T>> {
+  let mutationResult: ConfigMutationResult<T> | undefined;
+
+  return enqueueConfigWrite(() => {
+    const result = readConfigFile();
+    if (!result.ok) {
+      mutationResult = result;
+      return;
+    }
+
+    const value = mutate(result.data);
+    const shouldWrite = options?.shouldWrite?.(value) ?? true;
+    if (shouldWrite) {
+      writeConfigFileAtomic(result.data);
+      options?.onWritten?.();
+    }
+    mutationResult = { ok: true, value };
+  }).then(() => {
+    if (!mutationResult) {
+      throw new Error("Config mutation did not produce a result");
+    }
+    return mutationResult;
+  });
+}
+
+export function getConfigPath(): string {
+  return join(getWorkspaceDir(), CONFIG_FILENAME);
+}
+
+export type ConfigReadResult =
+  | { ok: true; data: Record<string, unknown> }
+  | { ok: false; reason: "malformed"; detail: string };
+
+export function readConfigFile(): ConfigReadResult {
+  const cfgPath = getConfigPath();
+  if (!existsSync(cfgPath)) {
+    return { ok: true, data: {} };
+  }
+  try {
+    const raw = readFileSync(cfgPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {
+        ok: false,
+        reason: "malformed",
+        detail: "Config file is not a JSON object",
+      };
+    }
+    return { ok: true, data: parsed };
+  } catch (err) {
+    return { ok: false, reason: "malformed", detail: String(err) };
+  }
+}
+
+export function readConfigFileOrEmpty(options?: {
+  onMalformed?: (detail: string) => void;
+}): Record<string, unknown> {
+  const result = readConfigFile();
+  if (result.ok) return result.data;
+  options?.onMalformed?.(result.detail);
+  return {};
+}
+
+/**
+ * Atomically write the config file: write to a temporary file in the same
+ * directory, then rename. This avoids partial-file corruption if the process
+ * crashes mid-write.
+ */
+export function writeConfigFileAtomic(data: Record<string, unknown>): void {
+  const cfgPath = getConfigPath();
+  const dir = dirname(cfgPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  const tmpPath = join(dir, `.config.${randomBytes(6).toString("hex")}.tmp`);
+  writeFileSync(tmpPath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  renameSync(tmpPath, cfgPath);
+}

package/src/config-file-watcher.ts

@@ -3,49 +3,39 @@
  * Uses the same fs.watch() + debounce pattern as CredentialWatcher.
  */
 
-import { existsSync, readFileSync, watch, type FSWatcher } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, watch, type FSWatcher } from "node:fs";
+import { dirname } from "node:path";
+import {
+  CONFIG_FILENAME,
+  getConfigPath,
+  readConfigFileOrEmpty,
+} from "./config-file-utils.js";
 import { getLogger } from "./logger.js";
-import { getWorkspaceDir } from "./credential-reader.js";
 
 const log = getLogger("config-file-watcher");
 
 const DEBOUNCE_MS = 500;
-const CONFIG_FILENAME = "config.json";
 
 export type ConfigChangeEvent = {
   /** Full parsed config.json data. */
   data: Record<string, unknown>;
   /** Top-level keys whose serialized value changed since the last poll. */
   changedKeys: Set<string>;
+  /**
+   * Shallow object fields that changed for changed top-level object keys.
+   * Non-object replacements are represented by the top-level key only.
+   */
+  changedFields: Map<string, Set<string>>;
 };
 
 export type ConfigChangeCallback = (event: ConfigChangeEvent) => void;
 
-function getConfigPath(): string {
-  return join(getWorkspaceDir(), CONFIG_FILENAME);
-}
-
-function readConfigFile(path: string): Record<string, unknown> {
-  try {
-    if (!existsSync(path)) return {};
-
-    const raw = readFileSync(path, "utf-8");
-    const data = JSON.parse(raw);
-    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
-
-    return data as Record<string, unknown>;
-  } catch (err) {
-    log.debug({ err }, "Failed to read config file");
-    return {};
-  }
-}
-
 export class ConfigFileWatcher {
   private watcher: FSWatcher | null = null;
   private watchingDirectory = false;
   private debounceTimer: ReturnType<typeof setTimeout> | null = null;
   private lastSerialized: Map<string, string> = new Map();
+  private lastValues: Map<string, unknown> = new Map();
   private callback: ConfigChangeCallback;
   private configPath: string;
 
@@ -134,9 +124,14 @@ export class ConfigFileWatcher {
   }
 
   private pollOnce(): void {
-    const data = readConfigFile(this.configPath);
+    const data = readConfigFileOrEmpty({
+      onMalformed: (detail) => {
+        log.debug({ err: detail }, "Failed to read config file");
+      },
+    });
 
     const changedKeys = new Set<string>();
+    const changedFields = new Map<string, Set<string>>();
 
     // Detect changed or added keys
     const allKeys = new Set([
@@ -150,10 +145,19 @@ export class ConfigFileWatcher {
 
       if (newVal !== oldVal) {
         changedKeys.add(key);
+        const fieldChanges = diffObjectFields(
+          this.lastValues.get(key),
+          key in data ? data[key] : undefined,
+        );
+        if (fieldChanges.size > 0) {
+          changedFields.set(key, fieldChanges);
+        }
         if (newVal !== undefined) {
           this.lastSerialized.set(key, newVal);
+          this.lastValues.set(key, data[key]);
         } else {
           this.lastSerialized.delete(key);
+          this.lastValues.delete(key);
         }
       }
     }
@@ -162,6 +166,34 @@ export class ConfigFileWatcher {
 
     log.info({ changedKeys: [...changedKeys] }, "Config file changed");
 
-    this.callback({ data, changedKeys });
+    this.callback({ data, changedKeys, changedFields });
   }
 }
+
+function diffObjectFields(oldValue: unknown, newValue: unknown): Set<string> {
+  if (!isPlainRecord(oldValue) && !isPlainRecord(newValue)) {
+    return new Set();
+  }
+
+  const oldRecord = isPlainRecord(oldValue) ? oldValue : {};
+  const newRecord = isPlainRecord(newValue) ? newValue : {};
+  const changed = new Set<string>();
+  const allKeys = new Set([
+    ...Object.keys(oldRecord),
+    ...Object.keys(newRecord),
+  ]);
+  for (const key of allKeys) {
+    const oldSerialized =
+      key in oldRecord ? JSON.stringify(oldRecord[key]) : undefined;
+    const newSerialized =
+      key in newRecord ? JSON.stringify(newRecord[key]) : undefined;
+    if (oldSerialized !== newSerialized) {
+      changed.add(key);
+    }
+  }
+  return changed;
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}

package/src/config.ts

@@ -11,6 +11,7 @@ export type GatewayConfig = {
   assistantRuntimeBaseUrl: string;
   defaultAssistantId: string | undefined;
   gatewayInternalBaseUrl: string;
+  velayBaseUrl?: string;
   logFile: LogFileConfig;
   maxAttachmentBytes: Record<
     "telegram" | "slack" | "whatsapp" | "default",
@@ -23,7 +24,6 @@ export type GatewayConfig = {
   routingEntries: RoutingEntry[];
   runtimeInitialBackoffMs: number;
   runtimeMaxRetries: number;
-  runtimeProxyEnabled: boolean;
   runtimeProxyRequireAuth: boolean;
   runtimeTimeoutMs: number;
   shutdownDrainMs: number;
@@ -93,6 +93,7 @@ export function loadConfig(): GatewayConfig {
   const assistantRuntimeBaseUrl = `http://${assistantHost}:${runtimePort}`;
 
   const gatewayInternalBaseUrl = `http://127.0.0.1:${port}`;
+  const velayBaseUrl = process.env.VELAY_BASE_URL?.trim() || undefined;
 
   // Read operational settings from workspace config (Docker) or env vars (CLI).
   const wsConfig = readWorkspaceConfig();
@@ -101,10 +102,6 @@ export function loadConfig(): GatewayConfig {
   // Env vars take precedence over workspace config values. This allows the
   // CLI to pass gateway settings directly via the process environment instead
   // of writing to the workspace config file.
-  const runtimeProxyEnabled =
-    process.env.RUNTIME_PROXY_ENABLED === "true" ||
-    gw.runtimeProxyEnabled === true ||
-    gw.runtimeProxyEnabled === "true";
   const runtimeProxyRequireAuth =
     process.env.RUNTIME_PROXY_REQUIRE_AUTH !== undefined
       ? process.env.RUNTIME_PROXY_REQUIRE_AUTH !== "false"
@@ -147,8 +144,8 @@ export function loadConfig(): GatewayConfig {
       routingEntryCount: routingEntries.length,
       unmappedPolicy,
       hasDefaultAssistant: !!defaultAssistantId,
+      hasVelayBaseUrl: !!velayBaseUrl,
       port,
-      runtimeProxyEnabled,
       runtimeProxyRequireAuth,
       trustProxy: false,
     },
@@ -159,6 +156,7 @@ export function loadConfig(): GatewayConfig {
     assistantRuntimeBaseUrl,
     defaultAssistantId,
     gatewayInternalBaseUrl,
+    velayBaseUrl,
     logFile,
     maxAttachmentBytes: {
       telegram: 20 * 1024 * 1024, // Telegram Bot API getFile (download) limit
@@ -173,7 +171,6 @@ export function loadConfig(): GatewayConfig {
     routingEntries,
     runtimeInitialBackoffMs: 500,
     runtimeMaxRetries: 2,
-    runtimeProxyEnabled,
     runtimeProxyRequireAuth,
     runtimeTimeoutMs: 30000,
     shutdownDrainMs: 5000,

package/src/db/connection.ts

@@ -1,7 +1,8 @@
 import { Database } from "bun:sqlite";
 import { drizzle } from "drizzle-orm/bun-sqlite";
-import { existsSync, mkdirSync, renameSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdirSync, realpathSync, renameSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { getGatewaySecurityDir, getLegacyRootDir } from "../paths.js";
 import * as schema from "./schema.js";
 import { seedTrustRulesFromRegistry } from "./seed-trust-rules.js";
@@ -71,6 +72,64 @@ async function pushSchemaNoPrompt(
 
 let db: GatewayDb | null = null;
 
+function canonicalizePathThroughExistingParent(path: string): string {
+  const resolvedPath = resolve(path);
+  const pendingSegments: string[] = [];
+  let currentPath = resolvedPath;
+
+  while (true) {
+    try {
+      return resolve(realpathSync(currentPath), ...pendingSegments.reverse());
+    } catch {
+      const parentPath = dirname(currentPath);
+      if (parentPath === currentPath) {
+        return resolvedPath;
+      }
+      pendingSegments.push(basename(currentPath));
+      currentPath = parentPath;
+    }
+  }
+}
+
+function assertTestDbIsIsolated(): void {
+  if (
+    process.env.NODE_ENV !== "test" ||
+    process.env.VELLUM_ALLOW_REAL_GATEWAY_SECURITY_IN_TESTS === "1"
+  ) {
+    return;
+  }
+
+  const securityDir = process.env.GATEWAY_SECURITY_DIR?.trim();
+  if (!securityDir) {
+    throw new Error(
+      [
+        "Refusing to open the gateway DB during tests without GATEWAY_SECURITY_DIR.",
+        "Run gateway tests from the gateway package so the test preload can isolate state:",
+        "  cd gateway && bun test src/path/to/file.test.ts",
+      ].join("\n"),
+    );
+  }
+
+  const resolvedSecurityDir =
+    canonicalizePathThroughExistingParent(securityDir);
+  const realSecurityDir = canonicalizePathThroughExistingParent(
+    process.env.VELLUM_TEST_REAL_GATEWAY_SECURITY_DIR?.trim() ||
+      join(homedir(), ".vellum", "protected"),
+  );
+  if (
+    resolvedSecurityDir === realSecurityDir ||
+    resolvedSecurityDir.startsWith(realSecurityDir + sep)
+  ) {
+    throw new Error(
+      [
+        "Refusing to open the real gateway security DB during tests.",
+        `GATEWAY_SECURITY_DIR resolved to ${resolvedSecurityDir}.`,
+        "Use a temp gateway security directory for tests instead.",
+      ].join("\n"),
+    );
+  }
+}
+
 /**
  * One-time migration: move gateway.sqlite from the legacy path
  * (~/.vellum/data/gateway.sqlite) to the new PVC-backed path
@@ -100,12 +159,15 @@ function migrateLegacyDb(newPath: string): void {
 }
 
 function getDbPath(): string {
+  assertTestDbIsIsolated();
   const securityDir = getGatewaySecurityDir();
   if (!existsSync(securityDir)) {
     mkdirSync(securityDir, { recursive: true });
   }
   const dbPath = join(securityDir, "gateway.sqlite");
-  migrateLegacyDb(dbPath);
+  if (process.env.NODE_ENV !== "test") {
+    migrateLegacyDb(dbPath);
+  }
   return dbPath;
 }
 

package/src/db/contact-store.ts

@@ -1,4 +1,4 @@
-import { desc, eq, and } from "drizzle-orm";
+import { desc, eq, and, sql } from "drizzle-orm";
 import { type GatewayDb, getGatewayDb } from "./connection.js";
 import { contacts, contactChannels } from "./schema.js";
 
@@ -65,4 +65,33 @@ export class ContactStore {
       .orderBy(contactChannels.createdAt)
       .all();
   }
+
+  /**
+   * Set lastSeenAt to now for a channel (gateway DB only).
+   */
+  touchChannelLastSeen(channelId: string): void {
+    const now = Date.now();
+    this.db
+      .update(contactChannels)
+      .set({ lastSeenAt: now, updatedAt: now })
+      .where(eq(contactChannels.id, channelId))
+      .run();
+  }
+
+  /**
+   * Increment interaction count and set lastInteraction timestamp
+   * (gateway DB only).
+   */
+  touchContactInteraction(channelId: string): void {
+    const now = Date.now();
+    this.db
+      .update(contactChannels)
+      .set({
+        lastInteraction: now,
+        interactionCount: sql`${contactChannels.interactionCount} + 1`,
+        updatedAt: now,
+      })
+      .where(eq(contactChannels.id, channelId))
+      .run();
+  }
 }

package/src/db/data-migrations/index.ts

@@ -21,6 +21,7 @@ import { getLogger } from "../../logger.js";
 
 import * as m0001 from "./m0001-guardian-init-lock.js";
 import * as m0002 from "./m0002-actor-token-tables-to-gateway.js";
+import * as m0003 from "./m0003-recover-backup-key.js";
 
 const log = getLogger("data-migrations");
 
@@ -34,6 +35,7 @@ type MigrationModule = {
 const MIGRATIONS: { key: string; mod: MigrationModule }[] = [
   { key: "m0001-guardian-init-lock", mod: m0001 },
   { key: "m0002-actor-token-tables-to-gateway", mod: m0002 },
+  { key: "m0003-recover-backup-key", mod: m0003 },
 ];
 
 /**

package/src/db/data-migrations/m0003-recover-backup-key.ts

@@ -0,0 +1,71 @@
+/**
+ * One-time migration: recover backup.key into GATEWAY_SECURITY_DIR.
+ *
+ * The backup key may exist at either of two legacy locations depending on
+ * which version of the assistant created it:
+ *
+ *   1. ~/.vellum/workspace/.backup.key  — migration 061 moved it here
+ *   2. ~/.vellum/protected/backup.key   — original location (pre-061)
+ *
+ * This migration copies the key from whichever location has it into the
+ * canonical gateway security directory (GATEWAY_SECURITY_DIR), which in
+ * local mode resolves to ~/.vellum/protected/ and in Docker mode to a
+ * dedicated volume. If the key already exists at the target, we leave it
+ * alone — the gateway's ensureBackupKey handles first-time generation.
+ */
+
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+import { getLogger } from "../../logger.js";
+import { getGatewaySecurityDir, getLegacyRootDir, getWorkspaceDir } from "../../paths.js";
+
+import type { MigrationResult } from "./index.js";
+
+const log = getLogger("m0003-recover-backup-key");
+
+const BACKUP_KEY_FILENAME = "backup.key";
+
+export function up(): MigrationResult {
+  const targetPath = join(getGatewaySecurityDir(), BACKUP_KEY_FILENAME);
+
+  if (existsSync(targetPath)) {
+    log.info({ targetPath }, "Backup key already exists at target — nothing to do");
+    return "done";
+  }
+
+  // Check both possible source locations
+  const workspacePath = join(getWorkspaceDir(), ".backup.key");
+  const legacyProtectedPath = join(getLegacyRootDir(), "protected", BACKUP_KEY_FILENAME);
+
+  // Prefer the workspace copy (migration 061 moved it there most recently)
+  const sourceCandidates = [workspacePath, legacyProtectedPath];
+
+  for (const source of sourceCandidates) {
+    // Skip if source is the same file as target (local mode where
+    // GATEWAY_SECURITY_DIR == ~/.vellum/protected/)
+    if (resolve(source) === resolve(targetPath)) {
+      log.info({ source }, "Source is the same as target — skipping");
+      continue;
+    }
+
+    if (!existsSync(source)) continue;
+
+    try {
+      mkdirSync(dirname(targetPath), { recursive: true, mode: 0o700 });
+      copyFileSync(source, targetPath);
+      log.info({ from: source, to: targetPath }, "Recovered backup key");
+      return "done";
+    } catch (err) {
+      log.error({ err, source }, "Failed to copy backup key — will retry");
+      return "skip";
+    }
+  }
+
+  log.info("No existing backup key found at either legacy location — ensureBackupKey will generate one");
+  return "done";
+}
+
+export function down(): MigrationResult {
+  return "done";
+}

package/src/db/schema.ts

@@ -21,16 +21,45 @@ import {
 
 export const slackActiveThreads = sqliteTable("slack_active_threads", {
   threadTs: text("thread_ts").primaryKey(),
+  // Channel hosting the active thread. Nullable because SQLite's
+  // ALTER TABLE ADD COLUMN cannot add a NOT NULL column without a default
+  // (https://sqlite.org/lang_altertable.html#alter_table_add_column);
+  // legacy rows pre-dating this column carry NULL until they age out of
+  // the thread TTL window, and reconnect catch-up enumeration filters them.
+  channelId: text("channel_id"),
   trackedAt: integer("tracked_at").notNull(),
   expiresAt: integer("expires_at").notNull(),
 });
 
 export const slackSeenEvents = sqliteTable("slack_seen_events", {
+  // Generic dedup key. Holds either a Slack `event_id` (live path) or a
+  // synthetic `msg:${channel}:${ts}` key (reconnect catch-up path) so both
+  // paths dedup symmetrically against the same row. The physical column
+  // name `event_id` is a historical artefact; semantically this is a
+  // dedup key, not strictly an event ID.
   eventId: text("event_id").primaryKey(),
   seenAt: integer("seen_at").notNull(),
   expiresAt: integer("expires_at").notNull(),
 });
 
+/**
+ * Persistent high-watermark for Slack Socket Mode catch-up.
+ *
+ * Slack does not buffer events for disconnected Socket Mode clients
+ * (https://api.slack.com/apis/socket-mode), so missed @mentions and DMs
+ * during a reconnect window are recovered via `conversations.history` /
+ * `conversations.replies`. This row stores the latest accepted event
+ * timestamp so catch-up knows where to resume from. A single row keyed
+ * by `'global'` is used; per-channel watermarks would add precision but
+ * are not necessary because the compound `msg:${channel}:${ts}` dedup
+ * absorbs the resulting overlap.
+ */
+export const slackLastSeenTs = sqliteTable("slack_last_seen_ts", {
+  key: text("key").primaryKey(),
+  ts: text("ts").notNull(),
+  updatedAt: integer("updated_at").notNull(),
+});
+
 // ---------------------------------------------------------------------------
 // Data migrations
 // ---------------------------------------------------------------------------
@@ -100,6 +129,7 @@ export const autoApproveThresholds = sqliteTable("auto_approve_thresholds", {
   id: integer("id").primaryKey().default(1),
   interactive: text("interactive").notNull().default("medium"),
   autonomous: text("autonomous").notNull().default("low"),
+  headless: text("headless").notNull().default("none"),
   updatedAt: text("updated_at")
     .notNull()
     .default(sql`(datetime('now'))`),
@@ -195,6 +225,68 @@ export const trustRules = sqliteTable(
   ],
 );
 
+// ---------------------------------------------------------------------------
+// Guardian verification rate limits
+// ---------------------------------------------------------------------------
+
+export const channelGuardianRateLimits = sqliteTable(
+  "channel_guardian_rate_limits",
+  {
+    id: text("id").primaryKey(),
+    channel: text("channel").notNull(),
+    actorExternalUserId: text("actor_external_user_id").notNull(),
+    actorChatId: text("actor_chat_id").notNull(),
+    attemptTimestampsJson: text("attempt_timestamps_json")
+      .notNull()
+      .default("[]"),
+    lockedUntil: integer("locked_until"),
+    createdAt: integer("created_at").notNull(),
+    updatedAt: integer("updated_at").notNull(),
+  },
+  (table) => [
+    uniqueIndex("idx_gw_channel_guardian_rate_limits_actor").on(
+      table.channel,
+      table.actorExternalUserId,
+      table.actorChatId,
+    ),
+  ],
+);
+
+// ---------------------------------------------------------------------------
+// Channel verification sessions (dual-write mirror of assistant table)
+// ---------------------------------------------------------------------------
+
+export const channelVerificationSessions = sqliteTable(
+  "channel_verification_sessions",
+  {
+    id: text("id").primaryKey(),
+    channel: text("channel").notNull(),
+    challengeHash: text("challenge_hash").notNull(),
+    expiresAt: integer("expires_at").notNull(),
+    status: text("status").notNull().default("pending"),
+    sourceConversationId: text("source_conversation_id"),
+    consumedByExternalUserId: text("consumed_by_external_user_id"),
+    consumedByChatId: text("consumed_by_chat_id"),
+    expectedExternalUserId: text("expected_external_user_id"),
+    expectedChatId: text("expected_chat_id"),
+    expectedPhoneE164: text("expected_phone_e164"),
+    identityBindingStatus: text("identity_binding_status").default("bound"),
+    destinationAddress: text("destination_address"),
+    lastSentAt: integer("last_sent_at"),
+    sendCount: integer("send_count").default(0),
+    nextResendAt: integer("next_resend_at"),
+    codeDigits: integer("code_digits").default(6),
+    maxAttempts: integer("max_attempts").default(3),
+    verificationPurpose: text("verification_purpose").default("guardian"),
+    bootstrapTokenHash: text("bootstrap_token_hash"),
+    createdAt: integer("created_at").notNull(),
+    updatedAt: integer("updated_at").notNull(),
+  },
+  (table) => [
+    index("idx_gw_cvs_channel_status").on(table.channel, table.status),
+  ],
+);
+
 // ---------------------------------------------------------------------------
 // Channel denial reply log (rate-limiting outbound denial replies)
 // ---------------------------------------------------------------------------