@vellumai/assistant 0.11.7-staging.1 → 0.11.7

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/rpc.ts

@@ -16,6 +16,13 @@
  * - `delete_credential` — Delete a credential by account name
  * - `list_credentials` — List all credential account names
  * - `bulk_set_credentials` — Store multiple credentials at once
+ *
+ * **Credential records** (non-secret identity + policy)
+ * - `get_credential_record` — Retrieve a credential record by account name
+ * - `set_credential_record` — Store or update a credential record
+ * - `delete_credential_record` — Delete a credential record by account name
+ * - `list_credential_records` — List all credential records
+ * - `bulk_set_credential_records` — Store multiple credential records at once
  */
 
 import { z } from "zod";
@@ -38,6 +45,16 @@ export const CesRpcMethod = {
   ListCredentials: "list_credentials",
   /** Bulk-import credentials (set multiple at once). */
   BulkSetCredentials: "bulk_set_credentials",
+  /** Retrieve a single credential record (identity + policy) by account name. */
+  GetCredentialRecord: "get_credential_record",
+  /** Store or update a credential record by account name. */
+  SetCredentialRecord: "set_credential_record",
+  /** Delete a credential record by account name. */
+  DeleteCredentialRecord: "delete_credential_record",
+  /** List all credential records. */
+  ListCredentialRecords: "list_credential_records",
+  /** Bulk-import credential records. */
+  BulkSetCredentialRecords: "bulk_set_credential_records",
 } as const;
 
 export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
@@ -168,6 +185,123 @@ export type BulkSetCredentialsResponse = z.infer<
   typeof BulkSetCredentialsResponseSchema
 >;
 
+// ---------------------------------------------------------------------------
+// Credential records (identity + policy, never secret values)
+// ---------------------------------------------------------------------------
+
+export const CredentialInjectionTemplateSchema = z.object({
+  hostPattern: z.string(),
+  injectionType: z.enum(["header", "query"]),
+  headerName: z.string().optional(),
+  valuePrefix: z.string().optional(),
+  queryParamName: z.string().optional(),
+  composeWith: z
+    .object({
+      service: z.string(),
+      field: z.string(),
+      separator: z.string(),
+    })
+    .optional(),
+  valueTransform: z.enum(["base64"]).optional(),
+});
+export type CredentialInjectionTemplate = z.infer<
+  typeof CredentialInjectionTemplateSchema
+>;
+
+export const CredentialRecordSchema = z.object({
+  credentialId: z.string(),
+  service: z.string(),
+  field: z.string(),
+  allowedTools: z.array(z.string()),
+  allowedDomains: z.array(z.string()),
+  usageDescription: z.string().optional(),
+  alias: z.string().optional(),
+  injectionTemplates: z.array(CredentialInjectionTemplateSchema).optional(),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type CredentialRecord = z.infer<typeof CredentialRecordSchema>;
+
+export const GetCredentialRecordSchema = z.object({
+  /** The account name to look up (`credential/{service}/{field}`). */
+  account: z.string(),
+});
+export type GetCredentialRecord = z.infer<typeof GetCredentialRecordSchema>;
+
+export const GetCredentialRecordResponseSchema = z.object({
+  found: z.boolean(),
+  record: CredentialRecordSchema.optional(),
+});
+export type GetCredentialRecordResponse = z.infer<
+  typeof GetCredentialRecordResponseSchema
+>;
+
+export const SetCredentialRecordSchema = z.object({
+  account: z.string(),
+  record: CredentialRecordSchema,
+});
+export type SetCredentialRecord = z.infer<typeof SetCredentialRecordSchema>;
+
+export const SetCredentialRecordResponseSchema = z.object({
+  ok: z.boolean(),
+});
+export type SetCredentialRecordResponse = z.infer<
+  typeof SetCredentialRecordResponseSchema
+>;
+
+export const DeleteCredentialRecordSchema = z.object({
+  account: z.string(),
+});
+export type DeleteCredentialRecord = z.infer<
+  typeof DeleteCredentialRecordSchema
+>;
+
+export const DeleteCredentialRecordResponseSchema = z.object({
+  result: z.enum(["deleted", "not-found", "error"]),
+});
+export type DeleteCredentialRecordResponse = z.infer<
+  typeof DeleteCredentialRecordResponseSchema
+>;
+
+export const ListCredentialRecordsSchema = z.object({});
+export type ListCredentialRecords = z.infer<typeof ListCredentialRecordsSchema>;
+
+export const ListCredentialRecordsResponseSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type ListCredentialRecordsResponse = z.infer<
+  typeof ListCredentialRecordsResponseSchema
+>;
+
+export const BulkSetCredentialRecordsSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type BulkSetCredentialRecords = z.infer<
+  typeof BulkSetCredentialRecordsSchema
+>;
+
+export const BulkSetCredentialRecordsResponseSchema = z.object({
+  results: z.array(
+    z.object({
+      account: z.string(),
+      ok: z.boolean(),
+    }),
+  ),
+});
+export type BulkSetCredentialRecordsResponse = z.infer<
+  typeof BulkSetCredentialRecordsResponseSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Full RPC contract type map
 // ---------------------------------------------------------------------------
@@ -201,6 +335,26 @@ export interface CesRpcContract {
     request: BulkSetCredentials;
     response: BulkSetCredentialsResponse;
   };
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecord;
+    response: GetCredentialRecordResponse;
+  };
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecord;
+    response: SetCredentialRecordResponse;
+  };
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecord;
+    response: DeleteCredentialRecordResponse;
+  };
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecords;
+    response: ListCredentialRecordsResponse;
+  };
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecords;
+    response: BulkSetCredentialRecordsResponse;
+  };
 }
 
 /**
@@ -231,4 +385,24 @@ export const CesRpcSchemas = {
     request: BulkSetCredentialsSchema,
     response: BulkSetCredentialsResponseSchema,
   },
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecordSchema,
+    response: GetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecordSchema,
+    response: SetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecordSchema,
+    response: DeleteCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecordsSchema,
+    response: ListCredentialRecordsResponseSchema,
+  },
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecordsSchema,
+    response: BulkSetCredentialRecordsResponseSchema,
+  },
 } as const;

package/node_modules/@vellumai/ces-client/src/http-credentials.ts

@@ -16,10 +16,14 @@
  * Auth: Bearer token from a caller-supplied config.
  */
 
+import type { CredentialRecord } from "@vellumai/service-contracts/credential-rpc";
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
 
+export type { CredentialRecord };
+
 /** Result of a credential get operation. */
 export interface CesCredentialGetResult {
   value: string | undefined;
@@ -111,6 +115,28 @@ export interface CesHttpCredentialClient {
 
   /** List all credential account names. */
   list(): Promise<CesCredentialListResult>;
+
+  /** Retrieve a credential record (identity + policy) by account name. */
+  getRecord(
+    account: string,
+  ): Promise<{ record: CredentialRecord | undefined; unreachable: boolean }>;
+
+  /** Store or update a credential record. */
+  setRecord(account: string, record: CredentialRecord): Promise<boolean>;
+
+  /** Delete a credential record by account name. */
+  deleteRecord(account: string): Promise<CesDeleteResult>;
+
+  /** List all credential records. */
+  listRecords(): Promise<{
+    records: Array<{ account: string; record: CredentialRecord }>;
+    unreachable: boolean;
+  }>;
+
+  /** Bulk-set credential records. */
+  bulkSetRecords(
+    records: Array<{ account: string; record: CredentialRecord }>,
+  ): Promise<Array<{ account: string; ok: boolean }>>;
 }
 
 // ---------------------------------------------------------------------------
@@ -292,5 +318,140 @@ export function createCesHttpCredentialClient(
         return { accounts: [], unreachable: true };
       }
     },
+
+    async getRecord(account: string) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "GET",
+          `/v1/metadata/${encodeURIComponent(account)}`,
+        );
+        if (!res) {
+          return { record: undefined, unreachable: true };
+        }
+        if (res.status === 404) {
+          return { record: undefined, unreachable: false };
+        }
+        if (!res.ok) {
+          logger.warn(
+            { account, status: res.status },
+            "CES credential record get returned non-OK status",
+          );
+          return { record: undefined, unreachable: true };
+        }
+        const data = (await res.json()) as { record?: CredentialRecord };
+        return { record: data.record, unreachable: false };
+      } catch (err) {
+        logger.warn(
+          { err, account } as Record<string, unknown>,
+          "CES credential record get threw unexpectedly",
+        );
+        return { record: undefined, unreachable: true };
+      }
+    },
+
+    async setRecord(account: string, record: CredentialRecord) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "PUT",
+          `/v1/metadata/${encodeURIComponent(account)}`,
+          { record },
+        );
+        return !!res?.ok;
+      } catch (err) {
+        logger.warn(
+          { err, account } as Record<string, unknown>,
+          "CES credential record set threw unexpectedly",
+        );
+        return false;
+      }
+    },
+
+    async deleteRecord(account: string) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "DELETE",
+          `/v1/metadata/${encodeURIComponent(account)}`,
+        );
+        if (!res) {
+          return "error";
+        }
+        if (res.status === 404) {
+          return "not-found";
+        }
+        if (!res.ok) {
+          return "error";
+        }
+        return "deleted";
+      } catch (err) {
+        logger.warn(
+          { err, account } as Record<string, unknown>,
+          "CES credential record delete threw unexpectedly",
+        );
+        return "error";
+      }
+    },
+
+    async listRecords() {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "GET",
+          "/v1/metadata",
+        );
+        if (!res) {
+          return { records: [], unreachable: true };
+        }
+        if (!res.ok) {
+          return { records: [], unreachable: true };
+        }
+        const data = (await res.json()) as {
+          records?: Array<{ account: string; record: CredentialRecord }>;
+        };
+        return { records: data.records ?? [], unreachable: false };
+      } catch (err) {
+        logger.warn(
+          { err } as Record<string, unknown>,
+          "CES credential record list threw unexpectedly",
+        );
+        return { records: [], unreachable: true };
+      }
+    },
+
+    async bulkSetRecords(
+      records: Array<{ account: string; record: CredentialRecord }>,
+    ) {
+      try {
+        const res = await cesRequest(
+          config,
+          logger,
+          "POST",
+          "/v1/metadata/bulk",
+          { records },
+        );
+        if (!res?.ok) {
+          return records.map((entry) => ({
+            account: entry.account,
+            ok: false,
+          }));
+        }
+        const data = (await res.json()) as {
+          results: Array<{ account: string; ok: boolean }>;
+        };
+        return data.results;
+      } catch (err) {
+        logger.warn(
+          { err } as Record<string, unknown>,
+          "CES credential record bulk set threw unexpectedly",
+        );
+        return records.map((entry) => ({ account: entry.account, ok: false }));
+      }
+    },
   };
 }

package/node_modules/@vellumai/ces-client/src/index.ts

@@ -18,6 +18,7 @@ export {
   type CesCredentialGetResult,
   type CesCredentialListResult,
   type CesDeleteResult,
+  type CredentialRecord,
 } from "./http-credentials.js";
 
 export {

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/rpc.ts

@@ -16,6 +16,13 @@
  * - `delete_credential` — Delete a credential by account name
  * - `list_credentials` — List all credential account names
  * - `bulk_set_credentials` — Store multiple credentials at once
+ *
+ * **Credential records** (non-secret identity + policy)
+ * - `get_credential_record` — Retrieve a credential record by account name
+ * - `set_credential_record` — Store or update a credential record
+ * - `delete_credential_record` — Delete a credential record by account name
+ * - `list_credential_records` — List all credential records
+ * - `bulk_set_credential_records` — Store multiple credential records at once
  */
 
 import { z } from "zod";
@@ -38,6 +45,16 @@ export const CesRpcMethod = {
   ListCredentials: "list_credentials",
   /** Bulk-import credentials (set multiple at once). */
   BulkSetCredentials: "bulk_set_credentials",
+  /** Retrieve a single credential record (identity + policy) by account name. */
+  GetCredentialRecord: "get_credential_record",
+  /** Store or update a credential record by account name. */
+  SetCredentialRecord: "set_credential_record",
+  /** Delete a credential record by account name. */
+  DeleteCredentialRecord: "delete_credential_record",
+  /** List all credential records. */
+  ListCredentialRecords: "list_credential_records",
+  /** Bulk-import credential records. */
+  BulkSetCredentialRecords: "bulk_set_credential_records",
 } as const;
 
 export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
@@ -168,6 +185,123 @@ export type BulkSetCredentialsResponse = z.infer<
   typeof BulkSetCredentialsResponseSchema
 >;
 
+// ---------------------------------------------------------------------------
+// Credential records (identity + policy, never secret values)
+// ---------------------------------------------------------------------------
+
+export const CredentialInjectionTemplateSchema = z.object({
+  hostPattern: z.string(),
+  injectionType: z.enum(["header", "query"]),
+  headerName: z.string().optional(),
+  valuePrefix: z.string().optional(),
+  queryParamName: z.string().optional(),
+  composeWith: z
+    .object({
+      service: z.string(),
+      field: z.string(),
+      separator: z.string(),
+    })
+    .optional(),
+  valueTransform: z.enum(["base64"]).optional(),
+});
+export type CredentialInjectionTemplate = z.infer<
+  typeof CredentialInjectionTemplateSchema
+>;
+
+export const CredentialRecordSchema = z.object({
+  credentialId: z.string(),
+  service: z.string(),
+  field: z.string(),
+  allowedTools: z.array(z.string()),
+  allowedDomains: z.array(z.string()),
+  usageDescription: z.string().optional(),
+  alias: z.string().optional(),
+  injectionTemplates: z.array(CredentialInjectionTemplateSchema).optional(),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type CredentialRecord = z.infer<typeof CredentialRecordSchema>;
+
+export const GetCredentialRecordSchema = z.object({
+  /** The account name to look up (`credential/{service}/{field}`). */
+  account: z.string(),
+});
+export type GetCredentialRecord = z.infer<typeof GetCredentialRecordSchema>;
+
+export const GetCredentialRecordResponseSchema = z.object({
+  found: z.boolean(),
+  record: CredentialRecordSchema.optional(),
+});
+export type GetCredentialRecordResponse = z.infer<
+  typeof GetCredentialRecordResponseSchema
+>;
+
+export const SetCredentialRecordSchema = z.object({
+  account: z.string(),
+  record: CredentialRecordSchema,
+});
+export type SetCredentialRecord = z.infer<typeof SetCredentialRecordSchema>;
+
+export const SetCredentialRecordResponseSchema = z.object({
+  ok: z.boolean(),
+});
+export type SetCredentialRecordResponse = z.infer<
+  typeof SetCredentialRecordResponseSchema
+>;
+
+export const DeleteCredentialRecordSchema = z.object({
+  account: z.string(),
+});
+export type DeleteCredentialRecord = z.infer<
+  typeof DeleteCredentialRecordSchema
+>;
+
+export const DeleteCredentialRecordResponseSchema = z.object({
+  result: z.enum(["deleted", "not-found", "error"]),
+});
+export type DeleteCredentialRecordResponse = z.infer<
+  typeof DeleteCredentialRecordResponseSchema
+>;
+
+export const ListCredentialRecordsSchema = z.object({});
+export type ListCredentialRecords = z.infer<typeof ListCredentialRecordsSchema>;
+
+export const ListCredentialRecordsResponseSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type ListCredentialRecordsResponse = z.infer<
+  typeof ListCredentialRecordsResponseSchema
+>;
+
+export const BulkSetCredentialRecordsSchema = z.object({
+  records: z.array(
+    z.object({
+      account: z.string(),
+      record: CredentialRecordSchema,
+    }),
+  ),
+});
+export type BulkSetCredentialRecords = z.infer<
+  typeof BulkSetCredentialRecordsSchema
+>;
+
+export const BulkSetCredentialRecordsResponseSchema = z.object({
+  results: z.array(
+    z.object({
+      account: z.string(),
+      ok: z.boolean(),
+    }),
+  ),
+});
+export type BulkSetCredentialRecordsResponse = z.infer<
+  typeof BulkSetCredentialRecordsResponseSchema
+>;
+
 // ---------------------------------------------------------------------------
 // Full RPC contract type map
 // ---------------------------------------------------------------------------
@@ -201,6 +335,26 @@ export interface CesRpcContract {
     request: BulkSetCredentials;
     response: BulkSetCredentialsResponse;
   };
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecord;
+    response: GetCredentialRecordResponse;
+  };
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecord;
+    response: SetCredentialRecordResponse;
+  };
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecord;
+    response: DeleteCredentialRecordResponse;
+  };
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecords;
+    response: ListCredentialRecordsResponse;
+  };
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecords;
+    response: BulkSetCredentialRecordsResponse;
+  };
 }
 
 /**
@@ -231,4 +385,24 @@ export const CesRpcSchemas = {
     request: BulkSetCredentialsSchema,
     response: BulkSetCredentialsResponseSchema,
   },
+  [CesRpcMethod.GetCredentialRecord]: {
+    request: GetCredentialRecordSchema,
+    response: GetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.SetCredentialRecord]: {
+    request: SetCredentialRecordSchema,
+    response: SetCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.DeleteCredentialRecord]: {
+    request: DeleteCredentialRecordSchema,
+    response: DeleteCredentialRecordResponseSchema,
+  },
+  [CesRpcMethod.ListCredentialRecords]: {
+    request: ListCredentialRecordsSchema,
+    response: ListCredentialRecordsResponseSchema,
+  },
+  [CesRpcMethod.BulkSetCredentialRecords]: {
+    request: BulkSetCredentialRecordsSchema,
+    response: BulkSetCredentialRecordsResponseSchema,
+  },
 } as const;