@vellumai/assistant 0.8.0 → 0.8.2

package/src/providers/provider-env-vars.ts

@@ -6,8 +6,9 @@
  *   1. LLM providers — names come from `PROVIDER_CATALOG` in
  *      `model-catalog.ts`. `getLlmProviderEnvVar` consults the catalog
  *      directly.
- *   2. Search providers — hardcoded in `SEARCH_PROVIDER_ENV_VAR_NAMES`
- *      below. The env var name follows the pattern `${ID}_API_KEY`.
+ *   2. Search providers — names come from `SEARCH_PROVIDER_CATALOG` in
+ *      `search-provider-catalog.ts`. `getSearchProviderEnvVar` consults
+ *      the catalog directly.
  *
  * Use `getLlmProviderEnvVar` when you're scoped to LLM providers,
  * `getSearchProviderEnvVar` when you're scoped to search providers, and
@@ -18,12 +19,21 @@
  * unknown IDs, and providers outside the helper's scope.
  */
 import { PROVIDER_CATALOG } from "./model-catalog.js";
+import { SEARCH_PROVIDER_CATALOG } from "./search-provider-catalog.js";
 
-/** Search-provider env var names. */
-const SEARCH_PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
-  brave: "BRAVE_API_KEY",
-  perplexity: "PERPLEXITY_API_KEY",
-};
+/**
+ * Search-provider env var names, derived from `SEARCH_PROVIDER_CATALOG`.
+ * Adding a BYOK provider to the catalog automatically extends this map —
+ * managed providers (no `envVar`) are filtered out.
+ */
+const SEARCH_PROVIDER_ENV_VAR_NAMES: Record<string, string> = Object.freeze(
+  Object.fromEntries(
+    SEARCH_PROVIDER_CATALOG.filter((p) => p.envVar !== undefined).map((p) => [
+      p.id,
+      p.envVar!,
+    ]),
+  ),
+);
 
 export function getLlmProviderEnvVar(providerId: string): string | undefined {
   return PROVIDER_CATALOG.find((p) => p.id === providerId)?.envVar;

package/src/providers/provider-secret-catalog.ts

@@ -2,13 +2,17 @@
  * Canonical source for API-key-addressable providers.
  *
  * This module composes the full set of providers that store API keys in
- * secure storage (the `api_key` secret type) from three sources:
+ * secure storage (the `api_key` secret type) from four sources:
  *
- * 1. **LLM / search providers** -- statically declared here because they
- *    have no separate catalog module yet.
- * 2. **STT providers** -- dynamically derived from the canonical STT
+ * 1. **LLM providers** -- derived from `PROVIDER_CATALOG`
+ *    (`model-catalog.ts`). Adding a provider to the catalog automatically
+ *    extends the API-key-addressable set.
+ * 2. **Search providers** -- derived from `SEARCH_PROVIDER_CATALOG`
+ *    (`search-provider-catalog.ts`). Adding a BYOK search provider to
+ *    the catalog automatically extends the API-key-addressable set.
+ * 3. **STT providers** -- dynamically derived from the canonical STT
  *    provider catalog by reading credential-provider names.
- * 3. **TTS catalog providers** -- dynamically derived from the canonical
+ * 4. **TTS catalog providers** -- dynamically derived from the canonical
  *    TTS provider catalog by selecting entries whose secret requirements
  *    use the bare-name (non-credential) storage convention.
  *
@@ -18,30 +22,45 @@
  */
 
 import { listCatalogProviders } from "../tts/provider-catalog.js";
+import { PROVIDER_CATALOG } from "./model-catalog.js";
+import { BYOK_SEARCH_PROVIDERS } from "./search-provider-catalog.js";
 import { listCredentialProviderNames as listSttCredentialProviderNames } from "./speech-to-text/provider-catalog.js";
 
 // ---------------------------------------------------------------------------
-// Static LLM / search providers
+// LLM and search providers
 // ---------------------------------------------------------------------------
 
 /**
- * LLM and search providers that store API keys under their bare provider
- * name in the secure credential store (e.g. `anthropic`, `openai`).
+ * LLM providers that store API keys under their bare provider name in the
+ * secure credential store (e.g. `anthropic`, `openai`).
  *
- * These are declared statically because no provider-catalog module exists
- * for them yet. When one is introduced, this array should be replaced with
- * a catalog-derived computation analogous to the TTS logic below.
+ * Derived from `PROVIDER_CATALOG` so that adding a new LLM provider to the
+ * catalog automatically extends the API-key-addressable provider set.
+ * `ollama` is intentionally included here even though it is `setupMode:
+ * "keyless"` — the keyless mode is enforced elsewhere; this list is purely
+ * about the set of bare-name credential-store keys accepted by
+ * `assistant keys ...`.
+ *
+ * Search providers (`brave`, `perplexity`, `tavily`) have no catalog module
+ * yet and remain statically declared below.
  */
-const LLM_AND_SEARCH_API_KEY_PROVIDERS = [
-  "anthropic",
-  "openai",
-  "gemini",
-  "ollama",
-  "fireworks",
-  "openrouter",
-  "brave",
-  "perplexity",
-] as const;
+const LLM_API_KEY_PROVIDERS: readonly string[] = PROVIDER_CATALOG.map(
+  (p) => p.id,
+);
+
+/**
+ * Search API providers, derived from `SEARCH_PROVIDER_CATALOG`. Managed
+ * search providers (e.g. `inference-provider-native`) are filtered out;
+ * only BYOK entries with a `secretKey` end up here.
+ */
+const SEARCH_API_KEY_PROVIDERS: readonly string[] = BYOK_SEARCH_PROVIDERS.map(
+  (p) => p.secretKey!,
+);
+
+const LLM_AND_SEARCH_API_KEY_PROVIDERS: readonly string[] = [
+  ...LLM_API_KEY_PROVIDERS,
+  ...SEARCH_API_KEY_PROVIDERS,
+];
 
 // ---------------------------------------------------------------------------
 // STT catalog-derived providers
@@ -110,15 +129,15 @@ function catalogApiKeyNames(): string[] {
  * - CLI `keys` command (help text, list iteration)
  * - Provider availability checks
  *
- * Adding a new TTS provider to the catalog with a bare-name secret
- * requirement automatically includes it here. Adding a new STT
- * provider to the STT catalog automatically includes it here (shared
- * credential names like `openai` are deduplicated against the LLM
- * list). Shared credential names across STT and TTS (e.g. `deepgram`)
- * are deduplicated so the list contains no duplicates. Adding a new
- * LLM or search provider requires appending to
- * {@link LLM_AND_SEARCH_API_KEY_PROVIDERS} until those domains get
- * their own catalog modules.
+ * Adding a new LLM provider to `PROVIDER_CATALOG` (`model-catalog.ts`)
+ * automatically includes it here. Adding a new BYOK search provider to
+ * `SEARCH_PROVIDER_CATALOG` (`search-provider-catalog.ts`) automatically
+ * includes it here. Adding a new TTS provider to the TTS catalog with a
+ * bare-name secret requirement automatically includes it here. Adding a
+ * new STT provider to the STT catalog automatically includes it here.
+ * Shared credential names across domains (e.g. `openai` for both LLM
+ * and STT; `deepgram` for both STT and TTS) are deduplicated so the
+ * list contains no duplicates.
  */
 export const API_KEY_PROVIDERS: readonly string[] = (() => {
   const seen = new Set<string>();

package/src/providers/provider-send-message.ts

@@ -7,7 +7,9 @@
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
-import { getProvider, initializeProviders, listProviders } from "./registry.js";
+import { getLogger } from "../util/logger.js";
+import { tryResolveProviderForConnectionName } from "./connection-resolution.js";
+import { initializeProviders, listProviders } from "./registry.js";
 import type {
   ContentBlock,
   Message,
@@ -18,8 +20,7 @@ import type {
   ToolUseContent,
 } from "./types.js";
 
-// Re-export the typed context-overflow error so callsites that dispatch on
-// this category do not need to reach into `./types.js` directly.
+const log = getLogger("provider-send-message");
 
 export interface ConfiguredProviderResult {
   provider: Provider;
@@ -107,25 +108,45 @@ export async function resolveConfiguredProvider(
     }
   }
 
-  const inferenceProvider = resolveCallSiteConfig(
-    callSite,
-    config.llm,
-    opts,
-  ).provider;
-
-  try {
-    const provider = getProvider(inferenceProvider);
-    return {
-      provider: new CallSiteConfiguredProvider(
-        provider,
-        callSite,
-        opts.overrideProfile,
-      ),
-      configuredProviderName: inferenceProvider,
-    };
-  } catch {
+  const resolved = resolveCallSiteConfig(callSite, config.llm, opts);
+  const inferenceProvider = resolved.provider;
+  const connectionName = resolved.provider_connection;
+
+  // Connection-aware path: every dispatch goes through `provider_connection`.
+  // The boot-time backfill ensures every profile has one in production.
+  // When unset (test envs that skip backfill, freshly-installed configs
+  // not yet backfilled, or users who manually cleared the field), we
+  // return null so callsites with deterministic fallbacks (invite
+  // instructions, telegram username resolution, etc.) keep working.
+  // Hard config errors — connection lookup failure, provider mismatch —
+  // still throw via `tryResolveProviderForConnectionName` below.
+  if (!connectionName) {
+    log.debug(
+      { callSite, inferenceProvider },
+      "resolveCallSiteConfig yielded no provider_connection — returning null so callsite can fall back",
+    );
     return null;
   }
+
+  const connectionProvider = await tryResolveProviderForConnectionName(
+    connectionName,
+    config,
+    inferenceProvider,
+  );
+  if (!connectionProvider) {
+    // Soft credential failure — the connection resolved to no usable
+    // adapter (credential missing, transient auth failure, etc.).
+    // Callers handle null as "no provider available" rather than crash.
+    return null;
+  }
+  return {
+    provider: new CallSiteConfiguredProvider(
+      connectionProvider,
+      callSite,
+      opts.overrideProfile,
+    ),
+    configuredProviderName: inferenceProvider,
+  };
 }
 
 /**

package/src/providers/registry.ts

@@ -1,24 +1,35 @@
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
+import { type LLMConfig } from "../config/schemas/llm.js";
 import { getProviderKeyAsync } from "../security/secure-keys.js";
 import { ProviderNotConfiguredError } from "../util/errors.js";
-import { AnthropicProvider } from "./anthropic/client.js";
-import { FireworksProvider } from "./fireworks/client.js";
-import { GeminiProvider } from "./gemini/client.js";
+import { getLogger } from "../util/logger.js";
+import {
+  buildProviderAdapter,
+  createAdapterFromConnection,
+} from "./inference/adapter-factory.js";
+// ---------------------------------------------------------------------------
+// Per-connection provider cache (mix-and-match support)
+// ---------------------------------------------------------------------------
+import type { ProviderConnection } from "./inference/auth.js";
+import { resolveAuth } from "./inference/resolve-auth.js";
+import { isModelInCatalog, PROVIDER_CATALOG } from "./model-catalog.js";
+import { getProviderDefaultModel } from "./model-intents.js";
 import {
   buildManagedBaseUrl,
   resolveManagedProxyContext,
-} from "./managed-proxy/context.js";
-import { isModelInCatalog } from "./model-catalog.js";
-import { getProviderDefaultModel } from "./model-intents.js";
-import { OllamaProvider } from "./ollama/client.js";
-import { OpenAIResponsesProvider } from "./openai/client.js";
-import { OpenRouterProvider } from "./openrouter/client.js";
+} from "./platform-proxy/context.js";
 import { RetryProvider } from "./retry.js";
 import type { Provider } from "./types.js";
 import { UsageTrackingProvider } from "./usage-tracking.js";
 
+const log = getLogger("provider-registry");
+
 const providers = new Map<string, Provider>();
 const routingSources = new Map<string, "user-key" | "managed-proxy">();
 
+/** Per-connection provider cache, keyed by connection name. */
+const connectionProviders = new Map<string, Provider>();
+
 function registerProvider(name: string, provider: Provider): void {
   providers.set(name, new UsageTrackingProvider(provider));
 }
@@ -43,9 +54,7 @@ export function getProviderRoutingSource(
 
 export interface ProvidersConfig {
   services: {
-    inference: {
-      mode: "managed" | "your-own";
-    };
+    inference: Record<string, never>;
     "image-generation": {
       mode: "managed" | "your-own";
       provider: string;
@@ -56,25 +65,15 @@ export interface ProvidersConfig {
       provider: string;
     };
   };
-  llm: {
-    default: {
-      provider: string;
-      model: string;
-    };
-  };
+  llm: LLMConfig;
   timeouts?: { providerStreamTimeoutSec?: number };
 }
 
 function resolveModel(config: ProvidersConfig, providerName: string): string {
-  const inferenceProvider = config.llm.default.provider;
-  const inferenceModel = config.llm.default.model;
+  const resolved = resolveCallSiteConfig("mainAgent", config.llm);
+  const inferenceProvider = resolved.provider;
+  const inferenceModel = resolved.model;
   if (inferenceProvider === providerName) {
-    // If a non-Anthropic provider is selected but the configured model is
-    // still an Anthropic catalog model (current or previous default), use a
-    // provider-appropriate fallback instead. Checking the full Anthropic
-    // catalog rather than only the current default prevents stale persisted
-    // defaults (e.g. claude-opus-4-6) from being sent to non-Anthropic APIs
-    // after the catalog default changes.
     if (
       providerName !== "anthropic" &&
       isModelInCatalog("anthropic", inferenceModel)
@@ -87,42 +86,21 @@ function resolveModel(config: ProvidersConfig, providerName: string): string {
 }
 
 /**
- * Resolve provider credentials using mode-aware logic.
- * In "managed" mode, routes through the platform proxy.
- * In "your-own" mode, uses the user's API key.
+ * Resolve provider credentials. User key takes precedence; managed proxy is
+ * used as a fallback when platform prerequisites are available.
+ *
+ * The routing decision is now derived from credential availability rather than
+ * the removed `services.inference.mode` config field.
  */
-async function resolveProviderCredentials(
-  providerName: string,
-  mode: "managed" | "your-own",
-): Promise<{
+async function resolveProviderCredentials(providerName: string): Promise<{
   apiKey: string;
   baseURL?: string;
   source: "user-key" | "managed-proxy";
 } | null> {
-  if (mode === "managed") {
-    // In managed mode, try managed proxy first, then fall back to user key
-    const managedBaseUrl = await buildManagedBaseUrl(providerName);
-    if (managedBaseUrl) {
-      const ctx = await resolveManagedProxyContext();
-      return {
-        apiKey: ctx.assistantApiKey,
-        baseURL: managedBaseUrl,
-        source: "managed-proxy",
-      };
-    }
-    // Managed proxy unavailable for this provider; fall back to user key
-    const userKey = await getProviderKeyAsync(providerName);
-    if (userKey) {
-      return { apiKey: userKey, source: "user-key" };
-    }
-    return null;
-  }
-  // "your-own" mode: check user key first, then try managed proxy fallback
   const userKey = await getProviderKeyAsync(providerName);
   if (userKey) {
     return { apiKey: userKey, source: "user-key" };
   }
-  // Fall back to managed proxy even in your-own mode (backwards compat)
   const managedBaseUrl = await buildManagedBaseUrl(providerName);
   if (managedBaseUrl) {
     const ctx = await resolveManagedProxyContext();
@@ -140,126 +118,140 @@ export async function initializeProviders(
 ): Promise<void> {
   providers.clear();
   routingSources.clear();
+  connectionProviders.clear();
 
   const streamTimeoutMs =
     (config.timeouts?.providerStreamTimeoutSec ?? 1800) * 1000;
-  const inferenceMode = config.services.inference.mode;
   const useNativeWebSearch =
     config.services["web-search"].provider === "inference-provider-native";
+  const mainAgentProvider = resolveCallSiteConfig(
+    "mainAgent",
+    config.llm,
+  ).provider;
 
-  // Anthropic
-  const anthropicCreds = await resolveProviderCredentials(
-    "anthropic",
-    inferenceMode,
-  );
-  if (anthropicCreds) {
-    const model = resolveModel(config, "anthropic");
-    registerProvider(
-      "anthropic",
-      new RetryProvider(
-        new AnthropicProvider(anthropicCreds.apiKey, model, {
-          useNativeWebSearch,
-          streamTimeoutMs,
-          ...(anthropicCreds.baseURL
-            ? { baseURL: anthropicCreds.baseURL }
-            : {}),
-        }),
-        {
-          forwardUsageAttributionHeaders:
-            anthropicCreds.source === "managed-proxy",
-        },
-      ),
-    );
-    routingSources.set("anthropic", anthropicCreds.source);
-  }
+  for (const entry of PROVIDER_CATALOG) {
+    const isKeyless = entry.setupMode === "keyless";
 
-  // OpenAI
-  const openaiCreds = await resolveProviderCredentials("openai", inferenceMode);
-  if (openaiCreds) {
-    const model = resolveModel(config, "openai");
-    registerProvider(
-      "openai",
-      new RetryProvider(
-        new OpenAIResponsesProvider(openaiCreds.apiKey, model, {
-          useNativeWebSearch,
-          streamTimeoutMs,
-          ...(openaiCreds.baseURL ? { baseURL: openaiCreds.baseURL } : {}),
-        }),
-        {
-          forwardUsageAttributionHeaders:
-            openaiCreds.source === "managed-proxy",
-        },
-      ),
-    );
-    routingSources.set("openai", openaiCreds.source);
-  }
+    // Credential resolution: user key first, managed proxy second. Keyless
+    // providers (e.g. ollama) skip both — they only need to be configured as
+    // the mainAgent provider, or have a key present (rare keyed-mode), to
+    // boot. Boot order matches catalog order; routingSources tracks which
+    // credential surface served each provider.
+    let apiKey = "";
+    let baseURL: string | undefined;
+    let source: "user-key" | "managed-proxy" = "user-key";
+    if (isKeyless) {
+      const key = await getProviderKeyAsync(entry.id);
+      const isConfiguredMainAgent = mainAgentProvider === entry.id;
+      if (!key && !isConfiguredMainAgent) continue;
+      apiKey = key ?? "";
+    } else {
+      const creds = await resolveProviderCredentials(entry.id);
+      if (!creds) continue;
+      apiKey = creds.apiKey;
+      baseURL = creds.baseURL;
+      source = creds.source;
+    }
 
-  // Gemini
-  const geminiCreds = await resolveProviderCredentials("gemini", inferenceMode);
-  if (geminiCreds) {
-    const model = resolveModel(config, "gemini");
-    registerProvider(
-      "gemini",
-      new RetryProvider(
-        new GeminiProvider(geminiCreds.apiKey, model, {
-          streamTimeoutMs,
-          ...(geminiCreds.baseURL
-            ? { managedBaseUrl: geminiCreds.baseURL }
-            : {}),
-        }),
-        {
-          forwardUsageAttributionHeaders:
-            geminiCreds.source === "managed-proxy",
-        },
-      ),
-    );
-    routingSources.set("gemini", geminiCreds.source);
-  }
+    const model = resolveModel(config, entry.id);
+    const adapter = buildProviderAdapter(entry.id, {
+      apiKey,
+      model,
+      streamTimeoutMs,
+      baseURL,
+      useNativeWebSearch,
+    });
+    if (!adapter) {
+      // Catalog declares a provider with no factory entry. The parity guard
+      // in adapter-factory.ts catches this at module load, so reaching here
+      // means a future refactor regressed the invariant.
+      log.error(
+        { providerId: entry.id },
+        "Catalog entry has no adapter factory — skipping",
+      );
+      continue;
+    }
 
-  // Ollama (keyless provider — always init when configured or key present)
-  const ollamaKey = await getProviderKeyAsync("ollama");
-  if (config.llm.default.provider === "ollama" || ollamaKey) {
-    const model = resolveModel(config, "ollama");
     registerProvider(
-      "ollama",
-      new RetryProvider(
-        new OllamaProvider(model, {
-          apiKey: ollamaKey ?? undefined,
-          streamTimeoutMs,
-        }),
-      ),
+      entry.id,
+      new RetryProvider(adapter, {
+        forwardUsageAttributionHeaders: source === "managed-proxy",
+      }),
     );
-    routingSources.set("ollama", "user-key");
+    routingSources.set(entry.id, source);
   }
+}
 
-  // Fireworks
-  const fireworksKey = await getProviderKeyAsync("fireworks");
-  if (fireworksKey) {
-    const model = resolveModel(config, "fireworks");
-    registerProvider(
-      "fireworks",
-      new RetryProvider(
-        new FireworksProvider(fireworksKey, model, {
-          streamTimeoutMs,
-        }),
-      ),
-    );
-    routingSources.set("fireworks", "user-key");
+// ---------------------------------------------------------------------------
+// Per-connection provider resolution (mix-and-match support)
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve a provider instance for a named `provider_connection`.
+ *
+ * Results are cached in `connectionProviders` for the lifetime of the
+ * current `initializeProviders` invocation (cleared on next boot). This
+ * prevents redundant vault reads for repeated calls to the same connection.
+ *
+ * Returns null when:
+ *   - The connection doesn't exist in the DB
+ *   - Auth resolution fails (missing credential, platform unavailable, v2 type)
+ *   - The provider/auth combination yields no usable adapter
+ */
+export async function resolveProviderFromConnection(
+  connection: ProviderConnection,
+  config: ProvidersConfig,
+): Promise<Provider | null> {
+  const cached = connectionProviders.get(connection.name);
+  if (cached) return cached;
+
+  const authResult = await resolveAuth(connection.auth, connection.provider);
+  if (!authResult.ok) {
+    const err = authResult.error;
+    if (err.code === "not_implemented") {
+      log.warn(
+        { connectionName: connection.name, authType: err.authType },
+        `Auth type '${err.authType}' is not yet implemented (v2). ` +
+          "Update the connection to use 'api_key', 'platform', or 'none'.",
+      );
+    } else if (err.code === "credential_not_found") {
+      log.warn(
+        { connectionName: connection.name, credential: err.credential },
+        `Credential '${err.credential}' not found in vault for connection '${connection.name}'.`,
+      );
+    } else {
+      log.warn(
+        { connectionName: connection.name },
+        `Platform auth unavailable for connection '${connection.name}'.`,
+      );
+    }
+    return null;
   }
 
-  // OpenRouter
-  const openrouterKey = await getProviderKeyAsync("openrouter");
-  if (openrouterKey) {
-    const model = resolveModel(config, "openrouter");
-    registerProvider(
-      "openrouter",
-      new RetryProvider(
-        new OpenRouterProvider(openrouterKey, model, {
-          useNativeWebSearch,
-          streamTimeoutMs,
-        }),
-      ),
-    );
-    routingSources.set("openrouter", "user-key");
+  const streamTimeoutMs =
+    (config.timeouts?.providerStreamTimeoutSec ?? 1800) * 1000;
+  const useNativeWebSearch =
+    config.services["web-search"].provider === "inference-provider-native";
+  const model = resolveModel(config, connection.provider);
+
+  const provider = createAdapterFromConnection(
+    connection,
+    authResult.resolved,
+    {
+      model,
+      streamTimeoutMs,
+      useNativeWebSearch,
+    },
+  );
+
+  if (provider) {
+    connectionProviders.set(connection.name, provider);
   }
+
+  return provider;
+}
+
+/** Clear per-connection provider cache (called by initializeProviders on boot). */
+export function clearConnectionProviderCache(): void {
+  connectionProviders.clear();
 }