@vellumai/assistant 0.8.1 → 0.8.3

package/src/runtime/routes/inference-provider-connection-routes.ts

@@ -10,9 +10,18 @@
 
 import { z } from "zod";
 
+import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
 import { getConfigReadOnly } from "../../config/loader.js";
 import { getDb } from "../../memory/db-connection.js";
-import { AuthSchema, ConnectionProviderSchema, ConnectionStatusSchema, ProviderConnectionSchema, VALID_CONNECTION_PROVIDERS } from "../../providers/inference/auth.js";
+import {
+  AuthSchema,
+  type ConnectionModel,
+  ConnectionModelSchema,
+  ConnectionProviderSchema,
+  ConnectionStatusSchema,
+  ProviderConnectionSchema,
+  VALID_CONNECTION_PROVIDERS,
+} from "../../providers/inference/auth.js";
 import {
   createConnection,
   deleteConnection,
@@ -21,11 +30,7 @@ import {
   MANAGED_CONNECTION_NAMES,
   updateConnection,
 } from "../../providers/inference/connections.js";
-import {
-  BadRequestError,
-  ConflictError,
-  NotFoundError,
-} from "./errors.js";
+import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ---------------------------------------------------------------------------
@@ -33,6 +38,75 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 // ---------------------------------------------------------------------------
 
 const providerConnectionResponseSchema = ProviderConnectionSchema;
+const OPENAI_COMPATIBLE_ENDPOINTS_FLAG = "openai-compatible-endpoints";
+
+function openAICompatibleEndpointsEnabled(): boolean {
+  return isAssistantFeatureFlagEnabled(
+    OPENAI_COMPATIBLE_ENDPOINTS_FLAG,
+    getConfigReadOnly(),
+  );
+}
+
+function rejectDisabledOpenAICompatibleProvider(provider: string): void {
+  if (provider !== "openai-compatible") return;
+  if (openAICompatibleEndpointsEnabled()) return;
+  throw new BadRequestError(
+    "OpenAI-compatible endpoints are disabled. Enable the openai-compatible-endpoints feature flag to configure this provider.",
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Custom provider field parsing (openai-compatible base_url + models)
+// ---------------------------------------------------------------------------
+
+function parseCustomProviderFields(body: Record<string, unknown>): {
+  baseUrl?: string | null;
+  models?: ConnectionModel[] | null;
+} {
+  const out: {
+    baseUrl?: string | null;
+    models?: ConnectionModel[] | null;
+  } = {};
+
+  if ("base_url" in body) {
+    const raw = body.base_url;
+    if (raw === null) {
+      out.baseUrl = null;
+    } else if (typeof raw === "string" && raw.length > 0) {
+      try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+          throw new BadRequestError(`Invalid base_url: must be an http(s) URL`);
+        }
+      } catch (err) {
+        if (err instanceof BadRequestError) throw err;
+        throw new BadRequestError(
+          `Invalid base_url: must be a valid http(s) URL`,
+        );
+      }
+      out.baseUrl = raw;
+    } else {
+      throw new BadRequestError(
+        `Invalid base_url: must be a non-empty string or null`,
+      );
+    }
+  }
+
+  if ("models" in body) {
+    const raw = body.models;
+    if (raw === null) {
+      out.models = null;
+    } else {
+      const parsed = z.array(ConnectionModelSchema).safeParse(raw);
+      if (!parsed.success) {
+        throw new BadRequestError(`Invalid models: ${parsed.error.message}`);
+      }
+      out.models = parsed.data;
+    }
+  }
+
+  return out;
+}
 
 // ---------------------------------------------------------------------------
 // Handlers
@@ -40,7 +114,18 @@ const providerConnectionResponseSchema = ProviderConnectionSchema;
 
 function handleListConnections({ queryParams = {} }: RouteHandlerArgs) {
   const provider = queryParams.provider;
-  const connections = listConnections(getDb(), provider ? { provider } : undefined);
+  if (provider) rejectDisabledOpenAICompatibleProvider(provider);
+  const connections = listConnections(
+    getDb(),
+    provider ? { provider } : undefined,
+  );
+  if (!openAICompatibleEndpointsEnabled()) {
+    return {
+      connections: connections.filter(
+        (conn) => conn.provider !== "openai-compatible",
+      ),
+    };
+  }
   return { connections };
 }
 
@@ -50,6 +135,12 @@ function handleGetConnection({ pathParams = {} }: RouteHandlerArgs) {
 
   const conn = getConnection(getDb(), name);
   if (!conn) throw new NotFoundError(`Connection "${name}" not found.`);
+  if (
+    conn.provider === "openai-compatible" &&
+    !openAICompatibleEndpointsEnabled()
+  ) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
 
   return conn;
 }
@@ -69,28 +160,41 @@ function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
       `Invalid provider "${String(provider)}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
     );
   }
+  rejectDisabledOpenAICompatibleProvider(providerResult.data);
 
   const authResult = AuthSchema.safeParse(auth);
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
 
-  const statusResult = body.status !== undefined ? ConnectionStatusSchema.safeParse(body.status) : null;
+  const statusResult =
+    body.status !== undefined
+      ? ConnectionStatusSchema.safeParse(body.status)
+      : null;
   if (statusResult && !statusResult.success) {
     throw new BadRequestError(`Invalid status: must be "active" or "disabled"`);
   }
 
   const labelRaw = body.label;
-  if (labelRaw !== undefined && labelRaw !== null && (typeof labelRaw !== "string" || labelRaw.length === 0)) {
-    throw new BadRequestError(`Invalid label: must be a non-empty string or null`);
+  if (
+    labelRaw !== undefined &&
+    labelRaw !== null &&
+    (typeof labelRaw !== "string" || labelRaw.length === 0)
+  ) {
+    throw new BadRequestError(
+      `Invalid label: must be a non-empty string or null`,
+    );
   }
 
+  const customFields = parseCustomProviderFields(body);
+
   const result = createConnection(getDb(), {
     name,
     provider: providerResult.data,
     auth: authResult.data,
     ...(statusResult ? { status: statusResult.data } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
+    ...customFields,
   });
 
   if (!result.ok) {
@@ -104,52 +208,99 @@ function handleCreateConnection({ body = {} }: RouteHandlerArgs) {
         `Invalid provider "${result.error.provider}". Valid: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
       );
     }
+    if (result.error.code === "base_url_required") {
+      throw new BadRequestError(
+        "base_url is required for openai-compatible connections.",
+      );
+    }
+    if (result.error.code === "models_required") {
+      throw new BadRequestError(
+        "At least one model is required for openai-compatible connections.",
+      );
+    }
     throw new BadRequestError("Invalid auth configuration.");
   }
 
   return result.connection;
 }
 
-function handleUpdateConnection({ pathParams = {}, body = {} }: RouteHandlerArgs) {
+function handleUpdateConnection({
+  pathParams = {},
+  body = {},
+}: RouteHandlerArgs) {
   const { name } = pathParams;
   if (!name) throw new BadRequestError("name is required");
 
+  const existing = getConnection(getDb(), name);
+  if (!existing) throw new NotFoundError(`Connection "${name}" not found.`);
+  if (
+    existing.provider === "openai-compatible" &&
+    !openAICompatibleEndpointsEnabled()
+  ) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
+
   const auth = body.auth;
   const authResult = AuthSchema.safeParse(auth);
   if (!authResult.success) {
     throw new BadRequestError(`Invalid auth: ${authResult.error.message}`);
   }
 
-  const statusResult = body.status !== undefined ? ConnectionStatusSchema.safeParse(body.status) : null;
+  const statusResult =
+    body.status !== undefined
+      ? ConnectionStatusSchema.safeParse(body.status)
+      : null;
   if (statusResult && !statusResult.success) {
     throw new BadRequestError(`Invalid status: must be "active" or "disabled"`);
   }
 
   const labelRaw = body.label;
-  if (labelRaw !== undefined && labelRaw !== null && (typeof labelRaw !== "string" || labelRaw.length === 0)) {
-    throw new BadRequestError(`Invalid label: must be a non-empty string or null`);
+  if (
+    labelRaw !== undefined &&
+    labelRaw !== null &&
+    (typeof labelRaw !== "string" || labelRaw.length === 0)
+  ) {
+    throw new BadRequestError(
+      `Invalid label: must be a non-empty string or null`,
+    );
   }
 
   // Managed connections: lock auth to `{type:"platform"}`. The boot upsert in
   // `seedCanonicalConnections` would revert any other value on next restart;
   // reject the write here so the surprise loop never happens. Label and status
   // remain user-editable (the boot upsert leaves those alone).
-  if (MANAGED_CONNECTION_NAMES.has(name) && authResult.data.type !== "platform") {
+  if (
+    MANAGED_CONNECTION_NAMES.has(name) &&
+    authResult.data.type !== "platform"
+  ) {
     throw new BadRequestError(
       `Cannot change auth on managed connection "${name}". Auth is locked to platform.`,
     );
   }
 
+  const customFields = parseCustomProviderFields(body);
+
   const result = updateConnection(getDb(), name, {
     auth: authResult.data,
     ...(statusResult ? { status: statusResult.data } : {}),
     ...(labelRaw !== undefined ? { label: labelRaw as string | null } : {}),
+    ...customFields,
   });
 
   if (!result.ok) {
     if (result.error.code === "not_found") {
       throw new NotFoundError(`Connection "${name}" not found.`);
     }
+    if (result.error.code === "base_url_required") {
+      throw new BadRequestError(
+        "base_url is required for openai-compatible connections.",
+      );
+    }
+    if (result.error.code === "models_required") {
+      throw new BadRequestError(
+        "At least one model is required for openai-compatible connections.",
+      );
+    }
     throw new BadRequestError("Invalid auth configuration.");
   }
 
@@ -162,7 +313,14 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
 
   // Existence check first so a stale `llm.default.provider_connection`
   // reference to a missing connection returns 404 (not 409).
-  if (!getConnection(getDb(), name)) {
+  const existing = getConnection(getDb(), name);
+  if (!existing) {
+    throw new NotFoundError(`Connection "${name}" not found.`);
+  }
+  if (
+    existing.provider === "openai-compatible" &&
+    !openAICompatibleEndpointsEnabled()
+  ) {
     throw new NotFoundError(`Connection "${name}" not found.`);
   }
 
@@ -180,7 +338,10 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   const config = getConfigReadOnly();
 
   // llm.default carries provider_connection (LLMConfigBase).
-  if ((config.llm?.default as Record<string, unknown> | undefined)?.provider_connection === name) {
+  if (
+    (config.llm?.default as Record<string, unknown> | undefined)
+      ?.provider_connection === name
+  ) {
     throw new ConflictError(
       `Connection "${name}" is referenced by llm.default. Update llm.default.provider_connection before deleting.`,
       { referencedBy: ["llm.default"] },
@@ -190,7 +351,9 @@ function handleDeleteConnection({ pathParams = {} }: RouteHandlerArgs) {
   // llm.profiles.*: only ProfileEntry has provider_connection.
   const profiles = config.llm?.profiles ?? {};
   const referencingProfiles = Object.entries(profiles)
-    .filter(([, p]) => (p as Record<string, unknown>).provider_connection === name)
+    .filter(
+      ([, p]) => (p as Record<string, unknown>).provider_connection === name,
+    )
     .map(([profileName]) => profileName);
 
   const result = deleteConnection(getDb(), name, {
@@ -234,7 +397,9 @@ export const ROUTES: RouteDefinition[] = [
         description: `Filter by provider. One of: ${VALID_CONNECTION_PROVIDERS.join(", ")}`,
       },
     ],
-    responseBody: z.object({ connections: z.array(providerConnectionResponseSchema) }),
+    responseBody: z.object({
+      connections: z.array(providerConnectionResponseSchema),
+    }),
     handler: handleListConnections,
   },
   {
@@ -265,6 +430,8 @@ export const ROUTES: RouteDefinition[] = [
       auth: AuthSchema,
       label: z.string().min(1).optional(),
       status: ConnectionStatusSchema.optional(),
+      base_url: z.string().url().nullable().optional(),
+      models: z.array(ConnectionModelSchema).nullable().optional(),
     }),
     responseBody: providerConnectionResponseSchema,
     responseStatus: "201",
@@ -288,10 +455,15 @@ export const ROUTES: RouteDefinition[] = [
       auth: AuthSchema,
       status: ConnectionStatusSchema.optional(),
       label: z.string().min(1).nullable().optional(),
+      base_url: z.string().url().nullable().optional(),
+      models: z.array(ConnectionModelSchema).nullable().optional(),
     }),
     responseBody: providerConnectionResponseSchema,
     additionalResponses: {
-      "400": { description: "Invalid auth schema, or attempt to change auth on a managed connection" },
+      "400": {
+        description:
+          "Invalid auth schema, or attempt to change auth on a managed connection",
+      },
       "404": { description: "Connection not found" },
     },
     handler: handleUpdateConnection,
@@ -308,9 +480,14 @@ export const ROUTES: RouteDefinition[] = [
     pathParams: [{ name: "name", description: "Connection name" }],
     responseBody: z.object({ ok: z.literal(true) }),
     additionalResponses: {
-      "400": { description: "Connection is a Vellum-managed connection and cannot be deleted" },
+      "400": {
+        description:
+          "Connection is a Vellum-managed connection and cannot be deleted",
+      },
       "404": { description: "Connection not found" },
-      "409": { description: "Connection is referenced by profile(s) or call site(s)" },
+      "409": {
+        description: "Connection is referenced by profile(s) or call site(s)",
+      },
     },
     handler: handleDeleteConnection,
   },

package/src/runtime/routes/integrations/a2a.ts

@@ -0,0 +1,235 @@
+/**
+ * Route handlers for A2A integration config endpoints.
+ *
+ * GET    /v1/integrations/a2a/config          — get current A2A config status
+ * POST   /v1/integrations/a2a/config          — enable A2A channel
+ * DELETE /v1/integrations/a2a/config          — disable A2A channel
+ * POST   /v1/integrations/a2a/invite          — create a shareable A2A invite token
+ * POST   /v1/integrations/a2a/invite/complete — sender-side invite completion
+ * POST   /v1/integrations/a2a/invite/redeem   — receiver-side invite redemption
+ */
+
+import { isA2AEnabled } from "../../../a2a/feature-gate.js";
+import { getConfig } from "../../../config/loader.js";
+import {
+  clearA2AConfig,
+  completeA2AInvite,
+  createA2AInvite,
+  getA2AConfig,
+  redeemA2AInvite,
+  setA2AConfig,
+} from "../../../daemon/handlers/config-a2a.js";
+import { BadRequestError } from "../errors.js";
+import type { RouteDefinition, RouteHandlerArgs } from "../types.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function assertA2AFlag(): void {
+  if (!isA2AEnabled(getConfig())) {
+    throw new BadRequestError("A2A channel is not available");
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+function handleGetA2AConfig() {
+  assertA2AFlag();
+  return getA2AConfig();
+}
+
+function handleSetA2AConfig() {
+  assertA2AFlag();
+  const result = setA2AConfig();
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to enable A2A");
+  }
+  return result;
+}
+
+function handleClearA2AConfig() {
+  assertA2AFlag();
+  return clearA2AConfig();
+}
+
+function handleCreateA2AInvite({ body = {} }: RouteHandlerArgs) {
+  assertA2AFlag();
+  const { expiresInHours } = body as { expiresInHours?: unknown };
+  if (expiresInHours !== undefined) {
+    if (
+      typeof expiresInHours !== "number" ||
+      !Number.isFinite(expiresInHours) ||
+      expiresInHours <= 0
+    ) {
+      throw new BadRequestError(
+        "expiresInHours must be a positive finite number",
+      );
+    }
+  }
+  const result = createA2AInvite({
+    expiresInHours: expiresInHours as number | undefined,
+  });
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to create A2A invite");
+  }
+  return result;
+}
+
+function handleCompleteA2AInvite({ body = {} }: RouteHandlerArgs) {
+  const { token, senderAssistantId, acceptor } = body as {
+    token?: unknown;
+    senderAssistantId?: unknown;
+    acceptor?: {
+      assistantId?: unknown;
+      displayName?: unknown;
+      gatewayUrl?: unknown;
+    };
+  };
+
+  if (typeof token !== "string" || !token) {
+    throw new BadRequestError(
+      "token is required and must be a non-empty string",
+    );
+  }
+  if (typeof senderAssistantId !== "string" || !senderAssistantId) {
+    throw new BadRequestError(
+      "senderAssistantId is required and must be a non-empty string",
+    );
+  }
+  if (
+    !acceptor ||
+    typeof acceptor.assistantId !== "string" ||
+    !acceptor.assistantId ||
+    typeof acceptor.displayName !== "string" ||
+    !acceptor.displayName ||
+    typeof acceptor.gatewayUrl !== "string" ||
+    !acceptor.gatewayUrl
+  ) {
+    throw new BadRequestError(
+      "acceptor must include non-empty assistantId, displayName, and gatewayUrl",
+    );
+  }
+
+  const result = completeA2AInvite({
+    token,
+    senderAssistantId,
+    acceptor: {
+      assistantId: acceptor.assistantId,
+      displayName: acceptor.displayName,
+      gatewayUrl: acceptor.gatewayUrl,
+    },
+  });
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to complete A2A invite");
+  }
+  return result;
+}
+
+function handleRedeemA2AInvite({ body = {} }: RouteHandlerArgs) {
+  const { sender } = body as {
+    sender?: {
+      assistantId?: unknown;
+      displayName?: unknown;
+      gatewayUrl?: unknown;
+    };
+  };
+
+  if (
+    !sender ||
+    typeof sender.assistantId !== "string" ||
+    !sender.assistantId ||
+    typeof sender.displayName !== "string" ||
+    !sender.displayName ||
+    typeof sender.gatewayUrl !== "string" ||
+    !sender.gatewayUrl
+  ) {
+    throw new BadRequestError(
+      "sender must include non-empty assistantId, displayName, and gatewayUrl",
+    );
+  }
+
+  const result = redeemA2AInvite({
+    sender: {
+      assistantId: sender.assistantId,
+      displayName: sender.displayName,
+      gatewayUrl: sender.gatewayUrl,
+    },
+  });
+  if (!result.success) {
+    throw new BadRequestError(result.error ?? "Failed to redeem A2A invite");
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+export const ROUTES: RouteDefinition[] = [
+  {
+    operationId: "integrations_a2a_config_get",
+    endpoint: "integrations/a2a/config",
+    method: "GET",
+    summary: "Get A2A config",
+    description: "Check current A2A channel configuration status.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleGetA2AConfig(),
+  },
+  {
+    operationId: "integrations_a2a_config_post",
+    endpoint: "integrations/a2a/config",
+    method: "POST",
+    summary: "Enable A2A channel",
+    description: "Enable the A2A channel for inter-assistant communication.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleSetA2AConfig(),
+  },
+  {
+    operationId: "integrations_a2a_config_delete",
+    endpoint: "integrations/a2a/config",
+    method: "DELETE",
+    summary: "Disable A2A channel",
+    description: "Disable the A2A channel.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: () => handleClearA2AConfig(),
+  },
+  {
+    operationId: "integrations_a2a_invite_post",
+    endpoint: "integrations/a2a/invite",
+    method: "POST",
+    summary: "Create A2A invite",
+    description:
+      "Create a shareable A2A invite token for link-based contact creation.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleCreateA2AInvite,
+  },
+  {
+    operationId: "integrations_a2a_invite_complete_post",
+    endpoint: "integrations/a2a/invite/complete",
+    method: "POST",
+    summary: "Complete A2A invite (sender side)",
+    description:
+      "Called by the platform to finalize the sender side of a link-based A2A connection.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleCompleteA2AInvite,
+  },
+  {
+    operationId: "integrations_a2a_invite_redeem_post",
+    endpoint: "integrations/a2a/invite/redeem",
+    method: "POST",
+    summary: "Redeem A2A invite (receiver side)",
+    description:
+      "Called by the platform to create a trusted contact on the receiver side of a link-based A2A connection.",
+    tags: ["integrations"],
+    requirePolicyEnforcement: true,
+    handler: handleRedeemA2AInvite,
+  },
+];