feat(vercel): Vercel and AI Gateway integration - #1583

security · PII-01 · apps/web/src/page/integrations/view-vercel-configure.ts:116

Anyone who can read the organization's telemetry can read it, for the whole retention window. Drop it, or record only whether it is set, and rotate any value already sent.

correctness · apps/ingest/src/ai_session/vercel_ai_gateway.rs:38

vercel.ai_gateway.cost.total is copied into gen_ai.usage.cost without reading vercel.ai_gateway.cost.currency, so a request billed in any other currency is restated as USD and summed into maple_ai.usage.cost and the session/model cost totals. This PR's own vercelAiGatewaySummarySQL guards the same field with sumIf(..., inList(currency, ["", "USD"])), so the session cost and Infrastructure → Vercel disagree for the same request.

Read `vercel.ai_gateway.cost.currency` and only emit `gen_ai.usage.cost` when it is absent or `USD`; add a test with `cost.currency: "EUR"` asserting no cost attribute.

correctness · packages/backend/src/services/integrations/VercelIntegrationService.ts:1218

The poll writes the newest listed deployment as deploymentsWatermarkAt even when listDeployments stopped at its page cap, so on the first pass (since 7 days back, newest-first listing) a team with more deployments than the cap only ever sees the newest pages and every older deployment is skipped for good. Those projects keep an empty deployment list on the Infrastructure → Vercel pages.

Have `listDeployments` report whether the last page was reached, and only advance the watermark when the listing was complete (or advance it to the oldest fetched page so the next tick resumes).

correctness · apps/web/src/page/integrations/view-vercel.ts:257

When a read that previously succeeded fails, Keyed.accept leaves AsyncData.Stale({ data, error }); readOf maps that to "failed" and discards the data, while failureOf/usageFailure only match AsyncData.isFailure, so quickMetrics renders statRailLoading forever with no error text and no retry. The admin sees a card that never finishes loading instead of the retained numbers plus an error.

Treat `onStale` as stale-with-data: pass the retained `data` to the value function and surface `error` through `usageFailure`/`errorState`.

correctness · apps/web/src/components/integrations/vercel-model.ts:181

The backend records lastError on a failed pass without advancing lastSuccessAt, but the derivation keys only on lastSuccessAt, and isVercelSettling stops the 15 s re-reads once connectedAt is ten minutes old — so an org whose token is rejected or whose poll keeps timing out shows "First sync pending", no issue row and no retry, forever. apps/web/src/page/integrations/derive.ts:295 derives the same wrong state for the hub row.

Return `"attention"` plus an issue when `status.lastError !== null` (or when `lastSuccessAt === null` and `connectedAt` is older than the settling window), and apply the same rule in `derive.ts`'s `vercelHealth`.

correctness · apps/web/src/page/infra-integrations/vercel/project/view.ts:640

projectStatusOf returns null for both "loading" and "the read failed", so a failed LoadVercelProjectStatus makes the header claim the project has no production deployment, drops the framework chip and leaves the raw prj_… id as the page title. The model's Message union has no retry for this slot, so the read can never be re-issued without reloading the page; the list page shows an errorState with a retry for the same data.

Give the status slot a failure branch like the list page's plus a `ClickedRetryStatus` message, and keep the "No production deployment recorded" line for loaded data only.

correctness · apps/web/src/page/integrations/view-vercel-configure.ts:416

Vercel accepts any rate in 0.01–1 and the settings PATCH stores what it is sent, so a connection saved at e.g. samplingRate: 0.3 produces defaultValue: "0.3", which matches no nativeOption; the browser selects the first entry ("Everything") while the drains panel prints "30% of events" for the same connection. changedSampling (update-vercel.ts:304) also drops any value outside the list, so the admin cannot re-pick the stored rate.

Append the saved rate as an option when it is not in `VERCEL_SAMPLING_RATES` so the control always reflects `draft.samplingRate`.

correctness · apps/web/src/page/infra-integrations/vercel/list/view.ts:136

vercelProjectRows keeps every forwarded project even with no telemetry, so a team that forwards projects but has received nothing renders a table of zeros and never the "waiting for Vercel's first logs" copy, while a connection that forwards nothing (projectScope: "some" with an empty selection) has rows.length === 0 and is told to wait for logs that can never arrive.

Branch the waiting copy on the telemetry rows (`projects.length === 0`) and choose its title from whether any `status.projects` entry has `forwarded: true`.

performance · packages/query-engine-integrations/src/vercel/vercel-infra.ts:36

Every /infra/vercel read filters Vercel logs on the cloud.provider value alone, so the org's whole log volume in the window is decompressed and the map lookups evaluated per row instead of only Vercel granules. The same file's traces query (vercel-infra.ts:151) adds the mapContains(ResourceAttributes, "cloud.provider") key test it says the value test alone cannot replace.

Add `CH.mapContains($.ResourceAttributes, "cloud.provider")` to `vercelLogsWhere` so `idx_resource_attr_keys` can skip granules.

After this merges, Maple checks whether they stop.

• ➕ span name McpTool.syncVercel · apps/ai/src/mcp/tools/integration-writes.ts:157
• ➕ span name VercelIntegrationService.reconcileDrain · packages/backend/src/services/integrations/VercelIntegrationService.ts:487
• ➕ attribute maple.vercel.drain_kind · packages/backend/src/services/integrations/VercelIntegrationService.ts:499
• ➕ attribute maple.vercel.drains_found · packages/backend/src/services/integrations/VercelIntegrationService.ts:500
• ➕ span name VercelIntegrationService.reconcileDrains · packages/backend/src/services/integrations/VercelIntegrationService.ts:575
• ➕ span name VercelIntegrationService.removeDrains · packages/backend/src/services/integrations/VercelIntegrationService.ts:590
• ➕ attribute maple.vercel.drains_removed · packages/backend/src/services/integrations/VercelIntegrationService.ts:611
• ➕ span name VercelIntegrationService.storeProjects · packages/backend/src/services/integrations/VercelIntegrationService.ts:635
• ➕ attribute maple.vercel.projects · packages/backend/src/services/integrations/VercelIntegrationService.ts:642
• ➕ span name VercelIntegrationService.storeDeployments · packages/backend/src/services/integrations/VercelIntegrationService.ts:692
• ➕ span name VercelIntegrationService.discover · packages/backend/src/services/integrations/VercelIntegrationService.ts:868
• ➕ span name VercelIntegrationService.connect · packages/backend/src/services/integrations/VercelIntegrationService.ts:947
• ➕ attribute maple.vercel.team_id · packages/backend/src/services/integrations/VercelIntegrationService.ts:952
• ➕ span name VercelIntegrationService.updateSettings · packages/backend/src/services/integrations/VercelIntegrationService.ts:1060
• ➕ span name VercelIntegrationService.disconnect · packages/backend/src/services/integrations/VercelIntegrationService.ts:1094
• ➕ span name VercelIntegrationService.deployments · packages/backend/src/services/integrations/VercelIntegrationService.ts:1110
• ➕ span name VercelIntegrationService.pollOrg · packages/backend/src/services/integrations/VercelIntegrationService.ts:1127
• ➕ attribute maple.vercel.deployments_upserted · packages/backend/src/services/integrations/VercelIntegrationService.ts:1264
• ➕ attribute maple.vercel.drains_repaired · packages/backend/src/services/integrations/VercelIntegrationService.ts:1265
• ➕ attribute maple.vercel.failures · packages/backend/src/services/integrations/VercelIntegrationService.ts:1266
• ➕ span name VercelIntegrationService.sync · packages/backend/src/services/integrations/VercelIntegrationService.ts:1349
• ➕ span name VercelApi.listTeams · packages/backend/src/services/integrations/vercel/api.ts:110
• ➕ span name VercelApi.listProjects · packages/backend/src/services/integrations/vercel/api.ts:171
• ➕ attribute maple.vercel.projects_complete · packages/backend/src/services/integrations/vercel/api.ts:198
• ➕ span name VercelApi.listDeployments · packages/backend/src/services/integrations/vercel/api.ts:253
• ➕ attribute maple.vercel.deployments · packages/backend/src/services/integrations/vercel/api.ts:293
• ➕ span name VercelApi.createDrain · packages/backend/src/services/integrations/vercel/api.ts:333
• ➕ span name VercelApi.updateDrain · packages/backend/src/services/integrations/vercel/api.ts:348
• ➕ span name VercelApi.listDrains · packages/backend/src/services/integrations/vercel/api.ts:416
• ➕ attribute maple.vercel.drains · packages/backend/src/services/integrations/vercel/api.ts:422

• Migration adds three tables; OrgScopedTable purge covers all three, including the encrypted token
• New ClickHouse queries filter OrgId and bound time; sql_baseline regenerated
• integration-inventory.ts:417 maps an unknown drain status to pending, not failing

The review ended before it read these diffs, so nothing above vouches for them.

• apps/ai/src/mcp/__evals__/provider-world.ts
• apps/ai/src/mcp/tools/__tests__/integration-tools.test.ts
• apps/ai/src/mcp/tools/__tests__/provider-infra-tools.test.ts
• apps/alerting/src/scheduled.test.ts
• apps/local-ui/src/page/service-map/data.ts
• apps/local-ui/src/page/service-map/rows.ts
• apps/web/src/components/infra/vercel/list-model.test.ts
• apps/web/src/components/integrations/vercel-model.test.ts
• apps/web/src/components/mcp/mcp-tool-groups.ts
• apps/web/src/lab/vercel-lab.test.ts
• apps/web/src/lab/vercel-lab.ts
• apps/web/src/lib/agent-sessions/vendor-color.test.ts
• apps/web/src/lib/agent-sessions/vendor-color.ts
• apps/web/src/lib/agent-sessions/vendor-label.ts
• apps/web/src/lib/docs.ts
• apps/web/src/page/agent-sessions/kit/vendor.ts
• apps/web/src/page/dashboards/templates/derive.ts
• apps/web/src/page/infra-integrations/vercel/list/vercel.scene.test.ts
• apps/web/src/page/infra-integrations/vercel/project/project.scene.test.ts
• apps/web/src/page/infra/kubernetes/workloads/workloads.scene.test.ts
• apps/web/src/page/integrations/vercel.scene.test.ts
• apps/web/src/page/settings/setup-health/derive.ts
• apps/web/src/page/sources/kit/platforms.ts
• apps/web/src/page/sources/kit/shared.ts
• apps/web/src/service-map/map/node-card.ts
• packages/backend/src/dashboard-templates/infrastructure/vercel.test.ts
• packages/backend/src/services/integrations/IntegrationInventoryService.test.ts
• packages/backend/src/services/integrations/VercelIntegrationService.test.ts
• packages/backend/src/services/integrations/VercelIntegrationService.ts
• packages/domain/src/integration-inventory.test.ts
• and 10 more