@axiom-lattice/core 6.0.0 → 6.1.0

package/dist/index.js

@@ -1662,6 +1662,7 @@ __export(index_exports, {
   InMemoryDatabaseConfigStore: () => InMemoryDatabaseConfigStore,
   InMemoryMailboxStore: () => InMemoryMailboxStore,
   InMemoryMenuStore: () => InMemoryMenuStore,
+  InMemoryModelProviderStore: () => InMemoryModelProviderStore,
   InMemoryOpenAuditStore: () => InMemoryOpenAuditStore,
   InMemoryProjectBotMembershipStore: () => InMemoryProjectBotMembershipStore,
   InMemoryProjectMembershipStore: () => InMemoryProjectMembershipStore,
@@ -1755,6 +1756,7 @@ __export(index_exports, {
   ThreadStatus: () => ThreadStatus2,
   TokenCache: () => TokenCache,
   ToolLatticeManager: () => ToolLatticeManager,
+  UnsafeUpstreamUrlError: () => UnsafeUpstreamUrlError,
   VectorStoreLatticeManager: () => VectorStoreLatticeManager,
   VectorStoreProviderManager: () => VectorStoreProviderManager,
   VolumeFilesystem: () => VolumeFilesystem,
@@ -1763,6 +1765,7 @@ __export(index_exports, {
   agentLatticeManager: () => agentLatticeManager,
   appendReconciliationWarning: () => appendReconciliationWarning,
   appendUiFence: () => appendUiFence,
+  assertSafeUpstreamUrl: () => assertSafeUpstreamUrl,
   buildGrepResultsDict: () => buildGrepResultsDict,
   buildInput: () => buildInput,
   buildNamedVolumeName: () => buildNamedVolumeName,
@@ -1945,6 +1948,7 @@ __export(index_exports, {
   registerExistingToolWithTenant: () => registerExistingToolWithTenant,
   registerLoggerLattice: () => registerLoggerLattice,
   registerModelLattice: () => registerModelLattice,
+  registerModelLatticeForTenant: () => registerModelLatticeForTenant,
   registerQueueLattice: () => registerQueueLattice,
   registerSTTModelLattice: () => registerSTTModelLattice,
   registerSandboxProviderType: () => registerSandboxProviderType,
@@ -2026,6 +2030,17 @@ var ModelLattice = class extends import_chat_models.BaseChatModel {
     this.config = config;
     this.llm = this.initChatModel(config);
   }
+  /**
+   * 返回构造时使用的配置
+   *
+   * 供调用方（如 models 控制器）读取 apiKey 是否存在、以及展示元数据，
+   * 避免反射读取私有字段。
+   *
+   * @returns 构造时传入的 LLMConfig
+   */
+  getConfig() {
+    return this.config;
+  }
   /**
    * 返回模型类型
    */
@@ -2165,6 +2180,9 @@ var ModelLattice = class extends import_chat_models.BaseChatModel {
         maxRetries: config.maxRetries || 2,
         streaming: config.streaming,
         reasoning: { effort: "none" },
+        // Responses API and Chat Completions are different paths with different
+        // request fields; an endpoint that supports only one rejects the other.
+        ...config.useResponsesApi ? { useResponsesApi: true } : {},
         apiKey: config.apiKey || process.env[config.apiKeyEnvName || "OPENAI_API_KEY"],
         configuration: {
           baseURL: config.baseURL
@@ -2255,9 +2273,74 @@ var ModelLatticeManager = class _ModelLatticeManager extends BaseLatticeManager
   getLatticeKeys() {
     return this.keys();
   }
+  // ========== 租户维度 API ==========
+  // 键由基类拼装为 models:{tenantId}:{key}。注意 "default" 租户的键与旧版
+  // key-only API 完全一致（models:default:{key}），因此对该租户是逐字节兼容的。
+  /**
+   * 以租户维度注册模型Lattice
+   *
+   * 同名 key 采用「后写覆盖」语义：先移除再注册，避免基类重复注册时抛错。
+   *
+   * @param tenantId 租户ID
+   * @param key Lattice键名
+   * @param config 模型配置
+   */
+  registerLatticeWithTenant(tenantId2, key5, config) {
+    const client = new ModelLattice(config);
+    const modelLattice = {
+      key: key5,
+      client
+    };
+    if (this.hasWithTenant(tenantId2, key5)) {
+      this.removeWithTenant(tenantId2, key5);
+    }
+    this.registerWithTenant(tenantId2, key5, modelLattice);
+  }
+  /**
+   * 获取指定租户的模型Lattice
+   * @param tenantId 租户ID
+   * @param key Lattice键名
+   */
+  getModelLatticeWithTenant(tenantId2, key5) {
+    return this.getWithTenant(tenantId2, key5);
+  }
+  /**
+   * 检查指定租户的模型Lattice是否存在
+   * @param tenantId 租户ID
+   * @param key Lattice键名
+   */
+  hasLatticeWithTenant(tenantId2, key5) {
+    return this.hasWithTenant(tenantId2, key5);
+  }
+  /**
+   * 获取指定租户的所有模型Lattice
+   * @param tenantId 租户ID
+   */
+  getAllLatticesByTenant(tenantId2) {
+    return this.getAllByTenant(tenantId2);
+  }
+  /**
+   * 获取指定租户的所有模型键名
+   *
+   * 只返回键名，不构造 Lattice 对象数组，适合仅需判断存在性的调用方。
+   *
+   * @param tenantId 租户ID
+   */
+  getLatticeKeysByTenant(tenantId2) {
+    return this.keysByTenant(tenantId2);
+  }
+  /**
+   * 移除指定租户的模型Lattice
+   * @param tenantId 租户ID
+   * @param key Lattice键名
+   */
+  removeLatticeWithTenant(tenantId2, key5) {
+    return this.removeWithTenant(tenantId2, key5);
+  }
 };
 var modelLatticeManager = ModelLatticeManager.getInstance();
 var registerModelLattice = (key5, config) => modelLatticeManager.registerLattice(key5, config);
+var registerModelLatticeForTenant = (tenantId2, key5, config) => modelLatticeManager.registerLatticeWithTenant(tenantId2, key5, config);
 var getModelLattice = (key5) => modelLatticeManager.getModelLattice(key5);
 
 // src/tool_lattice/get_current_date_time/index.ts
@@ -3993,6 +4076,240 @@ var InMemoryMcpServerConfigStore = class {
   }
 };
 
+// src/store_lattice/InMemoryModelProviderStore.ts
+var InMemoryModelProviderStore = class {
+  constructor() {
+    this.providers = /* @__PURE__ */ new Map();
+    this.models = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Get composite key for providers
+   */
+  getProviderKey(tenantId2, id) {
+    return `${tenantId2}:${id}`;
+  }
+  /**
+   * Get composite key for snapshot models
+   */
+  getModelKey(tenantId2, providerId, modelId) {
+    return `${tenantId2}:${providerId}:${modelId}`;
+  }
+  /**
+   * Get all provider configurations for a tenant
+   */
+  async listProviders(tenantId2) {
+    return Array.from(this.providers.values()).filter(
+      (provider) => provider.tenantId === tenantId2
+    );
+  }
+  /**
+   * Get a provider configuration by ID
+   */
+  async getProviderById(tenantId2, id) {
+    return this.providers.get(this.getProviderKey(tenantId2, id)) || null;
+  }
+  /**
+   * Get a provider configuration by business name
+   */
+  async getProviderByName(tenantId2, name) {
+    const providers = await this.listProviders(tenantId2);
+    return providers.find((provider) => provider.name === name) || null;
+  }
+  /**
+   * Create a new provider configuration
+   */
+  async createProvider(tenantId2, id, data) {
+    const now = /* @__PURE__ */ new Date();
+    const entry = {
+      id,
+      tenantId: tenantId2,
+      name: data.name,
+      displayName: data.displayName,
+      protocol: data.protocol,
+      apiStyle: data.apiStyle ?? "chat-completions",
+      // Phase 1 pins the LLM provider: the UI does not offer a choice, and some
+      // initChatModel branches hardcode their own baseURL and would silently
+      // ignore the tenant's (see ADR-138 decision 7b).
+      llmProvider: "openai",
+      baseURL: data.baseURL,
+      apiKey: data.apiKey || void 0,
+      apiKeyHint: data.apiKey ? data.apiKey.slice(-4) : void 0,
+      enabled: data.enabled ?? true,
+      status: "unknown",
+      createdAt: now,
+      updatedAt: now
+    };
+    this.providers.set(this.getProviderKey(tenantId2, id), entry);
+    return entry;
+  }
+  /**
+   * Update an existing provider configuration.
+   * An omitted or empty `apiKey` leaves the stored key untouched.
+   */
+  async updateProvider(tenantId2, id, updates) {
+    const key5 = this.getProviderKey(tenantId2, id);
+    const existing = this.providers.get(key5);
+    if (!existing) {
+      return null;
+    }
+    const hasNewApiKey = Boolean(updates.apiKey);
+    const clearsApiKey = updates.clearApiKey === true;
+    const updated = {
+      ...existing,
+      name: updates.name ?? existing.name,
+      displayName: updates.displayName !== void 0 ? updates.displayName : existing.displayName,
+      protocol: updates.protocol ?? existing.protocol,
+      apiStyle: updates.apiStyle ?? existing.apiStyle,
+      baseURL: updates.baseURL ?? existing.baseURL,
+      apiKey: clearsApiKey ? void 0 : hasNewApiKey ? updates.apiKey : existing.apiKey,
+      apiKeyHint: clearsApiKey ? void 0 : hasNewApiKey ? updates.apiKey?.slice(-4) : existing.apiKeyHint,
+      enabled: updates.enabled ?? existing.enabled,
+      updatedAt: /* @__PURE__ */ new Date()
+    };
+    this.providers.set(key5, updated);
+    return updated;
+  }
+  /**
+   * Delete a provider configuration and its model snapshot
+   */
+  async deleteProvider(tenantId2, id) {
+    await this.deleteModelsByProvider(tenantId2, id);
+    return this.providers.delete(this.getProviderKey(tenantId2, id));
+  }
+  /**
+   * Record the outcome of a discovery attempt
+   */
+  async markProviderStatus(tenantId2, id, status, lastError, discoveredAt) {
+    const key5 = this.getProviderKey(tenantId2, id);
+    const existing = this.providers.get(key5);
+    if (!existing) {
+      return;
+    }
+    this.providers.set(key5, {
+      ...existing,
+      status,
+      lastError: status === "ok" ? void 0 : lastError,
+      lastDiscoveredAt: discoveredAt ?? existing.lastDiscoveredAt,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+  }
+  /**
+   * List snapshot models for a tenant
+   */
+  async listModels(tenantId2, providerId) {
+    return Array.from(this.models.values()).filter(
+      (model) => model.tenantId === tenantId2 && (providerId === void 0 || model.providerId === providerId)
+    );
+  }
+  /**
+   * Get a single snapshot model.
+   * Keyed by provider as well as model id, since two providers in the same
+   * tenant may expose the same upstream model id.
+   */
+  async getModel(tenantId2, providerId, modelId) {
+    return this.models.get(this.getModelKey(tenantId2, providerId, modelId)) || null;
+  }
+  /**
+   * Replace a provider's model snapshot with the result of one discovery.
+   *
+   * Model ids are scoped per provider, so the same upstream id may appear
+   * under several providers in one tenant — each is an independent model.
+   *
+   * Models the upstream no longer offers are removed; models that survive keep
+   * the tenant's enable/disable choice rather than being reset.
+   */
+  async replaceProviderModels(tenantId2, providerId, models) {
+    const previous = await this.listModels(tenantId2, providerId);
+    const previousById = new Map(
+      previous.map((model) => [model.modelId, model])
+    );
+    const incomingIds = new Set(models.map((model) => model.id));
+    for (const model of previous) {
+      if (!incomingIds.has(model.modelId)) {
+        this.models.delete(
+          this.getModelKey(tenantId2, providerId, model.modelId)
+        );
+      }
+    }
+    const now = /* @__PURE__ */ new Date();
+    const upserted = [];
+    for (const model of models) {
+      const existing = previousById.get(model.id);
+      const entry = {
+        id: `${providerId}:${model.id}`,
+        tenantId: tenantId2,
+        providerId,
+        modelId: model.id,
+        displayName: model.displayName,
+        ownedBy: model.ownedBy,
+        upstreamCreatedAt: model.createdAt ? new Date(model.createdAt) : void 0,
+        // An explicit `enabled` from the caller wins; discovery omits it and
+        // the tenant's earlier choice is preserved.
+        enabled: model.enabled ?? existing?.enabled ?? true,
+        // Unlike `enabled`, this is not preserved: a model present in the list
+        // the caller just read is, by definition, no longer stale. Only an
+        // explicit flag marks one.
+        stale: model.stale ?? false,
+        discoveredAt: now
+      };
+      this.models.set(this.getModelKey(tenantId2, providerId, model.id), entry);
+      upserted.push(model.id);
+    }
+    return upserted;
+  }
+  /**
+   * Enable or disable a single snapshot model
+   */
+  async setModelEnabled(tenantId2, providerId, modelId, enabled) {
+    const key5 = this.getModelKey(tenantId2, providerId, modelId);
+    const existing = this.models.get(key5);
+    if (!existing) {
+      return null;
+    }
+    const updated = {
+      ...existing,
+      enabled
+    };
+    this.models.set(key5, updated);
+    return updated;
+  }
+  /**
+   * Delete every snapshot model belonging to a provider
+   */
+  async deleteModelsByProvider(tenantId2, providerId) {
+    let deleted = 0;
+    for (const [key5, model] of Array.from(this.models.entries())) {
+      if (model.tenantId === tenantId2 && model.providerId === providerId) {
+        this.models.delete(key5);
+        deleted += 1;
+      }
+    }
+    return deleted;
+  }
+  /**
+   * Clear all providers and models (useful for testing)
+   */
+  clear() {
+    this.providers.clear();
+    this.models.clear();
+  }
+  /**
+   * Clear providers and models for a specific tenant
+   */
+  clearByTenant(tenantId2) {
+    for (const [key5, provider] of Array.from(this.providers.entries())) {
+      if (provider.tenantId === tenantId2) {
+        this.providers.delete(key5);
+      }
+    }
+    for (const [key5, model] of Array.from(this.models.entries())) {
+      if (model.tenantId === tenantId2) {
+        this.models.delete(key5);
+      }
+    }
+  }
+};
+
 // src/store_lattice/InMemoryAgentWebAppStore.ts
 var import_crypto = require("crypto");
 function cloneAppearance(appearance) {
@@ -6473,6 +6790,7 @@ var defaultProjectStore = new InMemoryProjectStore(defaultCapabilityBundleCoordi
 var defaultDatabaseConfigStore = new InMemoryDatabaseConfigStore();
 var defaultMetricsServerConfigStore = new InMemoryMetricsServerConfigStore();
 var defaultMcpServerConfigStore = new InMemoryMcpServerConfigStore();
+var defaultModelProviderStore = new InMemoryModelProviderStore();
 var defaultAgentWebAppStore = new InMemoryAgentWebAppStore();
 var defaultCapabilityBundleStore = new InMemoryCapabilityBundleStore(defaultProjectStore, defaultCapabilityBundleCoordinator);
 var defaultProjectRoomCoordinator = new InMemoryProjectRoomCoordinator();
@@ -6494,6 +6812,7 @@ storeLatticeManager.registerLattice("default", "project", defaultProjectStore);
 storeLatticeManager.registerLattice("default", "database", defaultDatabaseConfigStore);
 storeLatticeManager.registerLattice("default", "metrics", defaultMetricsServerConfigStore);
 storeLatticeManager.registerLattice("default", "mcp", defaultMcpServerConfigStore);
+storeLatticeManager.registerLattice("default", "modelProvider", defaultModelProviderStore);
 storeLatticeManager.registerLattice("default", "agentWebApp", defaultAgentWebAppStore);
 storeLatticeManager.registerLattice("default", "capabilityBundle", defaultCapabilityBundleStore);
 storeLatticeManager.registerLattice("default", "projectRoom", defaultProjectRoomStore);
@@ -36334,13 +36653,16 @@ var LatticeEvalProject = class {
   constructor(project, onCaseComplete) {
     this.suites = /* @__PURE__ */ new Map();
     this.project = project;
-    const judgeModelKey = resolveJudgeModelKey(this.project.judge_agent_config.modelKey, modelLatticeManager);
+    const tenantId2 = this.project.lattice_server_config.tenant_id || "default";
+    const judgeModelKey = resolveJudgeModelKey(
+      this.project.judge_agent_config.modelKey,
+      modelLatticeManager
+    );
     if (!modelLatticeManager.hasLattice(judgeModelKey)) {
       throw new Error(
         `Judge model "${judgeModelKey}" not found. Register it first or provide a valid modelKey.`
       );
     }
-    const tenantId2 = this.project.lattice_server_config.tenant_id || "default";
     this.judgeAgentKey = `${this.project.projectName}_judge_agent`;
     const judgeAgentConfig = {
       key: this.judgeAgentKey,
@@ -40690,6 +41012,47 @@ function clearEncryptionKeyCache() {
   keyValidated = false;
 }
 
+// src/util/safeUpstreamUrl.ts
+var UnsafeUpstreamUrlError = class extends Error {
+  constructor(reason, message, statusCode = 400) {
+    super(message);
+    this.reason = reason;
+    this.statusCode = statusCode;
+    this.name = "UnsafeUpstreamUrlError";
+  }
+};
+async function assertSafeUpstreamUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new UnsafeUpstreamUrlError(
+      "INVALID_BASE_URL",
+      "Base URL is not a valid URL"
+    );
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new UnsafeUpstreamUrlError(
+      "UNSUPPORTED_SCHEME",
+      "Base URL must use http or https"
+    );
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    throw new UnsafeUpstreamUrlError(
+      "CREDENTIALS_IN_URL",
+      "Base URL must not embed credentials; configure the API key separately"
+    );
+  }
+  const hostname = url.hostname.replace(/^\[/, "").replace(/\]$/, "");
+  if (hostname.length === 0) {
+    throw new UnsafeUpstreamUrlError(
+      "INVALID_BASE_URL",
+      "Base URL must include a host"
+    );
+  }
+  return { url };
+}
+
 // src/middlewares/skillMiddleware.ts
 var import_langchain66 = require("langchain");
 
@@ -48103,6 +48466,7 @@ registerBuiltinPlugins();
   InMemoryDatabaseConfigStore,
   InMemoryMailboxStore,
   InMemoryMenuStore,
+  InMemoryModelProviderStore,
   InMemoryOpenAuditStore,
   InMemoryProjectBotMembershipStore,
   InMemoryProjectMembershipStore,
@@ -48196,6 +48560,7 @@ registerBuiltinPlugins();
   ThreadStatus,
   TokenCache,
   ToolLatticeManager,
+  UnsafeUpstreamUrlError,
   VectorStoreLatticeManager,
   VectorStoreProviderManager,
   VolumeFilesystem,
@@ -48204,6 +48569,7 @@ registerBuiltinPlugins();
   agentLatticeManager,
   appendReconciliationWarning,
   appendUiFence,
+  assertSafeUpstreamUrl,
   buildGrepResultsDict,
   buildInput,
   buildNamedVolumeName,
@@ -48386,6 +48752,7 @@ registerBuiltinPlugins();
   registerExistingToolWithTenant,
   registerLoggerLattice,
   registerModelLattice,
+  registerModelLatticeForTenant,
   registerQueueLattice,
   registerSTTModelLattice,
   registerSandboxProviderType,