@nocobase/plugin-ai 2.2.0-alpha.4 → 2.2.0-alpha.5

package/client-v2.d.ts

@@ -1 +1,2 @@
 export * from './dist/client-v2';
+export { default } from './dist/client-v2';

package/dist/ai/docs/nocobase/api/app/env.md

@@ -51,6 +51,33 @@ API_BASE_PATH=/api/
 
 ## API_BASE_URL
 
+## SERVER_REQUEST_WHITELIST
+
+Whitelist for outbound HTTP requests initiated by the server. It applies to server-side requests from features such as workflow request nodes, custom requests, and AI services.
+
+When this variable is not configured, NocoBase still allows `http` / `https` requests to keep existing deployments compatible. However, if the target is a loopback, private, link-local, or metadata address, or if a domain resolves to one of these addresses, the server logs a warning. Future versions may gradually tighten the default behavior. If your deployment needs to access internal services, configure an explicit whitelist in advance.
+
+Supported entries include:
+
+- Exact IPv4 address, such as `192.168.1.10`
+- IPv4 CIDR range, such as `10.0.0.0/8`
+- Exact IPv6 address, such as `::1`
+- IPv6 CIDR range, such as `fc00::/7`
+- Exact domain, such as `api.example.com`
+- Single-level wildcard subdomain, such as `*.example.com`
+
+Use `,` to separate multiple targets:
+
+```bash
+SERVER_REQUEST_WHITELIST=api.example.com,*.trusted.com,10.0.0.0/8,127.0.0.1
+```
+
+:::warning Note
+
+If a domain is configured in the whitelist, the whitelist check uses the host in the request URL. In other words, after `internal.example.com` is configured, it is treated as explicitly allowed even if the domain resolves to `127.0.0.1` or a private address.
+
+:::
+
 ## CLUSTER_MODE
 
 > `v1.6.0+`
@@ -285,4 +312,4 @@ Enabled trace data processors, defaults to `console`. Other values should refer
 
 ```bash
 TELEMETRY_TRACE_PROCESSOR=console
-```
+```

package/dist/ai/docs/nocobase/api/cli/config/delete.md

@@ -1,7 +1,7 @@
 ---
-title: "nb config delete"
-description: "nb config delete command reference: delete an explicitly set CLI configuration item."
-keywords: "nb config delete,NocoBase CLI,delete configuration"
+title: 'nb config delete'
+description: 'nb config delete command reference: delete an explicitly set CLI configuration item.'
+keywords: 'nb config delete,NocoBase CLI,delete configuration'
 ---
 
 # nb config delete
@@ -16,9 +16,9 @@ nb config delete <key>
 
 ## Parameters
 
-| Parameter | Type | Description |
-| --- | --- | --- |
-| `<key>` | string | Configuration item name. See [`nb config`](./index.md) for supported values |
+| Parameter | Type   | Description                                                                 |
+| --------- | ------ | --------------------------------------------------------------------------- |
+| `<key>`   | string | Configuration item name. See [`nb config`](./index.md) for supported values |
 
 ## Examples
 
@@ -27,6 +27,8 @@ nb config delete locale
 nb config delete update.policy
 nb config delete docker.network
 nb config delete docker.container-prefix
+nb config delete nb-image-registry
+nb config delete nb-image-variant
 nb config delete proxy.nb-cli-root
 nb config delete proxy.upstream-host
 nb config delete proxy.nginx-driver

package/dist/ai/docs/nocobase/api/cli/config/get.md

@@ -1,7 +1,7 @@
 ---
-title: "nb config get"
-description: "nb config get command reference: read the effective value of a CLI configuration item."
-keywords: "nb config get,NocoBase CLI,read configuration"
+title: 'nb config get'
+description: 'nb config get command reference: read the effective value of a CLI configuration item.'
+keywords: 'nb config get,NocoBase CLI,read configuration'
 ---
 
 # nb config get
@@ -16,9 +16,9 @@ nb config get <key>
 
 ## Parameters
 
-| Parameter | Type | Description |
-| --- | --- | --- |
-| `<key>` | string | Configuration item name. See [`nb config`](./index.md) for supported values |
+| Parameter | Type   | Description                                                                 |
+| --------- | ------ | --------------------------------------------------------------------------- |
+| `<key>`   | string | Configuration item name. See [`nb config`](./index.md) for supported values |
 
 ## Examples
 
@@ -28,6 +28,8 @@ nb config get update.policy
 nb config get license.pkg-url
 nb config get docker.network
 nb config get docker.container-prefix
+nb config get nb-image-registry
+nb config get nb-image-variant
 nb config get proxy.nb-cli-root
 nb config get proxy.upstream-host
 nb config get proxy.nginx-driver

package/dist/ai/docs/nocobase/api/cli/config/index.md

@@ -1,7 +1,7 @@
 ---
-title: "nb config"
-description: "nb config command reference: manage default configuration items for the NocoBase CLI."
-keywords: "nb config,NocoBase CLI,configuration,default configuration"
+title: 'nb config'
+description: 'nb config command reference: manage default configuration items for the NocoBase CLI.'
+keywords: 'nb config,NocoBase CLI,configuration,default configuration'
 ---
 
 # nb config
@@ -10,6 +10,7 @@ Manage default CLI configuration values. The currently supported keys are mainly
 
 - CLI itself: `locale`, `update.policy`, `license.pkg-url`
 - Docker runtime: `docker.network`, `docker.container-prefix`
+- Official NocoBase images: `nb-image-registry`, `nb-image-variant`
 - External executables: `bin.docker`, `bin.caddy`, `bin.git`, `bin.nginx`, `bin.pnpm`, `bin.yarn`
 - Proxy generation: `proxy.nb-cli-root`, `proxy.upstream-host`, `proxy.nginx-driver`, `proxy.caddy-driver`
 
@@ -18,28 +19,32 @@ Most projects only need a few of these keys. In practice, the most common ones a
 - `update.policy`
 - `docker.network`
 - `docker.container-prefix`
+- `nb-image-registry`
+- `nb-image-variant`
 - `bin.nginx` or `bin.caddy`
 - `proxy.nginx-driver` or `proxy.caddy-driver`
 
 ## Common configuration keys
 
-| Key | Default | Description |
-| --- | --- | --- |
-| `locale` | resolved by the current CLI rules | Override the language used by the CLI |
-| `update.policy` | `prompt` | Startup update policy: `prompt`, `auto`, or `off` |
-| `license.pkg-url` | `https://pkg.nocobase.com/` | Override the download URL for commercial extension packages |
-| `docker.network` | `nocobase` | Default network for CLI-managed Docker apps |
-| `docker.container-prefix` | `nb` | Default prefix for CLI-managed Docker containers |
-| `bin.docker` | `docker` | Override the Docker executable path |
-| `bin.caddy` | `caddy` | Override the Caddy executable path |
-| `bin.git` | `git` | Override the Git executable path |
-| `bin.nginx` | `nginx` | Override the Nginx executable path |
-| `bin.pnpm` | `pnpm` | Override the pnpm executable path |
-| `bin.yarn` | `yarn` | Override the Yarn executable path |
-| `proxy.nb-cli-root` | CLI root, usually the current user's home directory | Override the root path visible to the generated proxy config when the proxy process and CLI do not see the same filesystem root |
-| `proxy.upstream-host` | `127.0.0.1` | Override the host used when the proxy forwards traffic back to the NocoBase app |
-| `proxy.nginx-driver` | `local` | Default runtime driver used by `nb proxy nginx` |
-| `proxy.caddy-driver` | `local` | Default runtime driver used by `nb proxy caddy` |
+| Key                       | Default                                             | Description                                                                                                                     |
+| ------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| `locale`                  | resolved by the current CLI rules                   | Override the language used by the CLI                                                                                           |
+| `update.policy`           | `prompt`                                            | Startup update policy: `prompt`, `auto`, or `off`                                                                               |
+| `license.pkg-url`         | `https://pkg.nocobase.com/`                         | Override the download URL for commercial extension packages                                                                     |
+| `docker.network`          | `nocobase`                                          | Default network for CLI-managed Docker apps                                                                                     |
+| `docker.container-prefix` | `nb`                                                | Default prefix for CLI-managed Docker containers                                                                                |
+| `nb-image-registry`       | `dockerhub`                                         | Default registry family for official NocoBase images: `dockerhub` or `aliyun`                                                   |
+| `nb-image-variant`        | `full`                                              | Default tag variant for official NocoBase app images: `standard`, `no-nginx`, `full`, or `full-no-nginx`                        |
+| `bin.docker`              | `docker`                                            | Override the Docker executable path                                                                                             |
+| `bin.caddy`               | `caddy`                                             | Override the Caddy executable path                                                                                              |
+| `bin.git`                 | `git`                                               | Override the Git executable path                                                                                                |
+| `bin.nginx`               | `nginx`                                             | Override the Nginx executable path                                                                                              |
+| `bin.pnpm`                | `pnpm`                                              | Override the pnpm executable path                                                                                               |
+| `bin.yarn`                | `yarn`                                              | Override the Yarn executable path                                                                                               |
+| `proxy.nb-cli-root`       | CLI root, usually the current user's home directory | Override the root path visible to the generated proxy config when the proxy process and CLI do not see the same filesystem root |
+| `proxy.upstream-host`     | `127.0.0.1`                                         | Override the host used when the proxy forwards traffic back to the NocoBase app                                                 |
+| `proxy.nginx-driver`      | `local`                                             | Default runtime driver used by `nb proxy nginx`                                                                                 |
+| `proxy.caddy-driver`      | `local`                                             | Default runtime driver used by `nb proxy caddy`                                                                                 |
 
 ## Usage
 
@@ -49,12 +54,12 @@ nb config <command>
 
 ## Subcommands
 
-| Command | Description |
-| --- | --- |
-| [`nb config get`](./get.md) | Read the effective value of a configuration key |
-| [`nb config set`](./set.md) | Set a configuration key |
-| [`nb config delete`](./delete.md) | Delete an explicitly set configuration key |
-| [`nb config list`](./list.md) | List the configuration keys that are currently set explicitly |
+| Command                           | Description                                                   |
+| --------------------------------- | ------------------------------------------------------------- |
+| [`nb config get`](./get.md)       | Read the effective value of a configuration key               |
+| [`nb config set`](./set.md)       | Set a configuration key                                       |
+| [`nb config delete`](./delete.md) | Delete an explicitly set configuration key                    |
+| [`nb config list`](./list.md)     | List the configuration keys that are currently set explicitly |
 
 ## Examples
 
@@ -69,6 +74,9 @@ nb config set proxy.nginx-driver docker
 nb config set proxy.caddy-driver local
 nb config get docker.network
 nb config set docker.network nocobase
+nb config get nb-image-registry
+nb config set nb-image-registry aliyun
+nb config set nb-image-variant full-no-nginx
 nb config set bin.nginx /usr/sbin/nginx
 nb config set bin.git /usr/bin/git
 nb config set bin.pnpm /usr/local/bin/pnpm
@@ -79,6 +87,9 @@ nb config delete docker.container-prefix
 
 - `bin.nginx` and `bin.caddy` only affect the `local` driver for `nb proxy nginx` and `nb proxy caddy`
 - `bin.pnpm` is used when commands need to run pnpm directly, such as updating a pnpm-managed global CLI install with `nb self update`
+- `nb-image-registry` only affects official NocoBase image defaults used by the CLI. `dockerhub` maps app images to `nocobase/nocobase`, while `aliyun` maps them to `registry.cn-shanghai.aliyuncs.com/nocobase/nocobase`
+- `nb-image-variant` only affects official NocoBase app image tags. With version tag `1.7.14`, the CLI resolves `standard` to `1.7.14`, `no-nginx` to `1.7.14-no-nginx`, `full` to `1.7.14-full`, and `full-no-nginx` to `1.7.14-full-no-nginx`
+- When `nb-image-registry=aliyun`, the CLI also switches the default built-in database images to the official Aliyun mirrors for PostgreSQL, MySQL, MariaDB, and Kingbase
 - `proxy.nginx-driver` and `proxy.caddy-driver` store the default driver used by each provider
 - `proxy.nb-cli-root` and `proxy.upstream-host` are advanced proxy overrides. Most CLI-managed `local` or `docker` envs can use the defaults directly
 - If you only want to switch the active proxy driver, using `nb proxy nginx use` or `nb proxy caddy use` is usually clearer than setting the config key manually

package/dist/ai/docs/nocobase/api/cli/config/set.md

@@ -1,7 +1,7 @@
 ---
-title: "nb config set"
-description: "nb config set command reference: set a CLI configuration item."
-keywords: "nb config set,NocoBase CLI,set configuration"
+title: 'nb config set'
+description: 'nb config set command reference: set a CLI configuration item.'
+keywords: 'nb config set,NocoBase CLI,set configuration'
 ---
 
 # nb config set
@@ -16,10 +16,10 @@ nb config set <key> <value>
 
 ## Parameters
 
-| Parameter | Type | Description |
-| --- | --- | --- |
-| `<key>` | string | Configuration item name. See [`nb config`](./index.md) for supported values |
-| `<value>` | string | Configuration value, cannot be empty |
+| Parameter | Type   | Description                                                                 |
+| --------- | ------ | --------------------------------------------------------------------------- |
+| `<key>`   | string | Configuration item name. See [`nb config`](./index.md) for supported values |
+| `<value>` | string | Configuration value, cannot be empty                                        |
 
 ## Examples
 
@@ -29,6 +29,10 @@ nb config set update.policy auto
 nb config set license.pkg-url https://pkg.nocobase.com/
 nb config set docker.network nocobase
 nb config set docker.container-prefix nb
+nb config set nb-image-registry dockerhub
+nb config set nb-image-registry aliyun
+nb config set nb-image-variant full
+nb config set nb-image-variant full-no-nginx
 nb config set bin.docker /usr/local/bin/docker
 nb config set bin.caddy /opt/homebrew/bin/caddy
 nb config set bin.git /usr/bin/git
@@ -43,7 +47,9 @@ nb config set bin.yarn yarn
 
 ## Notes
 
-`update.policy` supports `prompt`, `auto`, and `off`, and the default value is `prompt`.
+- `update.policy` supports `prompt`, `auto`, and `off`, and the default value is `prompt`
+- `nb-image-registry` supports `dockerhub` and `aliyun`, and the default value is `dockerhub`
+- `nb-image-variant` supports `standard`, `no-nginx`, `full`, and `full-no-nginx`, and the default value is `full`
 
 ## Related commands
 

package/dist/ai/docs/nocobase/file-manager/field-attachment.md

@@ -1,5 +1,11 @@
 # Attachment
 
+:::warning Note
+
+The Attachment field will be deprecated in a future version. For new apps or when adjusting existing business flows, migrate to a custom file collection as early as possible and manage related files with association fields.
+
+:::
+
 ## Introduction
 
 The system has a built-in "Attachment" field type to support file uploads in custom collections.

package/dist/ai/docs/nocobase/file-manager/file-preview/index.md

@@ -12,17 +12,8 @@ Currently, NocoBase provides the following file preview plugins:
 
 ## PDF preview with external storage
 
-PDF preview uses PDF.js to render files in the browser. The browser must first read the PDF file content and then pass it to PDF.js for rendering. Therefore, when files are stored in external storage such as OSS, S3, COS, or a CDN, and the file access domain is different from the NocoBase site domain, the external storage must allow the NocoBase site to read files across origins.
+NocoBase previews PDFs through a browser iframe. Some browsers or PDF readers may support scripts, forms, or other interactive content inside PDF files. If the previewed file comes from an untrusted source, pay attention to the security boundary for script execution.
 
-If CORS is not configured, PDF downloads can still work normally, but preview may fail with a file loading error.
+We recommend isolating the file access domain from the NocoBase site and API domains. For example, serve files from OSS, S3, COS, or a CDN through a dedicated domain, instead of sharing the same origin with the NocoBase frontend or API.
 
-The CORS configuration for external storage or CDN should include:
-
-```http
-Access-Control-Allow-Origin: https://your-nocobase-domain
-Access-Control-Allow-Methods: GET, HEAD
-Access-Control-Allow-Headers: *
-Access-Control-Expose-Headers: Content-Length, Content-Range, Accept-Ranges, Content-Disposition, Content-Type
-```
-
-`Access-Control-Allow-Origin` should be set to the actual domain used to access NocoBase. Avoid using `*` for non-public files over the long term, because it expands the range of sites that can read the files.
+If the file domain is different from the API domain, and the API does not enable CORS access for the file domain, scripts running in the PDF preview environment are usually restricted by the browser's same-origin policy. They cannot directly read the NocoBase page, browser storage, or API responses.

package/dist/ai/docs/nocobase/file-manager/storage/aliyun-oss.md

@@ -2,6 +2,15 @@
 
 A storage engine based on Aliyun OSS. Before use, you need to prepare the relevant account and permissions.
 
+
+:::warning Note
+
+This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+Even if the OSS bucket itself is private, the built-in Aliyun OSS engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters
 
 

package/dist/ai/docs/nocobase/file-manager/storage/amazon-s3.md

@@ -2,6 +2,15 @@
 
 A storage engine based on Amazon S3. You need to prepare the relevant account and permissions before use.
 
+
+:::warning Note
+
+This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+Even if the S3 bucket itself is private, the built-in Amazon S3 engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters
 
 

package/dist/ai/docs/nocobase/file-manager/storage/index.md

@@ -18,6 +18,29 @@ Currently, NocoBase has built-in support for the following engine types:
 
 The system automatically adds a local storage engine during installation, which can be used directly. You can also add new engines or edit the parameters of existing ones.
 
+
+If you are already using a storage engine that only supports public access and want to migrate historical files to S3 Pro, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+## File Accessibility
+
+Different storage engines support different file access controls. Before configuring a storage engine, confirm whether your files need private access:
+
+| Storage engine | File accessibility |
+| --- | --- |
+| [Local Storage](./local) | Only public access is supported; private access is not supported |
+| [Amazon S3](./amazon-s3) | Only public access is supported; private access is not supported |
+| [Aliyun OSS](./aliyun-oss) | Only public access is supported; private access is not supported |
+| [Tencent COS](./tencent-cos) | Only public access is supported; private access is not supported |
+| [S3 Pro](./s3-pro) | Private access is supported through temporary signed URLs |
+
+:::warning Note
+
+Local Storage, Amazon S3, Aliyun OSS, and Tencent COS do not perform login authentication for file access and do not generate temporary signed URLs. After a file is uploaded, anyone who has the file access URL can access it directly.
+
+If you need to store contracts, identity documents, internal materials, or other files that should not be public, use [S3 Pro](./s3-pro) and enable private access.
+
+:::
+
 ## Common Parameters
 
 In addition to the specific parameters for different engine types, the following are common parameters (using local storage as an example):

package/dist/ai/docs/nocobase/file-manager/storage/local.md

@@ -2,6 +2,15 @@
 
 Uploaded files will be saved in a local directory on the server's hard drive. This is suitable for scenarios with a small total volume of uploaded files managed by the system or for experimental purposes.
 
+
+:::warning Note
+
+Local Storage does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
+
+If you need to store contracts, identity documents, internal materials, or other files that should not be public, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+
+:::
+
 ## Configuration Parameters