@nocobase/plugin-ai 3.0.0-alpha.7 → 3.0.0-alpha.9

package/dist/ai/docs/nocobase/ai-builder/ai-portal/model-selection.md

@@ -0,0 +1,120 @@
+---
+title: "LLM Selection"
+description: "Explore test results and selection guidance for using leading flagship models to build NocoBase applications, based on a standardized evaluation system covering data modeling, pages, permissions, and workflows."
+keywords: "NocoBase AI Builder,LLM selection,GPT,DeepSeek,Qwen,AI Agent,model evaluation"
+---
+
+# LLM Selection
+
+:::tip Key takeaway
+
+**Leading flagship models currently available on the market can all build the core of a NocoBase application.**
+
+Models differ in the completeness of their initial output, build time, and number of issues. Choose one based on the model services already available to you, network conditions in your region, cost, and your team's preferences.
+
+:::
+
+This evaluation used a standardized CRM requirement set (a sales opportunity and customer follow-up system) to validate the applications built by different models:
+
+| Evaluation dimensions | Standardized evaluation items |
+| :---: | :---: |
+| 14 | 61 |
+
+## Evaluation dimensions
+
+The evaluation covers NocoBase's core capabilities, configuration capabilities, and foundational components. It also checks whether each model can understand requirements and carry out the corresponding build tasks.
+
+| Capability | Evaluation focus |
+| --- | --- |
+| Data modeling | Collections, field types, relationships, required and unique constraints, and default values |
+| Pages and features | Navigation, lists, forms, details, search, filters, and dashboards |
+| Business logic | Status transitions, business validation, calculation rules, and consistency of related data |
+| Permissions and security | Roles, menu permissions, action permissions, data scopes, and field permissions |
+| Workflow automation | Triggers, nodes, conditional branches, notifications, data side effects, and failure retries |
+| User experience | Information architecture, form experience, action feedback, and responsive layouts |
+| Robustness | Invalid input, duplicate submissions, consistency on failure, data volume, and network recovery |
+| Requirements coverage | Whether explicit requirements and core business paths are fully implemented |
+| Reasonable extensions | Whether features proactively added by the model serve a clear business purpose |
+| Scope control | Whether the result contains duplicate, unused, or out-of-scope business modules |
+
+## Evaluation results
+
+| Evaluation dimension | GPT-5.6 Sol | DeepSeek-V4-Flash | Qwen3.8-Max | GPT-5.6 Luna |
+| --- | :---: | :---: | :---: | :---: |
+| Data modeling | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| Feature completion | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#d97706;font-weight:600">◐ Partial pass</span> |
+| Business logic | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| Permissions and security | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| Workflow automation | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| User experience | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#d97706;font-weight:600">◐ Partial pass</span> |
+| Robustness | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| Requirements coverage | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#d97706;font-weight:600">◐ Partial pass</span> |
+| Reasonable extensions | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| Scope control | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> | <span style="color:#15803d;font-weight:600">✓ Pass</span> |
+| **Build speed** | <span style="color:#2563eb;font-weight:700">Relatively fast</span> | <span style="color:#2563eb;font-weight:700">Relatively fast</span> | <span style="color:#d97706;font-weight:700">Slow</span> | <span style="color:#15803d;font-weight:700">Fastest</span> |
+| **Single-run quality score** | <span style="display:inline-block;min-width:42px;padding:2px 10px;border-radius:6px;color:#1d4ed8;background:#eff6ff;font-weight:800">90</span> | <span style="display:inline-block;min-width:42px;padding:2px 10px;border-radius:6px;color:#1d4ed8;background:#eff6ff;font-weight:800">91</span> | <span style="display:inline-block;min-width:42px;padding:2px 10px;border-radius:6px;color:#1d4ed8;background:#eff6ff;font-weight:800">90</span> | <span style="display:inline-block;min-width:42px;padding:2px 10px;border-radius:6px;color:#c2410c;background:#fff7ed;font-weight:800">77</span> |
+
+:::tip Single-run quality score
+
+The single-run quality score has a maximum of 100 points. One point is deducted for each bug found during the first complete acceptance check, providing an indication of the quality of the model's initial build. The model can resolve these issues through subsequent feedback and revisions.
+
+:::
+
+:::info Note on build time
+
+Build time is affected by factors such as computer hardware performance, dependency installation and Build compilation, model service response speed, and network conditions.
+
+:::
+
+## Evaluation item details
+
+The 61 standardized evaluation items are organized into three layers: 46 items for build result quality, 7 for requirements understanding and reasonable extensions, and 8 for build process efficiency. Every item uses consistent inspection methods and pass criteria.
+
+### Layer 1: Build result quality (46 items)
+
+<table style="table-layout: fixed; width: 100%;">
+  <colgroup><col style="width: 32%;" /><col style="width: 68%;" /></colgroup>
+  <thead><tr><th>Evaluation dimension</th><th>Standardized evaluation items</th></tr></thead>
+  <tbody>
+    <tr><td>Data modeling (8 items)</td><td><code>DM-01</code> Whether all required collections are created<br /><code>DM-02</code> Whether all required fields exist<br /><code>DM-03</code> Whether field types are correct<br /><code>DM-04</code> Whether one-to-one relationships can be created and used<br /><code>DM-05</code> Whether one-to-many relationships can be created and used<br /><code>DM-06</code> Whether many-to-many relationships can be created and used<br /><code>DM-07</code> Whether required, unique, and default-value rules take effect<br /><code>DM-08</code> Whether related data can be viewed and filtered</td></tr>
+    <tr><td>Feature completion (6 items)</td><td><code>FC-01</code> Whether all required pages and navigation entries are present<br /><code>FC-02</code> Whether records can be created, viewed, edited, and deleted<br /><code>FC-03</code> Whether core user journeys can be completed end to end<br /><code>FC-04</code> Whether key business actions are available<br /><code>FC-05</code> Whether search, filtering, and sorting are available<br /><code>FC-06</code> Whether dashboards contain the required content</td></tr>
+    <tr><td>Business logic (6 items)</td><td><code>BL-01</code> Whether opportunity status transition rules are correct<br /><code>BL-02</code> Whether business validation rules take effect<br /><code>BL-03</code> Whether calculated fields and statistical definitions are correct<br /><code>BL-04</code> Whether data is mapped correctly after lead conversion<br /><code>BL-05</code> Whether updates to related records remain consistent<br /><code>BL-06</code> Whether deletion and archiving rules are correct</td></tr>
+    <tr><td>Permissions and security (7 items)</td><td><code>ACL-01</code> Whether all required roles are created<br /><code>ACL-02</code> Whether test users and role assignments are correct<br /><code>ACL-03</code> Whether page and menu access permissions are correct<br /><code>ACL-04</code> Whether data operation permissions are correct<br /><code>ACL-05</code> Whether record-level data scopes are correct<br /><code>ACL-06</code> Whether field-level view and edit permissions are correct<br /><code>ACL-07</code> Whether role changes and combined roles behave correctly</td></tr>
+    <tr><td>Workflow automation (7 items)</td><td><code>WF-01</code> Whether all required workflows are created and enabled<br /><code>WF-02</code> Whether workflow triggers are designed correctly<br /><code>WF-03</code> Whether node order and data transfer are correct<br /><code>WF-04</code> Whether conditions and branch results are correct<br /><code>WF-05</code> Whether record read/write side effects are correct<br /><code>WF-06</code> Whether notification recipients and content are correct<br /><code>WF-07</code> Whether failure logs and retry behavior are traceable</td></tr>
+    <tr><td>User experience (7 items)</td><td><code>UX-01</code> Whether navigation and information architecture are clear<br /><code>UX-02</code> Whether list information and common actions are easy to use<br /><code>UX-03</code> Whether form grouping, order, and guidance are clear<br /><code>UX-04</code> Whether detail pages support understanding and follow-up actions<br /><code>UX-05</code> Whether action feedback and status changes are clear<br /><code>UX-06</code> Whether the application is usable at different screen widths<br /><code>UX-07</code> Whether empty, loading, and error states are complete</td></tr>
+    <tr><td>Robustness (5 items)</td><td><code>ROB-01</code> Whether invalid and boundary inputs are handled safely<br /><code>ROB-02</code> Whether duplicate submissions cause duplicate side effects<br /><code>ROB-03</code> Whether data remains consistent when execution fails<br /><code>ROB-04</code> Whether the application remains usable with empty and large datasets<br /><code>ROB-05</code> Whether the application can recover after a session or network interruption</td></tr>
+  </tbody>
+</table>
+
+### Layer 2: Requirements understanding and reasonable extensions (7 items)
+
+<table style="table-layout: fixed; width: 100%;">
+  <colgroup><col style="width: 32%;" /><col style="width: 68%;" /></colgroup>
+  <thead><tr><th>Evaluation dimension</th><th>Standardized evaluation items</th></tr></thead>
+  <tbody>
+    <tr><td>Requirements coverage (3 items)</td><td><code>COV-01</code> Whether all pages and actions requested in the prompt are implemented<br /><code>COV-02</code> Whether all data, permissions, and workflows requested in the prompt are implemented<br /><code>COV-03</code> Whether capabilities required by the main process but not individually specified in the prompt are present</td></tr>
+    <tr><td>Reasonable extensions (2 items)</td><td><code>EXT-01</code> Whether proactively added fields, relationships, and rules are necessary<br /><code>EXT-02</code> Whether proactively added pages, actions, and statistics serve a clear purpose</td></tr>
+    <tr><td>Scope control (2 items)</td><td><code>SCOPE-01</code> Whether duplicate or unused features and configurations are generated<br /><code>SCOPE-02</code> Whether business modules unrelated to the task scope are added</td></tr>
+  </tbody>
+</table>
+
+### Layer 3: Build process efficiency (8 items)
+
+<table style="table-layout: fixed; width: 100%;">
+  <colgroup><col style="width: 32%;" /><col style="width: 68%;" /></colgroup>
+  <thead><tr><th>Evaluation dimension</th><th>Standardized evaluation items</th></tr></thead>
+  <tbody>
+    <tr><td>Time to first usable result (1 item)</td><td><code>EFF-FIRST-01</code> Time required to reach the first usable result</td></tr>
+    <tr><td>Convergence efficiency (3 items)</td><td><code>EFF-FINAL-01</code> Number of iterations required to reach final acceptance<br /><code>EFF-FINAL-02</code> Total time required to reach the final state<br /><code>EFF-FINAL-03</code> Tokens consumed to reach the final state</td></tr>
+    <tr><td>Human intervention (1 item)</td><td><code>EFF-HUMAN-01</code> Number of human interventions during the evaluation</td></tr>
+    <tr><td>Repeatability (3 items)</td><td><code>EFF-STABLE-01</code> Whether repeated runs of the same task produce consistent acceptance results<br /><code>EFF-STABLE-02</code> Whether collections, relationships, roles, and workflows are consistent across three runs<br /><code>EFF-STABLE-03</code> Whether variation in iterations and time remains controlled</td></tr>
+  </tbody>
+</table>
+
+## Next steps
+
+- [Build collaboratively with an AI Agent](./agent-workflow.md) — Describe pages and interactions in natural language and iterate continuously with an AI Agent
+- [AI Portal quick start](./index.md) — Create and run your first AI Portal
+- [Data modeling](../data-modeling.md) — Create collections, fields, and relationships with natural language
+- [Workflow management](../workflow.md) — Create, edit, enable, and diagnose workflows
+- [Permission configuration](../acl.md) — Manage roles, permission policies, user assignments, and risk assessments

package/dist/ai/docs/nocobase/api/cli/api/resource/create.md

@@ -1,12 +1,12 @@
 ---
 title: "nb api resource create"
-description: "nb api resource create command reference: create a record in a selected NocoBase resource."
+description: "nb api resource create command reference: create one or more records in a selected NocoBase resource."
 keywords: "nb api resource create,NocoBase CLI,create record,CRUD"
 ---
 
 # nb api resource create
 
-Create a record in a selected resource. Pass record data as a JSON object through `--values`.
+Create records in a selected resource. Pass record data as a JSON object through `--values`, or as a JSON array of objects to create multiple records in a single request.
 
 ## Usage
 
@@ -21,7 +21,7 @@ nb api resource create --resource <resource> --values <json> [flags]
 | `--resource` | string | Resource name, required |
 | `--data-source` | string | Data source key, default `main` |
 | `--source-id` | string | Source record ID for association resources |
-| `--values` | string | Data for the new record as a JSON object, required |
+| `--values` | string | Data for the new records: a JSON object, or a JSON array of objects to create multiple records; required |
 | `--whitelist` | string[] | Fields allowed to write; repeatable or pass a JSON array |
 | `--blacklist` | string[] | Fields forbidden to write; repeatable or pass a JSON array |
 
@@ -31,6 +31,7 @@ Also supports common connection parameters from [`nb api resource`](./index.md).
 
 ```bash
 nb api resource create --resource users --values '{"nickname":"Ada"}'
+nb api resource create --resource users --values '[{"nickname":"Ada"},{"nickname":"Grace"}]'
 nb api resource create --resource posts.comments --source-id 1 --values '{"content":"Hello"}'
 ```
 

package/dist/ai/docs/nocobase/file-manager/file-preview/index.md

@@ -8,12 +8,53 @@ For file types that do not support native preview, you can enable preview functi
 
 Currently, NocoBase provides the following file preview plugins:
 
-* [Office File Preview Plugin](../file-preview/ms-office.md)
+- [Office File Preview Plugin](./ms-office.md)
 
-## PDF preview with external storage
+## PDF preview mechanism
 
-NocoBase previews PDFs through a browser iframe. Some browsers or PDF readers may support scripts, forms, or other interactive content inside PDF files. If the previewed file comes from an untrusted source, pay attention to the security boundary for script execution.
+NocoBase selects the PDF preview method according to whether the file URL has the same origin as the current page:
+
+| File URL | Common storage type | Preview method | CORS requirement |
+| --- | --- | --- | --- |
+| Same origin as NocoBase | Local storage | NocoBase reads the file and renders it with the built-in PDF.js viewer | No cross-origin CORS involved |
+| Cross-origin | Third-party storage such as OSS, S3, COS, or a CDN | The browser opens the file URL in an iframe | The iframe preview itself does not require CORS |
+
+:::tip What determines the preview method
+
+The preview method depends on whether the file URL is same-origin, not directly on the storage engine name. Local storage served from a separate file domain is treated as cross-origin. Third-party storage accessed through a same-origin NocoBase proxy is treated as same-origin.
+
+:::
+
+### Local storage or a same-origin URL
+
+Local storage URLs usually start with `/storage/uploads/` and have the same origin as the NocoBase page. During preview, NocoBase reads the PDF data and passes it to the built-in PDF.js viewer to render pages and text.
+
+This method does not depend on the browser's built-in PDF reader. Even if the file response uses `Content-Disposition: attachment` for security, NocoBase can still read and render the file in the preview component. The file URL must remain accessible with the current login state.
+
+### Third-party storage or a cross-origin URL
+
+Third-party storage such as OSS, S3, COS, and CDNs usually uses a separate domain. NocoBase places this PDF URL in an iframe, so the browser and the storage service's response headers determine the result.
+
+To open a PDF in the iframe, the storage service should normally return `Content-Type: application/pdf` and must not force a download with `Content-Disposition: attachment`. If the response requests a download, the browser downloads the file directly and NocoBase cannot override that behavior in the frontend.
+
+Loading a cross-origin PDF in an iframe does not itself require CORS. However, the download button in the preview component reads the file with `fetch` and creates a Blob, so cross-origin downloads still require the storage service to allow CORS requests from the NocoBase site.
+
+### Notes for Aliyun OSS
+
+In some cases, the default Aliyun OSS domain forces a download by returning `Content-Disposition: attachment` and `x-oss-force-download: true`. Images may still preview normally, while a PDF placed in an iframe is downloaded.
+
+You can usually resolve this by binding a custom domain to the bucket and configuring NocoBase to access files through that domain. See [Aliyun OSS troubleshooting](../storage/aliyun-oss.md#common-issues) for configuration and diagnostic steps.
+
+### Security boundary for cross-origin previews
+
+Some browsers or PDF readers may support scripts, forms, or other interactive content inside PDF files. If the previewed file comes from an untrusted source, pay attention to the security boundary for script execution.
 
 We recommend isolating the file access domain from the NocoBase site and API domains. For example, serve files from OSS, S3, COS, or a CDN through a dedicated domain, instead of sharing the same origin with the NocoBase frontend or API.
 
 If the file domain is different from the API domain, and the API does not enable CORS access for the file domain, scripts running in the PDF preview environment are usually restricted by the browser's same-origin policy. They cannot directly read the NocoBase page, browser storage, or API responses.
+
+## Related links
+
+- [Office File Preview Plugin](./ms-office.md)
+- [Aliyun OSS](../storage/aliyun-oss.md)
+- [S3 Pro](../storage/s3-pro.md)

package/dist/ai/docs/nocobase/file-manager/storage/aliyun-oss.md

@@ -7,7 +7,7 @@ A storage engine based on Aliyun OSS. Before use, you need to prepare the releva
 
 This engine does not support private access. After a file is uploaded, NocoBase generates a directly accessible URL, and anyone who has that URL can access the file.
 
-Even if the OSS bucket itself is private, the built-in Aliyun OSS engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
+Even if the OSS bucket itself is private, the built-in Aliyun OSS engine does not generate temporary signed URLs for file access. If you need private access, use [S3 Pro](./s3-pro.md). If historical files already exist, see [Migrate to S3 Pro](./migrate-to-s3-pro.md).
 
 :::
 
@@ -18,9 +18,13 @@ Even if the OSS bucket itself is private, the built-in Aliyun OSS engine does no
 
 
 :::info{title=Note}
-This section only introduces the specific parameters for the Aliyun OSS storage engine. For general parameters, please refer to [General Engine Parameters](./index#引擎通用参数).
+This section only introduces the specific parameters for the Aliyun OSS storage engine. For general parameters, see [General Engine Parameters](./index.md#common-parameters).
 :::
 
+### Base URL
+
+Enter the file access URL prefix, such as a custom domain bound to the current bucket: `https://oss.example.com`. Accessing PDFs through the default Aliyun OSS domain may cause the browser to download them. We recommend binding a custom domain first. See [Common issues](#common-issues) below for details.
+
 ### Region
 
 Enter the region of the OSS storage, for example: `oss-cn-hangzhou`.
@@ -43,4 +47,97 @@ Enter the name of the OSS bucket.
 
 ### Timeout
 
-Enter the timeout for uploading to Aliyun OSS, in milliseconds. The default is `60000` milliseconds (i.e., 60 seconds).
+Enter the timeout for uploading to Aliyun OSS, in milliseconds. The default is `60000` milliseconds (i.e., 60 seconds).
+
+## Common issues
+
+### A PDF is downloaded instead of previewed
+
+NocoBase previews cross-origin PDFs in an iframe. The browser accesses the OSS file URL directly, so the OSS response headers determine whether the file is displayed or downloaded.
+
+If a PDF is downloaded from the iframe, inspect the file request in the browser developer tools. A typical problematic response looks like this:
+
+```http
+Content-Type: application/pdf
+Content-Disposition: attachment
+x-oss-force-download: true
+```
+
+`Content-Type: application/pdf` identifies the file correctly, but `Content-Disposition: attachment` instructs the browser to download it. The default Aliyun OSS domain forces downloads in some cases. See the official Aliyun documentation: [How do I configure a PDF file to be previewed instead of downloaded?](https://help.aliyun.com/zh/oss/user-guide/how-do-i-configure-an-object-to-be-previewed-instead-of-downloaded).
+
+We recommend the following configuration:
+
+1. Follow [Access OSS resources through a custom domain](https://help.aliyun.com/zh/oss/user-guide/access-buckets-via-custom-domain-names) to bind a custom domain to the bucket
+2. Configure DNS and the HTTPS certificate, then verify that the custom domain can access the file directly
+3. Configure the access URL for the NocoBase storage engine in use
+
+For step 3:
+
+- With the built-in **Aliyun OSS** engine, set **Base URL** to the bound custom domain, such as `https://oss.example.com`
+- With [S3 Pro](./s3-pro.md) connected to Aliyun OSS, the upload endpoint can continue to use the regional OSS endpoint; set the access endpoint to the custom domain and set `Full access URL style` to `Ignore`
+
+Upload a new PDF to verify the configuration. If an existing file record stores a complete URL, also make sure that the URL returned to the frontend now uses the custom domain.
+
+:::tip Check the response headers
+
+Previewing a cross-origin PDF in an iframe does not itself require CORS. Whether the PDF can be displayed inline primarily depends on `Content-Type` and `Content-Disposition`. This is separate from the CORS requirement for the download button described below.
+
+:::
+
+### An image previews correctly, but the download button reports a CORS error
+
+Images are usually previewed with `<img>`, and cross-origin PDFs are previewed with an iframe. Both can display resources without CORS response headers. The download button, however, reads the file with `fetch` and creates a Blob for the browser to download. This request is subject to the browser's same-origin policy.
+
+The following console error means that OSS did not return `Access-Control-Allow-Origin` for the current NocoBase site:
+
+```text
+Access to fetch at 'https://oss.example.com/path/to/file.jpg' from origin
+'https://example.com' has been blocked by CORS policy:
+No 'Access-Control-Allow-Origin' header is present on the requested resource.
+```
+
+Follow the official Aliyun guide [Configure cross-origin resource sharing](https://help.aliyun.com/zh/oss/user-guide/configure-cross-origin-resource-sharing) and create a CORS rule for the bucket. For downloads from the preview component, use values like these:
+
+| Setting | Recommended value |
+| --- | --- |
+| Allowed Origins | The complete NocoBase origin, such as `https://example.com` |
+| Allowed Methods | `GET`, `HEAD` |
+| Allowed Headers | `*` |
+| Expose Headers | `ETag`, `Content-Disposition` |
+| MaxAgeSeconds | `600` |
+
+If S3 Pro also uploads files directly from the browser, add methods such as `PUT` and `POST` according to the actual upload requests shown in the browser Network panel, or create a separate upload rule.
+
+After saving the rule, request the file again with the NocoBase site origin. The response should include at least:
+
+```http
+Access-Control-Allow-Origin: https://example.com
+Access-Control-Allow-Methods: GET, HEAD
+```
+
+The browser may already have cached the response used for the image preview. That request did not include an `Origin` header, and the cached response may not contain `Access-Control-Allow-Origin`. If downloading still fails after you configure CORS, clear the browser cache for the file or select **Disable cache** in the developer tools and try again.
+
+### Verify the response headers
+
+Use `curl` to simulate a cross-origin request from the NocoBase site. Replace the example origin, file URL, and signature parameters with the actual values:
+
+```bash
+curl -sS -D - -o /dev/null \
+  -H 'Origin: https://example.com' \
+  'https://oss.example.com/path/to/file.pdf?<signed-query>'
+```
+
+Check the following results:
+
+- PDF preview returns `Content-Type: application/pdf` without `Content-Disposition: attachment`
+- Cross-origin download returns an `Access-Control-Allow-Origin` matching the NocoBase site
+- The actual file URL uses the custom domain instead of the default `*.oss-cn-*.aliyuncs.com` domain
+
+It is normal for a request without an `Origin` header to omit CORS response headers. Keep the `Origin` header in the example when verifying CORS.
+
+## Related links
+
+- [File Preview](../file-preview/index.md)
+- [S3 Pro](./s3-pro.md)
+- [Migrate to S3 Pro](./migrate-to-s3-pro.md)
+- [Storage Engines](./index.md)

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-bulk-edit/index.md

@@ -10,7 +10,7 @@ description: |
   Batch edit all records or selected records.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-bulk-update/index.md

@@ -10,7 +10,7 @@ description: |
   Batch update all records or selected records.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-custom-request/index.md

@@ -10,7 +10,7 @@ description: |
   Sending a request to any HTTP service supports sending context data to the target service.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-duplicate/index.md

@@ -10,7 +10,7 @@ description: |
   Duplicate a record, you can either duplicate it into a form and edit it before saving it, or you can duplicate it directly to generate a new record.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-export/index.md

@@ -10,7 +10,7 @@ description: |
   Export filtered records to excel, you can configure which fields to export.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-import/index.md

@@ -10,7 +10,7 @@ description: |
   Import records using excel templates. You can configure which fields to import and templates will be generated automatically.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-action-print/index.md

@@ -7,7 +7,7 @@ description: |
   Calls the browser's print function to print a record.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-ai/index.md

@@ -9,7 +9,7 @@ description: |
   Create AI employees with diverse skills to collaborate with humans, build systems, and handle business operations.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-ai-gigachat/index.md

@@ -9,7 +9,7 @@ description: |
   Support integration with GigaChat LLM service.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-api-doc/index.md

@@ -7,7 +7,7 @@ description: |
   An OpenAPI documentation generator for NocoBase HTTP API.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-api-keys/index.md

@@ -7,7 +7,7 @@ description: |
   Allows users to use API key to access application's HTTP API
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-async-task-manager/index.md

@@ -7,7 +7,7 @@ description: |
   Manage and monitor asynchronous tasks such as data import/export. Support task progress tracking and notification.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-audit-logs/index.md

@@ -7,7 +7,7 @@ description: |
   This plugin is deprecated. There will be a new audit log plugin in the future.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 deprecated: true
 editionLevel: 0
 ---

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-auth/index.md

@@ -7,7 +7,7 @@ description: |
   User authentication management, including password, SMS, and support for Single Sign-On (SSO) protocols, with extensibility.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-auth-sms/index.md

@@ -7,7 +7,7 @@ description: |
   SMS authentication.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-backup-restore/index.md

@@ -7,7 +7,7 @@ description: |
   Backup and restore applications for scenarios such as application replication, migration, and upgrades.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 deprecated: true
 editionLevel: 0
 ---

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-backups/index.md

@@ -10,7 +10,7 @@ description: |
   Provides backup and restore functionality, supports scheduled backups, and ensures data security and quick recovery.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-comment/index.md

@@ -7,7 +7,7 @@ description: |
   Provides a Comment block for viewing and creating comments in record details, pop-ups, and similar scenarios.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-grid-card/index.md

@@ -7,7 +7,7 @@ description: |
   Display data in a grid list with pagination support.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-iframe/index.md

@@ -7,7 +7,7 @@ description: |
   Create an iframe block on the page to embed and display external web pages or content.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-list/index.md

@@ -7,7 +7,7 @@ description: |
   Display data in a list with pagination support.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-markdown/index.md

@@ -7,7 +7,7 @@ description: |
   Provide Markdown block
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-multi-step-form/index.md

@@ -9,7 +9,7 @@ description: |
   Break the form with many fields into multiple steps to ease the burden on users.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 deprecated: true
 editionLevel: 0
 ---

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-template/index.md

@@ -7,7 +7,7 @@ description: |
   Create and manage block templates for reuse on pages.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 deprecated: true
 editionLevel: 0
 ---

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-tree/index.md

@@ -9,7 +9,7 @@ description: |
   Provides tree structure filter block
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-block-workbench/index.md

@@ -7,7 +7,7 @@ description: |
   Centrally manages and displays various actions, allowing users to efficiently perform tasks. It supports extensibility, with current action types including pop-ups, links, scanning, and custom requests.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-calendar/index.md

@@ -7,7 +7,7 @@ description: |
   Provides callendar collection template and block for managing date data, typically for date/time related information such as events, appointments, tasks, and so on.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 editionLevel: 0
 ---
 

package/dist/ai/docs/nocobase/plugins/@nocobase/plugin-charts/index.md

@@ -9,7 +9,7 @@ description: |
   The plugin has been deprecated, please use the data visualization plugin instead.
 isFree: true
 builtIn: true
-defaultEnabled: false
+defaultEnabled: true
 deprecated: true
 editionLevel: 0
 ---