@objectstack/service-settings 6.5.1 → 6.7.0

package/dist/index.js

@@ -141,20 +141,20 @@ var SettingsService = class {
   // Manifest registry
   // ---------------------------------------------------------------------
   /** Register (or replace) a manifest. Idempotent. */
-  registerManifest(manifest3) {
+  registerManifest(manifest5) {
     const scopes = /* @__PURE__ */ new Map();
     const encryptedKeys = /* @__PURE__ */ new Set();
     const defaults = /* @__PURE__ */ new Map();
-    const defaultScope = manifest3.scope ?? "tenant";
-    for (const spec of manifest3.specifiers) {
+    const defaultScope = manifest5.scope ?? "tenant";
+    for (const spec of manifest5.specifiers) {
       if (!spec.key || LAYOUT_ONLY_TYPES.has(spec.type)) continue;
       scopes.set(spec.key, spec.scope ?? defaultScope);
       if (spec.encrypted || spec.type === "password") encryptedKeys.add(spec.key);
       if (typeof spec.default !== "undefined") defaults.set(spec.key, spec.default);
     }
-    const prev = this.registry.get(manifest3.namespace);
+    const prev = this.registry.get(manifest5.namespace);
     const actions = prev?.actions ?? /* @__PURE__ */ new Map();
-    this.registry.set(manifest3.namespace, { manifest: manifest3, scopes, encryptedKeys, defaults, actions });
+    this.registry.set(manifest5.namespace, { manifest: manifest5, scopes, encryptedKeys, defaults, actions });
   }
   /** Look up a manifest, or throw `UnknownNamespaceError`. */
   getManifest(namespace) {
@@ -1141,11 +1141,512 @@ var storageTestActionHandler = async ({ values }) => {
   return { ok: false, severity: "error", message: `Unknown adapter: ${adapter}` };
 };
 
+// src/manifests/ai.manifest.ts
+var manifest3 = {
+  namespace: "ai",
+  version: 1,
+  label: "AI",
+  icon: "Sparkles",
+  description: "LLM provider, model, credentials, and embedder configuration used by the platform AI and knowledge services. Provider SDK packages (e.g. @ai-sdk/openai for chat, @objectstack/embedder-openai for embeddings) must be installed on the host for the chosen provider to be loadable at runtime.",
+  scope: "global",
+  readPermission: "setup.access",
+  writePermission: "setup.write",
+  category: "Infrastructure",
+  order: 30,
+  specifiers: [
+    // ── Provider selection ────────────────────────────────────────
+    {
+      type: "group",
+      id: "provider",
+      label: "Provider",
+      required: false,
+      description: "Choose the LLM backend. Memory mode echoes input \u2014 useful for tests but never for production."
+    },
+    {
+      type: "select",
+      key: "provider",
+      label: "Provider",
+      required: true,
+      default: "memory",
+      options: [
+        { value: "memory", label: "Memory (echo \u2014 testing only)" },
+        { value: "gateway", label: "Vercel AI Gateway" },
+        { value: "openai", label: "OpenAI" },
+        { value: "anthropic", label: "Anthropic" },
+        { value: "google", label: "Google Generative AI" }
+      ]
+    },
+    // ── Vercel AI Gateway ─────────────────────────────────────────
+    {
+      type: "group",
+      id: "gateway",
+      label: "Vercel AI Gateway",
+      required: false,
+      visible: "${data.provider === 'gateway'}",
+      description: "Multi-provider router. The model spec follows `provider/model`, e.g. `openai/gpt-4o`."
+    },
+    {
+      type: "text",
+      key: "gateway_model",
+      label: "Gateway model",
+      required: true,
+      description: "Forwarded as AI_GATEWAY_MODEL. Example: openai/gpt-4o",
+      visible: "${data.provider === 'gateway'}"
+    },
+    {
+      type: "password",
+      key: "gateway_api_key",
+      label: "Gateway API key",
+      required: false,
+      encrypted: true,
+      description: "Optional \u2014 required only if the gateway enforces auth.",
+      visible: "${data.provider === 'gateway'}"
+    },
+    // ── OpenAI ───────────────────────────────────────────────────
+    {
+      type: "group",
+      id: "openai",
+      label: "OpenAI",
+      required: false,
+      visible: "${data.provider === 'openai'}"
+    },
+    {
+      type: "password",
+      key: "openai_api_key",
+      label: "OpenAI API key",
+      required: true,
+      encrypted: true,
+      description: "Forwarded as OPENAI_API_KEY. Stored encrypted at rest.",
+      visible: "${data.provider === 'openai'}"
+    },
+    {
+      type: "text",
+      key: "openai_model",
+      label: "Model",
+      required: false,
+      default: "gpt-4o",
+      description: "Default model id. Per-agent overrides take precedence.",
+      visible: "${data.provider === 'openai'}"
+    },
+    {
+      type: "text",
+      key: "openai_base_url",
+      label: "Base URL",
+      required: false,
+      description: "Override for Azure OpenAI or self-hosted gateways. Leave blank for api.openai.com.",
+      visible: "${data.provider === 'openai'}"
+    },
+    // ── Anthropic ────────────────────────────────────────────────
+    {
+      type: "group",
+      id: "anthropic",
+      label: "Anthropic",
+      required: false,
+      visible: "${data.provider === 'anthropic'}"
+    },
+    {
+      type: "password",
+      key: "anthropic_api_key",
+      label: "Anthropic API key",
+      required: true,
+      encrypted: true,
+      description: "Forwarded as ANTHROPIC_API_KEY. Stored encrypted at rest.",
+      visible: "${data.provider === 'anthropic'}"
+    },
+    {
+      type: "text",
+      key: "anthropic_model",
+      label: "Model",
+      required: false,
+      default: "claude-sonnet-4-20250514",
+      visible: "${data.provider === 'anthropic'}"
+    },
+    // ── Google Generative AI ─────────────────────────────────────
+    {
+      type: "group",
+      id: "google",
+      label: "Google",
+      required: false,
+      visible: "${data.provider === 'google'}"
+    },
+    {
+      type: "password",
+      key: "google_api_key",
+      label: "Google API key",
+      required: true,
+      encrypted: true,
+      description: "Forwarded as GOOGLE_GENERATIVE_AI_API_KEY. Stored encrypted at rest.",
+      visible: "${data.provider === 'google'}"
+    },
+    {
+      type: "text",
+      key: "google_model",
+      label: "Model",
+      required: false,
+      default: "gemini-2.0-flash",
+      visible: "${data.provider === 'google'}"
+    },
+    // ── Generation defaults ──────────────────────────────────────
+    {
+      type: "group",
+      id: "defaults",
+      label: "Generation defaults",
+      required: false,
+      description: "Applied when an agent or chat request does not specify its own value.",
+      visible: "${data.provider !== 'memory'}"
+    },
+    {
+      type: "slider",
+      key: "temperature",
+      label: "Temperature",
+      required: false,
+      default: 0.7,
+      min: 0,
+      max: 2,
+      step: 0.1,
+      description: "0 = deterministic, 2 = highly creative.",
+      visible: "${data.provider !== 'memory'}"
+    },
+    {
+      type: "number",
+      key: "max_tokens",
+      label: "Max output tokens",
+      required: false,
+      default: 4096,
+      min: 1,
+      max: 1048576,
+      description: "Hard cap on tokens generated per response.",
+      visible: "${data.provider !== 'memory'}"
+    },
+    {
+      type: "number",
+      key: "request_timeout_ms",
+      label: "Request timeout (ms)",
+      required: false,
+      default: 6e4,
+      min: 1e3,
+      max: 6e5,
+      visible: "${data.provider !== 'memory'}"
+    },
+    // ── Observability ────────────────────────────────────────────
+    { type: "group", id: "observability", label: "Observability", required: false },
+    {
+      type: "toggle",
+      key: "trace_enabled",
+      label: "Record traces",
+      required: false,
+      default: true,
+      description: "Persist prompt/response traces to sys_ai_trace for debugging and replay."
+    },
+    {
+      type: "toggle",
+      key: "log_prompts",
+      label: "Log full prompts",
+      required: false,
+      default: false,
+      description: "Include rendered prompts (not just metadata) in trace rows. \u26A0 May leak PII \u2014 disable in regulated environments."
+    },
+    // ── Probe ────────────────────────────────────────────────────
+    {
+      type: "action_button",
+      id: "test",
+      label: "Test connection",
+      required: false,
+      icon: "Plug",
+      handler: { kind: "http", method: "POST", url: "/api/settings/ai/test" }
+    },
+    // ════════════════════════════════════════════════════════════════
+    // Embedder — text → vector provider used by knowledge / RAG.
+    // Decoupled from the chat provider above so an organisation can
+    // mix-and-match (e.g. OpenAI for chat + 阿里通义 for embeddings).
+    //
+    // The preset list mirrors @objectstack/embedder-openai's
+    // OPENAI_COMPATIBLE_PRESETS so a UI dropdown maps 1:1 to a
+    // runtime baseUrl. The "none" choice is the explicit opt-out
+    // for instances that disable knowledge / RAG entirely.
+    // ════════════════════════════════════════════════════════════════
+    {
+      type: "group",
+      id: "embedder",
+      label: "Embedder",
+      required: false,
+      description: "Text \u2192 vector provider used by knowledge sources and RAG. Independent from the chat provider above \u2014 mix providers freely (e.g. OpenAI for chat + \u963F\u91CC\u901A\u4E49 for embeddings)."
+    },
+    {
+      type: "select",
+      key: "embedder_provider",
+      label: "Provider",
+      required: false,
+      default: "none",
+      options: [
+        { value: "none", label: "Disabled (no embeddings)" },
+        { value: "openai", label: "OpenAI" },
+        { value: "azure", label: "Azure OpenAI" },
+        { value: "dashscope", label: "\u963F\u91CC\u901A\u4E49 DashScope" },
+        { value: "zhipu", label: "\u667A\u8C31 BigModel" },
+        { value: "siliconflow", label: "\u7845\u57FA\u6D41\u52A8 SiliconFlow" },
+        { value: "doubao", label: "\u706B\u5C71\u5F15\u64CE Doubao" },
+        { value: "minimax", label: "MiniMax" },
+        { value: "ollama", label: "Ollama (local)" },
+        { value: "custom", label: "Custom (OpenAI-compatible)" }
+      ]
+    },
+    {
+      type: "password",
+      key: "embedder_api_key",
+      label: "Embedder API key",
+      required: false,
+      encrypted: true,
+      description: "Bearer token sent as Authorization header. For Ollama any non-empty value works.",
+      visible: "${data.embedder_provider && data.embedder_provider !== 'none'}"
+    },
+    {
+      type: "text",
+      key: "embedder_model",
+      label: "Model",
+      required: false,
+      description: "Examples \u2014 OpenAI: text-embedding-3-small \xB7 \u963F\u91CC\u901A\u4E49: text-embedding-v3 \xB7 \u667A\u8C31: embedding-3 \xB7 \u7845\u57FA\u6D41\u52A8: BAAI/bge-m3 \xB7 Ollama: bge-m3",
+      visible: "${data.embedder_provider && data.embedder_provider !== 'none'}"
+    },
+    {
+      type: "text",
+      key: "embedder_base_url",
+      label: "Base URL",
+      required: false,
+      description: "Endpoint root (without /embeddings). Auto-filled from preset; override for proxies or self-hosted gateways.",
+      visible: "${data.embedder_provider === 'custom' || data.embedder_provider === 'azure'}"
+    },
+    {
+      type: "number",
+      key: "embedder_dimensions",
+      label: "Dimensions",
+      required: false,
+      min: 1,
+      max: 8192,
+      description: "Override output dimensionality (Matryoshka models only \u2014 OpenAI v3, \u667A\u8C31 embedding-3, BGE-m3 dense). Leave blank to use the model default.",
+      visible: "${data.embedder_provider && data.embedder_provider !== 'none'}"
+    },
+    {
+      type: "number",
+      key: "embedder_batch_size",
+      label: "Batch size",
+      required: false,
+      default: 64,
+      min: 1,
+      max: 2048,
+      description: "Chunks per embed() call. Reduce if hitting provider rate / size limits.",
+      visible: "${data.embedder_provider && data.embedder_provider !== 'none'}"
+    },
+    {
+      type: "action_button",
+      id: "test_embedder",
+      label: "Test embedder",
+      required: false,
+      icon: "Plug",
+      handler: { kind: "http", method: "POST", url: "/api/settings/ai/test_embedder" }
+    }
+  ]
+};
+var aiSettingsManifest = manifest3;
+var aiTestActionHandler = async ({ values, payload }) => {
+  const overrides = payload && typeof payload === "object" && payload !== null && "values" in payload ? payload.values ?? {} : {};
+  const merged = { ...values, ...overrides };
+  const provider = String(merged.provider ?? "memory");
+  values = merged;
+  if (provider === "memory") {
+    return {
+      ok: true,
+      severity: "warning",
+      message: "Memory provider is an echo stub \u2014 no external call to validate. Switch to a real provider for production."
+    };
+  }
+  if (provider === "gateway") {
+    if (!values.gateway_model) {
+      return { ok: false, severity: "error", message: "Gateway model is required (e.g. openai/gpt-4o)." };
+    }
+    return {
+      ok: true,
+      severity: "info",
+      message: `Vercel AI Gateway configured (model=${values.gateway_model}). Mount @objectstack/service-ai to exercise live calls.`
+    };
+  }
+  const keyField = `${provider}_api_key`;
+  if (!values[keyField]) {
+    return { ok: false, severity: "error", message: `${provider} API key is required.` };
+  }
+  const modelField = `${provider}_model`;
+  const model = values[modelField] ?? "(default)";
+  return {
+    ok: true,
+    severity: "info",
+    message: `${provider} configured (model=${model}). Mount @objectstack/service-ai to exercise live calls.`
+  };
+};
+
+// src/manifests/knowledge.manifest.ts
+var manifest4 = {
+  namespace: "knowledge",
+  version: 1,
+  label: "Knowledge",
+  icon: "BookOpen",
+  description: "Vector-store backend for RAG / knowledge sources. \u26A0 Switching adapter does NOT migrate existing indices \u2014 documents indexed under the previous adapter become unreachable until re-indexed. The embedder is configured separately under AI.",
+  scope: "global",
+  readPermission: "setup.access",
+  writePermission: "setup.write",
+  category: "Infrastructure",
+  order: 35,
+  specifiers: [
+    // ── Adapter selection ─────────────────────────────────────────
+    {
+      type: "group",
+      id: "adapter",
+      label: "Backend",
+      required: false,
+      description: "Choose where document chunks and their vectors are stored."
+    },
+    {
+      type: "select",
+      key: "adapter",
+      label: "Adapter",
+      required: true,
+      default: "memory",
+      options: [
+        { value: "memory", label: "In-memory (dev / test only)" },
+        { value: "turso", label: "Turso / libSQL (cloud or local)" },
+        { value: "ragflow", label: "RAGFlow (external)" }
+      ]
+    },
+    // ── Turso / libSQL ────────────────────────────────────────────
+    {
+      type: "group",
+      id: "turso",
+      label: "Turso / libSQL",
+      required: false,
+      visible: "${data.adapter === 'turso'}",
+      description: "Works against managed Turso (libsql://\u2026), local file (file:./knowledge.db), or in-memory (:memory:). For per-tenant cloud deployments, leave blank to reuse the tenant's primary libSQL connection."
+    },
+    {
+      type: "text",
+      key: "turso_url",
+      label: "Connection URL",
+      required: false,
+      description: "Examples: libsql://your-tenant.turso.io \xB7 file:./.objectstack/knowledge.db \xB7 :memory:",
+      visible: "${data.adapter === 'turso'}"
+    },
+    {
+      type: "password",
+      key: "turso_auth_token",
+      label: "Auth token",
+      required: false,
+      encrypted: true,
+      description: "Only required for managed Turso URLs. Leave blank for local file / :memory:.",
+      visible: "${data.adapter === 'turso'}"
+    },
+    // ── RAGFlow ───────────────────────────────────────────────────
+    {
+      type: "group",
+      id: "ragflow",
+      label: "RAGFlow",
+      required: false,
+      visible: "${data.adapter === 'ragflow'}",
+      description: "External RAGFlow deployment. See https://ragflow.io for self-host instructions."
+    },
+    {
+      type: "text",
+      key: "ragflow_base_url",
+      label: "Base URL",
+      required: true,
+      description: "Example: http://localhost:9380",
+      visible: "${data.adapter === 'ragflow'}"
+    },
+    {
+      type: "password",
+      key: "ragflow_api_key",
+      label: "API key",
+      required: true,
+      encrypted: true,
+      visible: "${data.adapter === 'ragflow'}"
+    },
+    {
+      type: "text",
+      key: "ragflow_default_dataset",
+      label: "Default dataset id",
+      required: false,
+      description: "Used when a KnowledgeSource does not specify its own RAGFlow dataset.",
+      visible: "${data.adapter === 'ragflow'}"
+    },
+    // ── Indexing defaults ─────────────────────────────────────────
+    {
+      type: "group",
+      id: "indexing",
+      label: "Indexing defaults",
+      required: false,
+      description: "Per-source values on KnowledgeSource.adapterConfig take precedence.",
+      visible: "${data.adapter !== 'memory'}"
+    },
+    {
+      type: "number",
+      key: "chunk_target",
+      label: "Target chunk size (chars)",
+      required: false,
+      default: 800,
+      min: 64,
+      max: 8192,
+      description: "Soft cap on chunk size in characters before token-aware splitting kicks in.",
+      visible: "${data.adapter !== 'memory'}"
+    },
+    {
+      type: "number",
+      key: "chunk_overlap",
+      label: "Chunk overlap (chars)",
+      required: false,
+      default: 80,
+      min: 0,
+      max: 2048,
+      description: "Characters retained from the previous chunk so context survives the boundary.",
+      visible: "${data.adapter !== 'memory'}"
+    },
+    {
+      type: "number",
+      key: "over_fetch",
+      label: "Over-fetch multiplier",
+      required: false,
+      default: 4,
+      min: 1,
+      max: 20,
+      description: "Internal `topK * overFetch` candidates fetched so JS-side metadata filtering still has rows to return.",
+      visible: "${data.adapter === 'turso'}"
+    },
+    // ── Permissions ───────────────────────────────────────────────
+    { type: "group", id: "permissions", label: "Permissions", required: false },
+    {
+      type: "toggle",
+      key: "enforce_rls",
+      label: "Enforce RLS on search",
+      required: false,
+      default: true,
+      description: "Re-check every hit against the caller's record-level permissions via IDataEngine. \u26A0 Disabling skips the platform's unique safeguard against vector-store data leakage \u2014 leave on in production."
+    },
+    // ── Probe ─────────────────────────────────────────────────────
+    {
+      type: "action_button",
+      id: "test",
+      label: "Test connection",
+      required: false,
+      icon: "Plug",
+      handler: { kind: "http", method: "POST", url: "/api/settings/knowledge/test" }
+    }
+  ]
+};
+var knowledgeSettingsManifest = manifest4;
+
 // src/manifests/index.ts
 var builtinSettingsManifests = [
   brandingSettingsManifest,
   mailSettingsManifest,
   storageSettingsManifest,
+  aiSettingsManifest,
+  knowledgeSettingsManifest,
   featureFlagsSettingsManifest
 ];
 
@@ -1271,6 +1772,196 @@ var en = {
       actions: {
         test: { label: "Test connection" }
       }
+    },
+    ai: {
+      title: "AI & Embedder",
+      description: "LLM provider, model, credentials, and embedder configuration used by the platform AI and knowledge services.",
+      groups: {
+        provider: {
+          title: "Provider",
+          description: "Choose the LLM backend. Memory mode echoes input \u2014 useful for tests but never for production."
+        },
+        gateway: {
+          title: "Vercel AI Gateway",
+          description: "Multi-provider router. The model spec follows `provider/model`, e.g. `openai/gpt-4o`."
+        },
+        openai: { title: "OpenAI" },
+        anthropic: { title: "Anthropic" },
+        google: { title: "Google" },
+        defaults: {
+          title: "Generation defaults",
+          description: "Applied when an agent or chat request does not specify its own value."
+        },
+        observability: { title: "Observability" },
+        embedder: {
+          title: "Embedder",
+          description: "Text \u2192 vector provider used by knowledge sources and RAG. Independent from the chat provider above."
+        }
+      },
+      keys: {
+        provider: {
+          label: "Provider",
+          options: {
+            memory: "Memory (echo \u2014 testing only)",
+            gateway: "Vercel AI Gateway",
+            openai: "OpenAI",
+            anthropic: "Anthropic",
+            google: "Google Generative AI"
+          }
+        },
+        gateway_model: {
+          label: "Gateway model",
+          help: "Forwarded as AI_GATEWAY_MODEL. Example: openai/gpt-4o"
+        },
+        gateway_api_key: {
+          label: "Gateway API key",
+          help: "Optional \u2014 required only if the gateway enforces auth."
+        },
+        openai_api_key: {
+          label: "OpenAI API key",
+          help: "Forwarded as OPENAI_API_KEY. Stored encrypted at rest."
+        },
+        openai_model: {
+          label: "Model",
+          help: "Default model id. Per-agent overrides take precedence."
+        },
+        openai_base_url: {
+          label: "Base URL",
+          help: "Override for Azure OpenAI or self-hosted gateways. Leave blank for api.openai.com."
+        },
+        anthropic_api_key: {
+          label: "Anthropic API key",
+          help: "Forwarded as ANTHROPIC_API_KEY. Stored encrypted at rest."
+        },
+        anthropic_model: { label: "Model" },
+        google_api_key: {
+          label: "Google API key",
+          help: "Forwarded as GOOGLE_GENERATIVE_AI_API_KEY. Stored encrypted at rest."
+        },
+        google_model: { label: "Model" },
+        temperature: {
+          label: "Temperature",
+          help: "0 = deterministic, 2 = highly creative."
+        },
+        max_tokens: {
+          label: "Max output tokens",
+          help: "Hard cap on tokens generated per response."
+        },
+        request_timeout_ms: { label: "Request timeout (ms)" },
+        trace_enabled: {
+          label: "Record traces",
+          help: "Persist prompt/response traces to sys_ai_trace for debugging and replay."
+        },
+        log_prompts: {
+          label: "Log full prompts",
+          help: "Include rendered prompts (not just metadata) in trace rows. \u26A0 May leak PII \u2014 disable in regulated environments."
+        },
+        embedder_provider: {
+          label: "Provider",
+          options: {
+            none: "Disabled (no embeddings)",
+            openai: "OpenAI",
+            azure: "Azure OpenAI",
+            dashscope: "\u963F\u91CC\u901A\u4E49 DashScope",
+            zhipu: "\u667A\u8C31 BigModel",
+            siliconflow: "\u7845\u57FA\u6D41\u52A8 SiliconFlow",
+            doubao: "\u706B\u5C71\u5F15\u64CE Doubao",
+            minimax: "MiniMax",
+            ollama: "Ollama (local)",
+            custom: "Custom (OpenAI-compatible)"
+          }
+        },
+        embedder_api_key: {
+          label: "Embedder API key",
+          help: "Bearer token sent as Authorization header. For Ollama any non-empty value works."
+        },
+        embedder_model: {
+          label: "Model",
+          help: "Examples \u2014 OpenAI: text-embedding-3-small \xB7 \u963F\u91CC\u901A\u4E49: text-embedding-v3 \xB7 \u667A\u8C31: embedding-3 \xB7 \u7845\u57FA\u6D41\u52A8: BAAI/bge-m3 \xB7 Ollama: bge-m3"
+        },
+        embedder_base_url: {
+          label: "Base URL",
+          help: "Endpoint root (without /embeddings). Auto-filled from preset; override for proxies or self-hosted gateways."
+        },
+        embedder_dimensions: {
+          label: "Dimensions",
+          help: "Override output dimensionality (Matryoshka models only). Leave blank to use the model default."
+        },
+        embedder_batch_size: {
+          label: "Batch size",
+          help: "Chunks per embed() call. Reduce if hitting provider rate / size limits."
+        }
+      },
+      actions: {
+        test: { label: "Test connection" },
+        test_embedder: { label: "Test embedder" }
+      }
+    },
+    knowledge: {
+      title: "Knowledge",
+      description: "Vector-store backend for RAG / knowledge sources. \u26A0 Switching adapter does NOT migrate existing indices.",
+      groups: {
+        adapter: {
+          title: "Backend",
+          description: "Choose where document chunks and their vectors are stored."
+        },
+        turso: {
+          title: "Turso / libSQL",
+          description: "Works against managed Turso, local file, or in-memory."
+        },
+        ragflow: {
+          title: "RAGFlow",
+          description: "External RAGFlow deployment. See https://ragflow.io for self-host instructions."
+        },
+        indexing: {
+          title: "Indexing defaults",
+          description: "Per-source values on KnowledgeSource.adapterConfig take precedence."
+        },
+        permissions: { title: "Permissions" }
+      },
+      keys: {
+        adapter: {
+          label: "Adapter",
+          options: {
+            memory: "In-memory (dev / test only)",
+            turso: "Turso / libSQL (cloud or local)",
+            ragflow: "RAGFlow (external)"
+          }
+        },
+        turso_url: {
+          label: "Connection URL",
+          help: "Examples: libsql://your-tenant.turso.io \xB7 file:./.objectstack/knowledge.db \xB7 :memory:"
+        },
+        turso_auth_token: {
+          label: "Auth token",
+          help: "Only required for managed Turso URLs."
+        },
+        ragflow_base_url: { label: "Base URL", help: "Example: http://localhost:9380" },
+        ragflow_api_key: { label: "API key" },
+        ragflow_default_dataset: {
+          label: "Default dataset id",
+          help: "Used when a KnowledgeSource does not specify its own RAGFlow dataset."
+        },
+        chunk_target: {
+          label: "Target chunk size (chars)",
+          help: "Soft cap on chunk size before token-aware splitting kicks in."
+        },
+        chunk_overlap: {
+          label: "Chunk overlap (chars)",
+          help: "Characters retained from the previous chunk so context survives the boundary."
+        },
+        over_fetch: {
+          label: "Over-fetch multiplier",
+          help: "Internal topK \xD7 overFetch candidates fetched so JS-side metadata filtering still has rows."
+        },
+        enforce_rls: {
+          label: "Enforce RLS on search",
+          help: "Re-check every hit against the caller's record-level permissions. \u26A0 Disabling skips the platform's unique safeguard."
+        }
+      },
+      actions: {
+        test: { label: "Test connection" }
+      }
     }
   }
 };
@@ -1397,6 +2088,103 @@ var zhCN = {
       actions: {
         test: { label: "\u6D4B\u8BD5\u8FDE\u63A5" }
       }
+    },
+    ai: {
+      title: "AI \u4E0E Embedder",
+      description: "\u5E73\u53F0 AI \u4E0E\u77E5\u8BC6\u5E93\u670D\u52A1\u4F7F\u7528\u7684 LLM \u63D0\u4F9B\u5546\u3001\u6A21\u578B\u3001\u51ED\u636E\u4E0E\u5411\u91CF\u5316\u914D\u7F6E\u3002",
+      groups: {
+        provider: { title: "\u63D0\u4F9B\u5546", description: "\u9009\u62E9 LLM \u540E\u7AEF\u3002Memory \u6A21\u5F0F\u4EC5\u539F\u6837\u56DE\u663E\u8F93\u5165,\u4EC5\u7528\u4E8E\u6D4B\u8BD5,\u4E25\u7981\u7528\u4E8E\u751F\u4EA7\u3002" },
+        gateway: { title: "Vercel AI Gateway", description: "\u591A\u63D0\u4F9B\u5546\u8DEF\u7531\u5668\u3002\u6A21\u578B\u89C4\u683C\u9075\u5FAA `provider/model` \u683C\u5F0F,\u4F8B\u5982 `openai/gpt-4o`\u3002" },
+        openai: { title: "OpenAI" },
+        anthropic: { title: "Anthropic" },
+        google: { title: "Google" },
+        defaults: { title: "\u751F\u6210\u9ED8\u8BA4\u503C", description: "\u5F53 Agent \u6216\u804A\u5929\u8BF7\u6C42\u672A\u6307\u5B9A\u65F6\u4F7F\u7528\u3002" },
+        observability: { title: "\u53EF\u89C2\u6D4B\u6027" },
+        embedder: { title: "Embedder", description: "\u77E5\u8BC6\u5E93\u548C RAG \u4F7F\u7528\u7684\u6587\u672C\u2192\u5411\u91CF\u63D0\u4F9B\u5546,\u4E0E\u4E0A\u65B9\u804A\u5929\u63D0\u4F9B\u5546\u76F8\u4E92\u72EC\u7ACB\u3002" }
+      },
+      keys: {
+        provider: {
+          label: "\u63D0\u4F9B\u5546",
+          options: {
+            memory: "Memory(\u56DE\u663E \u2014 \u4EC5\u6D4B\u8BD5)",
+            gateway: "Vercel AI Gateway",
+            openai: "OpenAI",
+            anthropic: "Anthropic",
+            google: "Google Generative AI"
+          }
+        },
+        gateway_model: { label: "Gateway \u6A21\u578B", help: "\u4F5C\u4E3A AI_GATEWAY_MODEL \u8F6C\u53D1\u3002\u793A\u4F8B:openai/gpt-4o" },
+        gateway_api_key: { label: "Gateway API Key", help: "\u53EF\u9009 \u2014\u2014 \u4EC5\u5F53 Gateway \u5F3A\u5236\u9274\u6743\u65F6\u9700\u8981\u3002" },
+        openai_api_key: { label: "OpenAI API Key", help: "\u4F5C\u4E3A OPENAI_API_KEY \u8F6C\u53D1,\u52A0\u5BC6\u5B58\u50A8\u3002" },
+        openai_model: { label: "\u6A21\u578B", help: "\u9ED8\u8BA4\u6A21\u578B ID\u3002Agent \u7EA7\u8986\u76D6\u4F18\u5148\u751F\u6548\u3002" },
+        openai_base_url: { label: "Base URL", help: "\u7528\u4E8E Azure OpenAI \u6216\u81EA\u5EFA\u7F51\u5173\u3002\u7559\u7A7A\u8D70 api.openai.com\u3002" },
+        anthropic_api_key: { label: "Anthropic API Key", help: "\u4F5C\u4E3A ANTHROPIC_API_KEY \u8F6C\u53D1,\u52A0\u5BC6\u5B58\u50A8\u3002" },
+        anthropic_model: { label: "\u6A21\u578B" },
+        google_api_key: { label: "Google API Key", help: "\u4F5C\u4E3A GOOGLE_GENERATIVE_AI_API_KEY \u8F6C\u53D1,\u52A0\u5BC6\u5B58\u50A8\u3002" },
+        google_model: { label: "\u6A21\u578B" },
+        temperature: { label: "\u6E29\u5EA6", help: "0 = \u786E\u5B9A\u6027,2 = \u9AD8\u5EA6\u53D1\u6563\u3002" },
+        max_tokens: { label: "\u6700\u5927\u8F93\u51FA tokens", help: "\u5355\u6B21\u54CD\u5E94\u751F\u6210\u7684\u786C\u4E0A\u9650\u3002" },
+        request_timeout_ms: { label: "\u8BF7\u6C42\u8D85\u65F6(\u6BEB\u79D2)" },
+        trace_enabled: { label: "\u8BB0\u5F55 Trace", help: "\u5C06 prompt/response \u843D\u5165 sys_ai_trace,\u4FBF\u4E8E\u8C03\u8BD5\u4E0E\u56DE\u653E\u3002" },
+        log_prompts: { label: "\u8BB0\u5F55\u5B8C\u6574 Prompt", help: "\u5728 trace \u884C\u4E2D\u5305\u542B\u5B8C\u6574 prompt \u800C\u975E\u4EC5\u5143\u6570\u636E\u3002\u26A0 \u53EF\u80FD\u6CC4\u9732 PII,\u5408\u89C4\u573A\u666F\u8BF7\u5173\u95ED\u3002" },
+        embedder_provider: {
+          label: "\u63D0\u4F9B\u5546",
+          options: {
+            none: "\u7981\u7528(\u4E0D\u505A\u5411\u91CF\u5316)",
+            openai: "OpenAI",
+            azure: "Azure OpenAI",
+            dashscope: "\u963F\u91CC\u901A\u4E49 DashScope",
+            zhipu: "\u667A\u8C31 BigModel",
+            siliconflow: "\u7845\u57FA\u6D41\u52A8 SiliconFlow",
+            doubao: "\u706B\u5C71\u5F15\u64CE Doubao",
+            minimax: "MiniMax",
+            ollama: "Ollama(\u672C\u5730)",
+            custom: "\u81EA\u5B9A\u4E49(OpenAI \u517C\u5BB9)"
+          }
+        },
+        embedder_api_key: { label: "Embedder API Key", help: "\u4F5C\u4E3A Authorization Bearer \u53D1\u9001\u3002Ollama \u4EFB\u610F\u975E\u7A7A\u503C\u5747\u53EF\u3002" },
+        embedder_model: { label: "\u6A21\u578B", help: "\u793A\u4F8B \u2014 OpenAI: text-embedding-3-small \xB7 \u963F\u91CC\u901A\u4E49: text-embedding-v3 \xB7 \u667A\u8C31: embedding-3 \xB7 \u7845\u57FA\u6D41\u52A8: BAAI/bge-m3 \xB7 Ollama: bge-m3" },
+        embedder_base_url: { label: "Base URL", help: "\u7AEF\u70B9\u6839\u8DEF\u5F84(\u4E0D\u542B /embeddings)\u3002\u9884\u8BBE\u4F1A\u81EA\u52A8\u586B\u5145,\u53EF\u8986\u76D6\u4E3A\u4EE3\u7406\u6216\u81EA\u5EFA\u7F51\u5173\u3002" },
+        embedder_dimensions: { label: "\u7EF4\u5EA6", help: "\u8986\u76D6\u8F93\u51FA\u7EF4\u5EA6(\u4EC5 Matryoshka \u6A21\u578B\u652F\u6301)\u3002\u7559\u7A7A\u4F7F\u7528\u6A21\u578B\u9ED8\u8BA4\u503C\u3002" },
+        embedder_batch_size: { label: "\u6279\u91CF\u5927\u5C0F", help: "\u5355\u6B21 embed() \u8C03\u7528\u7684 chunk \u6570\u3002\u547D\u4E2D\u901F\u7387/\u5927\u5C0F\u9650\u5236\u65F6\u8C03\u5C0F\u3002" }
+      },
+      actions: {
+        test: { label: "\u6D4B\u8BD5\u8FDE\u63A5" },
+        test_embedder: { label: "\u6D4B\u8BD5 Embedder" }
+      }
+    },
+    knowledge: {
+      title: "\u77E5\u8BC6\u5E93",
+      description: "RAG / \u77E5\u8BC6\u6E90\u4F7F\u7528\u7684\u5411\u91CF\u5B58\u50A8\u540E\u7AEF\u3002\u26A0 \u5207\u6362\u9002\u914D\u5668\u4E0D\u4F1A\u8FC1\u79FB\u5DF2\u6709\u7D22\u5F15\u3002",
+      groups: {
+        adapter: { title: "\u540E\u7AEF", description: "\u9009\u62E9\u6587\u6863\u5206\u5757\u53CA\u5176\u5411\u91CF\u7684\u5B58\u50A8\u4F4D\u7F6E\u3002" },
+        turso: { title: "Turso / libSQL", description: "\u652F\u6301\u6258\u7BA1 Turso\u3001\u672C\u5730\u6587\u4EF6\u3001\u5185\u5B58\u4E09\u79CD\u6A21\u5F0F\u3002" },
+        ragflow: { title: "RAGFlow", description: "\u5916\u90E8 RAGFlow \u90E8\u7F72\u3002\u81EA\u90E8\u7F72\u6587\u6863\u89C1 https://ragflow.io \u3002" },
+        indexing: { title: "\u7D22\u5F15\u9ED8\u8BA4\u503C", description: "KnowledgeSource.adapterConfig \u4E0A\u7684\u9010\u6E90\u8986\u76D6\u4F18\u5148\u751F\u6548\u3002" },
+        permissions: { title: "\u6743\u9650" }
+      },
+      keys: {
+        adapter: {
+          label: "\u9002\u914D\u5668",
+          options: {
+            memory: "\u5185\u5B58(\u4EC5\u5F00\u53D1/\u6D4B\u8BD5)",
+            turso: "Turso / libSQL(\u4E91\u7AEF\u6216\u672C\u5730)",
+            ragflow: "RAGFlow(\u5916\u90E8)"
+          }
+        },
+        turso_url: { label: "\u8FDE\u63A5 URL", help: "\u793A\u4F8B:libsql://your-tenant.turso.io \xB7 file:./.objectstack/knowledge.db \xB7 :memory:" },
+        turso_auth_token: { label: "Auth Token", help: "\u4EC5\u6258\u7BA1 Turso URL \u9700\u8981\u3002" },
+        ragflow_base_url: { label: "Base URL", help: "\u793A\u4F8B:http://localhost:9380" },
+        ragflow_api_key: { label: "API Key" },
+        ragflow_default_dataset: { label: "\u9ED8\u8BA4 Dataset ID", help: "KnowledgeSource \u672A\u6307\u5B9A\u65F6\u4F7F\u7528\u3002" },
+        chunk_target: { label: "\u76EE\u6807 chunk \u5927\u5C0F(\u5B57\u7B26)", help: "\u5728\u6309 token \u5207\u5206\u4E4B\u524D\u7684\u8F6F\u4E0A\u9650\u3002" },
+        chunk_overlap: { label: "Chunk \u91CD\u53E0(\u5B57\u7B26)", help: "\u4FDD\u7559\u4E0A\u4E00\u4E2A chunk \u672B\u5C3E\u7684\u5B57\u7B26,\u4EE5\u4FDD\u8BC1\u8DE8\u754C\u4E0A\u4E0B\u6587\u3002" },
+        over_fetch: { label: "\u8FC7\u53D6\u500D\u6570", help: "\u5185\u90E8\u6309 topK \xD7 overFetch \u62C9\u53D6\u5019\u9009,\u4EE5\u4FBF JS \u7AEF\u5143\u6570\u636E\u8FC7\u6EE4\u4ECD\u6709\u884C\u53EF\u8FD4\u56DE\u3002" },
+        enforce_rls: { label: "\u641C\u7D22\u65F6\u5F3A\u5236 RLS", help: "\u5BF9\u6BCF\u6761\u547D\u4E2D\u901A\u8FC7 IDataEngine \u518D\u6B21\u6821\u9A8C\u8C03\u7528\u65B9\u7684\u884C\u7EA7\u6743\u9650\u3002\u26A0 \u5173\u95ED\u5C06\u8DF3\u8FC7\u5E73\u53F0\u5BF9\u5411\u91CF\u5B58\u50A8\u6570\u636E\u5916\u6CC4\u7684\u72EC\u6709\u9632\u62A4\u3002" }
+      },
+      actions: {
+        test: { label: "\u6D4B\u8BD5\u8FDE\u63A5" }
+      }
     }
   }
 };
@@ -1546,7 +2334,8 @@ var SettingsServicePlugin = class {
       manifests: opts.manifests ?? builtinSettingsManifests,
       actionHandlers: opts.actionHandlers ?? {
         mail: { test: mailTestActionHandler },
-        storage: { test: storageTestActionHandler }
+        storage: { test: storageTestActionHandler },
+        ai: { test: aiTestActionHandler }
       }
     };
   }