n8n 2.35.2 → 2.36.0

package/dist/modules/instance-ai/instance-ai-settings.service.js

@@ -10,13 +10,14 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 var InstanceAiSettingsService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InstanceAiSettingsService = exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY = exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY = exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY = exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY = void 0;
+exports.InstanceAiSettingsService = exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY = exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY = exports.CREDENTIAL_TO_MODEL_PROVIDER = exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY = exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY = void 0;
 const node_util_1 = require("node:util");
 const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const di_1 = require("@n8n/di");
+const instance_ai_1 = require("@n8n/instance-ai");
 const permissions_1 = require("@n8n/permissions");
 const ensure_error_1 = require("@n8n/utils/errors/ensure-error");
 const n8n_workflow_1 = require("n8n-workflow");
@@ -28,10 +29,12 @@ const forbidden_error_1 = require("../../errors/response-errors/forbidden.error"
 const unprocessable_error_1 = require("../../errors/response-errors/unprocessable.error");
 const event_service_1 = require("../../events/event.service");
 const ai_service_1 = require("../../services/ai.service");
+const sandbox_settings_service_1 = require("../../services/sandbox-settings.service");
+Object.defineProperty(exports, "INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY", { enumerable: true, get: function () { return sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY; } });
+Object.defineProperty(exports, "INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY", { enumerable: true, get: function () { return sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY; } });
 const user_service_1 = require("../../services/user.service");
 const sandbox_provider_1 = require("./sandbox-provider");
 const ADMIN_SETTINGS_KEY = 'instanceAi.settings';
-const N8N_SANDBOX_HEADER_NAME = 'x-api-key';
 const MODEL_PROVIDER_API_KEY_ENV = new Map([
     ['anthropic', 'ANTHROPIC_API_KEY'],
     ['cohere', 'COHERE_API_KEY'],
@@ -43,7 +46,7 @@ const MODEL_PROVIDER_API_KEY_ENV = new Map([
     ['openrouter', 'OPENROUTER_API_KEY'],
     ['xai', 'XAI_API_KEY'],
 ]);
-const CREDENTIAL_TO_MODEL_PROVIDER = {
+exports.CREDENTIAL_TO_MODEL_PROVIDER = {
     openAiApi: 'openai',
     anthropicApi: 'anthropic',
     googlePalmApi: 'google',
@@ -105,16 +108,22 @@ function modelCredentialHeaders(credentialType, data) {
     }
     return Object.keys(headers).length ? headers : undefined;
 }
-function validateSandboxServiceCredential({ type, data, }) {
-    const headerName = requireConnectionValue(type, data, 'name').toLowerCase();
-    if (headerName !== N8N_SANDBOX_HEADER_NAME) {
-        throw new unprocessable_error_1.UnprocessableRequestError(`The credential's header name must be "${N8N_SANDBOX_HEADER_NAME}" but is "${headerName}"`);
-    }
-    requireConnectionValue(type, data, 'value');
+function isVertexAnthropicModelId(id) {
+    return id.startsWith('google-vertex-anthropic/');
 }
-function validateDaytonaCredential({ type, data, }) {
-    requireHttpUrl(type, data, 'apiUrl');
-    requireConnectionValue(type, data, 'apiKey');
+function projectIdFromServiceAccountJson(json) {
+    if (!json?.trim())
+        return '';
+    try {
+        const parsed = JSON.parse(json);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return '';
+        const projectId = parsed.project_id;
+        return typeof projectId === 'string' ? projectId.trim() : '';
+    }
+    catch {
+        return '';
+    }
 }
 function validateSearchCredential({ type, data, }) {
     if (type === 'searXngApi')
@@ -127,16 +136,6 @@ exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY = {
     credentialTypes: api_types_1.INSTANCE_AI_MODEL_CREDENTIAL_TYPES,
     validate: validateModelCredential,
 };
-exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY = {
-    id: 'instance-ai:sandbox:daytona',
-    credentialTypes: ['daytonaApi'],
-    validate: validateDaytonaCredential,
-};
-exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY = {
-    id: 'instance-ai:sandbox:n8n',
-    credentialTypes: ['httpHeaderAuth'],
-    validate: validateSandboxServiceCredential,
-};
 exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY = {
     id: 'instance-ai:search',
     credentialTypes: api_types_1.INSTANCE_AI_SEARCH_CREDENTIAL_TYPES,
@@ -146,11 +145,11 @@ function validateInstanceAiCredential(policy, credential) {
     if (policy === exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY) {
         validateModelCredential(credential);
     }
-    else if (policy === exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY) {
-        validateDaytonaCredential(credential);
+    else if (policy === sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY) {
+        sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY.validate?.(credential);
     }
-    else if (policy === exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY) {
-        validateSandboxServiceCredential(credential);
+    else if (policy === sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY) {
+        sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY.validate?.(credential);
     }
     else if (policy === exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY) {
         validateSearchCredential(credential);
@@ -160,7 +159,7 @@ function validateInstanceAiCredential(policy, credential) {
     }
 }
 let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSettingsService {
-    constructor(globalConfig, dbLockService, settingsRepository, userRepository, userService, aiService, credentialsService, credentialsFinderService, instanceCredentialBroker, eventService) {
+    constructor(globalConfig, dbLockService, settingsRepository, userRepository, userService, aiService, credentialsService, credentialsFinderService, instanceCredentialBroker, sandboxSettingsService, eventService) {
         this.dbLockService = dbLockService;
         this.settingsRepository = settingsRepository;
         this.userRepository = userRepository;
@@ -169,6 +168,7 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         this.credentialsService = credentialsService;
         this.credentialsFinderService = credentialsFinderService;
         this.instanceCredentialBroker = instanceCredentialBroker;
+        this.sandboxSettingsService = sandboxSettingsService;
         this.eventService = eventService;
         this.enabled = true;
         this.mcpAccessEnabled = true;
@@ -178,9 +178,8 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         this.adminN8nSandboxServiceUrl = null;
         this.config = globalConfig.instanceAi;
         this.deploymentConfig = globalConfig.deployment;
-        this.environmentSandboxProvider = (0, sandbox_provider_1.normalizeSandboxProvider)(this.config.sandboxProvider);
+        this.environmentSandboxProvider = this.sandboxSettingsService.getProvider();
         this.environmentN8nSandboxServiceUrl = this.config.n8nSandboxServiceUrl;
-        this.config.sandboxProvider = this.environmentSandboxProvider;
     }
     get isCloud() {
         return this.deploymentConfig.type === 'cloud';
@@ -189,10 +188,9 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         return this.aiService.isProxyEnabled();
     }
     async loadFromDb() {
-        this.config.sandboxProvider = (0, sandbox_provider_1.normalizeSandboxProvider)(this.config.sandboxProvider);
         const envSnapshot = {
             sandboxEnabled: this.config.sandboxEnabled,
-            sandboxProvider: this.config.sandboxProvider,
+            sandboxProvider: this.environmentSandboxProvider,
         };
         await this.reloadFromDb();
         const c = this.config;
@@ -219,7 +217,7 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             });
         }
         if (this.aiService.isProxyEnabled()) {
-            const n8nSandboxCredentialId = await this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY);
+            const n8nSandboxCredentialId = await this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY);
             return this.buildAdminSettingsResponse({
                 modelCredentialId: null,
                 modelName: null,
@@ -230,8 +228,8 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         }
         const [modelSelection, daytonaCredentialId, n8nSandboxCredentialId, searchCredentialId] = await Promise.all([
             this.readAdminModelSelection(),
-            this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY),
-            this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY),
+            this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY),
+            this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY),
             this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY),
         ]);
         return this.buildAdminSettingsResponse({
@@ -243,11 +241,16 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
     }
     buildAdminSettingsResponse(credentialSelection) {
         const c = this.config;
-        const modelProviderApiKeyEnv = MODEL_PROVIDER_API_KEY_ENV.get(c.model.split('/', 1)[0] ?? '');
+        const modelProvider = c.model.split('/', 1)[0] ?? '';
+        const modelProviderApiKeyEnv = MODEL_PROVIDER_API_KEY_ENV.get(modelProvider);
         const isProxyEnabled = this.aiService.isProxyEnabled();
         const isManaged = this.isCloud || isProxyEnabled;
         const providerModelApiKeyConfigured = Boolean(modelProviderApiKeyEnv && process.env[modelProviderApiKeyEnv]?.trim());
-        const modelConnectionEnvConfigured = Boolean(c.modelApiKey.trim() || c.modelUrl.trim() || providerModelApiKeyConfigured);
+        const vertexModelEnvConfigured = modelProvider === 'google-vertex-anthropic' && Boolean(this.resolveVertexProjectId());
+        const modelConnectionEnvConfigured = Boolean(c.modelApiKey.trim() ||
+            c.modelUrl.trim() ||
+            providerModelApiKeyConfigured ||
+            vertexModelEnvConfigured);
         const sandboxEnvConfigured = this.hasEnvironmentSandboxConnection();
         const searchEnvConfigured = this.hasEnvironmentSearchConnection();
         const directEnvironmentConfig = !isManaged;
@@ -372,7 +375,7 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
                     ? 'n8n-sandbox'
                     : settingsUpdate.sandboxProvider);
         await this.runConnectionHooks([modelPrepared, searchPrepared, sandboxPrepared]);
-        const { previous, next, credentialSelection } = await this.dbLockService.withLockContext(1007, async (ctx) => {
+        const { previous, next, credentialSelection, previousSelection } = await this.dbLockService.withLockContext(1007, async (ctx) => {
             if (user && modelConnection !== undefined) {
                 modelCredentialId = await this.upsertConnection(user, exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY, 'AI Assistant model', modelConnection, ctx, modelPrepared);
             }
@@ -400,8 +403,8 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             const current = this.mergeAdminSettings(this.snapshotAdminSettings(), this.parsePersistedAdminSettings(persisted?.value));
             const [currentModelCredentialId, currentDaytonaCredentialId, currentN8nCredentialId, currentSearchCredentialId,] = await Promise.all([
                 this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY, ctx),
-                this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, ctx),
-                this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, ctx),
+                this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, ctx),
+                this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, ctx),
                 this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY, ctx),
             ]);
             const nextDaytonaCredentialId = daytonaCredentialId === undefined ? currentDaytonaCredentialId : daytonaCredentialId;
@@ -443,17 +446,17 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             }
             next.modelName = nextModelName ?? null;
             await updateCredentialAssignment(exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY, modelCredentialId);
-            await updateCredentialAssignment(exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, daytonaCredentialId);
-            await updateCredentialAssignment(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, n8nSandboxCredentialId);
+            await updateCredentialAssignment(sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, daytonaCredentialId);
+            await updateCredentialAssignment(sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, n8nSandboxCredentialId);
             await updateCredentialAssignment(exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY, searchCredentialId);
             if (typeof modelCredentialId === 'string') {
                 await this.validateAssignedServiceCredential(exports.INSTANCE_AI_MODEL_CREDENTIAL_POLICY, ctx);
             }
             if (typeof daytonaCredentialId === 'string') {
-                await this.validateAssignedServiceCredential(exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, ctx);
+                await this.validateAssignedServiceCredential(sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, ctx);
             }
             if (typeof n8nSandboxCredentialId === 'string') {
-                await this.validateAssignedServiceCredential(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, ctx);
+                await this.validateAssignedServiceCredential(sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, ctx);
             }
             if (typeof searchCredentialId === 'string') {
                 await this.validateAssignedServiceCredential(exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY, ctx);
@@ -469,10 +472,25 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
                     n8nSandboxCredentialId: nextN8nCredentialId,
                     searchCredentialId: nextSearchCredentialId,
                 },
+                previousSelection: {
+                    modelCredentialId: currentModelCredentialId,
+                    modelName: current.modelName ?? null,
+                    daytonaCredentialId: currentDaytonaCredentialId,
+                    n8nSandboxCredentialId: currentN8nCredentialId,
+                    searchCredentialId: currentSearchCredentialId,
+                },
             };
         });
         this.applyAdminSettings(next);
-        this.emitSettingsUpdated(previous, next);
+        this.emitSettingsUpdated(previous, next, {
+            previous: previousSelection,
+            next: credentialSelection,
+            connectionsUpdated: {
+                model: modelConnection !== undefined && modelConnection !== null,
+                sandbox: sandboxConnection !== undefined && sandboxConnection !== null,
+                search: searchConnection !== undefined && searchConnection !== null,
+            },
+        });
         return this.buildAdminSettingsResponse(credentialSelection);
     }
     rejectConnectionConflicts(update) {
@@ -567,9 +585,9 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         if (!connection)
             return undefined;
         const policy = connection.type === 'daytonaApi'
-            ? exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY
+            ? sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY
             : connection.type === 'httpHeaderAuth'
-                ? exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY
+                ? sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY
                 : undefined;
         if (!policy) {
             throw new unprocessable_error_1.UnprocessableRequestError(`Connection type "${connection.type}" is not supported for the sandbox`);
@@ -587,21 +605,21 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         const name = 'AI Assistant sandbox';
         if (connection === null) {
             return {
-                daytonaCredentialId: await this.upsertConnection(user, exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, name, null, ctx),
-                n8nSandboxCredentialId: await this.upsertConnection(user, exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, name, null, ctx),
+                daytonaCredentialId: await this.upsertConnection(user, sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, name, null, ctx),
+                n8nSandboxCredentialId: await this.upsertConnection(user, sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, name, null, ctx),
             };
         }
         if (connection.type === 'daytonaApi') {
             return {
-                daytonaCredentialId: await this.upsertConnection(user, exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, name, connection, ctx, prepared),
-                n8nSandboxCredentialId: await this.upsertConnection(user, exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, name, null, ctx),
+                daytonaCredentialId: await this.upsertConnection(user, sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, name, connection, ctx, prepared),
+                n8nSandboxCredentialId: await this.upsertConnection(user, sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, name, null, ctx),
                 sandboxProvider: 'daytona',
             };
         }
         if (connection.type === 'httpHeaderAuth') {
             return {
-                n8nSandboxCredentialId: await this.upsertConnection(user, exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, name, connection, ctx, prepared),
-                daytonaCredentialId: await this.upsertConnection(user, exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, name, null, ctx),
+                n8nSandboxCredentialId: await this.upsertConnection(user, sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, name, connection, ctx, prepared),
+                daytonaCredentialId: await this.upsertConnection(user, sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, name, null, ctx),
                 sandboxProvider: 'n8n-sandbox',
             };
         }
@@ -682,10 +700,10 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         if (this.isCloud)
             return [];
         const policies = this.aiService.isProxyEnabled()
-            ? [exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY]
+            ? [sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY]
             : [
-                exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY,
-                exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY,
+                sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY,
+                sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY,
                 exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY,
             ];
         const credentials = await Promise.all(policies.map(async (policy) => await this.instanceCredentialBroker.listForUse(policy)));
@@ -701,49 +719,25 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             apiUrl: daytonaApiUrl || undefined,
             apiKey: daytonaApiKey || undefined,
         };
-        if (this.isDirectSelfManaged() &&
-            this.environmentSandboxProvider === 'daytona' &&
-            this.hasEnvironmentSandboxConnection()) {
+        if (this.aiService.isProxyEnabled() ||
+            (this.isDirectSelfManaged() &&
+                this.environmentSandboxProvider === 'daytona' &&
+                this.hasEnvironmentSandboxConnection())) {
             return envConfig;
         }
-        const resolved = await this.resolveServiceCredential(exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY, 'Daytona sandbox');
-        if (!resolved)
-            return envConfig;
-        const { data } = resolved;
-        const apiUrl = typeof data.apiUrl === 'string' ? data.apiUrl : undefined;
-        const apiKey = typeof data.apiKey === 'string' ? data.apiKey : undefined;
-        if (!apiUrl || !apiKey) {
-            this.warnCredentialFallback('Daytona sandbox', exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY.id, 'Credential data is incomplete');
-            return envConfig;
-        }
-        return { apiUrl, apiKey };
+        return await this.sandboxSettingsService.resolveDaytonaConfig();
     }
     async resolveN8nSandboxConfig() {
-        const { n8nSandboxServiceUrl, n8nSandboxServiceApiKey } = this.config;
-        const envConfig = {
-            serviceUrl: n8nSandboxServiceUrl || undefined,
-            apiKey: n8nSandboxServiceApiKey || undefined,
-        };
         if (this.isDirectSelfManaged() &&
             this.environmentSandboxProvider === 'n8n-sandbox' &&
             this.hasEnvironmentSandboxConnection()) {
-            return envConfig;
-        }
-        const resolved = await this.resolveServiceCredential(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY, 'n8n Sandbox');
-        if (!resolved)
-            return envConfig;
-        const { data } = resolved;
-        const headerName = typeof data.name === 'string' ? data.name.trim().toLowerCase() : '';
-        const apiKey = typeof data.value === 'string' ? data.value : undefined;
-        if (headerName !== N8N_SANDBOX_HEADER_NAME) {
-            this.warnCredentialFallback('n8n Sandbox', exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY.id, `Credential header must be "${N8N_SANDBOX_HEADER_NAME}" but is "${headerName || '(empty)'}"`);
-            return envConfig;
-        }
-        if (!apiKey) {
-            this.warnCredentialFallback('n8n Sandbox', exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY.id, 'Credential data is incomplete');
-            return envConfig;
+            const { n8nSandboxServiceUrl, n8nSandboxServiceApiKey } = this.config;
+            return {
+                serviceUrl: n8nSandboxServiceUrl || undefined,
+                apiKey: n8nSandboxServiceApiKey || undefined,
+            };
         }
-        return { serviceUrl: n8nSandboxServiceUrl || undefined, apiKey };
+        return await this.sandboxSettingsService.resolveN8nSandboxConfig();
     }
     async resolveSearchConfig() {
         const { braveSearchApiKey, searxngUrl } = this.config;
@@ -773,9 +767,7 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         validateInstanceAiCredential(policy, { type: resolved.type, data: resolved.data });
     }
     async resolveServiceCredential(policy, service, ctx) {
-        if (this.isCloud ||
-            (this.aiService.isProxyEnabled() &&
-                policy.id !== exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY.id))
+        if (this.isCloud || this.aiService.isProxyEnabled())
             return null;
         const resolved = ctx
             ? this.instanceCredentialBroker.resolveForUse(policy, ctx)
@@ -825,7 +817,7 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         return this.config.activationLockMessageThreshold;
     }
     getSandboxStatus() {
-        const provider = (0, sandbox_provider_1.normalizeSandboxProvider)(this.config.sandboxProvider);
+        const provider = this.sandboxSettingsService.getProvider();
         const unavailableReason = this.getSandboxUnavailableReason(this.config.sandboxEnabled, provider);
         return {
             enabled: this.config.sandboxEnabled,
@@ -842,8 +834,8 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             return true;
         const [modelSelection, daytonaCredentialId, n8nSandboxCredentialId, searchCredentialId] = await Promise.all([
             this.readAdminModelSelection(),
-            this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY),
-            this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY),
+            this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_DAYTONA_CREDENTIAL_POLICY),
+            this.instanceCredentialBroker.getAssignedCredentialId(sandbox_settings_service_1.INSTANCE_AI_N8N_SANDBOX_CREDENTIAL_POLICY),
             this.instanceCredentialBroker.getAssignedCredentialId(exports.INSTANCE_AI_SEARCH_CREDENTIAL_POLICY),
         ]);
         const response = this.buildAdminSettingsResponse({
@@ -852,13 +844,10 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             n8nSandboxCredentialId,
             searchCredentialId,
         });
-        const modelConfigured = Boolean(response.modelEnvConfigured || (response.modelCredentialId && response.modelName));
-        const sandboxCredentialId = response.sandboxProvider === 'daytona'
-            ? response.daytonaCredentialId
-            : response.n8nSandboxCredentialId;
-        const sandboxConfigured = Boolean(response.sandboxEnabled && (response.sandboxEnvConfigured || sandboxCredentialId));
-        const searchDecided = Boolean(response.searchEnvConfigured || response.searchCredentialId || response.searchDisabled);
-        return modelConfigured && sandboxConfigured && searchDecided;
+        return (0, api_types_1.deriveInstanceAiSetupState)(response).setupCompleted;
+    }
+    getConfiguredModelId() {
+        return this.config.model.trim();
     }
     resolveModelName(user) {
         const prefs = this.readUserPreferences(user);
@@ -895,11 +884,12 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
             const provider = config.includes('/') ? config.slice(0, config.indexOf('/')) : 'custom';
             return `${provider}/${modelName}`;
         }
-        if ('id' in config && typeof config.id === 'string') {
+        if ('id' in config && typeof config.id === 'string' && 'url' in config) {
             const provider = config.id.includes('/')
                 ? config.id.slice(0, config.id.indexOf('/'))
                 : 'custom';
-            return { ...config, id: `${provider}/${modelName}` };
+            const id = `${provider}/${modelName}`;
+            return { ...config, id };
         }
         return config;
     }
@@ -938,7 +928,7 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         return this.buildModelConfig(credential.type, data, modelName);
     }
     buildModelConfig(credentialType, data, modelName) {
-        const provider = CREDENTIAL_TO_MODEL_PROVIDER[credentialType];
+        const provider = exports.CREDENTIAL_TO_MODEL_PROVIDER[credentialType];
         if (!provider) {
             return null;
         }
@@ -1025,6 +1015,9 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
     }
     hasEnvironmentModelConnection() {
         const provider = this.config.model.split('/', 1)[0] ?? '';
+        if (provider === 'google-vertex-anthropic') {
+            return Boolean(this.resolveVertexProjectId());
+        }
         const providerApiKeyEnv = MODEL_PROVIDER_API_KEY_ENV.get(provider);
         return Boolean(this.config.modelApiKey.trim() ||
             this.config.modelUrl.trim() ||
@@ -1050,14 +1043,54 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         const id = model.includes('/')
             ? model
             : `custom/${model}`;
+        const customOptions = this.customModelOptionsFor(id);
+        const vertexConfig = this.vertexAnthropicModelConfig(id);
+        if (vertexConfig)
+            return vertexConfig;
         if (modelUrl) {
-            return { id, url: modelUrl, ...(modelApiKey ? { apiKey: modelApiKey } : {}) };
+            return {
+                id,
+                url: modelUrl,
+                ...(modelApiKey ? { apiKey: modelApiKey } : {}),
+                ...customOptions,
+            };
         }
         if (modelApiKey) {
-            return { id, url: '', apiKey: modelApiKey };
+            return {
+                id,
+                url: '',
+                apiKey: modelApiKey,
+                ...customOptions,
+            };
         }
         return model;
     }
+    resolveVertexProjectId() {
+        return (this.config.vertexProjectId?.trim() ||
+            process.env.GOOGLE_VERTEX_PROJECT?.trim() ||
+            projectIdFromServiceAccountJson(this.config.vertexServiceAccountJson) ||
+            '');
+    }
+    resolveVertexLocation() {
+        return (this.config.vertexLocation?.trim() || process.env.GOOGLE_VERTEX_LOCATION?.trim() || 'global');
+    }
+    vertexAnthropicModelConfig(id) {
+        if (!isVertexAnthropicModelId(id))
+            return null;
+        const googleCredentials = this.config.vertexServiceAccountJson?.trim() || undefined;
+        return {
+            id,
+            project: this.resolveVertexProjectId(),
+            location: this.resolveVertexLocation(),
+            ...(googleCredentials ? { googleCredentials } : {}),
+        };
+    }
+    customModelOptionsFor(modelId) {
+        if (!modelId.startsWith('custom/'))
+            return {};
+        const { supportsStructuredOutputs } = (0, instance_ai_1.resolveCustomModelExperimentDefaultsFromEnv)(modelId);
+        return supportsStructuredOutputs !== undefined ? { supportsStructuredOutputs } : {};
+    }
     extractModelName(model) {
         const slash = model.indexOf('/');
         return slash >= 0 ? model.slice(slash + 1) : model;
@@ -1162,11 +1195,12 @@ let InstanceAiSettingsService = InstanceAiSettingsService_1 = class InstanceAiSe
         delete settings.searchCredentialId;
         return settings;
     }
-    emitSettingsUpdated(previous, current) {
+    emitSettingsUpdated(previous, current, credentialSelections) {
         try {
             this.eventService.emit('instance-ai-settings-updated', {
                 mcpSettingsChanged: current.mcpServers !== previous.mcpServers ||
                     current.mcpAccessEnabled !== previous.mcpAccessEnabled,
+                credentialSelections,
             });
         }
         catch (error) {
@@ -1199,6 +1233,6 @@ InstanceAiSettingsService.MANAGED_PREFERENCE_FIELDS = [
 ];
 exports.InstanceAiSettingsService = InstanceAiSettingsService = InstanceAiSettingsService_1 = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [config_1.GlobalConfig, db_1.DbLockService, db_1.SettingsRepository, db_1.UserRepository, user_service_1.UserService, ai_service_1.AiService, credentials_service_1.CredentialsService, credentials_finder_service_1.CredentialsFinderService, instance_credential_broker_1.InstanceCredentialBroker, event_service_1.EventService])
+    __metadata("design:paramtypes", [config_1.GlobalConfig, db_1.DbLockService, db_1.SettingsRepository, db_1.UserRepository, user_service_1.UserService, ai_service_1.AiService, credentials_service_1.CredentialsService, credentials_finder_service_1.CredentialsFinderService, instance_credential_broker_1.InstanceCredentialBroker, sandbox_settings_service_1.SandboxSettingsService, event_service_1.EventService])
 ], InstanceAiSettingsService);
 //# sourceMappingURL=instance-ai-settings.service.js.map