plugin-ai-api 1.0.15 → 1.0.21

package/src/server/routes/router.ts

@@ -21,9 +21,14 @@ import { checkRolePermission } from '../middleware/role-permission';
 import { startUsageRecord, finishUsageRecord } from '../usage';
 import { isStreamingRequested } from '../utils/streaming';
 import type PluginAiApiServer from '../plugin';
+import { finalizeLlmBilling } from '../billing';
+import { finishAiApiObservation, startAiApiObservation } from '../utils/app-observability';
 
 const API_PREFIX = '/api/ai-llm/v1';
 
+/** Shared so the plugin can disable the core body parser for exactly these routes. */
+export const AI_LLM_PREFIX = API_PREFIX;
+
 type DataWrappingContext = Context & { withoutDataWrapping?: boolean };
 
 /**
@@ -73,7 +78,10 @@ export function createAiLlmRouter(plugin: PluginAiApiServer) {
     ctx.set('Access-Control-Allow-Origin', '*');
     ctx.set('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
     ctx.set('Access-Control-Allow-Headers', 'Authorization, Content-Type, X-AI-Mode, X-Timezone, X-Locale');
-    ctx.set('Access-Control-Expose-Headers', 'X-Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After');
+    ctx.set(
+      'Access-Control-Expose-Headers',
+      'X-Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reason, Retry-After',
+    );
     ctx.set('Access-Control-Max-Age', '86400');
 
     // ─── OPTIONS preflight — return immediately after CORS headers ────────
@@ -86,22 +94,9 @@ export function createAiLlmRouter(plugin: PluginAiApiServer) {
     const requestId = `req-${crypto.randomBytes(12).toString('hex')}`;
     ctx.set('X-Request-Id', requestId);
 
-    // ─── Parse body for POST requests if not already parsed ───────────────
-    if (method === 'POST' && !ctx.request.body) {
-      try {
-        const rawBody = await getRawBody(ctx);
-        ctx.request.body = JSON.parse(rawBody);
-      } catch (bodyErr: unknown) {
-        const status =
-          bodyErr && typeof bodyErr === 'object' && 'statusCode' in bodyErr && bodyErr.statusCode === 413 ? 413 : 400;
-        const message = status === 413 ? 'Request body too large (max 10 MB)' : 'Invalid JSON in request body';
-        ctx.status = status;
-        ctx.body = toOpenAIError(status, message, 'invalid_request_error');
-        return;
-      }
-    }
-
     // ─── Authenticate ─────────────────────────────────────────────────────
+    // Runs before the body is read: buffering a multi-megabyte payload for an
+    // anonymous caller would let unauthenticated traffic pin memory.
     const isAuth = await authenticateBearer(ctx);
     if (!isAuth) {
       logRequest(ctx, requestId, '-', 'auth_failed', 0);
@@ -122,6 +117,32 @@ export function createAiLlmRouter(plugin: PluginAiApiServer) {
       return;
     }
 
+    // ─── Parse body for POST requests if not already parsed ───────────────
+    if (method === 'POST' && !ctx.request.body) {
+      const maxBodyBytes = await resolveMaxBodyBytes(ctx);
+      const declaredLength = Number(ctx.get('Content-Length'));
+      if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        respondBodyTooLarge(ctx, maxBodyBytes);
+        logRequest(ctx, requestId, '-', 'body_too_large', 0);
+        return;
+      }
+      try {
+        const rawBody = await getRawBody(ctx, maxBodyBytes);
+        ctx.request.body = JSON.parse(rawBody);
+      } catch (bodyErr: unknown) {
+        const tooLarge =
+          bodyErr && typeof bodyErr === 'object' && 'statusCode' in bodyErr && bodyErr.statusCode === 413;
+        if (tooLarge) {
+          respondBodyTooLarge(ctx, maxBodyBytes);
+          logRequest(ctx, requestId, '-', 'body_too_large', 0);
+          return;
+        }
+        ctx.status = 400;
+        ctx.body = toOpenAIError(400, 'Invalid JSON in request body', 'invalid_request_error');
+        return;
+      }
+    }
+
     // ─── Route matching ───────────────────────────────────────────────────
     const requestBody = (ctx.request.body || {}) as Record<string, unknown>;
     const model = requestBody.model === undefined || requestBody.model === null ? '-' : String(requestBody.model);
@@ -141,6 +162,23 @@ export function createAiLlmRouter(plugin: PluginAiApiServer) {
       };
     }
     const t0 = Date.now();
+    if (isUsageEndpoint) {
+      const service =
+        subPath === '/embeddings'
+          ? 'llm.embedding'
+          : resolvedMode === 'agent'
+            ? 'llm.agent'
+            : subPath === '/completions'
+              ? 'llm.completion'
+              : 'llm.chat';
+      startAiApiObservation(ctx, {
+        service,
+        operation: subPath,
+        streaming,
+        model: model === '-' ? undefined : model,
+        mode: resolvedMode,
+      });
+    }
     let usageId: unknown;
     try {
       usageId = isUsageEndpoint
@@ -259,33 +297,120 @@ export function createAiLlmRouter(plugin: PluginAiApiServer) {
         } catch (usageError) {
           ctx.log.error('AI API usage record could not be finalized:', usageError);
         }
+      } else if (ctx.state.aiApiLlmBilling) {
+        try {
+          const usageResult = ctx.state.aiApiUsageResult;
+          const providerUsage = usageResult?.source === 'provider' ? usageResult.usage : undefined;
+          const succeeded = ctx.state.aiApiStreamResult
+            ? ctx.state.aiApiStreamResult.succeeded
+            : ctx.status >= 200 && ctx.status < 400;
+          await finalizeLlmBilling(ctx, providerUsage, succeeded);
+        } catch (billingError) {
+          ctx.log.error('AI API quota reservation could not be finalized:', billingError);
+        }
+      }
+      if (isUsageEndpoint) {
+        const streamResult = ctx.state.aiApiStreamResult;
+        finishAiApiObservation(ctx, {
+          status:
+            streamResult?.errorCode === 'client_disconnected'
+              ? 'cancelled'
+              : streamResult
+                ? streamResult.succeeded
+                  ? 'succeeded'
+                  : 'failed'
+                : ctx.status >= 200 && ctx.status < 400
+                  ? 'succeeded'
+                  : ctx.status >= 500
+                    ? 'failed'
+                    : 'rejected',
+          errorCode: streamResult?.errorCode,
+        });
       }
     }
   };
 }
 
-/** Maximum allowed request body size (10 MB) to prevent OOM DoS attacks. */
-const MAX_BODY_BYTES = 10 * 1024 * 1024;
+/** Body size cap used when aiApiConfig has no usable maxRequestBodyMb. */
+const DEFAULT_MAX_BODY_MB = 10;
 
 /**
- * Read raw body from request stream (fallback if bodyparser didn't handle it).
- * Rejects with a 413-style error if the body exceeds MAX_BODY_BYTES.
+ * Upper bound an admin can configure.
+ *
+ * The gateway buffers the whole payload in memory (raw chunks, the decoded
+ * string, and the parsed object all coexist briefly), so an unbounded value
+ * would turn a config typo into an out-of-memory risk.
  */
-function getRawBody(ctx: Context): Promise<string> {
+export const MAX_REQUEST_BODY_MB_LIMIT = 100;
+
+/** Clamp a configured megabyte value into the supported range. */
+export function normalizeMaxRequestBodyMb(value: unknown): number {
+  const mb = Number(value);
+  if (!Number.isSafeInteger(mb) || mb <= 0) return DEFAULT_MAX_BODY_MB;
+  return Math.min(mb, MAX_REQUEST_BODY_MB_LIMIT);
+}
+
+async function resolveMaxBodyBytes(ctx: Context): Promise<number> {
+  let configuredMb: unknown;
+  try {
+    const config = await ctx.db.getRepository('aiApiConfig').findOne();
+    configuredMb = config?.get('maxRequestBodyMb');
+  } catch (err) {
+    ctx.log?.warn?.('AI API: could not read maxRequestBodyMb, using default:', err);
+  }
+  return normalizeMaxRequestBodyMb(configuredMb) * 1024 * 1024;
+}
+
+function formatMb(bytes: number): string {
+  return `${Math.round(bytes / (1024 * 1024))} MB`;
+}
+
+function respondBodyTooLarge(ctx: Context, maxBodyBytes: number): void {
+  ctx.status = 413;
+  ctx.body = toOpenAIError(
+    413,
+    `Request body too large (max ${formatMb(maxBodyBytes)}). ` +
+      `Inline base64 images inflate payloads by ~33%; raise "Max request body size" in Settings → AI API Gateway if needed.`,
+    'invalid_request_error',
+  );
+}
+
+/**
+ * Read the raw request body.
+ *
+ * The plugin disables the core koa-bodyparser for these routes (see plugin.ts),
+ * so this cap is the one that actually governs gateway payload size.
+ * Rejects with a 413-style error once maxBodyBytes is exceeded.
+ *
+ * Exported so tests can drive the real implementation over a live socket rather
+ * than a copy that cannot catch a regression here.
+ */
+export function getRawBody(ctx: Pick<Context, 'req'>, maxBodyBytes: number): Promise<string> {
   return new Promise((resolve, reject) => {
-    let body = '';
+    const chunks: Buffer[] = [];
     let byteCount = 0;
+    let aborted = false;
 
     ctx.req.on('data', (chunk: Buffer) => {
+      if (aborted) return;
       byteCount += chunk.length;
-      if (byteCount > MAX_BODY_BYTES) {
-        ctx.req.destroy();
-        reject(Object.assign(new Error('Request body too large (max 10 MB)'), { statusCode: 413 }));
+      if (byteCount > maxBodyBytes) {
+        // Drop what we buffered and drain the rest instead of destroying the
+        // socket: ctx.req and the response share one connection, so destroying
+        // it replaces our 413 JSON with an ECONNRESET on the client.
+        aborted = true;
+        chunks.length = 0;
+        ctx.req.resume();
+        reject(Object.assign(new Error(`Request body too large (max ${formatMb(maxBodyBytes)})`), { statusCode: 413 }));
         return;
       }
-      body += chunk.toString();
+      chunks.push(chunk);
+    });
+    // Decode once at the end: a multi-byte UTF-8 character can straddle a chunk
+    // boundary, and per-chunk toString() would corrupt it.
+    ctx.req.on('end', () => {
+      if (!aborted) resolve(Buffer.concat(chunks).toString('utf8'));
     });
-    ctx.req.on('end', () => resolve(body));
     ctx.req.on('error', reject);
   });
 }

package/src/server/usage.ts

@@ -1,4 +1,6 @@
 import { Context } from '@nocobase/actions';
+import { finalizeLlmBilling, type LlmBillingState } from './billing';
+import { addAiApiUsage } from './utils/app-observability';
 
 export type Usage = {
   prompt_tokens: number | null;
@@ -35,6 +37,7 @@ interface AiApiContextState {
   currentRoles?: string[];
   currentUser?: { id?: string | number | bigint };
   oauthPrincipal?: OAuthPrincipal;
+  aiApiLlmBilling?: LlmBillingState;
 }
 
 function getAiApiState(ctx: Context): AiApiContextState {
@@ -74,6 +77,7 @@ export function setAiApiUsageResult(
   getAiApiState(ctx).aiApiUsageResult = usage
     ? { source: 'provider', usage, ...metadata }
     : { source: 'unavailable', ...metadata };
+  addAiApiUsage(ctx, usage);
   return usage;
 }
 
@@ -158,7 +162,10 @@ export async function finishUsageRecord(ctx: Context, id: unknown, startedAt: nu
   const state = getAiApiState(ctx);
   const streamResult = state.aiApiStreamResult;
   const usageResult = state.aiApiUsageResult ?? { source: 'unavailable' as const };
-  const usage = usageResult.source === 'provider' ? usageResult.usage : undefined;
+  const providerUsage = usageResult.source === 'provider' ? usageResult.usage : undefined;
+  const succeeded = streamResult ? streamResult.succeeded : status === 'succeeded';
+  const billing = await finalizeLlmBilling(ctx, providerUsage, succeeded);
+  const usage = billing.usage ?? providerUsage;
   const gatewayResponseId = usageResult.gatewayResponseId || response.id || streamResult?.id;
   const values = {
     status: streamResult ? (streamResult.succeeded ? 'succeeded' : 'failed') : status,
@@ -167,6 +174,17 @@ export async function finishUsageRecord(ctx: Context, id: unknown, startedAt: nu
     inputTokens: usage?.prompt_tokens ?? null,
     outputTokens: usage?.completion_tokens ?? null,
     totalTokens: usage?.total_tokens ?? null,
+    resolvedService: state.aiApiLlmBilling?.resolution?.service ?? null,
+    resolvedProvider: state.aiApiLlmBilling?.resolution?.provider ?? null,
+    resolvedModel: state.aiApiLlmBilling?.resolution?.model ?? null,
+    estimatedCost: billing.estimatedCost ?? null,
+    currency: billing.currency ?? null,
+    costStatus: billing.costStatus ?? null,
+    modelPriceId: billing.modelPriceId ?? null,
+    quotaPolicyId: billing.quotaPolicyId ?? null,
+    inputPricePerMillionTokens: billing.inputPricePerMillionTokens ?? null,
+    outputPricePerMillionTokens: billing.outputPricePerMillionTokens ?? null,
+    fixedCostPerRequest: billing.fixedCostPerRequest ?? null,
     providerRequestId: usageResult.providerRequestId ?? null,
     completedAt: new Date(),
     durationMs: Date.now() - startedAt,

package/src/server/utils/app-observability.ts

@@ -0,0 +1,105 @@
+import type { Context } from '@nocobase/actions';
+
+interface ObservationFinish {
+  status: 'succeeded' | 'failed' | 'cancelled' | 'rejected';
+  errorCode?: string;
+  inputTokens?: number;
+  outputTokens?: number;
+}
+interface ObservationHandle {
+  markFirstByte(): void;
+  addInputTokens(value: number): void;
+  addOutputTokens(value: number): void;
+  finish(result: ObservationFinish): void;
+}
+interface AppObservabilityContract {
+  start(input: {
+    service: string;
+    operation: string;
+    streaming?: boolean;
+    attributes?: Record<string, string | number | boolean | null>;
+  }): ObservationHandle;
+}
+interface AiApiObservabilityState {
+  aiApiObservabilityHandle?: ObservationHandle;
+  aiApiObservabilityOutcome?: ObservationFinish;
+}
+
+const CONTRACT_SYMBOL = Symbol.for('nocobase.app-observability.contract');
+const NOOP_HANDLE: ObservationHandle = {
+  markFirstByte() {},
+  addInputTokens() {},
+  addOutputTokens() {},
+  finish() {},
+};
+
+function state(ctx: Context): AiApiObservabilityState {
+  return ctx.state as AiApiObservabilityState;
+}
+
+function safely(ctx: Context, callback: () => void): void {
+  try {
+    callback();
+  } catch (error) {
+    ctx.app?.logger?.warn?.('[ai-api] App observability callback failed', { error });
+  }
+}
+
+export function startAiApiObservation(
+  ctx: Context,
+  input: {
+    service: 'llm.chat' | 'llm.agent' | 'llm.completion' | 'llm.embedding';
+    operation: string;
+    streaming: boolean;
+    model?: string;
+    mode: 'llm' | 'agent';
+  },
+): void {
+  let handle = NOOP_HANDLE;
+  safely(ctx, () => {
+    const contract = (ctx.app as object & { [CONTRACT_SYMBOL]?: AppObservabilityContract })[CONTRACT_SYMBOL];
+    if (!contract || typeof contract.start !== 'function') return;
+    const candidate = contract.start({
+      service: input.service,
+      operation: input.operation,
+      streaming: input.streaming,
+      attributes: {
+        mode: input.mode,
+        endpoint: input.operation,
+        ...(input.model ? { model: input.model } : {}),
+      },
+    });
+    if (candidate && typeof candidate.finish === 'function') handle = candidate;
+  });
+  state(ctx).aiApiObservabilityHandle = handle;
+}
+
+export function markAiApiFirstProviderOutput(ctx: Context): void {
+  safely(ctx, () => state(ctx).aiApiObservabilityHandle?.markFirstByte());
+}
+
+export function addAiApiUsage(
+  ctx: Context,
+  usage?: { prompt_tokens: number | null; completion_tokens: number | null },
+): void {
+  if (!usage) return;
+  safely(ctx, () => {
+    const handle = state(ctx).aiApiObservabilityHandle;
+    if (usage.prompt_tokens !== null) handle?.addInputTokens(usage.prompt_tokens);
+    if (usage.completion_tokens !== null) handle?.addOutputTokens(usage.completion_tokens);
+  });
+}
+
+export function setAiApiObservationOutcome(ctx: Context, outcome: ObservationFinish): void {
+  state(ctx).aiApiObservabilityOutcome = outcome;
+}
+
+export function finishAiApiObservation(ctx: Context, fallback: ObservationFinish): void {
+  const current = state(ctx);
+  const handle = current.aiApiObservabilityHandle;
+  if (!handle) return;
+  current.aiApiObservabilityHandle = undefined;
+  const outcome = current.aiApiObservabilityOutcome ?? fallback;
+  current.aiApiObservabilityOutcome = undefined;
+  safely(ctx, () => handle.finish(outcome));
+}

package/src/server/utils/streaming.ts

@@ -1,5 +1,17 @@
 import type { Context } from '@nocobase/actions';
 
+export class AiApiClientDisconnectedError extends Error {
+  readonly code = 'client_disconnected';
+  constructor() {
+    super('Client disconnected');
+    this.name = 'AiApiClientDisconnectedError';
+  }
+}
+
+export function isClientDisconnected(ctx: Context, error: unknown): boolean {
+  return ctx.req.aborted === true || error instanceof AiApiClientDisconnectedError;
+}
+
 export function isStreamingRequested(value: unknown) {
   return value !== false;
 }
@@ -7,7 +19,7 @@ export function isStreamingRequested(value: unknown) {
 export function createRequestAbortController(ctx: Context) {
   const controller = new AbortController();
   const abort = () => {
-    if (!ctx.res.writableEnded) controller.abort(new Error('Client disconnected'));
+    if (!ctx.res.writableEnded) controller.abort(new AiApiClientDisconnectedError());
   };
   ctx.req.once('aborted', abort);
   ctx.res.once('close', abort);

package/src/server/validation.ts

@@ -0,0 +1,89 @@
+import dayjs from 'dayjs';
+import type { Database, Model } from '@nocobase/database';
+
+function requireNonNegativeDecimal(value: unknown, field: string): void {
+  const normalized = String(value ?? '').trim();
+  if (!/^\d+(?:\.\d+)?$/.test(normalized)) {
+    throw new Error(`${field} must be a non-negative decimal.`);
+  }
+}
+
+function requireNonNegativeIntegerOrNull(value: unknown, field: string): void {
+  if (value === null || value === undefined || value === '') return;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) throw new Error(`${field} must be a non-negative integer.`);
+}
+
+export async function validateModelPrice(db: Database, model: Model): Promise<void> {
+  requireNonNegativeDecimal(model.get('inputPricePerMillionTokens'), 'inputPricePerMillionTokens');
+  requireNonNegativeDecimal(model.get('outputPricePerMillionTokens'), 'outputPricePerMillionTokens');
+  requireNonNegativeDecimal(model.get('fixedCostPerRequest') ?? 0, 'fixedCostPerRequest');
+
+  const effectiveFrom = new Date(String(model.get('effectiveFrom')));
+  const effectiveToValue = model.get('effectiveTo');
+  const effectiveTo = effectiveToValue ? new Date(String(effectiveToValue)) : undefined;
+  if (Number.isNaN(effectiveFrom.getTime())) throw new Error('effectiveFrom must be a valid date.');
+  if (effectiveTo && (Number.isNaN(effectiveTo.getTime()) || effectiveTo <= effectiveFrom)) {
+    throw new Error('effectiveTo must be later than effectiveFrom.');
+  }
+  if (model.get('enabled') === false) return;
+
+  const overlapFilter: Record<string, unknown> = {
+    llmService: model.get('llmService'),
+    model: model.get('model'),
+    enabled: true,
+    effectiveFrom: { $lt: effectiveTo ?? new Date('9999-12-31T23:59:59.999Z') },
+    $or: [{ effectiveTo: null }, { effectiveTo: { $gt: effectiveFrom } }],
+  };
+  if (model.get('id')) overlapFilter.id = { $ne: model.get('id') };
+  const overlap = await db.getRepository('aiApiModelPrices').findOne({
+    filter: overlapFilter,
+  });
+  if (overlap) throw new Error('An enabled price already overlaps this effective period.');
+}
+
+function requirePositiveIntegerOrNull(value: unknown, field: string): void {
+  if (value === null || value === undefined || value === '') return;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${field} must be a positive integer.`);
+}
+
+export function validateModelMetadata(model: Model): void {
+  if (!String(model.get('llmService') ?? '').trim()) throw new Error('llmService is required.');
+  if (!String(model.get('model') ?? '').trim()) throw new Error('model is required.');
+  requirePositiveIntegerOrNull(model.get('contextWindow'), 'contextWindow');
+  requirePositiveIntegerOrNull(model.get('maxCompletionTokens'), 'maxCompletionTokens');
+
+  const contextWindow = model.get('contextWindow');
+  const maxCompletionTokens = model.get('maxCompletionTokens');
+  if (
+    contextWindow !== null &&
+    contextWindow !== undefined &&
+    contextWindow !== '' &&
+    maxCompletionTokens !== null &&
+    maxCompletionTokens !== undefined &&
+    maxCompletionTokens !== '' &&
+    Number(maxCompletionTokens) > Number(contextWindow)
+  ) {
+    throw new Error('maxCompletionTokens cannot exceed contextWindow.');
+  }
+}
+
+export function validateQuotaPolicy(model: Model): void {
+  if (!['daily', 'monthly'].includes(String(model.get('periodType')))) {
+    throw new Error('periodType must be daily or monthly.');
+  }
+  if (!['allow', 'use_reserved'].includes(String(model.get('missingUsageBehavior')))) {
+    throw new Error('missingUsageBehavior must be allow or use_reserved.');
+  }
+  try {
+    dayjs().tz(String(model.get('timezone') || 'UTC'));
+  } catch {
+    throw new Error('timezone must be a valid IANA timezone.');
+  }
+  requireNonNegativeIntegerOrNull(model.get('requestLimit'), 'requestLimit');
+  requireNonNegativeIntegerOrNull(model.get('totalTokenLimit'), 'totalTokenLimit');
+  if (model.get('costLimit') !== null && model.get('costLimit') !== undefined) {
+    requireNonNegativeDecimal(model.get('costLimit'), 'costLimit');
+  }
+}

package/src/swagger.ts

@@ -258,6 +258,15 @@ export default {
             type: 'integer',
             description: 'Max requests per minute per user (0 = unlimited)',
           },
+          maxRequestBodyMb: {
+            type: 'integer',
+            minimum: 1,
+            maximum: 100,
+            default: 10,
+            description:
+              'Max request body size in megabytes. Requests above this return 413. ' +
+              'The gateway buffers each body in memory, so values above 100 are rejected.',
+          },
         },
       },
       ModelObject: {
@@ -269,11 +278,39 @@ export default {
           owned_by: { type: 'string' },
         },
       },
+      ContentBlock: {
+        type: 'object',
+        description:
+          'A multimodal content block. Only text and image_url blocks are forwarded to the provider; ' +
+          'any other type is rejected with 400 unsupported_content_block.',
+        properties: {
+          type: { type: 'string', enum: ['text', 'image_url'] },
+          text: { type: 'string' },
+          image_url: {
+            type: 'object',
+            properties: {
+              url: {
+                type: 'string',
+                description: 'An https URL or a base64 data URL, e.g. data:image/png;base64,iVBORw0KGgo...',
+                example: 'data:image/png;base64,iVBORw0KGgo...',
+              },
+              detail: { type: 'string', enum: ['auto', 'low', 'high'] },
+            },
+            required: ['url'],
+          },
+        },
+        required: ['type'],
+      },
       ChatMessage: {
         type: 'object',
         properties: {
           role: { type: 'string', enum: ['system', 'user', 'assistant', 'tool'] },
-          content: { type: 'string' },
+          content: {
+            description:
+              'Plain text, or an array of content blocks for multimodal requests. ' +
+              'Inline base64 images inflate the payload by about 33%; see "Max request body size" in the gateway settings.',
+            oneOf: [{ type: 'string' }, { type: 'array', items: { $ref: '#/components/schemas/ContentBlock' } }],
+          },
           name: { type: 'string' },
           tool_call_id: { type: 'string' },
           tool_calls: { type: 'array', items: { $ref: '#/components/schemas/ToolCall' } },

package/dist/client/778.5c452944cb747975.js

@@ -1,10 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-"use strict";(self.webpackChunkplugin_ai_api=self.webpackChunkplugin_ai_api||[]).push([["778"],{905:function(e,t,r){r.r(t),r.d(t,{AiApiRolePermissions:function(){return d}});var n=r(155),l=r.n(n),a=r(485),o=r(59);function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var r=0,n=Array(t);r<t;r++)n[r]=e[r];return n}function u(e,t,r,n,l,a,o){try{var i=e[a](o),u=i.value}catch(e){r(e);return}i.done?t(u):Promise.resolve(u).then(n,l)}function c(e){return function(){var t=this,r=arguments;return new Promise(function(n,l){var a=e.apply(t,r);function o(e){u(a,n,l,o,i,"next",e)}function i(e){u(a,n,l,o,i,"throw",e)}o(void 0)})}}function s(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{},n=Object.keys(r);"function"==typeof Object.getOwnPropertySymbols&&(n=n.concat(Object.getOwnPropertySymbols(r).filter(function(e){return Object.getOwnPropertyDescriptor(r,e).enumerable}))),n.forEach(function(t){var n;n=r[t],t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n})}return e}function p(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var r,n,l=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=l){var a=[],o=!0,i=!1;try{for(l=l.call(e);!(o=(r=l.next()).done)&&(a.push(r.value),!t||a.length!==t);o=!0);}catch(e){i=!0,n=e}finally{try{o||null==l.return||l.return()}finally{if(i)throw n}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return i(e,t);var r=Object.prototype.toString.call(e).slice(8,-1);if("Object"===r&&e.constructor&&(r=e.constructor.name),"Map"===r||"Set"===r)return Array.from(r);if("Arguments"===r||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r))return i(e,t)}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function f(e,t){var r,n,l,a={label:0,sent:function(){if(1&l[0])throw l[1];return l[1]},trys:[],ops:[]},o=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),i=Object.defineProperty;return i(o,"next",{value:u(0)}),i(o,"throw",{value:u(1)}),i(o,"return",{value:u(2)}),"function"==typeof Symbol&&i(o,Symbol.iterator,{value:function(){return this}}),o;function u(i){return function(u){var c=[i,u];if(r)throw TypeError("Generator is already executing.");for(;o&&(o=0,c[0]&&(a=0)),a;)try{if(r=1,n&&(l=2&c[0]?n.return:c[0]?n.throw||((l=n.return)&&l.call(n),0):n.next)&&!(l=l.call(n,c[1])).done)return l;switch(n=0,l&&(c=[2&c[0],l.value]),c[0]){case 0:case 1:l=c;break;case 4:return a.label++,{value:c[1],done:!1};case 5:a.label++,n=c[1],c=[0];continue;case 7:c=a.ops.pop(),a.trys.pop();continue;default:if(!(l=(l=a.trys).length>0&&l[l.length-1])&&(6===c[0]||2===c[0])){a=0;continue}if(3===c[0]&&(!l||c[1]>l[0]&&c[1]<l[3])){a.label=c[1];break}if(6===c[0]&&a.label<l[1]){a.label=l[1],l=c;break}if(l&&a.label<l[2]){a.label=l[2],a.ops.push(c);break}l[2]&&a.ops.pop(),a.trys.pop();continue}c=t.call(e,a)}catch(e){c=[6,e],n=0}finally{r=l=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}}}var m=o.Typography.Text;function d(e){var t=e.role,r=(0,a.useApp)().apiClient,i=p((0,n.useState)(!0),2),u=i[0],d=i[1],y=p((0,n.useState)(!1),2),b=y[0],h=y[1],v=p((0,n.useState)([]),2),w=v[0],E=v[1],g=p((0,n.useState)(null),2),A=g[0],O=g[1],S=null==t?void 0:t.name;(0,n.useEffect)(function(){S&&P()},[S]);var P=function(){return c(function(){var e,t,n,l,a,o,i;return f(this,function(u){switch(u.label){case 0:d(!0),u.label=1;case 1:return u.trys.push([1,3,4,5]),[4,Promise.all([r.request({url:"aiApiRolePermissions",params:{filter:{roleName:S},paginate:!1}}),r.request({url:"aiEmployees:list",params:{paginate:!1}})])];case 2:return a=(l=p.apply(void 0,[u.sent(),2]))[0],o=l[1],O((i=null==a||null==(t=a.data)||null==(e=t.data)?void 0:e[0])?{id:i.id,roleName:i.roleName,enabled:!!i.enabled,allowAllEmployees:!1!==i.allowAllEmployees,allowedEmployees:i.allowedEmployees||[]}:{roleName:S,enabled:!1,allowAllEmployees:!0,allowedEmployees:[]}),E(((null==o||null==(n=o.data)?void 0:n.data)||[]).map(function(e){return{username:e.username,nickname:e.nickname||e.username}})),[3,5];case 3:return console.error("Failed to load AI API role permissions:",u.sent()),[3,5];case 4:return d(!1),[7];case 5:return[2]}})})()},j=function(e){return c(function(){var t,n,l,a;return f(this,function(o){switch(o.label){case 0:if(!A)return[2];O(t=s({},A,e)),h(!0),o.label=1;case 1:if(o.trys.push([1,6,7,8]),!t.id)return[3,3];return[4,r.request({url:"aiApiRolePermissions/".concat(t.id),method:"PUT",data:t})];case 2:return o.sent(),[3,5];case 3:return[4,r.request({url:"aiApiRolePermissions",method:"POST",data:t})];case 4:var i,u;(null==(a=null==(l=o.sent())||null==(n=l.data)?void 0:n.data)?void 0:a.id)&&O((i=s({},t),u=u={id:a.id},Object.getOwnPropertyDescriptors?Object.defineProperties(i,Object.getOwnPropertyDescriptors(u)):(function(e){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t.push.apply(t,r)}return t})(Object(u)).forEach(function(e){Object.defineProperty(i,e,Object.getOwnPropertyDescriptor(u,e))}),i)),o.label=5;case 5:return[3,8];case 6:return console.error("Failed to save AI API role permissions:",o.sent()),O(A),[3,8];case 7:return h(!1),[7];case 8:return[2]}})})()};return u?l().createElement(o.Spin,null):l().createElement(o.Card,{bordered:!1},l().createElement(o.Space,{direction:"vertical",style:{width:"100%"},size:"middle"},l().createElement(o.Space,null,l().createElement(o.Switch,{checked:!!(null==A?void 0:A.enabled),loading:b,onChange:function(e){return j({enabled:e})}}),l().createElement(m,{strong:!0},"Allow this role to use the AI API")),(null==A?void 0:A.enabled)&&l().createElement(l().Fragment,null,l().createElement(o.Divider,{style:{margin:"8px 0"}}),l().createElement(o.Space,null,l().createElement(o.Switch,{checked:!!(null==A?void 0:A.allowAllEmployees),loading:b,onChange:function(e){return j({allowAllEmployees:e})}}),l().createElement(m,null,"Allow all AI Employees")),!(null==A?void 0:A.allowAllEmployees)&&l().createElement("div",null,l().createElement(m,{type:"secondary",style:{display:"block",marginBottom:8}},"Select which AI Employees this role may use:"),l().createElement(o.Select,{mode:"multiple",allowClear:!0,style:{width:"100%",maxWidth:480},placeholder:"Select allowed AI Employees",value:(null==A?void 0:A.allowedEmployees)||[],options:w.map(function(e){return{label:"".concat(e.nickname," (").concat(e.username,")"),value:e.username}}),onChange:function(e){return j({allowedEmployees:e})},disabled:b})))))}}}]);

package/dist/client/950.83390c5f1d5a97fb.js

@@ -1,10 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-"use strict";(self.webpackChunkplugin_ai_api=self.webpackChunkplugin_ai_api||[]).push([["950"],{693:function(e,t,n){n.r(t),n.d(t,{AiApiConfigPage:function(){return y}});var a=n(155),r=n.n(a),l=n(59),o=n(485);function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,a=Array(t);n<t;n++)a[n]=e[n];return a}function c(e,t,n,a,r,l,o){try{var i=e[l](o),c=i.value}catch(e){n(e);return}i.done?t(c):Promise.resolve(c).then(a,r)}function u(e){return function(){var t=this,n=arguments;return new Promise(function(a,r){var l=e.apply(t,n);function o(e){c(l,a,r,o,i,"next",e)}function i(e){c(l,a,r,o,i,"throw",e)}o(void 0)})}}function s(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n,a,r=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=r){var l=[],o=!0,i=!1;try{for(r=r.call(e);!(o=(n=r.next()).done)&&(l.push(n.value),!t||l.length!==t);o=!0);}catch(e){i=!0,a=e}finally{try{o||null==r.return||r.return()}finally{if(i)throw a}}return l}}(e,t)||function(e,t){if(e){if("string"==typeof e)return i(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);if("Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n)return Array.from(n);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return i(e,t)}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function m(e,t){var n,a,r,l={label:0,sent:function(){if(1&r[0])throw r[1];return r[1]},trys:[],ops:[]},o=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),i=Object.defineProperty;return i(o,"next",{value:c(0)}),i(o,"throw",{value:c(1)}),i(o,"return",{value:c(2)}),"function"==typeof Symbol&&i(o,Symbol.iterator,{value:function(){return this}}),o;function c(i){return function(c){var u=[i,c];if(n)throw TypeError("Generator is already executing.");for(;o&&(o=0,u[0]&&(l=0)),l;)try{if(n=1,a&&(r=2&u[0]?a.return:u[0]?a.throw||((r=a.return)&&r.call(a),0):a.next)&&!(r=r.call(a,u[1])).done)return r;switch(a=0,r&&(u=[2&u[0],r.value]),u[0]){case 0:case 1:r=u;break;case 4:return l.label++,{value:u[1],done:!1};case 5:l.label++,a=u[1],u=[0];continue;case 7:u=l.ops.pop(),l.trys.pop();continue;default:if(!(r=(r=l.trys).length>0&&r[r.length-1])&&(6===u[0]||2===u[0])){l=0;continue}if(3===u[0]&&(!r||u[1]>r[0]&&u[1]<r[3])){l.label=u[1];break}if(6===u[0]&&l.label<r[1]){l.label=r[1],r=u;break}if(r&&l.label<r[2]){l.label=r[2],l.ops.push(u);break}r[2]&&l.ops.pop(),l.trys.pop();continue}u=t.call(e,l)}catch(e){u=[6,e],a=0}finally{n=r=0}if(5&u[0])throw u[1];return{value:u[0]?u[1]:void 0,done:!0}}}}var p=l.Typography.Title,d=l.Typography.Text,f=l.Typography.Paragraph;function y(){var e=(0,o.useApp)().apiClient,t=s(l.Form.useForm(),1)[0],n=s((0,a.useState)(!0),2),i=n[0],c=n[1],y=s((0,a.useState)(!1),2),v=y[0],h=y[1],b=s((0,a.useState)([]),2),g=b[0],E=b[1],A=s((0,a.useState)([]),2),S=A[0],w=A[1],I=s((0,a.useState)(""),2),L=I[0],k=I[1];(0,a.useEffect)(function(){C(),k("".concat(window.location.origin,"/api/ai-llm/v1"))},[]);var C=function(){return u(function(){var n,a,r,l,o,i,u;return m(this,function(s){switch(s.label){case 0:c(!0),s.label=1;case 1:return s.trys.push([1,5,6,7]),[4,e.request({url:"aiApiConfig:get"})];case 2:return(o=null==(l=s.sent())||null==(n=l.data)?void 0:n.data)&&t.setFieldsValue({mode:o.mode||"llm",defaultAiEmployee:o.defaultAiEmployee||void 0,defaultLlmService:o.defaultLlmService||void 0,enabledLlmServices:o.enabledLlmServices||[],rateLimitPerMinute:o.rateLimitPerMinute||60}),[4,e.request({url:"aiEmployees:list",params:{paginate:!1}})];case 3:return E(((null==(i=s.sent())||null==(a=i.data)?void 0:a.data)||[]).map(function(e){return{username:e.username,nickname:e.nickname||e.username}})),[4,e.request({url:"ai:listLLMServices"})];case 4:return w(((null==(u=s.sent())||null==(r=u.data)?void 0:r.data)||[]).map(function(e){return{name:e.name,title:e.title||e.name,provider:e.provider,enabled:!1!==e.enabled}})),[3,7];case 5:return console.error("Failed to load config:",s.sent()),[3,7];case 6:return c(!1),[7];case 7:return[2]}})})()};return i?r().createElement("div",{style:{display:"flex",justifyContent:"center",padding:60}},r().createElement(l.Spin,{size:"large"})):r().createElement("div",{style:{maxWidth:800,margin:"0 auto",padding:"24px 0"}},r().createElement(p,{level:3},"AI API Gateway Configuration"),r().createElement(f,{type:"secondary"},"Configure the OpenAI-compatible API endpoint. External applications can connect using the base URL and a NocoBase API key."),r().createElement(l.Card,{style:{marginBottom:24}},r().createElement(l.Alert,{type:"info",showIcon:!0,message:"API Endpoint",description:r().createElement(l.Space,{direction:"vertical",size:4},r().createElement(d,null,"Base URL:"," ",r().createElement(d,{code:!0,copyable:!0},L)),r().createElement(d,{type:"secondary"},"Use this as the base URL in any OpenAI-compatible client (Cursor, Continue.dev, n8n, etc.)")),style:{marginBottom:16}}),r().createElement(l.Alert,{type:"warning",showIcon:!0,message:"Authentication",description:r().createElement(d,null,"Clients must include a NocoBase API key as a Bearer token:",r().createElement("br",null),r().createElement(d,{code:!0},"Authorization: Bearer ","<your-nocobase-api-key>"),r().createElement("br",null),r().createElement(d,{type:"secondary"},"API keys can be created in Settings → API keys."))})),r().createElement(l.Card,{title:"Configuration"},r().createElement(l.Form,{form:t,layout:"vertical",onFinish:function(){return u(function(){var n;return m(this,function(a){switch(a.label){case 0:h(!0),a.label=1;case 1:return a.trys.push([1,3,4,5]),n=t.getFieldsValue(),[4,e.request({url:"aiApiConfig:save",method:"post",data:n})];case 2:return a.sent(),l.message.success("Configuration saved"),[3,5];case 3:return a.sent(),l.message.error("Failed to save configuration"),[3,5];case 4:return h(!1),[7];case 5:return[2]}})})()},initialValues:{mode:"llm"}},r().createElement(l.Form.Item,{name:"mode",label:"API Mode",tooltip:"LLM Proxy: Direct access to the LLM model. Agent: Full AI Employee with tools, knowledge base, and agent capabilities."},r().createElement(l.Radio.Group,null,r().createElement(l.Radio.Button,{value:"llm"},"LLM Proxy"),r().createElement(l.Radio.Button,{value:"agent"},"AI Employee Agent"))),r().createElement(l.Form.Item,{name:"defaultAiEmployee",label:"Default AI Employee",tooltip:"The AI Employee whose system prompt will be injected into chat completions (when client doesn't provide a system message)"},r().createElement(l.Select,{allowClear:!0,placeholder:"Select an AI Employee (optional)",options:g.map(function(e){return{label:"".concat(e.nickname," (").concat(e.username,")"),value:e.username}})})),r().createElement(l.Form.Item,{name:"defaultLlmService",label:"Default LLM Service",tooltip:"The LLM service used when clients send only a model name (e.g. 'gpt-4o') without a service prefix. This is the main service that powers the API.",rules:[{required:!0,message:"Please select a default LLM service"}]},r().createElement(l.Select,{allowClear:!0,placeholder:"Select an LLM Service",options:S.map(function(e){return{label:"".concat(e.title," (").concat(e.provider,")"),value:e.name}})})),r().createElement(l.Form.Item,{name:"enabledLlmServices",label:"Enabled LLM Services",tooltip:"Only these services will be exposed via the API. Leave empty to expose all enabled services."},r().createElement(l.Select,{mode:"multiple",allowClear:!0,placeholder:"All enabled services (default)",options:S.map(function(e){return{label:"".concat(e.title," (").concat(e.provider,")"),value:e.name}})})),r().createElement(l.Form.Item,{name:"rateLimitPerMinute",label:"Rate Limit (requests/minute)",tooltip:"Maximum API requests per user per minute. Set 0 for unlimited."},r().createElement(l.InputNumber,{min:0,max:1e4,style:{width:200}})),r().createElement(l.Form.Item,null,r().createElement(l.Button,{type:"primary",htmlType:"submit",loading:v},"Save Configuration")))),r().createElement(l.Card,{title:"Quick Start",style:{marginTop:24}},r().createElement(p,{level:5},"cURL Example"),r().createElement(f,null,r().createElement("pre",{style:{background:"#1a1a2e",color:"#e0e0e0",padding:16,borderRadius:8,fontSize:13,overflow:"auto"}},"curl ".concat(L,'/chat/completions \\\n  -H "Authorization: Bearer <your-api-key>" \\\n  -H "Content-Type: application/json" \\\n  -d \'{\n    "model": "<service-name>/<model-id>",\n    "messages": [\n      {"role": "user", "content": "Hello!"}\n    ]\n  }\''))),r().createElement(p,{level:5},"Python (OpenAI SDK)"),r().createElement(f,null,r().createElement("pre",{style:{background:"#1a1a2e",color:"#e0e0e0",padding:16,borderRadius:8,fontSize:13,overflow:"auto"}},'from openai import OpenAI\n\nclient = OpenAI(\n    base_url="'.concat(L,'",\n    api_key="<your-nocobase-api-key>"\n)\n\nresponse = client.chat.completions.create(\n    model="<service-name>/<model-id>",\n    messages=[{"role": "user", "content": "Hello!"}]\n)'))),r().createElement(p,{level:5},"List Available Models"),r().createElement(f,null,r().createElement("pre",{style:{background:"#1a1a2e",color:"#e0e0e0",padding:16,borderRadius:8,fontSize:13,overflow:"auto"}},"curl ".concat(L,'/models \\\n  -H "Authorization: Bearer <your-api-key>"')))))}t.default=y}}]);