plugin-ai-api 1.0.20 → 1.0.21

package/dist/server/routes/auth.js

@@ -57,7 +57,17 @@ async function authenticateBearer(ctx) {
         const rolesRepository2 = ctx.db.getRepository("users.roles", ctx.state.currentUser.id);
         const roles2 = await rolesRepository2.find({ fields: ["name"] });
         const roleNames2 = roles2.map((role) => role.name);
-        ctx.state.currentRole = roleNames2.includes(requestedRole) ? requestedRole : roleNames2[0];
+        if (requestedRole && !roleNames2.includes(requestedRole)) {
+          ctx.status = 403;
+          ctx.body = (0, import_openai_format.toOpenAIError)(
+            403,
+            `Requested role '${requestedRole}' is not assigned to this user`,
+            "permission_denied",
+            "role_not_permitted"
+          );
+          return false;
+        }
+        ctx.state.currentRole = requestedRole || roleNames2[0];
         ctx.state.currentRoles = ctx.state.currentRole ? [ctx.state.currentRole] : roleNames2;
       }
       return true;

package/dist/server/routes/chat-completions.js

@@ -27,8 +27,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var chat_completions_exports = {};
 __export(chat_completions_exports, {
   applyProviderRequestParameters: () => applyProviderRequestParameters,
+  findContentBlockProblem: () => findContentBlockProblem,
+  findMessageProblem: () => findMessageProblem,
   getProviderRequestParameters: () => getProviderRequestParameters,
-  handleChatCompletions: () => handleChatCompletions
+  handleChatCompletions: () => handleChatCompletions,
+  normalizeMessageContent: () => normalizeMessageContent
 });
 module.exports = __toCommonJS(chat_completions_exports);
 var import_openai_format = require("../utils/openai-format");
@@ -37,6 +40,7 @@ var import_streaming = require("../utils/streaming");
 var import_role_permission = require("../middleware/role-permission");
 var import_usage = require("../usage");
 var import_billing = require("../billing");
+var import_app_observability = require("../utils/app-observability");
 async function handleChatCompletions(ctx, plugin) {
   var _a;
   const body = ctx.request.body;
@@ -50,6 +54,28 @@ async function handleChatCompletions(ctx, plugin) {
     ctx.body = (0, import_openai_format.toOpenAIError)(400, "'messages' must be a non-empty array", "invalid_request_error", "missing_messages");
     return;
   }
+  const messageProblem = findMessageProblem(body.messages);
+  if (messageProblem) {
+    ctx.status = 400;
+    ctx.body = (0, import_openai_format.toOpenAIError)(
+      400,
+      `Invalid messages[${messageProblem.index}]: ${messageProblem.reason}.`,
+      "invalid_request_error",
+      "invalid_message"
+    );
+    return;
+  }
+  const blockProblem = findContentBlockProblem(body.messages);
+  if (blockProblem) {
+    ctx.status = 400;
+    ctx.body = (0, import_openai_format.toOpenAIError)(
+      400,
+      `Invalid content block in messages[${blockProblem.index}]: ${blockProblem.reason}.`,
+      "invalid_request_error",
+      "invalid_content_block"
+    );
+    return;
+  }
   if (body.n !== void 0 && body.n !== null && body.n !== 1) {
     ctx.status = 400;
     ctx.body = (0, import_openai_format.toOpenAIError)(
@@ -157,7 +183,7 @@ async function handleChatCompletions(ctx, plugin) {
     }
     const langchainMessages = messages.map((msg) => {
       const role = msg.role === "assistant" ? "ai" : msg.role;
-      const content = typeof msg.content === "string" ? msg.content : JSON.stringify(msg.content);
+      const content = normalizeMessageContent(msg.content);
       if (msg.role === "assistant" && msg.tool_calls) {
         return {
           role,
@@ -268,6 +294,7 @@ async function handleStreamingCompletion(ctx, chatModel, messages, completionId,
         content = (textPart == null ? void 0 : textPart.text) || "";
       }
       if (content) {
+        (0, import_app_observability.markAiApiFirstProviderOutput)(ctx);
         await (0, import_streaming.writeResponse)(
           ctx,
           (0, import_openai_format.formatSSE)(
@@ -281,6 +308,7 @@ async function handleStreamingCompletion(ctx, chatModel, messages, completionId,
       }
       const toolCallChunks = normalizeToolCallChunks(chunk.tool_call_chunks);
       if (toolCallChunks.length) {
+        (0, import_app_observability.markAiApiFirstProviderOutput)(ctx);
         finishReason = "tool_calls";
         await (0, import_streaming.writeResponse)(
           ctx,
@@ -307,6 +335,7 @@ async function handleStreamingCompletion(ctx, chatModel, messages, completionId,
     (0, import_usage.setAiApiUsageResult)(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
     ctx.state.aiApiStreamResult = { succeeded: true, id: completionId };
   } catch (err) {
+    const cancelled = (0, import_streaming.isClientDisconnected)(ctx, err);
     ctx.log.error("AI API streaming error:", err);
     if (!ctx.res.destroyed && !ctx.res.writableEnded) {
       await (0, import_streaming.writeResponse)(
@@ -320,7 +349,11 @@ async function handleStreamingCompletion(ctx, chatModel, messages, completionId,
       );
     }
     (0, import_usage.setAiApiUsageResult)(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
-    ctx.state.aiApiStreamResult = { succeeded: false, id: completionId, errorCode: "stream_error" };
+    ctx.state.aiApiStreamResult = {
+      succeeded: false,
+      id: completionId,
+      errorCode: cancelled ? "client_disconnected" : "stream_error"
+    };
   } finally {
     requestAbort.dispose();
     if (!ctx.res.writableEnded && !ctx.res.destroyed) ctx.res.end();
@@ -329,6 +362,111 @@ async function handleStreamingCompletion(ctx, chatModel, messages, completionId,
 function getErrorMessage(error, fallback) {
   return error instanceof Error && error.message ? error.message : fallback;
 }
+const SUPPORTED_CONTENT_BLOCK_TYPES = /* @__PURE__ */ new Set(["text", "image_url"]);
+const BASE64_DATA_URL_PATTERN = /^data:(\w+\/\w+);base64,([A-Za-z0-9+/]+=*)$/;
+function isDecodableBase64(payload) {
+  try {
+    return Buffer.from(payload, "base64").toString("base64") === payload;
+  } catch {
+    return false;
+  }
+}
+const SUPPORTED_MESSAGE_ROLES = /* @__PURE__ */ new Set(["system", "developer", "user", "human", "assistant", "ai", "tool"]);
+function findMessageProblem(messages) {
+  for (const [index, message] of messages.entries()) {
+    if (!isRecord(message)) return { index, reason: "each message must be an object" };
+    const role = typeof message.role === "string" ? message.role : void 0;
+    if (!role) return { index, reason: "each message requires a string 'role' field" };
+    if (!SUPPORTED_MESSAGE_ROLES.has(role)) {
+      return {
+        index,
+        reason: `role '${role}' is not supported \u2014 use one of ${[...SUPPORTED_MESSAGE_ROLES].join(", ")}`
+      };
+    }
+    if (role === "tool" && typeof message.tool_call_id !== "string") {
+      return { index, reason: "a 'tool' message requires a string 'tool_call_id' field" };
+    }
+    const { content } = message;
+    const hasToolCalls = Array.isArray(message.tool_calls) && message.tool_calls.length > 0;
+    if (content === void 0 || content === null) {
+      if ((role === "assistant" || role === "ai") && hasToolCalls) continue;
+      return { index, reason: "each message requires a 'content' field" };
+    }
+    if (typeof content !== "string" && !Array.isArray(content)) {
+      return { index, reason: "'content' must be a string or an array of content blocks" };
+    }
+  }
+  return void 0;
+}
+function findContentBlockProblem(messages) {
+  for (const [index, message] of messages.entries()) {
+    const content = isRecord(message) ? message.content : void 0;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      if (typeof block === "string") continue;
+      const reason = describeContentBlockProblem(block);
+      if (reason) return { index, reason };
+    }
+  }
+  return void 0;
+}
+function describeContentBlockProblem(block) {
+  if (!isRecord(block)) return "each content block must be an object";
+  const type = typeof block.type === "string" ? block.type : void 0;
+  if (!type) return "each content block requires a 'type' field";
+  if (!SUPPORTED_CONTENT_BLOCK_TYPES.has(type)) {
+    return `content block type '${type}' is not supported \u2014 this gateway forwards 'text' and 'image_url' only. Send documents as text, or inline them as an 'image_url' data URL if the model reads images`;
+  }
+  if (type === "text") {
+    return typeof block.text === "string" ? void 0 : "a 'text' block requires a string 'text' field";
+  }
+  return describeImageUrlProblem(block.image_url);
+}
+function describeImageUrlProblem(imageUrl) {
+  const url = typeof imageUrl === "string" ? imageUrl : isRecord(imageUrl) ? imageUrl.url : void 0;
+  if (typeof url !== "string" || url === "") {
+    return "an 'image_url' block requires a non-empty 'image_url.url' string";
+  }
+  if (url.startsWith("data:")) {
+    const match = BASE64_DATA_URL_PATTERN.exec(url);
+    if (!match) {
+      return `malformed base64 data URL. Expected 'data:<mime-type>;base64,<base64>' with standard base64 (no whitespace or URL-safe characters)`;
+    }
+    const mimeType = match[1].toLowerCase();
+    if (!mimeType.startsWith("image/")) {
+      return `data URL MIME type '${mimeType}' is not an image. Only 'image/*' data URLs are forwarded, because providers reject or ignore other types on an 'image_url' block`;
+    }
+    if (!isDecodableBase64(match[2])) {
+      return `base64 payload is not decodable. Check the padding and length \u2014 the data must be a multiple of 4 characters with at most two trailing '='`;
+    }
+    return void 0;
+  }
+  let protocol;
+  try {
+    protocol = new URL(url).protocol;
+  } catch {
+    return `'${url}' is not a valid URL. Use an http(s) URL or a base64 data URL`;
+  }
+  if (protocol !== "http:" && protocol !== "https:") {
+    return `URL protocol '${protocol}' is not supported. Use an http(s) URL or a base64 data URL`;
+  }
+  return void 0;
+}
+function normalizeMessageContent(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((block) => {
+      if (typeof block === "string") return { type: "text", text: block };
+      const record = block;
+      if ((record == null ? void 0 : record.type) === "image_url" && typeof record.image_url === "string") {
+        return { ...record, image_url: { url: record.image_url } };
+      }
+      return record;
+    });
+  }
+  if (content === null || content === void 0) return "";
+  return JSON.stringify(content);
+}
 const GATEWAY_MANAGED_PARAMETERS = /* @__PURE__ */ new Set(["model", "messages", "tools", "tool_choice", "stream", "n"]);
 function getProviderRequestParameters(body) {
   return Object.fromEntries(
@@ -399,6 +537,9 @@ function serializeToolArguments(value) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   applyProviderRequestParameters,
+  findContentBlockProblem,
+  findMessageProblem,
   getProviderRequestParameters,
-  handleChatCompletions
+  handleChatCompletions,
+  normalizeMessageContent
 });

package/dist/server/routes/completions.js

@@ -34,6 +34,7 @@ var import_resolve_service = require("../utils/resolve-service");
 var import_streaming = require("../utils/streaming");
 var import_usage = require("../usage");
 var import_billing = require("../billing");
+var import_app_observability = require("../utils/app-observability");
 async function handleCompletions(ctx, plugin) {
   var _a;
   const body = ctx.request.body;
@@ -215,6 +216,7 @@ async function handleStreamingTextCompletion(ctx, chatModel, messages, completio
         text = (textPart == null ? void 0 : textPart.text) || "";
       }
       if (text) {
+        (0, import_app_observability.markAiApiFirstProviderOutput)(ctx);
         await (0, import_streaming.writeResponse)(
           ctx,
           (0, import_openai_format.formatSSE)({
@@ -261,6 +263,7 @@ async function handleStreamingTextCompletion(ctx, chatModel, messages, completio
     (0, import_usage.setAiApiUsageResult)(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
     ctx.state.aiApiStreamResult = { succeeded: true, id: completionId };
   } catch (err) {
+    const cancelled = (0, import_streaming.isClientDisconnected)(ctx, err);
     ctx.log.error("AI API completions streaming error:", err);
     if (!ctx.res.destroyed && !ctx.res.writableEnded) {
       await (0, import_streaming.writeResponse)(
@@ -274,7 +277,11 @@ async function handleStreamingTextCompletion(ctx, chatModel, messages, completio
       );
     }
     (0, import_usage.setAiApiUsageResult)(ctx, usage, { gatewayResponseId: completionId, providerRequestId });
-    ctx.state.aiApiStreamResult = { succeeded: false, id: completionId, errorCode: "stream_error" };
+    ctx.state.aiApiStreamResult = {
+      succeeded: false,
+      id: completionId,
+      errorCode: cancelled ? "client_disconnected" : "stream_error"
+    };
   } finally {
     requestAbort.dispose();
     if (!ctx.res.writableEnded && !ctx.res.destroyed) ctx.res.end();

package/dist/server/routes/models.js

@@ -26,6 +26,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var models_exports = {};
 __export(models_exports, {
+  buildModelObject: () => buildModelObject,
   handleGetModel: () => handleGetModel,
   handleListModels: () => handleListModels
 });
@@ -49,6 +50,7 @@ async function handleListModels(ctx, plugin) {
       filter,
       sort: "sort"
     });
+    const metadataMap = await loadModelMetadata(ctx);
     const now = Math.floor(Date.now() / 1e3);
     const models = [];
     for (const service of services) {
@@ -56,14 +58,10 @@ async function handleListModels(ctx, plugin) {
       const enabledModels = resolveEnabledModels(service);
       const serviceLabel = service.title || service.name;
       for (const model of enabledModels) {
-        models.push({
-          // Use "serviceName/modelId" format so the ID can be used directly in
-          // POST /v1/chat/completions without ambiguity in multi-service setups.
-          id: `${service.name}/${model.value}`,
-          object: "model",
-          created: now,
-          owned_by: serviceLabel
-        });
+        const fullId = `${service.name}/${model.value}`;
+        const meta = metadataMap.get(fullId);
+        if (meta && meta.enabled === false) continue;
+        models.push(buildModelObject(fullId, now, serviceLabel, meta));
       }
     }
     ctx.status = 200;
@@ -89,6 +87,7 @@ async function handleGetModel(ctx, modelId, plugin) {
       filter,
       sort: "sort"
     });
+    const metadataMap = await loadModelMetadata(ctx);
     const now = Math.floor(Date.now() / 1e3);
     let found = null;
     for (const service of services) {
@@ -98,12 +97,9 @@ async function handleGetModel(ctx, modelId, plugin) {
       for (const model of enabledModels) {
         const fullId = `${service.name}/${model.value}`;
         if (fullId === modelId || model.value === modelId) {
-          found = {
-            id: fullId,
-            object: "model",
-            created: now,
-            owned_by: serviceLabel
-          };
+          const meta = metadataMap.get(fullId);
+          if (meta && meta.enabled === false) continue;
+          found = buildModelObject(fullId, now, serviceLabel, meta);
           break;
         }
       }
@@ -122,6 +118,61 @@ async function handleGetModel(ctx, modelId, plugin) {
     ctx.body = (0, import_openai_format.toOpenAIError)(500, "Failed to retrieve model", "server_error");
   }
 }
+async function loadModelMetadata(ctx) {
+  var _a, _b;
+  const map = /* @__PURE__ */ new Map();
+  try {
+    const rows = await ctx.db.getRepository("aiApiModelMetadata").find();
+    for (const row of rows) {
+      const service = row.get("llmService");
+      const model = row.get("model");
+      if (!service || !model) continue;
+      map.set(`${service}/${model}`, {
+        contextWindow: row.get("contextWindow"),
+        maxCompletionTokens: row.get("maxCompletionTokens"),
+        ownedByOverride: row.get("ownedByOverride"),
+        displayName: row.get("displayName"),
+        description: row.get("description"),
+        enabled: row.get("enabled")
+      });
+    }
+  } catch (err) {
+    (_b = (_a = ctx.log) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(_a, "AI API model metadata unavailable, skipping overrides:", err);
+  }
+  return map;
+}
+function buildModelObject(fullId, created, serviceLabel, meta) {
+  const model = {
+    id: fullId,
+    object: "model",
+    created,
+    owned_by: (meta == null ? void 0 : meta.ownedByOverride) || serviceLabel
+  };
+  const contextWindow = toPositiveInt(meta == null ? void 0 : meta.contextWindow);
+  if (contextWindow !== null) {
+    model.context_window = contextWindow;
+    model.context_length = contextWindow;
+  }
+  const maxCompletionTokens = toPositiveInt(meta == null ? void 0 : meta.maxCompletionTokens);
+  if (maxCompletionTokens !== null) {
+    model.max_completion_tokens = maxCompletionTokens;
+  }
+  if (meta == null ? void 0 : meta.displayName) {
+    model.display_name = meta.displayName;
+    model.name = meta.displayName;
+  }
+  if (meta == null ? void 0 : meta.description) {
+    model.description = meta.description;
+  }
+  if (meta) {
+    model.active = meta.enabled !== false;
+  }
+  return model;
+}
+function toPositiveInt(value) {
+  const n = Number(value);
+  return Number.isSafeInteger(n) && n > 0 ? n : null;
+}
 async function getPluginConfig(ctx) {
   return ctx.db.getRepository("aiApiConfig").findOne();
 }
@@ -142,16 +193,23 @@ function resolveEnabledModels(service) {
   return getRecommendedModelsForProvider(service.provider);
 }
 function getRecommendedModelsForProvider(provider) {
-  try {
-    const { getRecommendedModels } = require("@nocobase/plugin-ai/src/common/recommended-models");
-    const models = getRecommendedModels(provider);
-    return Array.isArray(models) ? models : [];
-  } catch {
-    return [];
+  const modulePaths = [
+    "@nocobase/plugin-ai/dist/common/recommended-models",
+    "@nocobase/plugin-ai/src/common/recommended-models"
+  ];
+  for (const modulePath of modulePaths) {
+    try {
+      const { getRecommendedModels } = require(modulePath);
+      const models = getRecommendedModels(provider);
+      return Array.isArray(models) ? models : [];
+    } catch {
+    }
   }
+  return [];
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  buildModelObject,
   handleGetModel,
   handleListModels
 });

package/dist/server/routes/router.js

@@ -36,7 +36,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var router_exports = {};
 __export(router_exports, {
-  createAiLlmRouter: () => createAiLlmRouter
+  AI_LLM_PREFIX: () => AI_LLM_PREFIX,
+  MAX_REQUEST_BODY_MB_LIMIT: () => MAX_REQUEST_BODY_MB_LIMIT,
+  createAiLlmRouter: () => createAiLlmRouter,
+  getRawBody: () => getRawBody,
+  normalizeMaxRequestBodyMb: () => normalizeMaxRequestBodyMb
 });
 module.exports = __toCommonJS(router_exports);
 var import_crypto = __toESM(require("crypto"));
@@ -52,7 +56,9 @@ var import_role_permission = require("../middleware/role-permission");
 var import_usage = require("../usage");
 var import_streaming = require("../utils/streaming");
 var import_billing = require("../billing");
+var import_app_observability = require("../utils/app-observability");
 const API_PREFIX = "/api/ai-llm/v1";
+const AI_LLM_PREFIX = API_PREFIX;
 function createAiLlmRouter(plugin) {
   const checkRateLimit = (0, import_rate_limit.createRateLimitMiddleware)(plugin.rateLimiter);
   return async (ctx, next) => {
@@ -77,18 +83,6 @@ function createAiLlmRouter(plugin) {
     }
     const requestId = `req-${import_crypto.default.randomBytes(12).toString("hex")}`;
     ctx.set("X-Request-Id", requestId);
-    if (method === "POST" && !ctx.request.body) {
-      try {
-        const rawBody = await getRawBody(ctx);
-        ctx.request.body = JSON.parse(rawBody);
-      } catch (bodyErr) {
-        const status = bodyErr && typeof bodyErr === "object" && "statusCode" in bodyErr && bodyErr.statusCode === 413 ? 413 : 400;
-        const message = status === 413 ? "Request body too large (max 10 MB)" : "Invalid JSON in request body";
-        ctx.status = status;
-        ctx.body = (0, import_openai_format.toOpenAIError)(status, message, "invalid_request_error");
-        return;
-      }
-    }
     const isAuth = await (0, import_auth.authenticateBearer)(ctx);
     if (!isAuth) {
       logRequest(ctx, requestId, "-", "auth_failed", 0);
@@ -104,6 +98,29 @@ function createAiLlmRouter(plugin) {
       logRequest(ctx, requestId, "-", "rate_limited", 0);
       return;
     }
+    if (method === "POST" && !ctx.request.body) {
+      const maxBodyBytes = await resolveMaxBodyBytes(ctx);
+      const declaredLength = Number(ctx.get("Content-Length"));
+      if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+        respondBodyTooLarge(ctx, maxBodyBytes);
+        logRequest(ctx, requestId, "-", "body_too_large", 0);
+        return;
+      }
+      try {
+        const rawBody = await getRawBody(ctx, maxBodyBytes);
+        ctx.request.body = JSON.parse(rawBody);
+      } catch (bodyErr) {
+        const tooLarge = bodyErr && typeof bodyErr === "object" && "statusCode" in bodyErr && bodyErr.statusCode === 413;
+        if (tooLarge) {
+          respondBodyTooLarge(ctx, maxBodyBytes);
+          logRequest(ctx, requestId, "-", "body_too_large", 0);
+          return;
+        }
+        ctx.status = 400;
+        ctx.body = (0, import_openai_format.toOpenAIError)(400, "Invalid JSON in request body", "invalid_request_error");
+        return;
+      }
+    }
     const requestBody = ctx.request.body || {};
     const model = requestBody.model === void 0 || requestBody.model === null ? "-" : String(requestBody.model);
     const isUsageEndpoint = method === "POST" && (subPath === "/chat/completions" || subPath === "/completions" || subPath === "/embeddings");
@@ -121,6 +138,16 @@ function createAiLlmRouter(plugin) {
       };
     }
     const t0 = Date.now();
+    if (isUsageEndpoint) {
+      const service = subPath === "/embeddings" ? "llm.embedding" : resolvedMode === "agent" ? "llm.agent" : subPath === "/completions" ? "llm.completion" : "llm.chat";
+      (0, import_app_observability.startAiApiObservation)(ctx, {
+        service,
+        operation: subPath,
+        streaming,
+        model: model === "-" ? void 0 : model,
+        mode: resolvedMode
+      });
+    }
     let usageId;
     try {
       usageId = isUsageEndpoint ? await (0, import_usage.startUsageRecord)(ctx, requestId, subPath, model, streaming, resolvedMode) : void 0;
@@ -225,24 +252,65 @@ function createAiLlmRouter(plugin) {
           ctx.log.error("AI API quota reservation could not be finalized:", billingError);
         }
       }
+      if (isUsageEndpoint) {
+        const streamResult = ctx.state.aiApiStreamResult;
+        (0, import_app_observability.finishAiApiObservation)(ctx, {
+          status: (streamResult == null ? void 0 : streamResult.errorCode) === "client_disconnected" ? "cancelled" : streamResult ? streamResult.succeeded ? "succeeded" : "failed" : ctx.status >= 200 && ctx.status < 400 ? "succeeded" : ctx.status >= 500 ? "failed" : "rejected",
+          errorCode: streamResult == null ? void 0 : streamResult.errorCode
+        });
+      }
     }
   };
 }
-const MAX_BODY_BYTES = 10 * 1024 * 1024;
-function getRawBody(ctx) {
+const DEFAULT_MAX_BODY_MB = 10;
+const MAX_REQUEST_BODY_MB_LIMIT = 100;
+function normalizeMaxRequestBodyMb(value) {
+  const mb = Number(value);
+  if (!Number.isSafeInteger(mb) || mb <= 0) return DEFAULT_MAX_BODY_MB;
+  return Math.min(mb, MAX_REQUEST_BODY_MB_LIMIT);
+}
+async function resolveMaxBodyBytes(ctx) {
+  var _a, _b;
+  let configuredMb;
+  try {
+    const config = await ctx.db.getRepository("aiApiConfig").findOne();
+    configuredMb = config == null ? void 0 : config.get("maxRequestBodyMb");
+  } catch (err) {
+    (_b = (_a = ctx.log) == null ? void 0 : _a.warn) == null ? void 0 : _b.call(_a, "AI API: could not read maxRequestBodyMb, using default:", err);
+  }
+  return normalizeMaxRequestBodyMb(configuredMb) * 1024 * 1024;
+}
+function formatMb(bytes) {
+  return `${Math.round(bytes / (1024 * 1024))} MB`;
+}
+function respondBodyTooLarge(ctx, maxBodyBytes) {
+  ctx.status = 413;
+  ctx.body = (0, import_openai_format.toOpenAIError)(
+    413,
+    `Request body too large (max ${formatMb(maxBodyBytes)}). Inline base64 images inflate payloads by ~33%; raise "Max request body size" in Settings \u2192 AI API Gateway if needed.`,
+    "invalid_request_error"
+  );
+}
+function getRawBody(ctx, maxBodyBytes) {
   return new Promise((resolve, reject) => {
-    let body = "";
+    const chunks = [];
     let byteCount = 0;
+    let aborted = false;
     ctx.req.on("data", (chunk) => {
+      if (aborted) return;
       byteCount += chunk.length;
-      if (byteCount > MAX_BODY_BYTES) {
-        ctx.req.destroy();
-        reject(Object.assign(new Error("Request body too large (max 10 MB)"), { statusCode: 413 }));
+      if (byteCount > maxBodyBytes) {
+        aborted = true;
+        chunks.length = 0;
+        ctx.req.resume();
+        reject(Object.assign(new Error(`Request body too large (max ${formatMb(maxBodyBytes)})`), { statusCode: 413 }));
         return;
       }
-      body += chunk.toString();
+      chunks.push(chunk);
+    });
+    ctx.req.on("end", () => {
+      if (!aborted) resolve(Buffer.concat(chunks).toString("utf8"));
     });
-    ctx.req.on("end", () => resolve(body));
     ctx.req.on("error", reject);
   });
 }
@@ -277,5 +345,9 @@ function logRequest(ctx, requestId, model, status, durationMs) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createAiLlmRouter
+  AI_LLM_PREFIX,
+  MAX_REQUEST_BODY_MB_LIMIT,
+  createAiLlmRouter,
+  getRawBody,
+  normalizeMaxRequestBodyMb
 });

package/dist/server/usage.js

@@ -35,6 +35,7 @@ __export(usage_exports, {
 });
 module.exports = __toCommonJS(usage_exports);
 var import_billing = require("./billing");
+var import_app_observability = require("./utils/app-observability");
 function getAiApiState(ctx) {
   return ctx.state;
 }
@@ -60,6 +61,7 @@ function normalizeUsage(value) {
 function setAiApiUsageResult(ctx, value, metadata = {}) {
   const usage = normalizeUsage(value);
   getAiApiState(ctx).aiApiUsageResult = usage ? { source: "provider", usage, ...metadata } : { source: "unavailable", ...metadata };
+  (0, import_app_observability.addAiApiUsage)(ctx, usage);
   return usage;
 }
 function setAiApiUsageUnavailable(ctx, gatewayResponseId) {