iatoolkit 2.40.0__tar.gz → 2.41.0__tar.gz

{iatoolkit-2.40.0/src/iatoolkit.egg-info → iatoolkit-2.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.40.0
+Version: 2.41.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.40.0"
+__version__ = "2.41.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/common/model_registry.py

@@ -26,6 +26,26 @@ class ModelMetadata:
     history_type: HistoryType
 
 
+#: Providers a model can actually be served by: the ones `LLMProxy._build_adapter`
+#: knows how to build. Deliberately narrower than `ProviderType`, which also
+#: contains `xai` — `normalize_provider` accepts it and a client is built for it,
+#: but there is no xAI adapter, so a model declared `xai` raises "Provider not
+#: supported" on its first request. A test pins this tuple to the adapters that
+#: exist so the two cannot drift.
+#:
+#: Anything that lets a person choose a provider must offer exactly these: the
+#: value reaches `_build_adapter` verbatim, so a typo becomes a runtime failure in
+#: front of an end user, hours after it was saved.
+SERVABLE_PROVIDERS: tuple[str, ...] = (
+    "openai",
+    "anthropic",
+    "gemini",
+    "deepseek",
+    "openrouter",
+    "openai_compatible",
+)
+
+
 @singleton
 class ModelRegistry:
     """

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/common/routes.py

@@ -253,9 +253,11 @@ def register_views(app):
 
     # company configuration
     configuration_view = ConfigurationApiView.as_view('configuration')
+    # No POST: adding an arbitrary new key had no caller in any frontend, and
+    # the write path is deliberately narrow — see TENANT_WRITABLE_CONFIG_KEYS.
     app.add_url_rule('/<company_short_name>/api/configuration',
                      view_func=configuration_view,
-                     methods=['GET', 'POST', 'PATCH'],)
+                     methods=['GET', 'PATCH'],)
 
     # explicit runtime reload endpoint used by admin/dashboard integrations
     app.add_url_rule('/<company_short_name>/api/load_configuration',

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/infra/llm_proxy.py

@@ -118,6 +118,7 @@ class LLMProxy:
             provider=provider,
             company_short_name=company_short_name,
             telemetry_request=telemetry_request,
+            model_config=model_config,
         )
 
         request_kwargs = self._apply_provider_request_overrides(
@@ -202,12 +203,20 @@ class LLMProxy:
         provider: str,
         company_short_name: str,
         telemetry_request: Dict[str, Any] | None = None,
+        model_config: Dict[str, Any] | None = None,
     ) -> Any:
         """
         Return an adapter instance for the given provider.
         If none exists yet, create it using a cached or new low-level client.
+
+        ``model_config`` is threaded through because whose key pays is decided
+        per model, not per provider: a company can resell one model through the
+        platform and fund another with a key of its own, and both may be served
+        by the same provider. The client cache is keyed by the resolved api key,
+        so two models of one provider on different keys get different clients
+        instead of sharing the first one created.
         """
-        client_config = self._get_client_config(company_short_name, provider)
+        client_config = self._get_client_config(company_short_name, provider, model_config=model_config)
         api_key = client_config["api_key"]
         base_url = client_config.get("base_url") or ""
         default_headers = client_config.get("default_headers") or {}
@@ -569,12 +578,19 @@ class LLMProxy:
             f"Provider not supported in _create_client_for_provider: {provider}"
         )
 
-    def _get_client_config(self, company_short_name: str, provider: str) -> dict:
+    def _get_client_config(
+        self,
+        company_short_name: str,
+        provider: str,
+        model_config: Dict[str, Any] | None = None,
+    ) -> dict:
         provider_config = self.configuration_service.get_llm_provider_config(company_short_name, provider) or {}
+        secret_ref = self._model_credential_ref(model_config)
         provider_api_key = self._get_api_key_from_config(
             company_short_name,
             provider,
             required=False,
+            secret_ref=secret_ref,
         )
         gateway_transport = self.gateway_resolver.resolve(
             company_short_name=company_short_name,
@@ -595,6 +611,7 @@ class LLMProxy:
                 company_short_name,
                 provider,
                 required=True,
+                secret_ref=secret_ref,
             )
         configured_base_url = self._get_base_url_from_config(company_short_name, provider)
         configured_headers = self._get_default_headers_from_config(company_short_name, provider)
@@ -709,7 +726,34 @@ class LLMProxy:
     # -------------------------------------------------------------------------
     # Configuration helpers
     # -------------------------------------------------------------------------
-    def _get_api_key_from_config(self, company_short_name: str, provider: str, *, required: bool = True) -> str:
+    @staticmethod
+    def _model_credential_ref(model_config: Dict[str, Any] | None) -> str | None:
+        """The secret this model is entitled to run on, when the company owns it.
+
+        `credential_owner` and `secret_key_name` come from the company's
+        catalogue entitlement, and until now nothing on the request path read
+        them: the key was resolved only from `llm.provider_api_keys`, by name. So
+        a model the catalogue said the platform pays for could still run on a
+        customer's key — whenever the customer had stored a secret under the same
+        name as the platform's variable — and be invoiced as platform-served.
+
+        Only `company` ownership overrides. `platform` deliberately falls through
+        to the deployment's mapping, which is what "we pay for this" means.
+        """
+        if not isinstance(model_config, dict):
+            return None
+        if str(model_config.get("credential_owner") or "").strip().lower() != "company":
+            return None
+        return str(model_config.get("secret_key_name") or "").strip() or None
+
+    def _get_api_key_from_config(
+        self,
+        company_short_name: str,
+        provider: str,
+        *,
+        required: bool = True,
+        secret_ref: str | None = None,
+    ) -> str:
         """
         Read the LLM API key from company configuration and environment variables.
 
@@ -730,8 +774,17 @@ class LLMProxy:
         provider_keys = llm_config.get("provider_api_keys") or {}
         env_var_name = None
 
+        # 0) El secreto de la habilitación del modelo, cuando la empresa trae su
+        #    propia key. Gana sobre el mapeo del archivo porque es la decisión
+        #    explícita y por modelo; el mapeo es del deployment y por proveedor.
+        # 0) El secreto de la habilitación del modelo, cuando la empresa trae su
+        #    propia key. Gana sobre el mapeo del archivo porque es la decisión
+        #    explícita y por modelo; el mapeo es del deployment y por proveedor.
+        if secret_ref:
+            env_var_name = secret_ref
+
         # 1) Intentar api-key específica por proveedor (si existe el bloque provider_api_keys)
-        if provider_keys and isinstance(provider_keys, dict):
+        if not env_var_name and provider_keys and isinstance(provider_keys, dict):
             env_var_name = provider_keys.get(provider)
 
         # 2) Fallback: usar api-key global si no hay específica

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/locales/en.yaml

@@ -2138,6 +2138,57 @@ ui:
     obs_identity: "Identity"
     obs_outcome: "Outcome"
     obs_latency: "Latency"
+  models:
+    form_provider_hint: "A model you run yourself — locally, a self-hosted endpoint, your own gateway — is openai_compatible."
+    form_model_key: "Model key"
+    form_model_key_hint: "Exactly as the provider expects it."
+    form_provider: "Provider"
+    form_display_name: "Name people see here"
+    empty_state_self_serve: "No models yet. Add the first one to make it available here."
+    action_add: "Add model"
+    action_remove: "Remove"
+    confirm_remove: "Remove {model_key} from this workspace? People here stop being able to pick it."
+    add_title: "Add a model"
+    add_hint: "The key has to match exactly what the provider expects. This install invoices nobody, so there is no price to set."
+    add_success: "Model added and available."
+    remove_success: "Model removed."
+    key_required: "The model key is required."
+    title: "Models"
+    subtitle: "Choose which AI models this workspace can use, and whose API key pays for them."
+    empty_state: "No models are available yet. Your IAToolkit contact publishes them."
+    col_model: "Model"
+    col_cost: "Cost"
+    col_key: "API key"
+    col_enabled: "Enabled"
+    cost_metered: "Metered"
+    cost_not_billable: "No charge"
+    cost_own_key: "Billed by your provider"
+    key_platform: "Included"
+    label_default: "Default"
+    label_enabled: "Enabled"
+    label_disabled: "Not enabled"
+    action_configure: "Configure"
+    action_enable: "Enable"
+    modal_title: "Model settings"
+    form_enabled: "Available in this workspace"
+    form_enabled_hint: "People here can pick this model when they start a conversation."
+    form_is_default: "Use as the default model"
+    form_credential_owner: "Which API key runs it"
+    form_owner_platform: "The key included with IAToolkit"
+    form_owner_platform_hint: "Usage is measured and appears on your invoice."
+    form_owner_company: "One of your own keys"
+    form_owner_company_hint: "Your provider bills you directly, so this usage never reaches your IAToolkit invoice."
+    form_secret_key_name: "Stored key to use"
+    form_secret_hint: "Keys are added and rotated under Administration → Secrets, where they stay encrypted. This screen only points at one by name."
+    not_billable_note: "This model costs nothing to run, so it never appears on an invoice whichever key it uses."
+    secret_required: "Choose the stored key this model should use."
+    load_error: "Could not load the models."
+    save_error: "Could not save the model."
+    save_success: "Model updated."
+    reasoning_applies_to: "Applies to {model}"
+    form_secret_value: "Your provider key"
+    secret_hint_new: "Stored encrypted for this provider. Your provider bills you directly."
+    secret_hint_stored: "A key is already stored for this provider. Paste one to replace it."
   secrets:
     title: "Secrets"
     subtitle: "Manage company secrets used by integrations and services."
@@ -2195,10 +2246,6 @@ ui:
     company_name: "Company name"
     short_name: "Short name"
     runtime_mode: "Runtime mode"
-    model_card_title: "Default AI Model"
-    model_card_desc: "Choose the default model used across the company configuration."
-    default_model: "Default model"
-    model_card_helper: "This model will be used as the default runtime selection."
     default_reasoning: "Default reasoning"
     default_reasoning_auto: "Automatic"
     reasoning_card_helper: "Applies when the selected model and provider support this reasoning level. Prompts can still override it."
@@ -2213,7 +2260,6 @@ ui:
     reasoning_effort_high: "High"
     reasoning_effort_xhigh: "Very high"
     branding_card_title: "Branding"
-    branding_card_desc: "Adjust the main colors used by the company experience."
     primary_color: "Primary color"
     secondary_color: "Secondary color"
     preview: "Preview"
@@ -2236,6 +2282,7 @@ ui:
     chat_context_preview_subtitle: "Logical view of the active conversational context for this user."
     chat_context_preview_block_label: "Sent Context"
 
+    runtime_defaults_card_title: "Runtime defaults"
   rag:
     ingestion: "Ingestion"
     ingestion_description: "Ingest documents into the knowledge base."

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/locales/es.yaml

@@ -2144,6 +2144,57 @@ ui:
     obs_identity: "Identidad"
     obs_outcome: "Resultado"
     obs_latency: "Latencia"
+  models:
+    form_provider_hint: "Un modelo que corres vos —local, un endpoint propio, tu gateway— es openai_compatible."
+    form_model_key: "Clave del modelo"
+    form_model_key_hint: "Exactamente como la espera el proveedor."
+    form_provider: "Proveedor"
+    form_display_name: "Nombre que ven las personas de acá"
+    empty_state_self_serve: "Todavía no hay modelos. Agrega el primero para que quede disponible acá."
+    action_add: "Agregar modelo"
+    action_remove: "Quitar"
+    confirm_remove: "¿Quitar {model_key} de este espacio de trabajo? Las personas de acá dejan de poder elegirlo."
+    add_title: "Agregar un modelo"
+    add_hint: "La clave tiene que coincidir exactamente con lo que espera el proveedor. Esta instalación no factura a nadie, así que no hay precio que definir."
+    add_success: "Modelo agregado y disponible."
+    remove_success: "Modelo quitado."
+    key_required: "La clave del modelo es obligatoria."
+    title: "Modelos"
+    subtitle: "Elige qué modelos de IA puede usar este espacio de trabajo, y con qué API key se pagan."
+    empty_state: "Todavía no hay modelos disponibles. Tu contacto en IAToolkit los publica."
+    col_model: "Modelo"
+    col_cost: "Costo"
+    col_key: "API key"
+    col_enabled: "Habilitado"
+    cost_metered: "Con medición"
+    cost_not_billable: "Sin costo"
+    cost_own_key: "Lo factura tu proveedor"
+    key_platform: "Incluida"
+    label_default: "Por defecto"
+    label_enabled: "Habilitado"
+    label_disabled: "No habilitado"
+    action_configure: "Configurar"
+    action_enable: "Habilitar"
+    modal_title: "Configuración del modelo"
+    form_enabled: "Disponible en este espacio de trabajo"
+    form_enabled_hint: "Las personas de aquí podrán elegir este modelo al iniciar una conversación."
+    form_is_default: "Usar como modelo por defecto"
+    form_credential_owner: "Con qué API key funciona"
+    form_owner_platform: "La key incluida con IAToolkit"
+    form_owner_platform_hint: "El consumo se mide y aparece en tu factura."
+    form_owner_company: "Una key propia"
+    form_owner_company_hint: "Tu proveedor te factura directo, así que este consumo nunca llega a tu factura de IAToolkit."
+    form_secret_key_name: "Key almacenada a usar"
+    form_secret_hint: "Las keys se agregan y rotan en Administración → Secretos, donde quedan encriptadas. Esta pantalla solo apunta a una por su nombre."
+    not_billable_note: "Este modelo no tiene costo de ejecución, así que no aparece en ninguna factura sin importar con qué key funcione."
+    secret_required: "Elige la key almacenada que debe usar este modelo."
+    load_error: "No se pudieron cargar los modelos."
+    save_error: "No se pudo guardar el modelo."
+    save_success: "Modelo actualizado."
+    reasoning_applies_to: "Aplica a {model}"
+    form_secret_value: "Tu key del proveedor"
+    secret_hint_new: "Se guarda cifrada para este proveedor. Tu proveedor te factura directamente."
+    secret_hint_stored: "Ya hay una key guardada para este proveedor. Pegá otra para reemplazarla."
   secrets:
     title: "Secrets"
     subtitle: "Administra los secrets de la empresa usados por integraciones y servicios."
@@ -2201,10 +2252,6 @@ ui:
     company_name: "Nombre de la empresa"
     short_name: "Nombre corto"
     runtime_mode: "Modo runtime"
-    model_card_title: "Modelo AI por defecto"
-    model_card_desc: "Elige el modelo por defecto usado en la configuración de la empresa."
-    default_model: "Modelo por defecto"
-    model_card_helper: "Este modelo se usará como selección por defecto en runtime."
     default_reasoning: "Razonamiento por defecto"
     default_reasoning_auto: "Automático"
     reasoning_card_helper: "Se aplica cuando el modelo y el provider seleccionados soportan este nivel de razonamiento. Los prompts igual pueden sobreescribirlo."
@@ -2219,7 +2266,6 @@ ui:
     reasoning_effort_high: "Alto"
     reasoning_effort_xhigh: "Muy alto"
     branding_card_title: "Branding"
-    branding_card_desc: "Ajusta los colores principales usados por la experiencia de la empresa."
     primary_color: "Color primario"
     secondary_color: "Color secundario"
     preview: "Vista previa"
@@ -2242,6 +2288,7 @@ ui:
     chat_context_preview_subtitle: "Vista lógica del contexto conversacional activo para este usuario."
     chat_context_preview_block_label: "Contexto Enviado"
 
+    runtime_defaults_card_title: "Valores por defecto en runtime"
   rag:
     ingestion: "Ingesta"
     ingestion_description: "Ingestar documentos en la base de conocimiento."

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/repositories/database_manager.py

@@ -208,7 +208,40 @@ class DatabaseManager(DatabaseProvider):
         """
         Esta función se ejecuta cada vez que se establece una conexión.
         dbapi_connection es la conexión psycopg2 real.
+
+        On a database that does not have the pgvector extension yet, this is
+        where a brand-new installation dies: ``register_vector`` raises "vector
+        type not found in the database" on the very first connection, before
+        ``create_all`` has run and long before any CLI command can help. So the
+        extension is created here, once, and only after the lookup has already
+        failed — a database that has it pays nothing.
+
+        ``CREATE EXTENSION`` needs a privileged role. When the connecting role
+        does not have it, the original error is raised with the statement to run
+        by hand, because there is nothing this process can do about it.
         """
+        try:
+            register_vector(dbapi_connection)
+            return
+        except Exception as exc:
+            logging.info("pgvector is not registered yet on this database: %s", exc)
+
+        try:
+            # The failed lookup left a transaction open, and psycopg2 refuses to
+            # switch autocommit inside one — so end it and commit explicitly
+            # instead of touching the connection's mode.
+            dbapi_connection.rollback()
+            with dbapi_connection.cursor() as cursor:
+                cursor.execute("CREATE EXTENSION IF NOT EXISTS vector")
+            dbapi_connection.commit()
+            logging.info("Created the pgvector extension on this database.")
+        except Exception as exc:
+            raise RuntimeError(
+                "This database does not have the pgvector extension and the "
+                f"connecting role could not create it ({exc}). Run this once as "
+                "a privileged role: CREATE EXTENSION IF NOT EXISTS vector;"
+            ) from exc
+
         register_vector(dbapi_connection)
 
     def get_session(self):

{iatoolkit-2.40.0 → iatoolkit-2.41.0}/src/iatoolkit/repositories/knowledge_wiki_repo.py

@@ -149,6 +149,7 @@ class KnowledgeWikiRepo:
         body_text: str | None = None,
         status: KnowledgeWikiPageStatus = KnowledgeWikiPageStatus.PUBLISHED,
         tags: list[str] | None = None,
+        access_tags: list[str] | None = None,
         owner: str | None = None,
         source_meta: dict | None = None,
         last_synced_at: datetime | None = None,
@@ -166,6 +167,11 @@ class KnowledgeWikiRepo:
             page.source_storage_key = source_storage_key
             page.status = status
             page.tags = tags or []
+            # None means "leave the stored labels alone": a wiki with no access
+            # manifest must not lose its labels because a page's markdown changed.
+            # An empty list is a real value and does clear them.
+            if access_tags is not None:
+                page.access_tags = list(access_tags)
             page.owner = owner
             page.source_meta = source_meta or {}
             page.last_synced_at = last_synced_at
@@ -181,6 +187,7 @@ class KnowledgeWikiRepo:
                 source_storage_key=source_storage_key,
                 status=status,
                 tags=tags or [],
+                access_tags=list(access_tags or []),
                 owner=owner,
                 source_meta=source_meta or {},
                 last_synced_at=last_synced_at,