Files
accounted/lib/ai/rasterize-pdf.ts
T
Jakob Wennberg c7a75d069d feat(ai): job-shaped AI service with OpenAI-compatible backend, extraction-first; stop extracting every inbox document twice (#1740)
* feat(ai): job-shaped AI service with OpenAI-compatible backend, extraction-first; stop extracting every inbox document twice

Sovereign plan WS1 PR1 (#1406 Tier 2, extraction-first, aligned with the
AI surface audit).

lib/ai grows a job-shaped service (generateText / generateStructured /
extractFromDocument; no streaming members yet, see plan rule R3):
- services/anthropic-family delegates to the existing createAiClient()
  and sends the exact request literals the inbox extractor sent before
  (request-shape tests deep-equal them), so hosted Bedrock stays
  byte-identical.
- services/openai-compatible talks to any chat-completions endpoint
  (BYO Swedish provider) via Vercel AI SDK 6.x, exact-pinned and
  guarded: images as parts, PDFs rasterized with poppler (AI_PDF_MODE)
  or sent natively, AI_VISION / AI_STRICT_JSON declared, honest skips
  (ai_no_vision, pdf_rasterizer_missing) instead of fake failures.
- config.ts: AI_PROVIDER/AI_BASE_URL/AI_API_KEY/AI_MODEL and per-tier
  AI_*_MODEL with the legacy BEDROCK_* names kept as the same overrides;
  getAiStatus() is the single source of truth for "is AI wired up".
- provider.ts: openai-compatible in the auto-detect chain (after Bedrock
  and the direct API); createAiClient() refuses it loudly.

Document extraction moves onto the service and gets the audit's fixes:
- Inbox documents were extracted TWICE (pipeline A ran inside
  uploadDocument() before the inbox row existed, so its dedupe branch
  never fired; 3 707 + 1 666 calls / 30 d). The inbox now declares
  extractionOwner on the upload, the extension yields, and the inbox
  mirrors its single outcome onto document_attachments from every
  writer (sync, deferred, attach, retry, MCP).
- Every "no extraction will ever happen" outcome is stamped
  (skipped:no_ai_entitlement / ai_unconfigured / system_generated /
  ...); the status route maps the quiet ones to 'disabled' on the first
  poll instead of a 30 s client timeout. Prod showed 309 of the 327
  never-extracted uploads were the paywall working silently.
- Self-generated documents (our own invoice PDFs, payout files) are no
  longer OCR'd.
- Agent invoke answers 503 ai_unconfigured when the deployment has no
  assistant backend, distinct from the paywall.

Guard: new direct-ai-client antipattern check (shrink-only allowlist of
the pre-abstraction SDK callers) plus exact pins for @anthropic-ai/sdk,
ai and @ai-sdk/openai-compatible.

Verified: 15 958 unit tests green, guards, lint ratchet, typecheck, and a
live smoke against hosted Bedrock through the new service (ping, streamed
tool turn, thinking+cache, PDF extraction).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(ai): make AI_API_KEY optional for OpenAI-compatible endpoints (keyless local model servers)

A local model server (llama.cpp's server, Ollama /v1, LM Studio, vLLM)
usually has no auth. Before, the OpenAI-compatible backend required both
AI_BASE_URL and AI_API_KEY to count as configured, so running Accounted on a
local model meant setting a meaningless placeholder key.

- resolveAiProvider / hasAiCredentials: a base URL alone is now enough.
- services/openai-compatible: only send Authorization: Bearer when AI_API_KEY
  is set, so a keyless server is never handed an empty bearer; a hosted
  provider that needs a key still sets it.
- Docs (SELF-HOSTING Option 3: local-model example, key marked optional),
  DECISIONS.

Verified: with no AI_API_KEY, just AI_BASE_URL + AI_MODEL, getAiStatus()
reports configured=true / provider=openai-compatible (live). lib/ai suite
71 green; tsc, guards, lint clean. Bedrock/Anthropic logic unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-20 19:39:08 +02:00

89 lines
3.4 KiB
TypeScript

import { execFile } from 'node:child_process'
import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
import { tmpdir } from 'node:os'
import { join } from 'node:path'
import { promisify } from 'node:util'
const execFileAsync = promisify(execFile)
/**
* PDF -> page images for backends that cannot read PDF bytes natively (most
* OpenAI-compatible endpoints: the OpenAI `file` content part is not part of
* the de-facto chat-completions standard the Swedish providers implement).
*
* Uses poppler's `pdftoppm`, a system binary the self-host Docker image
* installs (hosted runs Claude on Bedrock, which reads PDFs natively and
* never needs this). A missing binary is a configuration state, not a crash:
* callers stamp `skipped:pdf_rasterizer_missing` and move on.
*
* Rejected alternatives: pdfjs-dist + @napi-rs/canvas (two new npm
* dependencies, memory spikes on large scans, dead weight on hosted).
*/
export type RasterizePdfResult =
| { ok: true; pages: Buffer[]; mediaType: 'image/png'; pageCount: number }
| { ok: false; reason: 'rasterizer_missing' | 'failed'; error?: string }
export interface RasterizePdfOptions {
/** Pages rendered from the start of the document; invoice data sits on the first page(s). */
maxPages: number
/** Render resolution. 110 dpi keeps an A4 page under 1000x1300 px: readable, cheap in tokens. */
dpi?: number
/** Binary name or path; overridable for tests and unusual installs. */
binary?: string
timeoutMs?: number
}
const DEFAULT_DPI = 110
const DEFAULT_TIMEOUT_MS = 60_000
function pageNumberOf(fileName: string): number {
// pdftoppm names pages <prefix>-1.png, <prefix>-01.png, <prefix>-001.png
// depending on the page count's digit width. Sort by the numeric suffix.
const match = /-(\d+)\.png$/.exec(fileName)
return match ? Number(match[1]) : Number.MAX_SAFE_INTEGER
}
export async function rasterizePdf(
pdf: Buffer,
opts: RasterizePdfOptions
): Promise<RasterizePdfResult> {
const binary = opts.binary ?? process.env.AI_PDF_RASTERIZER_BIN ?? 'pdftoppm'
const dpi = opts.dpi ?? DEFAULT_DPI
const maxPages = Math.max(1, Math.floor(opts.maxPages))
let dir: string | null = null
try {
dir = await mkdtemp(join(tmpdir(), 'accounted-pdf-'))
const input = join(dir, 'input.pdf')
const prefix = join(dir, 'page')
await writeFile(input, pdf)
await execFileAsync(
binary,
['-r', String(dpi), '-png', '-f', '1', '-l', String(maxPages), input, prefix],
{ timeout: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS, maxBuffer: 1024 * 1024 }
)
const names = (await readdir(dir))
.filter((n) => n.startsWith('page-') && n.endsWith('.png'))
.sort((a, b) => pageNumberOf(a) - pageNumberOf(b))
if (names.length === 0) {
return { ok: false, reason: 'failed', error: 'pdftoppm produced no pages' }
}
const pages: Buffer[] = []
for (const name of names) pages.push(await readFile(join(dir, name)))
return { ok: true, pages, mediaType: 'image/png', pageCount: pages.length }
} catch (err) {
const code = (err as { code?: string } | null)?.code
if (code === 'ENOENT') return { ok: false, reason: 'rasterizer_missing' }
return {
ok: false,
reason: 'failed',
error: err instanceof Error ? err.message : String(err),
}
} finally {
if (dir) await rm(dir, { recursive: true, force: true }).catch(() => undefined)
}
}