## Problem/Motivation The provider was built against AI 1.1. It implemented chat, streaming, embeddings and moderation itself, on top of `AiProviderClientBase`. Since then: - **AI core has a shared base class.** AI 1.2+ ships `OpenAiBasedProviderClientBase` for OpenAI-compatible APIs, and the OpenAI, LiteLLM, Ollama and Azure providers use it. AI's own `create-ai-provider` guidelines require it for OpenAI-compatible services such as STACKIT. Our own copy misses what the base class gives: token usage, rate limit info, fiber support, batched embeddings (`EmbeddingsCollectionInterface`), and `include_usage` for streaming. - **STACKIT changed its model catalogue.** - The default chat model `neuralmagic/Meta-Llama-3.1-8B-Instruct-FP8` was retired on 2026-06-04. - `google/gemma-3-27b-it` passed its migration deadline on 2026-10-14. - E5 accepts 4096 input tokens, not 8191. - **STACKIT has no moderation endpoint.** `POST /v1/moderations` returns 404. With moderation enabled (the default), every chat and embeddings call made an extra request that always failed and logged a warning. - **Requests bypassed the configured settings.** - Streaming and embeddings created their own Guzzle client, so the configured endpoint and timeout were ignored. Streaming always used the default endpoint. - The `timeout` setting was never used at all. - **Hardening was needed.** - The endpoint field accepted any URL, including `http://`, which would send the bearer token in plain text. - The connection test rendered API response bodies as raw `#markup`. - Prompts and full API responses were written to the log. - **Some code did not belong in a provider.** - `hook_module_implements_alter()`, which Drupal 12 removes. - An empty `hook_ai_operationtype_alter()` and an empty CKEditor config subscriber. - A `hook_editor_js_settings_alter()` that rewrote ai_ckeditor's settings. ## Proposed resolution Rebuild the provider on `OpenAiBasedProviderClientBase` and keep only what is specific to STACKIT. **Provider (`StackITProvider`)** - Extend `OpenAiBasedProviderClientBase`. Supported operation types are `chat` and `embeddings`. Chat covers streaming, tool calling, structured output (JSON schema) and vision. - **Model discovery** comes from `/v1/models`, cached for one hour. The cache is invalidated when the settings are saved, and failures are cached for two minutes. - STACKIT's `/models` returns IDs only, so models are classified by ID: embedding models versus chat models, and vision models. - Only the capabilities STACKIT models actually have are reported. - **Error mapping:** | Response | Exception | |---|---| | 401/403 | `AiSetupFailureException` (expired token) | | 400/413/422 | `AiBadRequestException` | | 402 | `AiQuotaException` | | 404, 5xx, connection errors | `AiResponseErrorException` | | 429 | `AiRateLimitException` | - **Model limits** (context, output, embedding dimensions) come from STACKIT's list of shared models. - **New default models:** - `google/gemma-4-31B-it` for chat and vision. - `cortecs/Llama-3.3-70B-Instruct-FP8-Dynamic` for tools. - `openai/gpt-oss-120b` for structured output. - `intfloat/e5-mistral-7b-instruct` for embeddings. - **HTTPS only:** the token is never sent to a non-HTTPS endpoint, even from imported configuration. **Settings form** - `#config_target` for the key and the endpoint. - **Endpoint:** only absolute HTTPS URLs are accepted. - **Saving:** the token is checked against the API, and the recommended models are set only for operation types without a default and only when the token can use them. - **Test connection:** results are rendered as escaped render arrays. - **Models table removed:** the AI module's models table is not used. Its links break on model IDs that contain a slash, which all STACKIT IDs do; see the AI issue about the `ai.edit_model_settings_form` route. **Clean-up** - Remove the moderation operation type and the `moderation` and `timeout` settings. The request timeout is set in the AI settings. `ai_provider_stackit_update_10001()` removes these keys and resets a non-HTTPS endpoint to the default. - Remove `StackITStreamedChatMessageIterator`, `CKEditorConfigSubscriber`, the unused HTTP client service and the hooks mentioned above. `hook_help()` stays, as an OOP hook with a `#[LegacyHook]` wrapper. **Requirements** - `drupal/ai ^1.4` (for `handleApiThrowable()`), tested with 1.5.1. - `openai-php/client >=0.16` (exceptions expose the HTTP response). - Core `^10.5 || ^11.2 || ^12`, matching what AI 1.4+ supports. **Quality** - Kernel tests with a mocked HTTP stack: discovery, filtering, caching, endpoint, chat payload, error mapping, rendering the settings form. - Functional tests: access and HTTPS validation. - `phpstan.neon` at level 6, cspell project words, and a README following the drupal.org template. ## Steps to test 1. Install on Drupal 11.4 with AI 1.5.1 and Key, and create a key with a STACKIT AI Model Serving token. 2. At `/admin/config/ai/providers/stackit`, select the key and click "Test connection". The models the token can use are listed. Save. 3. In the AI API Explorer, check: - chat, with and without streaming; - a tool call; - structured output; - an image prompt with a vision model; - embeddings. 4. Select an expired token. Saving is refused with "STACKIT rejected the auth token". 5. Enter `http://example.com/v1` as the endpoint. It is refused. 6. Update an existing site with `drush updb`. The `moderation` and `timeout` keys are removed from `ai_provider_stackit.settings`. Verified locally on Drupal 11.4.10 with AI 1.5.1: - **Live STACKIT API, through the AI provider plugin manager:** - chat, streaming, tools, JSON schema, vision, embeddings and batched embeddings; - token usage and rate limits; - a 403 for an invalid token and a 404 for an unknown model. - **Settings form:** saving, "Test connection", escaping of the endpoint value, and the update hook. - **Automated checks:** 20 PHPUnit tests pass, and phpcs (Drupal, DrupalPractice) and phpstan level 6 are clean. ## Remaining tasks - [ ] Open the MR from the issue fork. - [ ] Review. - [ ] Run the tests on GitLab CI. ## User interface changes - The settings form has an endpoint field and a single "Test connection" button. The moderation checkbox, the timeout field and the "Test Embeddings" button are removed. - The provider label is "STACKIT", the product's own spelling. ## API changes - **Removed:** `StackITStreamedChatMessageIterator` and `CKEditorConfigSubscriber`, the `ai_provider_stackit.http_client` and `ai_provider_stackit.ckeditor_config_subscriber` services, and the `moderation` operation type. - **`StackITProvider` changes:** - It now extends `OpenAiBasedProviderClientBase`. - New public methods: `listModelIds()` and `overrideEndpoint()`. - `getModels()`, `moderationEndpoints()`, `enableModeration()` and `disableModeration()` are removed. - There has been no stable release, so no BC layer is provided. ## Data model changes `ai_provider_stackit.settings` loses `moderation` and `timeout`. The update hook handles existing sites.