@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/config.d.ts

@@ -0,0 +1,238 @@
+import type { AuthStorage } from '@mastra/code-sdk/auth/storage';
+import type { ProviderAccess } from '@mastra/code-sdk/onboarding/packs';
+import type { ThinkingLevelSetting } from '@mastra/code-sdk/onboarding/settings';
+import type { ApiRoute } from '@mastra/core/server';
+import type { CredentialRecord, LoginSessionKind, ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';
+import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
+import type { ModelDefaultsStorage } from '../storage/domains/model-defaults/base.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import { Route } from './route.js';
+import type { RouteDependencies } from './route.js';
+/**
+ * Server-side configuration routes for the web app.
+ *
+ * The browser has no access to the credential store or the model catalog, so
+ * the web settings panel asks the server — which owns both — to list providers
+ * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the
+ * same `AuthStorage`-backed key management over HTTP.
+ *
+ * Keys are never returned to the client; only their presence and source.
+ */
+/**
+ * Where a provider's active credential comes from, as seen by the caller.
+ * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode
+ * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).
+ * `deployment` (tenant mode) marks a provider the operator opted in to run on
+ * the server process's own credentials (e.g. Amazon Bedrock's AWS chain).
+ */
+export type ProviderCredentialSource = 'deployment' | 'oauth' | 'stored' | 'env' | 'none' | 'oauth-user' | 'oauth-org' | 'stored-user' | 'stored-org';
+/** A model provider with the current source of its credentials. */
+export interface ProviderInfo {
+    provider: string;
+    /** Env var the provider's key is read from, if any. */
+    envVar?: string;
+    /** Where the active credential comes from. */
+    source: ProviderCredentialSource;
+    /**
+     * Tenant mode: whether an org-wide API key exists for this provider, even
+     * when the caller's personal credential shadows it. Lets the UI tell
+     * "shared with the org" apart from "only works for me".
+     */
+    orgKey?: boolean;
+    /**
+     * Tenant mode: the caller's personal credential for this provider, if any.
+     * Reported independently of `source` so the UI can manage each scope even
+     * when one shadows the other.
+     */
+    userCredential?: 'oauth' | 'api_key';
+    /** Tenant mode: the shared org credential for this provider, if any. */
+    orgCredential?: 'oauth' | 'api_key';
+    /** Web OAuth sign-in capability, when the provider supports it. */
+    oauth?: {
+        supported: true;
+        modes: LoginSessionKind[];
+    };
+}
+/** Minimal session surface the config routes touch. */
+export interface OMSession {
+    /** `get()` returns '' when no model is selected, so callers fall back on falsy. */
+    model: {
+        get: () => string;
+    };
+}
+/** Minimal controller surface this module needs (model catalog + modes + sessions). */
+interface ModelCatalog {
+    listAvailableModels: () => Promise<Array<{
+        id?: string;
+        modelName?: string;
+        provider: string;
+        hasApiKey: boolean;
+        apiKeyEnvVar?: string;
+    }>>;
+    listModes?: () => Array<{
+        id: string;
+        defaultModelId?: string;
+    }>;
+    getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;
+}
+/**
+ * Build a deduplicated, sorted list of providers from the model catalog,
+ * annotated with where each provider's credential currently comes from.
+ * Mirrors the TUI's `/api-keys` provider list.
+ *
+ * When `tenantCredentials` is given (deployed mode), sources reflect the
+ * *caller's* tenant rows with user > org precedence and the server-global
+ * `authStorage` is ignored; otherwise the local `auth.json` view is reported.
+ */
+export declare function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders, }: {
+    controller: ModelCatalog;
+    authStorage?: AuthStorage;
+    tenantCredentials?: CredentialRecord[];
+    deploymentProviders?: ReadonlySet<string>;
+}): Promise<ProviderInfo[]>;
+/** A user-defined OpenAI-compatible provider, with key presence (never the key). */
+export interface CustomProviderInfo {
+    id: string;
+    name: string;
+    url: string;
+    hasApiKey: boolean;
+    models: string[];
+}
+/**
+ * Providers whose credentials can only come from the server process (Amazon
+ * Bedrock authenticates through the AWS credential chain). In tenant mode they
+ * are usable only when the operator lists them in
+ * `MastraFactoryConfig.deploymentModelProviders`.
+ */
+export declare const DEPLOYMENT_MODEL_PROVIDERS: readonly string[];
+export declare function isDeploymentModelProvider(provider: string): boolean;
+/**
+ * Normalize the operator's `deploymentModelProviders` list. Unsupported ids are
+ * ignored with a warning rather than failing boot.
+ */
+export declare function resolveDeploymentModelProviders(providers: readonly string[] | undefined): ReadonlySet<string>;
+/**
+ * Compute which providers the user can reach, mirroring the TUI's
+ * `/models-pack` access derivation: OAuth/api-key from the credential store for
+ * the named providers, plus any other provider that has a usable key.
+ */
+export declare function buildProviderAccess({ controller, authStorage, tenantCredentials, deploymentProviders, }: {
+    controller: ModelCatalog;
+    authStorage?: AuthStorage;
+    tenantCredentials?: CredentialRecord[];
+    deploymentProviders?: ReadonlySet<string>;
+}): Promise<ProviderAccess>;
+/** Per-user default model context for the current request. */
+export interface ModelDefaultsContext {
+    storage: ModelDefaultsStorage;
+    orgId: string;
+    userId: string;
+}
+export interface OMRoleConfigInfo {
+    model: 'auto' | string;
+    effectiveModelId: string;
+    effectiveModelSource: 'explicit' | 'live-session' | 'configured-default';
+    providerStatus: 'available' | 'unavailable';
+}
+/** Persisted intent plus the concrete models the current Factory configuration resolves. */
+export interface OMConfigInfo {
+    observer: OMRoleConfigInfo;
+    reflector: OMRoleConfigInfo;
+    /** @deprecated Use `observer.effectiveModelId`. */
+    observerModelId: string;
+    /** @deprecated Use `reflector.effectiveModelId`. */
+    reflectorModelId: string;
+    observationThreshold: number;
+    reflectionThreshold: number;
+    observeAttachments: 'auto' | boolean;
+}
+export interface ProviderOMDefaultsResponse {
+    ok: true;
+    config: OMConfigInfo;
+}
+/** `GET /web/config/thinking` — deployment-scoped reasoning-effort defaults. */
+export interface ThinkingConfigInfo {
+    /** All selectable levels, in escalation order. */
+    levels: readonly ThinkingLevelSetting[];
+    /** `preferences.thinkingLevel` — what every run uses without a session override. */
+    globalDefault: ThinkingLevelSetting;
+    /** False when the deployment refuses writes, so the UI can render read-only rows. */
+    editable: boolean;
+}
+/** `PUT /web/config/thinking` success payload. */
+export interface UpdateThinkingConfigResponse {
+    ok: true;
+    globalDefault: ThinkingLevelSetting;
+}
+/** Dependencies injected into {@link ConfigRoutes}. */
+export interface ConfigRoutesDeps extends RouteDependencies {
+    controller: ModelCatalog;
+    features?: {
+        knowledge: boolean;
+    };
+    authStorage?: AuthStorage;
+    /** Tenant credential domain handle; absent in local (no-DB) mode. */
+    modelCredentials?: ModelCredentialsStorage;
+    /** Tenant model-defaults domain handle; absent in local (no-DB) mode. */
+    modelDefaults?: ModelDefaultsStorage;
+    /** Source-control sessions available to config route integrations. */
+    sourceControlSessions?: Pick<SourceControlStorageHandle['sessions'], 'getBySessionId'>;
+    /** Thread membership used to resolve the same model policy as an invocation. */
+    workItems?: WorkItemsStorage;
+    /** Tenant memory-settings domain handle; absent in local (no-DB) mode. */
+    memorySettings?: MemorySettingsStorage;
+    /** Factory projects domain, used to derive OM fallbacks from a factory's default model. */
+    factoryProjects?: FactoryProjectsStorage;
+    /** Custom-providers domain handle; absent when the app database is missing. */
+    customProviders?: CustomProvidersStorage;
+    /** Notifies the host after tenant credentials change so caches can be dropped. */
+    onCredentialsChanged?: (tenant: {
+        orgId: string;
+        userId?: string;
+    }) => void;
+    /** Notifies the host after custom providers change so model-router caches can be dropped. */
+    onCustomProvidersChanged?: (tenant: {
+        orgId: string;
+    }) => void;
+    /**
+     * Tenant mode: providers the operator opted in to run on the server process's
+     * own credentials (see `DEPLOYMENT_MODEL_PROVIDERS`).
+     */
+    deploymentProviders?: ReadonlySet<string>;
+    /**
+     * Path of the server's settings.json backing the deployment-scoped thinking
+     * defaults. Defaults to the standard app-data location; injectable for tests.
+     */
+    settingsPath?: string;
+    /**
+     * Organization this deployment serves (`MASTRACODE_DEPLOYMENT_ORGANIZATION_ID`).
+     * When auth is enabled, only admins of this organization may write
+     * deployment-wide settings; without it those writes stay blocked.
+     */
+    deploymentOrganizationId?: string;
+}
+/**
+ * The web config routes as Mastra `apiRoutes`:
+ *   - `GET    /web/config/features`               — list server-enabled product features
+ *   - `GET    /web/config/providers`              — list providers + key source
+ *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key
+ *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key
+ *   - `GET    /web/config/models`                  — list available models (credentialed providers)
+ *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers
+ *   - `POST   /web/config/custom-providers`        — create/update a custom provider
+ *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider
+ *   - `GET    /web/config/thinking`                — read thinking (reasoning-effort) defaults
+ *   - `PUT    /web/config/thinking`                — set the global thinking default
+ *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments
+ *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model
+ *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds
+ *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)
+ */
+export declare class ConfigRoutes extends Route<ConfigRoutesDeps> {
+    routes(): ApiRoute[];
+}
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,mCAAmC,CAAC;AAS7F,OAAO,KAAK,EAAyB,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAKxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAOpD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAwB,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAEhH,OAAO,KAAK,EAGV,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAQ9E,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/D;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,KAAK,GACL,MAAM,GACN,YAAY,GACZ,WAAW,GACX,aAAa,GACb,YAAY,CAAC;AAEjB,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,wEAAwE;IACxE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,mEAAmE;IACnE,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;CACxD;AAED,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,mFAAmF;IACnF,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED,uFAAuF;AACvF,UAAU,YAAY;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAChC,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CACxG,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA6D1B;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiFD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAAgC,CAAC;AAEzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAc7G;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1B;AAMD,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAwCD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,UAAU,GAAG,cAAc,GAAG,oBAAoB,CAAC;IACzE,cAAc,EAAE,WAAW,GAAG,aAAa,CAAC;CAC7C;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACxC,oFAAoF;IACpF,aAAa,EAAE,oBAAoB,CAAC;IACpC,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,oBAAoB,CAAC;CACrC;AAyHD,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,yEAAyE;IACzE,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvF,gFAAgF;IAChF,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,2FAA2F;IAC3F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5E,6FAA6F;IAC7F,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D;;;OAGG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAa,SAAQ,KAAK,CAAC,gBAAgB,CAAC;IACvD,MAAM,IAAI,QAAQ,EAAE;CAyuBrB"}