@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/config.js

@@ -0,0 +1,1011 @@
+import { WEB_OAUTH_FLOW_KINDS, getAuthProviderId, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId } from "./provider-credentials.js";
+import { resolveFactoryModelPolicy } from "../session/credential-policy.js";
+import "../session/memory-settings-hydration.js";
+import { factoryMemorySettingsUserId } from "../storage/domains/memory-settings/base.js";
+import { Route } from "./route.js";
+import { RequestContext } from "@mastra/core/request-context";
+import { registerApiRoute } from "@mastra/core/server";
+import { MASTRA_GATEWAY_PREFIX } from "@mastra/code-sdk/providers/model-ids";
+import { z } from "zod";
+import { MastraCodeGateway } from "@mastra/code-sdk/agents/mastracode-gateway";
+import { resolveAutoOMModelId } from "@mastra/code-sdk/onboarding/packs";
+import { MASTRA_GATEWAY_PROVIDER, THINKING_LEVEL_VALUES, getCustomProviderId, isThinkingLevelSetting, loadSettings, saveSettings } from "@mastra/code-sdk/onboarding/settings";
+import { AMAZON_BEDROCK_GATEWAY_ID } from "@mastra/code-sdk/providers/amazon-bedrock-gateway";
+import { getModelReasoningOptions } from "@mastra/core/llm";
+//#region src/routes/config.ts
+/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */
+function loose(c) {
+	return c;
+}
+/**
+* Build a deduplicated, sorted list of providers from the model catalog,
+* annotated with where each provider's credential currently comes from.
+* Mirrors the TUI's `/api-keys` provider list.
+*
+* When `tenantCredentials` is given (deployed mode), sources reflect the
+* *caller's* tenant rows with user > org precedence and the server-global
+* `authStorage` is ignored; otherwise the local `auth.json` view is reported.
+*/
+async function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders }) {
+	const models = await controller.listAvailableModels();
+	const seen = /* @__PURE__ */ new Map();
+	for (const model of models) {
+		if (seen.has(model.provider)) continue;
+		if (tenantCredentials && isDeploymentModelProvider(model.provider)) {
+			if (deploymentProviders?.has(model.provider) && models.some((m) => m.provider === model.provider && m.hasApiKey)) seen.set(model.provider, {
+				provider: model.provider,
+				source: "deployment"
+			});
+			continue;
+		}
+		const authProviderId = getAuthProviderId(model.provider);
+		let source = "none";
+		let orgKey;
+		let userCredential;
+		let orgCredential;
+		if (tenantCredentials) {
+			const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
+			const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
+			orgKey = orgRec !== void 0;
+			userCredential = userRec?.credential.type;
+			orgCredential = orgRec?.credential.type;
+			if (userRec?.credential.type === "oauth") source = "oauth-user";
+			else if (userRec?.credential.type === "api_key") source = "stored-user";
+			else if (orgRec?.credential.type === "oauth") source = "oauth-org";
+			else if (orgRec?.credential.type === "api_key") source = "stored-org";
+		} else if (authStorage?.isLoggedIn(authProviderId)) source = "oauth";
+		else if (authStorage?.hasStoredApiKey(model.provider)) source = "stored";
+		else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) source = "env";
+		else if (model.hasApiKey) source = "env";
+		const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];
+		seen.set(model.provider, {
+			provider: model.provider,
+			envVar: model.apiKeyEnvVar,
+			source,
+			...orgKey !== void 0 ? { orgKey } : {},
+			...userCredential ? { userCredential } : {},
+			...orgCredential ? { orgCredential } : {},
+			...flowKind ? { oauth: {
+				supported: true,
+				modes: [flowKind]
+			} } : {}
+		});
+	}
+	return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));
+}
+/** Redact a stored custom-provider row for the client (key presence only). */
+function toCustomProviderInfo(record) {
+	return {
+		id: record.providerId,
+		name: record.name,
+		url: record.url,
+		hasApiKey: Boolean(record.apiKey),
+		models: record.models
+	};
+}
+/**
+* Resolve the custom-providers context for a request, or a ready-to-return
+* error response. Same posture as memory settings: tenant rows in deployed
+* mode, a sentinel `local` org in no-auth mode — never settings.json.
+*/
+async function resolveCustomProvidersContext({ c, auth, customProviders }) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (customProviders) try {
+		await customProviders.ensureReady();
+		return tenant ? {
+			storage: customProviders,
+			orgId: tenantOrgId(tenant),
+			userId: tenant.userId
+		} : {
+			storage: customProviders,
+			orgId: "local",
+			userId: "local"
+		};
+	} catch {}
+	return { response: c.json({
+		error: "custom_providers_unavailable",
+		message: "Custom provider storage is unavailable — the app database is not configured or failed to start."
+	}, 503) };
+}
+/** Validate + coerce a request body into a CustomProviderSetting. */
+function parseCustomProviderBody(body) {
+	if (!body || typeof body !== "object") return { error: "Invalid JSON body" };
+	const b = body;
+	const name = typeof b.name === "string" ? b.name.trim() : "";
+	if (!name) return { error: "Missing required field: name" };
+	const url = typeof b.url === "string" ? b.url.trim() : "";
+	if (!url) return { error: "Missing required field: url" };
+	try {
+		const parsed = new URL(url);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return { error: "url must be an http(s) URL" };
+	} catch {
+		return { error: "url must be a valid URL" };
+	}
+	return {
+		name,
+		url,
+		apiKey: typeof b.apiKey === "string" && b.apiKey.trim() ? b.apiKey.trim() : void 0,
+		models: Array.isArray(b.models) ? b.models.filter((m) => typeof m === "string" && m.trim().length > 0).map((m) => m.trim()) : []
+	};
+}
+/**
+* Providers whose credentials can only come from the server process (Amazon
+* Bedrock authenticates through the AWS credential chain). In tenant mode they
+* are usable only when the operator lists them in
+* `MastraFactoryConfig.deploymentModelProviders`.
+*/
+const DEPLOYMENT_MODEL_PROVIDERS = [AMAZON_BEDROCK_GATEWAY_ID];
+function isDeploymentModelProvider(provider) {
+	return DEPLOYMENT_MODEL_PROVIDERS.includes(provider);
+}
+/**
+* Normalize the operator's `deploymentModelProviders` list. Unsupported ids are
+* ignored with a warning rather than failing boot.
+*/
+function resolveDeploymentModelProviders(providers) {
+	const resolved = /* @__PURE__ */ new Set();
+	for (const raw of providers ?? []) {
+		const provider = raw.trim();
+		if (!provider) continue;
+		if (isDeploymentModelProvider(provider)) resolved.add(provider);
+		else console.warn(`[factory] Ignoring deployment model provider "${provider}". Supported: ${DEPLOYMENT_MODEL_PROVIDERS.join(", ")}.`);
+	}
+	return resolved;
+}
+/**
+* Compute which providers the user can reach, mirroring the TUI's
+* `/models-pack` access derivation: OAuth/api-key from the credential store for
+* the named providers, plus any other provider that has a usable key.
+*/
+async function buildProviderAccess({ controller, authStorage, tenantCredentials, deploymentProviders }) {
+	const models = await controller.listAvailableModels();
+	const hasModelKey = (provider) => models.some((m) => m.provider === provider && m.hasApiKey);
+	const accessLevel = (provider) => {
+		const authProviderId = getAuthProviderId(provider);
+		if (tenantCredentials) {
+			if (isDeploymentModelProvider(provider)) return deploymentProviders?.has(provider) && hasModelKey(provider) ? "apikey" : false;
+			const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
+			const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
+			const credential = userRec?.credential ?? orgRec?.credential;
+			if (credential?.type === "oauth") return "oauth";
+			if (credential?.type === "api_key" && credential.key.trim().length > 0) return "apikey";
+			return false;
+		}
+		if ((authStorage?.get(authProviderId))?.type === "oauth") return "oauth";
+		if (authStorage?.hasStoredApiKey(provider)) return "apikey";
+		const directCredential = authStorage?.get(provider);
+		if (directCredential?.type === "api_key" && directCredential.key.trim().length > 0) return "apikey";
+		return hasModelKey(provider) ? "apikey" : false;
+	};
+	const access = {
+		anthropic: accessLevel("anthropic"),
+		openai: accessLevel("openai"),
+		cerebras: accessLevel("cerebras"),
+		google: accessLevel("google"),
+		deepseek: accessLevel("deepseek"),
+		"github-copilot": accessLevel("github-copilot")
+	};
+	const seen = new Set(Object.keys(access));
+	for (const m of models) if (!seen.has(m.provider)) {
+		access[m.provider] = accessLevel(m.provider);
+		seen.add(m.provider);
+	}
+	return access;
+}
+function canUseModelProvider(access, provider) {
+	return Boolean(access[provider]);
+}
+/** Resolve the default-model context for a request, or a ready-to-return error response. */
+async function resolveModelDefaultsContext({ c, auth, modelDefaults }) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (modelDefaults) try {
+		await modelDefaults.ensureReady();
+		return tenant ? {
+			storage: modelDefaults,
+			orgId: tenantOrgId(tenant),
+			userId: tenant.userId
+		} : {
+			storage: modelDefaults,
+			orgId: "local",
+			userId: "local"
+		};
+	} catch {}
+	return { response: c.json({
+		error: "model_defaults_unavailable",
+		message: "Default model storage is unavailable — the app database is not configured or failed to start."
+	}, 503) };
+}
+function modelProvider(modelId) {
+	return modelId.replace(/^mastracode\//, "").replace(/^mastra\//, "").split("/", 1)[0] ?? "";
+}
+function roleConfig(model, effectiveModelId, autoModelSource, availableProviders) {
+	return {
+		model,
+		effectiveModelId,
+		effectiveModelSource: model === "auto" ? autoModelSource : "explicit",
+		providerStatus: availableProviders.has(modelProvider(effectiveModelId)) || effectiveModelId.startsWith(MASTRA_GATEWAY_PREFIX) && availableProviders.has(MASTRA_GATEWAY_PROVIDER) ? "available" : "unavailable"
+	};
+}
+function readStoredOMConfig(record, currentModelId, autoModelSource, availableProviders) {
+	const autoModelId = resolveAutoOMModelId(currentModelId);
+	const observerModelId = record?.observerModelId ?? autoModelId;
+	const reflectorModelId = record?.reflectorModelId ?? autoModelId;
+	return {
+		observer: roleConfig(record?.observerModelId ?? "auto", observerModelId, autoModelSource, availableProviders),
+		reflector: roleConfig(record?.reflectorModelId ?? "auto", reflectorModelId, autoModelSource, availableProviders),
+		observerModelId,
+		reflectorModelId,
+		observationThreshold: record?.observationThreshold ?? 3e4,
+		reflectionThreshold: record?.reflectionThreshold ?? 4e4,
+		observeAttachments: record?.observeAttachments ?? "auto"
+	};
+}
+/**
+* Resolve the memory-settings context for a request, or a ready-to-return
+* error response. When `factoryProjectId` is provided the row addressed is the
+* factory project's shared settings (a sentinel user id in the caller's org)
+* instead of the caller's personal row — this is what factory board runs and
+* channel sessions hydrate from.
+*/
+async function resolveMemorySettingsContext({ c, auth, memorySettings, factoryProjectId, factoryProjects }) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (factoryProjectId && tenant) {
+		if (!factoryProjects) return { response: c.json({ error: "factory_unavailable" }, 503) };
+		try {
+			await factoryProjects.ensureReady();
+			if (!await factoryProjects.get({
+				orgId: tenantOrgId(tenant),
+				id: factoryProjectId
+			})) return { response: c.json({ error: "factory_project_not_found" }, 404) };
+		} catch {
+			return { response: c.json({ error: "factory_unavailable" }, 503) };
+		}
+	}
+	if (memorySettings) try {
+		await memorySettings.ensureReady();
+		const factoryUserId = factoryProjectId ? factoryMemorySettingsUserId(factoryProjectId) : void 0;
+		return tenant ? {
+			storage: memorySettings,
+			orgId: tenantOrgId(tenant),
+			userId: factoryUserId ?? tenant.userId
+		} : {
+			storage: memorySettings,
+			orgId: "local",
+			userId: factoryUserId ?? "local"
+		};
+	} catch {}
+	return { response: c.json({
+		error: "memory_settings_unavailable",
+		message: "Memory settings storage is unavailable — the app database is not configured or failed to start."
+	}, 503) };
+}
+/** Persist an OM knob change to the caller's memory-settings row. */
+async function persistMemorySettings(context, patch) {
+	await context.storage.patch({
+		orgId: context.orgId,
+		userId: context.userId,
+		patch
+	});
+}
+/**
+* The web config routes as Mastra `apiRoutes`:
+*   - `GET    /web/config/features`               — list server-enabled product features
+*   - `GET    /web/config/providers`              — list providers + key source
+*   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key
+*   - `DELETE /web/config/providers/:provider/key` — remove a stored API key
+*   - `GET    /web/config/models`                  — list available models (credentialed providers)
+*   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers
+*   - `POST   /web/config/custom-providers`        — create/update a custom provider
+*   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider
+*   - `GET    /web/config/thinking`                — read thinking (reasoning-effort) defaults
+*   - `PUT    /web/config/thinking`                — set the global thinking default
+*   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments
+*   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model
+*   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds
+*   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)
+*/
+var ConfigRoutes = class extends Route {
+	routes() {
+		const options = this.deps;
+		const { controller, authStorage, auth, deploymentProviders } = options;
+		const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});
+		const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});
+		const resolveOMResponseContext = async (c) => {
+			const tenantCredentials = await listTenantCredentialsForRequest({
+				c: loose(c),
+				auth,
+				credentials: options.modelCredentials
+			});
+			const access = await buildProviderAccess({
+				controller,
+				authStorage: tenantCredentials ? void 0 : authStorage,
+				tenantCredentials,
+				deploymentProviders
+			});
+			const availableProviders = new Set(Object.entries(access).flatMap(([providerId, configured]) => configured ? [providerId] : []));
+			if (MastraCodeGateway.getMastraGatewayApiKey()) availableProviders.add(MASTRA_GATEWAY_PROVIDER);
+			if (options.customProviders) {
+				const context = await resolveCustomProvidersContext({
+					c: loose(c),
+					auth,
+					customProviders: options.customProviders
+				});
+				if (!("response" in context)) for (const provider of await context.storage.list({ orgId: context.orgId })) availableProviders.add(provider.providerId);
+			}
+			return availableProviders;
+		};
+		const factoryOmFallback = async (factoryProjectId) => {
+			try {
+				const defaultModelId = factoryProjectId ? await options.factoryProjects?.getById({ id: factoryProjectId }).then((project) => project?.defaultModelId ?? void 0) : controller.listModes?.().find((mode) => mode.defaultModelId)?.defaultModelId;
+				return defaultModelId ? resolveAutoOMModelId(defaultModelId) : void 0;
+			} catch {
+				return;
+			}
+		};
+		const deploymentThinkingAccess = async (c) => {
+			if (!auth.enabled()) return { ok: true };
+			await auth.ensureUser(c);
+			const tenant = auth.tenant(c);
+			if (!tenant) return {
+				ok: false,
+				status: 401,
+				error: "unauthorized"
+			};
+			const orgId = tenantOrgId(tenant);
+			if (!options.deploymentOrganizationId || orgId !== options.deploymentOrganizationId) return {
+				ok: false,
+				status: 403,
+				error: "deployment_organization_required",
+				message: "Deployment thinking defaults are shared by the whole deployment. Set MASTRACODE_DEPLOYMENT_ORGANIZATION_ID to let that organization's admins change them while authentication is enabled"
+			};
+			if (!await auth.isOrganizationAdmin(c, orgId)) return {
+				ok: false,
+				status: 403,
+				error: "organization_admin_required",
+				message: "Only organization admins can change deployment thinking defaults while authentication is enabled"
+			};
+			return { ok: true };
+		};
+		return [
+			registerApiRoute("/web/config/features", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => c.json({ knowledge: options.features?.knowledge ?? false })
+			}),
+			registerApiRoute("/web/config/providers", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					try {
+						const tenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						const tenant = auth.tenant(loose(c));
+						const orgKeyAdmin = tenant ? await auth.isOrganizationAdmin(loose(c), tenantOrgId(tenant)) : void 0;
+						return c.json({
+							providers: await listProviders({
+								controller,
+								authStorage: tenantCredentials ? void 0 : authStorage,
+								tenantCredentials,
+								deploymentProviders
+							}),
+							...orgKeyAdmin !== void 0 ? { orgKeyAdmin } : {}
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/key", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: options.modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const key = typeof body.key === "string" ? body.key.trim() : "";
+					if (!key) return c.json({ error: "Missing required field: key" }, 400);
+					const envVar = typeof body.envVar === "string" ? body.envVar : void 0;
+					const scope = body.scope === "org" ? "org" : "user";
+					try {
+						if (ctx.mode === "tenant") {
+							if (isDeploymentModelProvider(provider)) return c.json({
+								error: "provider_configured_by_deployment",
+								message: `${provider} is configured by the Factory deployment (credentials on the server), not per account.`
+							}, 400);
+							if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({ error: "organization_admin_required" }, 403);
+							const tenant = scope === "org" ? { orgId: ctx.orgId } : {
+								orgId: ctx.orgId,
+								userId: ctx.userId
+							};
+							await ctx.storage.setCredential(tenant, getAuthProviderId(provider), {
+								type: "api_key",
+								key
+							});
+							onCredentialsChanged(tenant);
+							const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
+							const providers = await listProviders({
+								controller,
+								tenantCredentials: records,
+								deploymentProviders
+							});
+							return c.json({
+								ok: true,
+								provider: providers.find((p) => p.provider === provider)
+							});
+						}
+						if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+						authStorage.setStoredApiKey(provider, key, envVar);
+						const providers = await listProviders({
+							controller,
+							authStorage
+						});
+						return c.json({
+							ok: true,
+							provider: providers.find((p) => p.provider === provider)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/key", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: options.modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					const scope = c.req.query("scope") === "org" ? "org" : "user";
+					try {
+						if (ctx.mode === "tenant") {
+							if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({ error: "organization_admin_required" }, 403);
+							const tenant = scope === "org" ? { orgId: ctx.orgId } : {
+								orgId: ctx.orgId,
+								userId: ctx.userId
+							};
+							await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));
+							onCredentialsChanged(tenant);
+							const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
+							const providers = await listProviders({
+								controller,
+								tenantCredentials: records,
+								deploymentProviders
+							});
+							return c.json({
+								ok: true,
+								provider: providers.find((p) => p.provider === provider)
+							});
+						}
+						if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+						authStorage.remove(`apikey:${provider}`);
+						const providers = await listProviders({
+							controller,
+							authStorage
+						});
+						return c.json({
+							ok: true,
+							provider: providers.find((p) => p.provider === provider)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/custom-providers", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCustomProvidersContext({
+						c: loose(c),
+						auth,
+						customProviders: options.customProviders
+					});
+					if ("response" in ctx) return ctx.response;
+					try {
+						const records = await ctx.storage.list({ orgId: ctx.orgId });
+						return c.json({ providers: records.map(toCustomProviderInfo) });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/custom-providers", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCustomProvidersContext({
+						c: loose(c),
+						auth,
+						customProviders: options.customProviders
+					});
+					if ("response" in ctx) return ctx.response;
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const parsed = parseCustomProviderBody(body);
+					if ("error" in parsed) return c.json({ error: parsed.error }, 400);
+					const previousId = body && typeof body === "object" && typeof body.previousId === "string" ? body.previousId : void 0;
+					try {
+						const record = await ctx.storage.upsert({
+							orgId: ctx.orgId,
+							userId: ctx.userId,
+							input: {
+								providerId: getCustomProviderId(parsed.name),
+								name: parsed.name,
+								url: parsed.url,
+								apiKey: parsed.apiKey,
+								models: parsed.models
+							},
+							previousProviderId: previousId
+						});
+						onCustomProvidersChanged({ orgId: ctx.orgId });
+						return c.json({
+							ok: true,
+							provider: toCustomProviderInfo(record)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/custom-providers/:id", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCustomProvidersContext({
+						c: loose(c),
+						auth,
+						customProviders: options.customProviders
+					});
+					if ("response" in ctx) return ctx.response;
+					const id = c.req.param("id");
+					try {
+						await ctx.storage.delete({
+							orgId: ctx.orgId,
+							providerId: id
+						});
+						onCustomProvidersChanged({ orgId: ctx.orgId });
+						return c.json({ ok: true });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/models", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					try {
+						const allTenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						const factoryProjectId = c.req.query("factoryId") || void 0;
+						const tenant = auth.tenant(c);
+						let tenantCredentials = allTenantCredentials;
+						let sessionPolicy;
+						const resourceId = c.req.query("resourceId");
+						const threadId = c.req.query("threadId");
+						if (resourceId !== void 0 || threadId !== void 0) {
+							const address = z.object({
+								resourceId: z.string().trim().min(1),
+								threadId: z.string().trim().min(1)
+							}).safeParse({
+								resourceId,
+								threadId
+							});
+							if (!address.success) return c.json({ error: "invalid_session_context" }, 400);
+							if (!tenant && auth.enabled()) return c.json({ error: "unauthorized" }, 401);
+							if (tenant) {
+								if (!options.factoryProjects || !options.sourceControlSessions || !options.workItems || !options.modelCredentials) return c.json({ error: "session_model_policy_unavailable" }, 503);
+								const requestContext = new RequestContext();
+								requestContext.set("user", {
+									id: tenant.userId,
+									organizationId: tenantOrgId(tenant)
+								});
+								requestContext.set("controller", address.data);
+								let policy;
+								try {
+									policy = await resolveFactoryModelPolicy(requestContext, {
+										projects: options.factoryProjects,
+										sourceControl: options.sourceControlSessions,
+										workItems: options.workItems
+									});
+								} catch {
+									return c.json({ error: "session_model_policy_unavailable" }, 403);
+								}
+								if (!policy) return c.json({ error: "unauthorized" }, 401);
+								const orgId = policy.tenant.orgId ?? tenantOrgId(tenant);
+								const modelScope = policy.tenant.credentialScope ?? "user";
+								const storageScope = modelScope === "factory" ? "org" : "user";
+								tenantCredentials = (await options.modelCredentials.listCredentials(orgId, policy.tenant.userId)).filter((record) => record.scope === storageScope);
+								let defaultModelId = policy.factoryDefaultModelId ?? null;
+								if (modelScope === "user") {
+									if (!options.modelDefaults) return c.json({ error: "model_defaults_unavailable" }, 503);
+									await options.modelDefaults.ensureReady();
+									defaultModelId = (await options.modelDefaults.get({
+										orgId,
+										userId: policy.tenant.userId
+									}))?.modelId ?? null;
+								}
+								sessionPolicy = {
+									modelScope,
+									defaultModelId
+								};
+							}
+						} else if (allTenantCredentials && c.req.query("scope") === "user") tenantCredentials = allTenantCredentials.filter((record) => record.scope === "user");
+						else if (allTenantCredentials && factoryProjectId && tenant) {
+							if (!options.factoryProjects) return c.json({ error: "factory_unavailable" }, 503);
+							await options.factoryProjects.ensureReady();
+							const project = await options.factoryProjects.get({
+								orgId: tenantOrgId(tenant),
+								id: factoryProjectId
+							});
+							if (!project) return c.json({ error: "factory_project_not_found" }, 404);
+							const credentialScope = project.modelScope === "user" ? "user" : "org";
+							tenantCredentials = allTenantCredentials.filter((record) => record.scope === credentialScope);
+						}
+						const [models, access] = await Promise.all([controller.listAvailableModels(), buildProviderAccess({
+							controller,
+							authStorage: tenantCredentials ? void 0 : authStorage,
+							tenantCredentials,
+							deploymentProviders
+						})]);
+						const catalog = models.flatMap(({ id, provider, modelName }) => typeof id === "string" && canUseModelProvider(access, provider) ? [{
+							id,
+							provider,
+							modelName,
+							hasApiKey: true,
+							reasoningOptions: getModelReasoningOptions(id)
+						}] : []);
+						if (options.customProviders) try {
+							const ctx = await resolveCustomProvidersContext({
+								c: loose(c),
+								auth,
+								customProviders: options.customProviders
+							});
+							if (!("response" in ctx)) {
+								const known = new Set(catalog.map((m) => m.id));
+								for (const record of await ctx.storage.list({ orgId: ctx.orgId })) for (const model of record.models) {
+									const id = `${record.providerId}/${model}`;
+									if (known.has(id)) continue;
+									known.add(id);
+									catalog.push({
+										id,
+										provider: record.providerId,
+										modelName: model,
+										hasApiKey: true,
+										reasoningOptions: void 0
+									});
+								}
+							}
+						} catch {}
+						return c.json({
+							...sessionPolicy,
+							models: catalog.sort((a, b) => a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider))
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/default-model", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					const context = await resolveModelDefaultsContext({
+						c: loose(c),
+						auth,
+						modelDefaults: options.modelDefaults
+					});
+					if ("response" in context) return context.response;
+					try {
+						const record = await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						return c.json({ modelId: record?.modelId ?? null });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/default-model", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					const context = await resolveModelDefaultsContext({
+						c: loose(c),
+						auth,
+						modelDefaults: options.modelDefaults
+					});
+					if ("response" in context) return context.response;
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const parsed = z.object({ modelId: z.string().trim().min(1).max(256) }).safeParse(body);
+					if (!parsed.success) return c.json({ error: "Missing required field: modelId" }, 400);
+					const { modelId } = parsed.data;
+					try {
+						await context.storage.set({
+							orgId: context.orgId,
+							userId: context.userId,
+							modelId
+						});
+						return c.json({
+							ok: true,
+							modelId
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/default-model", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const context = await resolveModelDefaultsContext({
+						c: loose(c),
+						auth,
+						modelDefaults: options.modelDefaults
+					});
+					if ("response" in context) return context.response;
+					try {
+						await context.storage.clear({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						return c.json({
+							ok: true,
+							modelId: null
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/thinking", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					try {
+						const settings = loadSettings(options.settingsPath);
+						return c.json({
+							levels: THINKING_LEVEL_VALUES,
+							globalDefault: settings.preferences.thinkingLevel,
+							editable: (await deploymentThinkingAccess(loose(c))).ok
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/thinking", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					const access = await deploymentThinkingAccess(loose(c));
+					if (!access.ok) return c.json({
+						error: access.error,
+						...access.message ? { message: access.message } : {}
+					}, access.status);
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const parsed = z.object({ globalDefault: z.custom(isThinkingLevelSetting) }).strict().safeParse(body);
+					if (!parsed.success) return c.json({ error: `Expected only globalDefault, one of: ${THINKING_LEVEL_VALUES.join(", ")}` }, 400);
+					const { globalDefault } = parsed.data;
+					try {
+						const settings = loadSettings(options.settingsPath);
+						settings.preferences.thinkingLevel = globalDefault;
+						saveSettings(settings, options.settingsPath);
+						return c.json({
+							ok: true,
+							globalDefault: settings.preferences.thinkingLevel
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					const resourceId = c.req.query("resourceId");
+					const scope = c.req.query("scope") || void 0;
+					const factoryProjectId = c.req.query("factoryId") || void 0;
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings,
+						factoryProjectId,
+						factoryProjects: options.factoryProjects
+					});
+					if ("response" in context) return context.response;
+					try {
+						const record = await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						const fallback = await factoryOmFallback(factoryProjectId);
+						const availableProviders = await resolveOMResponseContext(loose(c));
+						const sessionModelId = (resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0)?.model.get();
+						return c.json({ config: readStoredOMConfig(record, sessionModelId || fallback, sessionModelId ? "live-session" : "configured-default", availableProviders) });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/:role/model", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					const role = c.req.param("role");
+					if (role !== "observer" && role !== "reflector") return c.json({ error: `Unknown OM role "${role}"` }, 400);
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					const factoryProjectId = typeof body.factoryId === "string" && body.factoryId ? body.factoryId : void 0;
+					const model = typeof body.modelId === "string" ? body.modelId.trim() : "";
+					if (!model) return c.json({ error: "Missing required field: modelId" }, 400);
+					const wantsAuto = model === "auto";
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings,
+						factoryProjectId,
+						factoryProjects: options.factoryProjects
+					});
+					if ("response" in context) return context.response;
+					const availableProviders = await resolveOMResponseContext(loose(c));
+					try {
+						await persistMemorySettings(context, { [role === "observer" ? "observerModelId" : "reflectorModelId"]: wantsAuto ? null : model });
+						const record = await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						const sessionModelId = (resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0)?.model.get();
+						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", availableProviders);
+						return c.json({
+							ok: true,
+							config
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/thresholds", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					const factoryProjectId = typeof body.factoryId === "string" && body.factoryId ? body.factoryId : void 0;
+					const observation = typeof body.observationThreshold === "number" && body.observationThreshold > 0 ? Math.round(body.observationThreshold) : void 0;
+					const reflection = typeof body.reflectionThreshold === "number" && body.reflectionThreshold > 0 ? Math.round(body.reflectionThreshold) : void 0;
+					if (observation === void 0 && reflection === void 0) return c.json({ error: "Provide observationThreshold and/or reflectionThreshold (positive numbers)" }, 400);
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings,
+						factoryProjectId,
+						factoryProjects: options.factoryProjects
+					});
+					if ("response" in context) return context.response;
+					const availableProviders = await resolveOMResponseContext(loose(c));
+					try {
+						await persistMemorySettings(context, {
+							...observation !== void 0 ? { observationThreshold: observation } : {},
+							...reflection !== void 0 ? { reflectionThreshold: reflection } : {}
+						});
+						const record = await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						const sessionModelId = (resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0)?.model.get();
+						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", availableProviders);
+						return c.json({
+							ok: true,
+							config
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/observe-attachments", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					const factoryProjectId = typeof body.factoryId === "string" && body.factoryId ? body.factoryId : void 0;
+					const raw = body.value;
+					const value = raw === "auto" || raw === true || raw === false ? raw : "auto";
+					if (raw !== "auto" && raw !== true && raw !== false) return c.json({ error: "value must be 'auto', true, or false" }, 400);
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings,
+						factoryProjectId,
+						factoryProjects: options.factoryProjects
+					});
+					if ("response" in context) return context.response;
+					const availableProviders = await resolveOMResponseContext(loose(c));
+					try {
+						await persistMemorySettings(context, { observeAttachments: value });
+						const record = await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						const sessionModelId = (resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0)?.model.get();
+						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", availableProviders);
+						return c.json({
+							ok: true,
+							config
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			})
+		];
+	}
+};
+//#endregion
+export { ConfigRoutes, DEPLOYMENT_MODEL_PROVIDERS, buildProviderAccess, isDeploymentModelProvider, listProviders, resolveDeploymentModelProviders };
+
+//# sourceMappingURL=config.js.map