@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/routes/config.js

@@ -0,0 +1,972 @@
+import { WEB_OAUTH_FLOW_KINDS, getAuthProviderId, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId } from "./provider-credentials.js";
+import { Route } from "./route.js";
+import { registerApiRoute } from "@mastra/core/server";
+import { DEFAULT_OM_MODEL_ID } from "@mastra/code-sdk/constants";
+import { getAvailableModePacks, resolveProviderOMDefault } from "@mastra/code-sdk/onboarding/packs";
+import { THREAD_ACTIVE_MODEL_PACK_ID_KEY, getCustomProviderId } from "@mastra/code-sdk/onboarding/settings";
+//#region src/routes/config.ts
+/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */
+function loose(c) {
+	return c;
+}
+/**
+* Build a deduplicated, sorted list of providers from the model catalog,
+* annotated with where each provider's credential currently comes from.
+* Mirrors the TUI's `/api-keys` provider list.
+*
+* When `tenantCredentials` is given (deployed mode), sources reflect the
+* *caller's* tenant rows with user > org precedence and the server-global
+* `authStorage` is ignored; otherwise the local `auth.json` view is reported.
+*/
+async function listProviders({ controller, authStorage, tenantCredentials }) {
+	const models = await controller.listAvailableModels();
+	const seen = /* @__PURE__ */ new Map();
+	for (const model of models) {
+		if (seen.has(model.provider)) continue;
+		const authProviderId = getAuthProviderId(model.provider);
+		let source = "none";
+		let orgKey;
+		if (tenantCredentials) {
+			const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
+			const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
+			orgKey = orgRec?.credential.type === "api_key";
+			if (userRec?.credential.type === "oauth") source = "oauth-user";
+			else if (userRec?.credential.type === "api_key") source = "stored-user";
+			else if (orgRec?.credential.type === "api_key") source = "stored-org";
+		} else if (authStorage?.isLoggedIn(authProviderId)) source = "oauth";
+		else if (authStorage?.hasStoredApiKey(model.provider)) source = "stored";
+		else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) source = "env";
+		else if (model.hasApiKey) source = "env";
+		const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];
+		seen.set(model.provider, {
+			provider: model.provider,
+			envVar: model.apiKeyEnvVar,
+			source,
+			...orgKey !== void 0 ? { orgKey } : {},
+			...flowKind ? { oauth: {
+				supported: true,
+				modes: [flowKind]
+			} } : {}
+		});
+	}
+	return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));
+}
+/** Redact a stored custom-provider row for the client (key presence only). */
+function toCustomProviderInfo(record) {
+	return {
+		id: record.providerId,
+		name: record.name,
+		url: record.url,
+		hasApiKey: Boolean(record.apiKey),
+		models: record.models
+	};
+}
+/**
+* Resolve the custom-providers context for a request, or a ready-to-return
+* error response. Same posture as memory settings: tenant rows in deployed
+* mode, a sentinel `local` org in no-auth mode — never settings.json.
+*/
+async function resolveCustomProvidersContext({ c, auth, customProviders }) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (customProviders) try {
+		await customProviders.ensureReady();
+		return tenant ? {
+			storage: customProviders,
+			orgId: tenantOrgId(tenant),
+			userId: tenant.userId
+		} : {
+			storage: customProviders,
+			orgId: "local",
+			userId: "local"
+		};
+	} catch {}
+	return { response: c.json({
+		error: "custom_providers_unavailable",
+		message: "Custom provider storage is unavailable — the app database is not configured or failed to start."
+	}, 503) };
+}
+/** Validate + coerce a request body into a CustomProviderSetting. */
+function parseCustomProviderBody(body) {
+	if (!body || typeof body !== "object") return { error: "Invalid JSON body" };
+	const b = body;
+	const name = typeof b.name === "string" ? b.name.trim() : "";
+	if (!name) return { error: "Missing required field: name" };
+	const url = typeof b.url === "string" ? b.url.trim() : "";
+	if (!url) return { error: "Missing required field: url" };
+	try {
+		const parsed = new URL(url);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return { error: "url must be an http(s) URL" };
+	} catch {
+		return { error: "url must be a valid URL" };
+	}
+	return {
+		name,
+		url,
+		apiKey: typeof b.apiKey === "string" && b.apiKey.trim() ? b.apiKey.trim() : void 0,
+		models: Array.isArray(b.models) ? b.models.filter((m) => typeof m === "string" && m.trim().length > 0).map((m) => m.trim()) : []
+	};
+}
+/**
+* Compute which providers the user can reach, mirroring the TUI's
+* `/models-pack` access derivation: OAuth/api-key from the credential store for
+* the named providers, plus any other provider that has a usable key.
+*/
+async function buildProviderAccess({ controller, authStorage, tenantCredentials }) {
+	const models = await controller.listAvailableModels();
+	const hasModelKey = (provider) => models.some((m) => m.provider === provider && m.hasApiKey);
+	const accessLevel = (provider) => {
+		const authProviderId = getAuthProviderId(provider);
+		if (tenantCredentials) {
+			const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
+			const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
+			const credential = userRec?.credential ?? orgRec?.credential;
+			if (credential?.type === "oauth") return "oauth";
+			if (credential?.type === "api_key" && credential.key.trim().length > 0) return "apikey";
+			return false;
+		}
+		if ((authStorage?.get(authProviderId))?.type === "oauth") return "oauth";
+		if (authStorage?.hasStoredApiKey(provider)) return "apikey";
+		const directCredential = authStorage?.get(provider);
+		if (directCredential?.type === "api_key" && directCredential.key.trim().length > 0) return "apikey";
+		return hasModelKey(provider) ? "apikey" : false;
+	};
+	const access = {
+		anthropic: accessLevel("anthropic"),
+		openai: accessLevel("openai"),
+		cerebras: accessLevel("cerebras"),
+		google: accessLevel("google"),
+		deepseek: accessLevel("deepseek"),
+		"github-copilot": accessLevel("github-copilot")
+	};
+	const seen = new Set(Object.keys(access));
+	for (const m of models) if (!seen.has(m.provider)) {
+		access[m.provider] = accessLevel(m.provider);
+		seen.add(m.provider);
+	}
+	return access;
+}
+function canUseModelProvider(access, provider) {
+	return Boolean(access[provider]);
+}
+/** Resolve the pack context for a request, or a ready-to-return error response. */
+async function resolvePackContext({ c, auth, modelPacks }) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (modelPacks) try {
+		await modelPacks.ensureReady();
+		return tenant ? {
+			storage: modelPacks,
+			orgId: tenantOrgId(tenant),
+			userId: tenant.userId
+		} : {
+			storage: modelPacks,
+			orgId: "local",
+			userId: "local"
+		};
+	} catch {}
+	return { response: c.json({
+		error: "model_packs_unavailable",
+		message: "Model pack storage is unavailable — the app database is not configured or failed to start."
+	}, 503) };
+}
+/** DB row → the `ModePack` shape the packs list and activation flow consume. */
+function recordToModePack(record) {
+	return {
+		id: `custom:${record.id}`,
+		name: record.name,
+		description: "Saved custom pack",
+		models: record.models
+	};
+}
+/**
+* List available model packs (built-in, gated by provider access, plus saved
+* custom packs from the request's pack context). Drops the synthetic
+* "New Custom" placeholder — the web client has its own create flow. `active`
+* is set from the given session's thread when a resourceId is supplied.
+*/
+async function listModelPacks({ controller, authStorage, tenantCredentials, packContext, activePackId }) {
+	return [...getAvailableModePacks(await buildProviderAccess({
+		controller,
+		authStorage,
+		tenantCredentials
+	})), ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack)].filter((p) => p.id !== "custom").map((p) => ({
+		...p,
+		custom: p.id.startsWith("custom:"),
+		active: activePackId != null && p.id === activePackId
+	}));
+}
+/** Resolve the active pack id for a session by reading its current thread. */
+async function resolveActivePackId(session) {
+	if (!session) return null;
+	const threadId = session.thread.getId();
+	if (!threadId) return null;
+	const value = (await session.thread.list()).find((t) => t.id === threadId)?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];
+	return typeof value === "string" ? value : null;
+}
+/**
+* Apply a pack to a session: seed each mode's default model, switch the current
+* mode's model, set per-subagent models, and tag the thread with the active
+* pack id. Mirrors the TUI `applyPack` orchestration.
+*/
+async function applyPackToSession({ controller, session, pack }) {
+	const modes = controller.listModes?.() ?? [];
+	const packModels = pack.models;
+	for (const mode of modes) {
+		const modelId = packModels[mode.id];
+		if (modelId) {
+			mode.defaultModelId = modelId;
+			await session.thread.setSetting({
+				key: `modeModelId_${mode.id}`,
+				value: modelId
+			});
+		}
+	}
+	const currentModeModel = packModels[session.mode.get()];
+	if (currentModeModel) await session.model.switch({ modelId: currentModeModel });
+	for (const [agentType, modeId] of Object.entries({
+		explore: "fast",
+		plan: "plan",
+		execute: "build"
+	})) {
+		const saModelId = packModels[modeId];
+		if (saModelId) await session.subagents.model.set({
+			modelId: saModelId,
+			agentType
+		});
+	}
+	await session.thread.setSetting({
+		key: THREAD_ACTIVE_MODEL_PACK_ID_KEY,
+		value: pack.id
+	});
+}
+/** Default thresholds mirror the TUI `/om` fallbacks. */
+const DEFAULT_OBSERVATION_THRESHOLD = 3e4;
+const DEFAULT_REFLECTION_THRESHOLD = 4e4;
+function readOMConfig(session) {
+	const observeAttachments = (session.state.get() ?? {}).observeAttachments;
+	return {
+		observerModelId: session.om.observer.modelId() ?? "",
+		reflectorModelId: session.om.reflector.modelId() ?? "",
+		observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,
+		reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,
+		observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : "auto"
+	};
+}
+function readStoredOMConfig(record) {
+	return {
+		observerModelId: record?.observerModelId ?? DEFAULT_OM_MODEL_ID,
+		reflectorModelId: record?.reflectorModelId ?? DEFAULT_OM_MODEL_ID,
+		observationThreshold: record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD,
+		reflectionThreshold: record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD,
+		observeAttachments: record?.observeAttachments ?? "auto"
+	};
+}
+/** Resolve the memory-settings context for a request, or a ready-to-return error response. */
+async function resolveMemorySettingsContext({ c, auth, memorySettings }) {
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (memorySettings) try {
+		await memorySettings.ensureReady();
+		return tenant ? {
+			storage: memorySettings,
+			orgId: tenantOrgId(tenant),
+			userId: tenant.userId
+		} : {
+			storage: memorySettings,
+			orgId: "local",
+			userId: "local"
+		};
+	} catch {}
+	return { response: c.json({
+		error: "memory_settings_unavailable",
+		message: "Memory settings storage is unavailable — the app database is not configured or failed to start."
+	}, 503) };
+}
+/** Persist an OM knob change to the caller's memory-settings row. */
+async function persistMemorySettings(context, patch, fillIfUnset) {
+	await context.storage.patch({
+		orgId: context.orgId,
+		userId: context.userId,
+		patch,
+		fillIfUnset
+	});
+}
+/**
+* Apply the stored memory-settings row onto the session, so the DB — not
+* whatever happens to sit in persisted session state (e.g. a stale boot-time
+* seed from before memory settings moved to the DB) — is what the web surface
+* reads and what the session's OM actually runs with. The row is authoritative:
+* knobs without a stored value reset to the built-in defaults.
+*/
+async function hydrateSessionMemorySettings(session, record) {
+	for (const role of ["observer", "reflector"]) {
+		const target = (role === "observer" ? record?.observerModelId : record?.reflectorModelId) ?? DEFAULT_OM_MODEL_ID;
+		if (session.om[role].modelId() !== target) await session.om[role].switchModel({ modelId: target });
+	}
+	const state = session.state.get() ?? {};
+	const updates = {};
+	const observationThreshold = record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD;
+	if (state.observationThreshold !== observationThreshold) updates.observationThreshold = observationThreshold;
+	const reflectionThreshold = record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD;
+	if (state.reflectionThreshold !== reflectionThreshold) updates.reflectionThreshold = reflectionThreshold;
+	const observeAttachments = record?.observeAttachments ?? "auto";
+	if ((state.observeAttachments ?? "auto") !== observeAttachments) updates.observeAttachments = observeAttachments;
+	if (Object.keys(updates).length > 0) await session.state.set(updates);
+}
+/**
+* The web config routes as Mastra `apiRoutes`:
+*   - `GET    /web/config/providers`              — list providers + key source
+*   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key
+*   - `DELETE /web/config/providers/:provider/key` — remove a stored API key
+*   - `GET    /web/config/models`                  — list available models (credentialed providers)
+*   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers
+*   - `POST   /web/config/custom-providers`        — create/update a custom provider
+*   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider
+*   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments
+*   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model
+*   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds
+*   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)
+*/
+var ConfigRoutes = class extends Route {
+	routes() {
+		const options = this.deps;
+		const { controller, authStorage, auth } = options;
+		const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});
+		const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});
+		return [
+			registerApiRoute("/web/config/providers", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					try {
+						const tenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						const tenant = auth.tenant(loose(c));
+						const orgKeyAdmin = tenant ? await auth.isOrganizationAdmin(loose(c), tenantOrgId(tenant)) : void 0;
+						return c.json({
+							providers: await listProviders({
+								controller,
+								authStorage: tenantCredentials ? void 0 : authStorage,
+								tenantCredentials
+							}),
+							...orgKeyAdmin !== void 0 ? { orgKeyAdmin } : {}
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/key", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: options.modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const key = typeof body.key === "string" ? body.key.trim() : "";
+					if (!key) return c.json({ error: "Missing required field: key" }, 400);
+					const envVar = typeof body.envVar === "string" ? body.envVar : void 0;
+					const scope = body.scope === "org" ? "org" : "user";
+					try {
+						if (ctx.mode === "tenant") {
+							if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({ error: "organization_admin_required" }, 403);
+							const tenant = scope === "org" ? { orgId: ctx.orgId } : {
+								orgId: ctx.orgId,
+								userId: ctx.userId
+							};
+							await ctx.storage.setCredential(tenant, getAuthProviderId(provider), {
+								type: "api_key",
+								key
+							});
+							onCredentialsChanged(tenant);
+							const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
+							const providers = await listProviders({
+								controller,
+								tenantCredentials: records
+							});
+							return c.json({
+								ok: true,
+								provider: providers.find((p) => p.provider === provider)
+							});
+						}
+						if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+						authStorage.setStoredApiKey(provider, key, envVar);
+						const providers = await listProviders({
+							controller,
+							authStorage
+						});
+						return c.json({
+							ok: true,
+							provider: providers.find((p) => p.provider === provider)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/key", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: options.modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					const scope = c.req.query("scope") === "org" ? "org" : "user";
+					try {
+						if (ctx.mode === "tenant") {
+							if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({ error: "organization_admin_required" }, 403);
+							const tenant = scope === "org" ? { orgId: ctx.orgId } : {
+								orgId: ctx.orgId,
+								userId: ctx.userId
+							};
+							await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));
+							onCredentialsChanged(tenant);
+							const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
+							const providers = await listProviders({
+								controller,
+								tenantCredentials: records
+							});
+							return c.json({
+								ok: true,
+								provider: providers.find((p) => p.provider === provider)
+							});
+						}
+						if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+						authStorage.remove(`apikey:${provider}`);
+						const providers = await listProviders({
+							controller,
+							authStorage
+						});
+						return c.json({
+							ok: true,
+							provider: providers.find((p) => p.provider === provider)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/custom-providers", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCustomProvidersContext({
+						c: loose(c),
+						auth,
+						customProviders: options.customProviders
+					});
+					if ("response" in ctx) return ctx.response;
+					try {
+						const records = await ctx.storage.list({ orgId: ctx.orgId });
+						return c.json({ providers: records.map(toCustomProviderInfo) });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/custom-providers", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCustomProvidersContext({
+						c: loose(c),
+						auth,
+						customProviders: options.customProviders
+					});
+					if ("response" in ctx) return ctx.response;
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const parsed = parseCustomProviderBody(body);
+					if ("error" in parsed) return c.json({ error: parsed.error }, 400);
+					const previousId = body && typeof body === "object" && typeof body.previousId === "string" ? body.previousId : void 0;
+					try {
+						const record = await ctx.storage.upsert({
+							orgId: ctx.orgId,
+							userId: ctx.userId,
+							input: {
+								providerId: getCustomProviderId(parsed.name),
+								name: parsed.name,
+								url: parsed.url,
+								apiKey: parsed.apiKey,
+								models: parsed.models
+							},
+							previousProviderId: previousId
+						});
+						onCustomProvidersChanged({ orgId: ctx.orgId });
+						return c.json({
+							ok: true,
+							provider: toCustomProviderInfo(record)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/custom-providers/:id", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCustomProvidersContext({
+						c: loose(c),
+						auth,
+						customProviders: options.customProviders
+					});
+					if ("response" in ctx) return ctx.response;
+					const id = c.req.param("id");
+					try {
+						await ctx.storage.delete({
+							orgId: ctx.orgId,
+							providerId: id
+						});
+						onCustomProvidersChanged({ orgId: ctx.orgId });
+						return c.json({ ok: true });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/models", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					try {
+						const tenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						const [models, access] = await Promise.all([controller.listAvailableModels(), buildProviderAccess({
+							controller,
+							authStorage: tenantCredentials ? void 0 : authStorage,
+							tenantCredentials
+						})]);
+						const catalog = models.filter((m) => canUseModelProvider(access, m.provider) && typeof m.id === "string").map((m) => ({
+							id: m.id,
+							provider: m.provider,
+							modelName: m.modelName,
+							hasApiKey: true
+						}));
+						if (options.customProviders) try {
+							const ctx = await resolveCustomProvidersContext({
+								c: loose(c),
+								auth,
+								customProviders: options.customProviders
+							});
+							if (!("response" in ctx)) {
+								const known = new Set(catalog.map((m) => m.id));
+								for (const record of await ctx.storage.list({ orgId: ctx.orgId })) for (const model of record.models) {
+									const id = `${record.providerId}/${model}`;
+									if (known.has(id)) continue;
+									known.add(id);
+									catalog.push({
+										id,
+										provider: record.providerId,
+										modelName: model,
+										hasApiKey: true
+									});
+								}
+							}
+						} catch {}
+						return c.json({ models: catalog.sort((a, b) => a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider)) });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/model-packs", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					const packContext = await resolvePackContext({
+						c: loose(c),
+						auth,
+						modelPacks: options.modelPacks
+					});
+					if ("response" in packContext) return packContext.response;
+					const resourceId = c.req.query("resourceId");
+					const scope = c.req.query("scope") || void 0;
+					try {
+						const activePackId = await resolveActivePackId(resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0);
+						const tenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						return c.json({
+							packs: await listModelPacks({
+								controller,
+								authStorage: tenantCredentials ? void 0 : authStorage,
+								tenantCredentials,
+								packContext,
+								activePackId
+							}),
+							activePackId
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/model-packs", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const packContext = await resolvePackContext({
+						c: loose(c),
+						auth,
+						modelPacks: options.modelPacks
+					});
+					if ("response" in packContext) return packContext.response;
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const name = typeof body.name === "string" ? body.name.trim() : "";
+					if (!name) return c.json({ error: "Missing required field: name" }, 400);
+					const m = body.models ?? {};
+					const build = typeof m.build === "string" ? m.build.trim() : "";
+					const plan = typeof m.plan === "string" ? m.plan.trim() : "";
+					const fast = typeof m.fast === "string" ? m.fast.trim() : "";
+					if (!build || !plan || !fast) return c.json({ error: "models.build, models.plan and models.fast are required" }, 400);
+					try {
+						const record = await packContext.storage.upsert({
+							orgId: packContext.orgId,
+							userId: packContext.userId,
+							input: {
+								name,
+								models: {
+									build,
+									plan,
+									fast
+								}
+							}
+						});
+						return c.json({
+							ok: true,
+							pack: recordToModePack(record)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/model-packs/:id", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const packContext = await resolvePackContext({
+						c: loose(c),
+						auth,
+						modelPacks: options.modelPacks
+					});
+					if ("response" in packContext) return packContext.response;
+					const id = decodeURIComponent(c.req.param("id"));
+					try {
+						const recordId = id.startsWith("custom:") ? id.slice(7) : id;
+						return await packContext.storage.delete({
+							orgId: packContext.orgId,
+							id: recordId
+						}) ? c.json({ ok: true }) : c.json({ error: `Unknown pack "${id}"` }, 404);
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/model-packs/:id/activate", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const packContext = await resolvePackContext({
+						c: loose(c),
+						auth,
+						modelPacks: options.modelPacks
+					});
+					if ("response" in packContext) return packContext.response;
+					const id = decodeURIComponent(c.req.param("id"));
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					if (!resourceId) return c.json({ error: "Missing required field: resourceId" }, 400);
+					try {
+						const session = await controller.getSessionByResource?.(resourceId, scope);
+						if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+						const tenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						const pack = (await listModelPacks({
+							controller,
+							authStorage: tenantCredentials ? void 0 : authStorage,
+							tenantCredentials,
+							packContext
+						})).find((p) => p.id === id);
+						if (!pack) return c.json({ error: `Unknown pack "${id}"` }, 404);
+						await applyPackToSession({
+							controller,
+							session,
+							pack
+						});
+						return c.json({
+							ok: true,
+							activePackId: pack.id
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/provider-defaults", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const providerId = typeof body.providerId === "string" ? body.providerId.trim() : "";
+					const factoryModelId = typeof body.factoryModelId === "string" ? body.factoryModelId.trim() : "";
+					if (!providerId) return c.json({ error: "Missing required field: providerId" }, 400);
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings
+					});
+					if ("response" in context) return context.response;
+					try {
+						const tenantCredentials = await listTenantCredentialsForRequest({
+							c: loose(c),
+							auth,
+							credentials: options.modelCredentials
+						});
+						if (!(await buildProviderAccess({
+							controller,
+							authStorage: tenantCredentials ? void 0 : authStorage,
+							tenantCredentials
+						}))[providerId]) return c.json({ error: `Provider "${providerId}" is not configured` }, 400);
+						const modelId = resolveProviderOMDefault(providerId, factoryModelId).modelId;
+						const record = await context.storage.patch({
+							orgId: context.orgId,
+							userId: context.userId,
+							patch: {},
+							fillIfUnset: {
+								observerModelId: modelId,
+								reflectorModelId: modelId
+							}
+						});
+						return c.json({
+							ok: true,
+							config: readStoredOMConfig(record)
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (c) => {
+					const resourceId = c.req.query("resourceId");
+					const scope = c.req.query("scope") || void 0;
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings
+					});
+					if ("response" in context) return context.response;
+					try {
+						const record = await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						});
+						if (!resourceId) return c.json({ config: readStoredOMConfig(record) });
+						const session = await controller.getSessionByResource?.(resourceId, scope);
+						if (!session) return c.json({ config: readStoredOMConfig(record) });
+						await hydrateSessionMemorySettings(session, record);
+						return c.json({ config: readOMConfig(session) });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/:role/model", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					const role = c.req.param("role");
+					if (role !== "observer" && role !== "reflector") return c.json({ error: `Unknown OM role "${role}"` }, 400);
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
+					if (!modelId) return c.json({ error: "Missing required field: modelId" }, 400);
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings
+					});
+					if ("response" in context) return context.response;
+					try {
+						const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
+						const otherRoleCurrentModelId = (session ? role === "observer" ? session.om.reflector : session.om.observer : void 0)?.modelId() ?? null;
+						await session?.om[role].switchModel({ modelId });
+						const otherKey = role === "observer" ? "reflectorModelId" : "observerModelId";
+						await persistMemorySettings(context, { [role === "observer" ? "observerModelId" : "reflectorModelId"]: modelId }, otherRoleCurrentModelId ? { [otherKey]: otherRoleCurrentModelId } : void 0);
+						const config = session ? readOMConfig(session) : readStoredOMConfig(await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						}));
+						return c.json({
+							ok: true,
+							config
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/thresholds", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					const observation = typeof body.observationThreshold === "number" && body.observationThreshold > 0 ? Math.round(body.observationThreshold) : void 0;
+					const reflection = typeof body.reflectionThreshold === "number" && body.reflectionThreshold > 0 ? Math.round(body.reflectionThreshold) : void 0;
+					if (observation === void 0 && reflection === void 0) return c.json({ error: "Provide observationThreshold and/or reflectionThreshold (positive numbers)" }, 400);
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings
+					});
+					if ("response" in context) return context.response;
+					try {
+						const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
+						if (observation !== void 0 && session) {
+							await session.state.set({ observationThreshold: observation });
+							await session.thread.setSetting({
+								key: "observationThreshold",
+								value: observation
+							});
+						}
+						if (reflection !== void 0 && session) {
+							await session.state.set({ reflectionThreshold: reflection });
+							await session.thread.setSetting({
+								key: "reflectionThreshold",
+								value: reflection
+							});
+						}
+						await persistMemorySettings(context, {
+							...observation !== void 0 ? { observationThreshold: observation } : {},
+							...reflection !== void 0 ? { reflectionThreshold: reflection } : {}
+						});
+						const config = session ? readOMConfig(session) : readStoredOMConfig(await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						}));
+						return c.json({
+							ok: true,
+							config
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			}),
+			registerApiRoute("/web/config/om/observe-attachments", {
+				method: "PUT",
+				requiresAuth: false,
+				handler: async (c) => {
+					let body;
+					try {
+						body = await c.req.json();
+					} catch {
+						return c.json({ error: "Invalid JSON body" }, 400);
+					}
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+					const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+					const raw = body.value;
+					const value = raw === "auto" || raw === true || raw === false ? raw : "auto";
+					if (raw !== "auto" && raw !== true && raw !== false) return c.json({ error: "value must be 'auto', true, or false" }, 400);
+					const context = await resolveMemorySettingsContext({
+						c: loose(c),
+						auth,
+						memorySettings: options.memorySettings
+					});
+					if ("response" in context) return context.response;
+					try {
+						const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
+						if (session) {
+							await session.state.set({ observeAttachments: value });
+							await session.thread.setSetting({
+								key: "observeAttachments",
+								value
+							});
+						}
+						await persistMemorySettings(context, { observeAttachments: value });
+						const config = session ? readOMConfig(session) : readStoredOMConfig(await context.storage.get({
+							orgId: context.orgId,
+							userId: context.userId
+						}));
+						return c.json({
+							ok: true,
+							config
+						});
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			})
+		];
+	}
+};
+//#endregion
+export { ConfigRoutes, buildProviderAccess, listModelPacks, listProviders, readOMConfig };
+
+//# sourceMappingURL=config.js.map