@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/dist/routes/config.js

@@ -0,0 +1,770 @@
+// src/routes/config.ts
+import { removeCustomPackFromSettings } from "@mastra/code-sdk/onboarding/custom-packs";
+import {
+  removeCustomProviderFromSettings,
+  upsertCustomProviderInSettings
+} from "@mastra/code-sdk/onboarding/custom-providers";
+import { applyOmRoleOverride, persistOmObserveAttachments } from "@mastra/code-sdk/onboarding/om-settings";
+import { getAvailableModePacks } from "@mastra/code-sdk/onboarding/packs";
+import {
+  getCustomProviderId,
+  loadSettings,
+  saveSettings,
+  THREAD_ACTIVE_MODEL_PACK_ID_KEY
+} from "@mastra/code-sdk/onboarding/settings";
+import { registerApiRoute } from "@mastra/core/server";
+
+// src/routes/provider-credentials.ts
+function getAuthProviderId(provider) {
+  return provider === "openai" ? "openai-codex" : provider;
+}
+var WEB_OAUTH_FLOW_KINDS = {
+  anthropic: "paste-code",
+  openai: "device-code",
+  "github-copilot": "device-code",
+  xai: "device-code"
+};
+async function getTenantCredentialsStorage(credentials) {
+  if (!credentials) return void 0;
+  try {
+    await credentials.ensureReady();
+  } catch {
+    return void 0;
+  }
+  return credentials;
+}
+function tenantOrgId(tenant) {
+  return tenant.orgId ?? `user:${tenant.userId}`;
+}
+async function resolveCredentialContext({
+  c,
+  auth,
+  credentials
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) {
+    if (auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+    return { mode: "local" };
+  }
+  const storage = await getTenantCredentialsStorage(credentials);
+  if (!storage) {
+    return {
+      response: c.json(
+        {
+          error: "credentials_unavailable",
+          message: "Tenant credential storage is unavailable \u2014 the app database is not configured or failed to start."
+        },
+        503
+      )
+    };
+  }
+  return { mode: "tenant", storage, orgId: tenantOrgId(tenant), userId: tenant.userId };
+}
+async function listTenantCredentialsForRequest({
+  c,
+  auth,
+  credentials
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) return auth.enabled() ? [] : void 0;
+  const storage = await getTenantCredentialsStorage(credentials);
+  if (!storage) return [];
+  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);
+}
+
+// src/routes/route.ts
+var Route = class {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+};
+
+// src/routes/config.ts
+function loose(c) {
+  return c;
+}
+async function listProviders({
+  controller,
+  authStorage,
+  tenantCredentials
+}) {
+  const models = await controller.listAvailableModels();
+  const seen = /* @__PURE__ */ new Map();
+  for (const model of models) {
+    if (seen.has(model.provider)) continue;
+    const authProviderId = getAuthProviderId(model.provider);
+    let source = "none";
+    if (tenantCredentials) {
+      const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
+      const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
+      if (userRec?.credential.type === "oauth") {
+        source = "oauth-user";
+      } else if (userRec?.credential.type === "api_key") {
+        source = "stored-user";
+      } else if (orgRec?.credential.type === "api_key") {
+        source = "stored-org";
+      }
+    } else if (authStorage?.isLoggedIn(authProviderId)) {
+      source = "oauth";
+    } else if (authStorage?.hasStoredApiKey(model.provider)) {
+      source = "stored";
+    } else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) {
+      source = "env";
+    } else if (model.hasApiKey) {
+      source = "env";
+    }
+    const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];
+    seen.set(model.provider, {
+      provider: model.provider,
+      envVar: model.apiKeyEnvVar,
+      source,
+      ...flowKind ? { oauth: { supported: true, modes: [flowKind] } } : {}
+    });
+  }
+  return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));
+}
+function listCustomProviders() {
+  const settings = loadSettings();
+  return settings.customProviders.map((p) => ({
+    id: getCustomProviderId(p.name),
+    name: p.name,
+    url: p.url,
+    hasApiKey: Boolean(p.apiKey),
+    models: p.models
+  }));
+}
+function parseCustomProviderBody(body) {
+  if (!body || typeof body !== "object") return { error: "Invalid JSON body" };
+  const b = body;
+  const name = typeof b.name === "string" ? b.name.trim() : "";
+  if (!name) return { error: "Missing required field: name" };
+  const url = typeof b.url === "string" ? b.url.trim() : "";
+  if (!url) return { error: "Missing required field: url" };
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { error: "url must be an http(s) URL" };
+    }
+  } catch {
+    return { error: "url must be a valid URL" };
+  }
+  const apiKey = typeof b.apiKey === "string" && b.apiKey.trim() ? b.apiKey.trim() : void 0;
+  const models = Array.isArray(b.models) ? b.models.filter((m) => typeof m === "string" && m.trim().length > 0).map((m) => m.trim()) : [];
+  return { name, url, apiKey, models };
+}
+async function buildProviderAccess({
+  controller,
+  authStorage,
+  tenantCredentials
+}) {
+  const models = await controller.listAvailableModels();
+  const hasModelKey = (provider) => models.some((m) => m.provider === provider && m.hasApiKey);
+  const accessLevel = (provider) => {
+    const authProviderId = getAuthProviderId(provider);
+    if (tenantCredentials) {
+      const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
+      const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
+      const credential = userRec?.credential ?? orgRec?.credential;
+      if (credential?.type === "oauth") return "oauth";
+      if (credential?.type === "api_key" && credential.key.trim().length > 0) return "apikey";
+      return false;
+    }
+    const oauthCredential = authStorage?.get(authProviderId);
+    if (oauthCredential?.type === "oauth") return "oauth";
+    if (authStorage?.hasStoredApiKey(provider)) return "apikey";
+    const directCredential = authStorage?.get(provider);
+    if (directCredential?.type === "api_key" && directCredential.key.trim().length > 0) return "apikey";
+    return hasModelKey(provider) ? "apikey" : false;
+  };
+  const access = {
+    anthropic: accessLevel("anthropic"),
+    openai: accessLevel("openai"),
+    cerebras: accessLevel("cerebras"),
+    google: accessLevel("google"),
+    deepseek: accessLevel("deepseek"),
+    "github-copilot": accessLevel("github-copilot")
+  };
+  const seen = new Set(Object.keys(access));
+  for (const m of models) {
+    if (!seen.has(m.provider)) {
+      access[m.provider] = accessLevel(m.provider);
+      seen.add(m.provider);
+    }
+  }
+  return access;
+}
+function canUseModelProvider(access, provider) {
+  return Boolean(access[provider]);
+}
+async function getTenantModelPacksStorage(modelPacks) {
+  if (!modelPacks) return void 0;
+  try {
+    await modelPacks.ensureReady();
+  } catch {
+    return void 0;
+  }
+  return modelPacks;
+}
+async function resolvePackContext({
+  c,
+  auth,
+  modelPacks
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) {
+    if (auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+    return { mode: "local" };
+  }
+  const storage = await getTenantModelPacksStorage(modelPacks);
+  if (!storage) {
+    return {
+      response: c.json(
+        {
+          error: "model_packs_unavailable",
+          message: "Model pack storage is unavailable \u2014 the app database is not configured or failed to start."
+        },
+        503
+      )
+    };
+  }
+  return { mode: "tenant", storage, orgId: tenantOrgId(tenant), userId: tenant.userId };
+}
+function recordToModePack(record) {
+  return { id: `custom:${record.id}`, name: record.name, description: "Saved custom pack", models: record.models };
+}
+async function listModelPacks({
+  controller,
+  authStorage,
+  tenantCredentials,
+  packContext,
+  activePackId
+}) {
+  const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });
+  const packs = packContext.mode === "local" ? getAvailableModePacks(access, loadSettings().customModelPacks) : [
+    ...getAvailableModePacks(access),
+    ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack)
+  ];
+  return packs.filter((p) => p.id !== "custom").map((p) => ({
+    ...p,
+    custom: p.id.startsWith("custom:"),
+    active: activePackId != null && p.id === activePackId
+  }));
+}
+async function resolveActivePackId(session) {
+  if (!session) return null;
+  const threadId = session.thread.getId();
+  if (!threadId) return null;
+  const thread = (await session.thread.list()).find((t) => t.id === threadId);
+  const value = thread?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];
+  return typeof value === "string" ? value : null;
+}
+async function applyPackToSession({
+  controller,
+  session,
+  pack
+}) {
+  const modes = controller.listModes?.() ?? [];
+  const packModels = pack.models;
+  for (const mode of modes) {
+    const modelId = packModels[mode.id];
+    if (modelId) {
+      mode.defaultModelId = modelId;
+      await session.thread.setSetting({ key: `modeModelId_${mode.id}`, value: modelId });
+    }
+  }
+  const currentModeModel = packModels[session.mode.get()];
+  if (currentModeModel) {
+    await session.model.switch({ modelId: currentModeModel });
+  }
+  const subagentModeMap = { explore: "fast", plan: "plan", execute: "build" };
+  for (const [agentType, modeId] of Object.entries(subagentModeMap)) {
+    const saModelId = packModels[modeId];
+    if (saModelId) {
+      await session.subagents.model.set({ modelId: saModelId, agentType });
+    }
+  }
+  await session.thread.setSetting({ key: THREAD_ACTIVE_MODEL_PACK_ID_KEY, value: pack.id });
+}
+var DEFAULT_OBSERVATION_THRESHOLD = 3e4;
+var DEFAULT_REFLECTION_THRESHOLD = 4e4;
+function readOMConfig(session) {
+  const state = session.state.get() ?? {};
+  const observeAttachments = state.observeAttachments;
+  return {
+    observerModelId: session.om.observer.modelId() ?? "",
+    reflectorModelId: session.om.reflector.modelId() ?? "",
+    observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,
+    reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,
+    observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : "auto"
+  };
+}
+function persistOmThreshold({ role, value }) {
+  const settings = loadSettings();
+  if (role === "observation") settings.models.omObservationThreshold = value;
+  else settings.models.omReflectionThreshold = value;
+  saveSettings(settings);
+}
+function persistOmRoleOverride({
+  role,
+  modelId,
+  otherRoleCurrentModelId
+}) {
+  const settings = loadSettings();
+  applyOmRoleOverride(settings, role, modelId, otherRoleCurrentModelId);
+  saveSettings(settings);
+}
+var ConfigRoutes = class extends Route {
+  routes() {
+    const options = this.deps;
+    const { controller, authStorage, auth } = options;
+    const onCredentialsChanged = options.onCredentialsChanged ?? (() => {
+    });
+    return [
+      registerApiRoute("/web/config/providers", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          try {
+            const tenantCredentials = await listTenantCredentialsForRequest({
+              c: loose(c),
+              auth,
+              credentials: options.modelCredentials
+            });
+            return c.json({
+              providers: await listProviders({
+                controller,
+                authStorage: tenantCredentials ? void 0 : authStorage,
+                tenantCredentials
+              })
+            });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/providers/:provider/key", {
+        method: "PUT",
+        requiresAuth: false,
+        handler: async (c) => {
+          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });
+          if ("response" in ctx) return ctx.response;
+          const provider = c.req.param("provider");
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const key = typeof body.key === "string" ? body.key.trim() : "";
+          if (!key) return c.json({ error: "Missing required field: key" }, 400);
+          const envVar = typeof body.envVar === "string" ? body.envVar : void 0;
+          const scope = body.scope === "org" ? "org" : "user";
+          try {
+            if (ctx.mode === "tenant") {
+              if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) {
+                return c.json({ error: "organization_admin_required" }, 403);
+              }
+              const tenant = scope === "org" ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };
+              await ctx.storage.setCredential(tenant, getAuthProviderId(provider), { type: "api_key", key });
+              onCredentialsChanged(tenant);
+              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
+              const providers2 = await listProviders({ controller, tenantCredentials: records });
+              return c.json({ ok: true, provider: providers2.find((p) => p.provider === provider) });
+            }
+            if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+            authStorage.setStoredApiKey(provider, key, envVar);
+            const providers = await listProviders({ controller, authStorage });
+            return c.json({ ok: true, provider: providers.find((p) => p.provider === provider) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/providers/:provider/key", {
+        method: "DELETE",
+        requiresAuth: false,
+        handler: async (c) => {
+          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });
+          if ("response" in ctx) return ctx.response;
+          const provider = c.req.param("provider");
+          const scope = c.req.query("scope") === "org" ? "org" : "user";
+          try {
+            if (ctx.mode === "tenant") {
+              if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) {
+                return c.json({ error: "organization_admin_required" }, 403);
+              }
+              const tenant = scope === "org" ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };
+              await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));
+              onCredentialsChanged(tenant);
+              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
+              const providers2 = await listProviders({ controller, tenantCredentials: records });
+              return c.json({ ok: true, provider: providers2.find((p) => p.provider === provider) });
+            }
+            if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+            authStorage.remove(`apikey:${provider}`);
+            const providers = await listProviders({ controller, authStorage });
+            return c.json({ ok: true, provider: providers.find((p) => p.provider === provider) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────
+      // Mirrors the TUI's /custom-providers command. Backed by GlobalSettings
+      // (settings.json), not session state — these are user-global definitions.
+      registerApiRoute("/web/config/custom-providers", {
+        method: "GET",
+        requiresAuth: false,
+        handler: (c) => {
+          try {
+            return c.json({ providers: listCustomProviders() });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/custom-providers", {
+        method: "POST",
+        requiresAuth: false,
+        handler: async (c) => {
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const parsed = parseCustomProviderBody(body);
+          if ("error" in parsed) return c.json({ error: parsed.error }, 400);
+          const previousId = body && typeof body === "object" && typeof body.previousId === "string" ? body.previousId : void 0;
+          try {
+            const settings = loadSettings();
+            upsertCustomProviderInSettings(settings, parsed, previousId);
+            saveSettings(settings);
+            const id = getCustomProviderId(parsed.name);
+            return c.json({ ok: true, provider: listCustomProviders().find((p) => p.id === id) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/custom-providers/:id", {
+        method: "DELETE",
+        requiresAuth: false,
+        handler: (c) => {
+          const id = c.req.param("id");
+          try {
+            const settings = loadSettings();
+            removeCustomProviderFromSettings(settings, id);
+            saveSettings(settings);
+            return c.json({ ok: true });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      // ── Available models ────────────────────────────────────────────────────
+      // Session-independent model catalog for settings pickers (Factory default
+      // model, pack editors). Only models whose provider has a credential are
+      // returned — the same filter the session-scoped hook applies client-side.
+      registerApiRoute("/web/config/models", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          try {
+            const tenantCredentials = await listTenantCredentialsForRequest({
+              c: loose(c),
+              auth,
+              credentials: options.modelCredentials
+            });
+            const [models, access] = await Promise.all([
+              controller.listAvailableModels(),
+              buildProviderAccess({
+                controller,
+                authStorage: tenantCredentials ? void 0 : authStorage,
+                tenantCredentials
+              })
+            ]);
+            return c.json({
+              models: models.filter((m) => canUseModelProvider(access, m.provider) && typeof m.id === "string").map((m) => ({ id: m.id, provider: m.provider, modelName: m.modelName, hasApiKey: true })).sort(
+                (a, b) => a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider)
+              )
+            });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      // ── Model packs ─────────────────────────────────────────────────────────
+      // Mirrors the TUI's /models-pack command. Custom-pack CRUD is DB-backed in
+      // tenant mode (model-packs storage domain, org-scoped) and settings.json in
+      // local mode; activation is session-scoped and resolves the session from
+      // the controller registry by resourceId.
+      registerApiRoute("/web/config/model-packs", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });
+          if ("response" in packContext) return packContext.response;
+          const resourceId = c.req.query("resourceId");
+          const scope = c.req.query("scope") || void 0;
+          try {
+            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
+            const activePackId = await resolveActivePackId(session);
+            const tenantCredentials = await listTenantCredentialsForRequest({
+              c: loose(c),
+              auth,
+              credentials: options.modelCredentials
+            });
+            return c.json({
+              packs: await listModelPacks({
+                controller,
+                authStorage: tenantCredentials ? void 0 : authStorage,
+                tenantCredentials,
+                packContext,
+                activePackId
+              }),
+              activePackId
+            });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/model-packs", {
+        method: "POST",
+        requiresAuth: false,
+        handler: async (c) => {
+          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });
+          if ("response" in packContext) return packContext.response;
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const name = typeof body.name === "string" ? body.name.trim() : "";
+          if (!name) return c.json({ error: "Missing required field: name" }, 400);
+          const m = body.models ?? {};
+          const build = typeof m.build === "string" ? m.build.trim() : "";
+          const plan = typeof m.plan === "string" ? m.plan.trim() : "";
+          const fast = typeof m.fast === "string" ? m.fast.trim() : "";
+          if (!build || !plan || !fast) {
+            return c.json({ error: "models.build, models.plan and models.fast are required" }, 400);
+          }
+          try {
+            if (packContext.mode === "tenant") {
+              const record = await packContext.storage.upsert({
+                orgId: packContext.orgId,
+                userId: packContext.userId,
+                input: { name, models: { build, plan, fast } }
+              });
+              return c.json({ ok: true, pack: recordToModePack(record) });
+            }
+            const settings = loadSettings();
+            const entry = { name, models: { build, plan, fast }, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+            const idx = settings.customModelPacks.findIndex((p) => p.name === name);
+            if (idx >= 0) settings.customModelPacks[idx] = entry;
+            else settings.customModelPacks.push(entry);
+            saveSettings(settings);
+            return c.json({ ok: true, pack: { id: `custom:${name}`, name, models: { build, plan, fast } } });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/model-packs/:id", {
+        method: "DELETE",
+        requiresAuth: false,
+        handler: async (c) => {
+          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });
+          if ("response" in packContext) return packContext.response;
+          const id = decodeURIComponent(c.req.param("id"));
+          try {
+            if (packContext.mode === "tenant") {
+              const recordId = id.startsWith("custom:") ? id.slice("custom:".length) : id;
+              const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });
+              return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack "${id}"` }, 404);
+            }
+            const settings = loadSettings();
+            removeCustomPackFromSettings(settings, id);
+            saveSettings(settings);
+            return c.json({ ok: true });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/model-packs/:id/activate", {
+        method: "POST",
+        requiresAuth: false,
+        handler: async (c) => {
+          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });
+          if ("response" in packContext) return packContext.response;
+          const id = decodeURIComponent(c.req.param("id"));
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+          const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+          if (!resourceId) return c.json({ error: "Missing required field: resourceId" }, 400);
+          try {
+            const session = await controller.getSessionByResource?.(resourceId, scope);
+            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            const tenantCredentials = await listTenantCredentialsForRequest({
+              c: loose(c),
+              auth,
+              credentials: options.modelCredentials
+            });
+            const packs = await listModelPacks({
+              controller,
+              authStorage: tenantCredentials ? void 0 : authStorage,
+              tenantCredentials,
+              packContext
+            });
+            const pack = packs.find((p) => p.id === id);
+            if (!pack) return c.json({ error: `Unknown pack "${id}"` }, 404);
+            await applyPackToSession({ controller, session, pack });
+            return c.json({ ok: true, activePackId: pack.id });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      // ── Observational memory ──────────────────────────────────────────────────
+      // Mirrors the TUI's /om command. All five knobs are session-scoped (resolved
+      // from the session, persisted to its state + thread setting) plus written to
+      // GlobalSettings so the choice survives restarts and stays in sync with the TUI.
+      registerApiRoute("/web/config/om", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          const resourceId = c.req.query("resourceId");
+          const scope = c.req.query("scope") || void 0;
+          if (!resourceId) return c.json({ error: "Missing required query param: resourceId" }, 400);
+          try {
+            const session = await controller.getSessionByResource?.(resourceId, scope);
+            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            return c.json({ config: readOMConfig(session) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/om/:role/model", {
+        method: "PUT",
+        requiresAuth: false,
+        handler: async (c) => {
+          const role = c.req.param("role");
+          if (role !== "observer" && role !== "reflector") {
+            return c.json({ error: `Unknown OM role "${role}"` }, 400);
+          }
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+          const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+          const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
+          if (!resourceId) return c.json({ error: "Missing required field: resourceId" }, 400);
+          if (!modelId) return c.json({ error: "Missing required field: modelId" }, 400);
+          try {
+            const session = await controller.getSessionByResource?.(resourceId, scope);
+            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            const otherRole = role === "observer" ? session.om.reflector : session.om.observer;
+            const otherRoleCurrentModelId = otherRole.modelId() ?? null;
+            await session.om[role].switchModel({ modelId });
+            persistOmRoleOverride({ role, modelId, otherRoleCurrentModelId });
+            return c.json({ ok: true, config: readOMConfig(session) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/om/thresholds", {
+        method: "PUT",
+        requiresAuth: false,
+        handler: async (c) => {
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+          const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+          if (!resourceId) return c.json({ error: "Missing required field: resourceId" }, 400);
+          const observation = typeof body.observationThreshold === "number" && body.observationThreshold > 0 ? Math.round(body.observationThreshold) : void 0;
+          const reflection = typeof body.reflectionThreshold === "number" && body.reflectionThreshold > 0 ? Math.round(body.reflectionThreshold) : void 0;
+          if (observation === void 0 && reflection === void 0) {
+            return c.json({ error: "Provide observationThreshold and/or reflectionThreshold (positive numbers)" }, 400);
+          }
+          try {
+            const session = await controller.getSessionByResource?.(resourceId, scope);
+            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            if (observation !== void 0) {
+              await session.state.set({ observationThreshold: observation });
+              await session.thread.setSetting({ key: "observationThreshold", value: observation });
+              persistOmThreshold({ role: "observation", value: observation });
+            }
+            if (reflection !== void 0) {
+              await session.state.set({ reflectionThreshold: reflection });
+              await session.thread.setSetting({ key: "reflectionThreshold", value: reflection });
+              persistOmThreshold({ role: "reflection", value: reflection });
+            }
+            return c.json({ ok: true, config: readOMConfig(session) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      }),
+      registerApiRoute("/web/config/om/observe-attachments", {
+        method: "PUT",
+        requiresAuth: false,
+        handler: async (c) => {
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const resourceId = typeof body.resourceId === "string" ? body.resourceId : "";
+          const scope = typeof body.scope === "string" && body.scope ? body.scope : void 0;
+          if (!resourceId) return c.json({ error: "Missing required field: resourceId" }, 400);
+          const raw = body.value;
+          const value = raw === "auto" || raw === true || raw === false ? raw : "auto";
+          if (raw !== "auto" && raw !== true && raw !== false) {
+            return c.json({ error: "value must be 'auto', true, or false" }, 400);
+          }
+          try {
+            const session = await controller.getSessionByResource?.(resourceId, scope);
+            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            await session.state.set({ observeAttachments: value });
+            await session.thread.setSetting({ key: "observeAttachments", value });
+            persistOmObserveAttachments(value);
+            return c.json({ ok: true, config: readOMConfig(session) });
+          } catch (error) {
+            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+          }
+        }
+      })
+    ];
+  }
+};
+export {
+  ConfigRoutes,
+  buildProviderAccess,
+  listCustomProviders,
+  listModelPacks,
+  listProviders,
+  readOMConfig
+};
+//# sourceMappingURL=config.js.map