@mastra/factory 0.20.0-alpha.10 → 0.21.0-alpha.0

package/dist/routes/config.d.ts

@@ -24,8 +24,10 @@ import type { RouteDependencies } from './route.js';
  * Where a provider's active credential comes from, as seen by the caller.
  * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode
  * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).
+ * `deployment` (tenant mode) marks a provider the operator opted in to run on
+ * the server process's own credentials (e.g. Amazon Bedrock's AWS chain).
  */
-export type ProviderCredentialSource = 'oauth' | 'stored' | 'env' | 'none' | 'oauth-user' | 'oauth-org' | 'stored-user' | 'stored-org';
+export type ProviderCredentialSource = 'deployment' | 'oauth' | 'stored' | 'env' | 'none' | 'oauth-user' | 'oauth-org' | 'stored-user' | 'stored-org';
 /** A model provider with the current source of its credentials. */
 export interface ProviderInfo {
     provider: string;
@@ -114,10 +116,11 @@ interface ModelCatalog {
  * *caller's* tenant rows with user > org precedence and the server-global
  * `authStorage` is ignored; otherwise the local `auth.json` view is reported.
  */
-export declare function listProviders({ controller, authStorage, tenantCredentials, }: {
+export declare function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders, }: {
     controller: ModelCatalog;
     authStorage?: AuthStorage;
     tenantCredentials?: CredentialRecord[];
+    deploymentProviders?: ReadonlySet<string>;
 }): Promise<ProviderInfo[]>;
 /** A user-defined OpenAI-compatible provider, with key presence (never the key). */
 export interface CustomProviderInfo {
@@ -127,15 +130,29 @@ export interface CustomProviderInfo {
     hasApiKey: boolean;
     models: string[];
 }
+/**
+ * Providers whose credentials can only come from the server process (Amazon
+ * Bedrock authenticates through the AWS credential chain). In tenant mode they
+ * are usable only when the operator lists them in
+ * `MastraFactoryConfig.deploymentModelProviders`.
+ */
+export declare const DEPLOYMENT_MODEL_PROVIDERS: readonly string[];
+export declare function isDeploymentModelProvider(provider: string): boolean;
+/**
+ * Normalize the operator's `deploymentModelProviders` list. Unsupported ids are
+ * ignored with a warning rather than failing boot.
+ */
+export declare function resolveDeploymentModelProviders(providers: readonly string[] | undefined): ReadonlySet<string>;
 /**
  * Compute which providers the user can reach, mirroring the TUI's
  * `/models-pack` access derivation: OAuth/api-key from the credential store for
  * the named providers, plus any other provider that has a usable key.
  */
-export declare function buildProviderAccess({ controller, authStorage, tenantCredentials, }: {
+export declare function buildProviderAccess({ controller, authStorage, tenantCredentials, deploymentProviders, }: {
     controller: ModelCatalog;
     authStorage?: AuthStorage;
     tenantCredentials?: CredentialRecord[];
+    deploymentProviders?: ReadonlySet<string>;
 }): Promise<ProviderAccess>;
 /** Per-user default model context for the current request. */
 export interface ModelDefaultsContext {
@@ -203,6 +220,11 @@ export interface ConfigRoutesDeps extends RouteDependencies {
     onCustomProvidersChanged?: (tenant: {
         orgId: string;
     }) => void;
+    /**
+     * Tenant mode: providers the operator opted in to run on the server process's
+     * own credentials (see `DEPLOYMENT_MODEL_PROVIDERS`).
+     */
+    deploymentProviders?: ReadonlySet<string>;
     /**
      * Path of the server's settings.json backing the deployment-scoped thinking
      * defaults. Defaults to the standard app-data location; injectable for tests.

package/dist/routes/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,mCAAmC,CAAC;AAQ7F,OAAO,KAAK,EAAyB,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAUpD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAwB,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAEhH,OAAO,KAAK,EAIV,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAS5F,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/D;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,QAAQ,GACR,KAAK,GACL,MAAM,GACN,YAAY,GACZ,WAAW,GACX,aAAa,GACb,YAAY,CAAC;AAEjB,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,wEAAwE;IACxE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,mEAAmE;IACnE,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;CACxD;AAED,2DAA2D;AAC3D,UAAU,MAAM;IACd,OAAO,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,UAAU,aAAa;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,CAAC,GAAG,EAAE,mBAAmB,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;QAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KACvD,CAAC;IACF,MAAM,EAAE;QACN,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACtE,CAAC;IACF,EAAE,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,uFAAuF;AACvF,UAAU,YAAY;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAChC,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CACxG,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAmD1B;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAmFD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,cAAc,CAAC,CAqC1B;AAQD,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACxC,yEAAyE;IACzE,aAAa,EAAE,oBAAoB,CAAC;IACpC,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACpD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,YAAY,CAU7D;AA2FD,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,yEAAyE;IACzE,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvF,0EAA0E;IAC1E,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,2FAA2F;IAC3F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5E,6FAA6F;IAC7F,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAa,SAAQ,KAAK,CAAC,gBAAgB,CAAC;IACvD,MAAM,IAAI,QAAQ,EAAE;CAmtBrB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,mCAAmC,CAAC;AAQ7F,OAAO,KAAK,EAAyB,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAExG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAUpD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAwB,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAEhH,OAAO,KAAK,EAIV,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAS5F,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/D;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC,YAAY,GACZ,OAAO,GACP,QAAQ,GACR,KAAK,GACL,MAAM,GACN,YAAY,GACZ,WAAW,GACX,aAAa,GACb,YAAY,CAAC;AAEjB,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,wEAAwE;IACxE,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,mEAAmE;IACnE,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;CACxD;AAED,2DAA2D;AAC3D,UAAU,MAAM;IACd,OAAO,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,UAAU,aAAa;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,CAAC,GAAG,EAAE,mBAAmB,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;QAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KACvD,CAAC;IACF,MAAM,EAAE;QACN,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACtE,CAAC;IACF,EAAE,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,uFAAuF;AACvF,UAAU,YAAY;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAChC,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CACxG,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA6D1B;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAmFD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAAgC,CAAC;AAEzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAc7G;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1B;AAQD,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACxC,yEAAyE;IACzE,aAAa,EAAE,oBAAoB,CAAC;IACpC,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACpD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,YAAY,CAU7D;AA2FD,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,yEAAyE;IACzE,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvF,0EAA0E;IAC1E,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,2FAA2F;IAC3F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5E,6FAA6F;IAC7F,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/D;;;OAGG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAa,SAAQ,KAAK,CAAC,gBAAgB,CAAC;IACvD,MAAM,IAAI,QAAQ,EAAE;CAiuBrB"}

package/dist/routes/config.js

@@ -1,13 +1,14 @@
 import { WEB_OAUTH_FLOW_KINDS, getAuthProviderId, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId } from "./provider-credentials.js";
-import { Route } from "./route.js";
 import { factoryMemorySettingsUserId } from "../storage/domains/memory-settings/base.js";
 import { applyStoredMemorySettings } from "../session/memory-settings-hydration.js";
 import { seedPersonalOmDefaults } from "./om-seed.js";
+import { Route } from "./route.js";
 import { registerApiRoute } from "@mastra/core/server";
 import { z } from "zod";
-import { resolveProviderOMDefault } from "@mastra/code-sdk/onboarding/packs";
 import { DEFAULT_OM_MODEL_ID } from "@mastra/code-sdk/constants";
+import { resolveProviderOMDefault } from "@mastra/code-sdk/onboarding/packs";
 import { THINKING_LEVEL_VALUES, getCustomProviderId, isThinkingLevelSetting, loadSettings, saveSettings } from "@mastra/code-sdk/onboarding/settings";
+import { AMAZON_BEDROCK_GATEWAY_ID } from "@mastra/code-sdk/providers/amazon-bedrock-gateway";
 //#region src/routes/config.ts
 /** Widen a route-local Hono context to the plain `Context` the auth helpers take. */
 function loose(c) {
@@ -22,11 +23,18 @@ function loose(c) {
 * *caller's* tenant rows with user > org precedence and the server-global
 * `authStorage` is ignored; otherwise the local `auth.json` view is reported.
 */
-async function listProviders({ controller, authStorage, tenantCredentials }) {
+async function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders }) {
 	const models = await controller.listAvailableModels();
 	const seen = /* @__PURE__ */ new Map();
 	for (const model of models) {
 		if (seen.has(model.provider)) continue;
+		if (tenantCredentials && isDeploymentModelProvider(model.provider)) {
+			if (deploymentProviders?.has(model.provider) && models.some((m) => m.provider === model.provider && m.hasApiKey)) seen.set(model.provider, {
+				provider: model.provider,
+				source: "deployment"
+			});
+			continue;
+		}
 		const authProviderId = getAuthProviderId(model.provider);
 		let source = "none";
 		let orgKey;
@@ -120,16 +128,41 @@ function parseCustomProviderBody(body) {
 	};
 }
 /**
+* Providers whose credentials can only come from the server process (Amazon
+* Bedrock authenticates through the AWS credential chain). In tenant mode they
+* are usable only when the operator lists them in
+* `MastraFactoryConfig.deploymentModelProviders`.
+*/
+const DEPLOYMENT_MODEL_PROVIDERS = [AMAZON_BEDROCK_GATEWAY_ID];
+function isDeploymentModelProvider(provider) {
+	return DEPLOYMENT_MODEL_PROVIDERS.includes(provider);
+}
+/**
+* Normalize the operator's `deploymentModelProviders` list. Unsupported ids are
+* ignored with a warning rather than failing boot.
+*/
+function resolveDeploymentModelProviders(providers) {
+	const resolved = /* @__PURE__ */ new Set();
+	for (const raw of providers ?? []) {
+		const provider = raw.trim();
+		if (!provider) continue;
+		if (isDeploymentModelProvider(provider)) resolved.add(provider);
+		else console.warn(`[factory] Ignoring deployment model provider "${provider}". Supported: ${DEPLOYMENT_MODEL_PROVIDERS.join(", ")}.`);
+	}
+	return resolved;
+}
+/**
 * Compute which providers the user can reach, mirroring the TUI's
 * `/models-pack` access derivation: OAuth/api-key from the credential store for
 * the named providers, plus any other provider that has a usable key.
 */
-async function buildProviderAccess({ controller, authStorage, tenantCredentials }) {
+async function buildProviderAccess({ controller, authStorage, tenantCredentials, deploymentProviders }) {
 	const models = await controller.listAvailableModels();
 	const hasModelKey = (provider) => models.some((m) => m.provider === provider && m.hasApiKey);
 	const accessLevel = (provider) => {
 		const authProviderId = getAuthProviderId(provider);
 		if (tenantCredentials) {
+			if (isDeploymentModelProvider(provider)) return deploymentProviders?.has(provider) && hasModelKey(provider) ? "apikey" : false;
 			const userRec = tenantCredentials.find((r) => r.scope === "user" && r.provider === authProviderId);
 			const orgRec = tenantCredentials.find((r) => r.scope === "org" && r.provider === authProviderId);
 			const credential = userRec?.credential ?? orgRec?.credential;
@@ -273,7 +306,7 @@ async function persistMemorySettings(context, patch, fillIfUnset) {
 var ConfigRoutes = class extends Route {
 	routes() {
 		const options = this.deps;
-		const { controller, authStorage, auth } = options;
+		const { controller, authStorage, auth, deploymentProviders } = options;
 		const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});
 		const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});
 		const factoryOmFallback = async (factoryProjectId) => {
@@ -308,7 +341,8 @@ var ConfigRoutes = class extends Route {
 							providers: await listProviders({
 								controller,
 								authStorage: tenantCredentials ? void 0 : authStorage,
-								tenantCredentials
+								tenantCredentials,
+								deploymentProviders
 							}),
 							...orgKeyAdmin !== void 0 ? { orgKeyAdmin } : {}
 						});
@@ -340,6 +374,10 @@ var ConfigRoutes = class extends Route {
 					const scope = body.scope === "org" ? "org" : "user";
 					try {
 						if (ctx.mode === "tenant") {
+							if (isDeploymentModelProvider(provider)) return c.json({
+								error: "provider_configured_by_deployment",
+								message: `${provider} is configured by the Factory deployment (credentials on the server), not per account.`
+							}, 400);
 							if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({ error: "organization_admin_required" }, 403);
 							const tenant = scope === "org" ? { orgId: ctx.orgId } : {
 								orgId: ctx.orgId,
@@ -358,7 +396,8 @@ var ConfigRoutes = class extends Route {
 							const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
 							const providers = await listProviders({
 								controller,
-								tenantCredentials: records
+								tenantCredentials: records,
+								deploymentProviders
 							});
 							return c.json({
 								ok: true,
@@ -404,7 +443,8 @@ var ConfigRoutes = class extends Route {
 							const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);
 							const providers = await listProviders({
 								controller,
-								tenantCredentials: records
+								tenantCredentials: records,
+								deploymentProviders
 							});
 							return c.json({
 								ok: true,
@@ -522,7 +562,8 @@ var ConfigRoutes = class extends Route {
 						const [models, access] = await Promise.all([controller.listAvailableModels(), buildProviderAccess({
 							controller,
 							authStorage: tenantCredentials ? void 0 : authStorage,
-							tenantCredentials
+							tenantCredentials,
+							deploymentProviders
 						})]);
 						const catalog = models.filter((m) => canUseModelProvider(access, m.provider) && typeof m.id === "string").map((m) => ({
 							id: m.id,
@@ -728,7 +769,8 @@ var ConfigRoutes = class extends Route {
 						if (!(await buildProviderAccess({
 							controller,
 							authStorage: tenantCredentials ? void 0 : authStorage,
-							tenantCredentials
+							tenantCredentials,
+							deploymentProviders
 						}))[providerId]) return c.json({ error: `Provider "${providerId}" is not configured` }, 400);
 						const modelId = resolveProviderOMDefault(providerId, factoryModelId).modelId;
 						const record = await context.storage.patch({
@@ -932,6 +974,6 @@ var ConfigRoutes = class extends Route {
 	}
 };
 //#endregion
-export { ConfigRoutes, buildProviderAccess, listProviders, readOMConfig };
+export { ConfigRoutes, DEPLOYMENT_MODEL_PROVIDERS, buildProviderAccess, isDeploymentModelProvider, listProviders, readOMConfig, resolveDeploymentModelProviders };
 
 //# sourceMappingURL=config.js.map