@mastra/factory 0.25.0-alpha.8 → 0.26.0-alpha.0

package/dist/routes/config.js

@@ -8,6 +8,7 @@ import { factoryMemorySettingsUserId } from "../storage/domains/memory-settings/
 import { Route } from "./route.js";
 import { RequestContext } from "@mastra/core/request-context";
 import { registerApiRoute } from "@mastra/core/server";
+import { MIN_OBSERVATION_THRESHOLD } from "@mastra/code-sdk/constants";
 import { z } from "zod";
 import { MASTRA_GATEWAY_PREFIX } from "@mastra/code-sdk/providers/model-ids";
 import { MastraCodeGateway } from "@mastra/code-sdk/agents/mastracode-gateway";
@@ -29,7 +30,7 @@ function loose(c) {
 * *caller's* tenant rows with user > org precedence and the server-global
 * `authStorage` is ignored; otherwise the local `auth.json` view is reported.
 */
-async function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders }) {
+async function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders, listCustomProviders }) {
 	const models = await controller.listAvailableModels();
 	const seen = /* @__PURE__ */ new Map();
 	for (const model of models) {
@@ -80,6 +81,16 @@ async function listProviders({ controller, authStorage, tenantCredentials, deplo
 			} } : {}
 		});
 	}
+	if (listCustomProviders) try {
+		for (const record of await listCustomProviders()) {
+			if (seen.has(record.providerId)) continue;
+			seen.set(record.providerId, {
+				provider: record.providerId,
+				source: tenantCredentials ? "stored-org" : "stored",
+				custom: true
+			});
+		}
+	} catch {}
 	return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));
 }
 /** Redact a stored custom-provider row for the client (key presence only). */
@@ -306,7 +317,7 @@ function readStoredOMConfig(record, currentModelId, autoModelSource, availablePr
 		reflector: roleConfig(record?.reflectorModelId ?? "auto", reflectorModelId, autoModelSource, availableProviders),
 		observerModelId,
 		reflectorModelId,
-		observationThreshold: record?.observationThreshold ?? 3e4,
+		observationThreshold: Math.max(record?.observationThreshold ?? 3e4, MIN_OBSERVATION_THRESHOLD),
 		reflectionThreshold: record?.reflectionThreshold ?? 4e4,
 		observeAttachments: record?.observeAttachments ?? "auto"
 	};
@@ -381,12 +392,87 @@ var ConfigRoutes = class extends Route {
 		const { controller, authStorage, auth, deploymentProviders } = options;
 		const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});
 		const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});
-		const resolveOMResponseContext = async (c) => {
-			const tenantCredentials = await listTenantCredentialsForRequest({
+		const resolveSessionModelContext = async (c, address, includeDefaultModel = true) => {
+			const tenant = auth.tenant(c);
+			if (!tenant && auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+			if (!tenant) return void 0;
+			if (!options.factoryProjects || !options.sourceControlSessions || !options.workItems || !options.modelCredentials) return { response: c.json({ error: "session_model_policy_unavailable" }, 503) };
+			const requestContext = new RequestContext();
+			requestContext.set("user", {
+				id: tenant.userId,
+				organizationId: tenantOrgId(tenant)
+			});
+			requestContext.set("controller", address);
+			let policy;
+			try {
+				policy = await resolveFactoryModelPolicy(requestContext, {
+					projects: options.factoryProjects,
+					sourceControl: options.sourceControlSessions,
+					workItems: options.workItems
+				});
+			} catch {
+				return { response: c.json({ error: "session_model_policy_unavailable" }, 403) };
+			}
+			if (!policy) return { response: c.json({ error: "unauthorized" }, 401) };
+			const orgId = policy.tenant.orgId ?? tenantOrgId(tenant);
+			const modelScope = policy.tenant.credentialScope ?? "user";
+			const tenantCredentials = await listSessionScopedCredentials({
+				credentials: options.modelCredentials,
+				orgId,
+				userId: policy.tenant.userId,
+				modelScope
+			});
+			let defaultModelId = policy.factoryDefaultModelId ?? null;
+			let personalThinkingLevel = null;
+			if (modelScope === "user" && includeDefaultModel) {
+				if (!options.modelDefaults) return { response: c.json({ error: "model_defaults_unavailable" }, 503) };
+				const ownerDefaults = await routedPersonalDefaults(policy.tenant, options.modelDefaults);
+				defaultModelId = ownerDefaults?.modelId ?? null;
+				personalThinkingLevel = ownerDefaults?.thinkingLevel ?? null;
+			}
+			return {
+				tenantCredentials,
+				modelScope,
+				defaultModelId,
+				personalThinkingLevel
+			};
+		};
+		const resolveOMResponseContext = async (c, { sessionId, threadId, resourceId, factoryProjectId }) => {
+			let tenantCredentials = await listTenantCredentialsForRequest({
 				c: loose(c),
 				auth,
 				credentials: options.modelCredentials
 			});
+			const tenant = auth.tenant(c);
+			if (sessionId !== void 0 && threadId !== void 0) {
+				const address = z.object({
+					sessionId: z.string().trim().min(1),
+					threadId: z.string().trim().min(1),
+					resourceId: z.string().trim().min(1).optional()
+				}).transform((data) => ({
+					...data,
+					resourceId: data.resourceId ?? data.sessionId
+				})).safeParse({
+					sessionId,
+					threadId,
+					resourceId
+				});
+				if (!address.success) return { response: c.json({ error: "invalid_session_context" }, 400) };
+				const sessionContext = await resolveSessionModelContext(c, address.data, false);
+				if (sessionContext && "response" in sessionContext) return { response: sessionContext.response };
+				tenantCredentials = sessionContext?.tenantCredentials;
+			} else if (threadId !== void 0) return { response: c.json({ error: "invalid_session_context" }, 400) };
+			else if (tenantCredentials && factoryProjectId && tenant) {
+				if (!options.factoryProjects) return { response: c.json({ error: "factory_unavailable" }, 503) };
+				await options.factoryProjects.ensureReady();
+				const project = await options.factoryProjects.get({
+					orgId: tenantOrgId(tenant),
+					id: factoryProjectId
+				});
+				if (!project) return { response: c.json({ error: "factory_project_not_found" }, 404) };
+				const scope = effectiveModelScope(project.modelScope, "run") === "factory" ? "org" : "user";
+				tenantCredentials = tenantCredentials.filter((record) => record.scope === scope);
+			} else if (tenantCredentials) tenantCredentials = tenantCredentials.filter((record) => record.scope === "user");
 			const access = await buildProviderAccess({
 				controller,
 				authStorage: tenantCredentials ? void 0 : authStorage,
@@ -403,7 +489,7 @@ var ConfigRoutes = class extends Route {
 				});
 				if (!("response" in context)) for (const provider of await context.storage.list({ orgId: context.orgId })) availableProviders.add(provider.providerId);
 			}
-			return availableProviders;
+			return { availableProviders };
 		};
 		const factoryOmFallback = async (factoryProjectId) => {
 			try {
@@ -433,12 +519,22 @@ var ConfigRoutes = class extends Route {
 						});
 						const tenant = auth.tenant(loose(c));
 						const orgKeyAdmin = tenant ? await auth.isOrganizationAdmin(loose(c), tenantOrgId(tenant)) : void 0;
+						const customProviders = options.customProviders;
+						const listCustomProviders = customProviders ? async () => {
+							const ctx = await resolveCustomProvidersContext({
+								c: loose(c),
+								auth,
+								customProviders
+							});
+							return "response" in ctx ? [] : ctx.storage.list({ orgId: ctx.orgId });
+						} : void 0;
 						return c.json({
 							providers: await listProviders({
 								controller,
 								authStorage: tenantCredentials ? void 0 : authStorage,
 								tenantCredentials,
-								deploymentProviders
+								deploymentProviders,
+								listCustomProviders
 							}),
 							...orgKeyAdmin !== void 0 ? { orgKeyAdmin } : {}
 						});
@@ -672,46 +768,14 @@ var ConfigRoutes = class extends Route {
 								sessionId
 							});
 							if (!address.success) return c.json({ error: "invalid_session_context" }, 400);
-							if (!tenant && auth.enabled()) return c.json({ error: "unauthorized" }, 401);
-							if (tenant) {
-								if (!options.factoryProjects || !options.sourceControlSessions || !options.workItems || !options.modelCredentials) return c.json({ error: "session_model_policy_unavailable" }, 503);
-								const requestContext = new RequestContext();
-								requestContext.set("user", {
-									id: tenant.userId,
-									organizationId: tenantOrgId(tenant)
-								});
-								requestContext.set("controller", address.data);
-								let policy;
-								try {
-									policy = await resolveFactoryModelPolicy(requestContext, {
-										projects: options.factoryProjects,
-										sourceControl: options.sourceControlSessions,
-										workItems: options.workItems
-									});
-								} catch {
-									return c.json({ error: "session_model_policy_unavailable" }, 403);
-								}
-								if (!policy) return c.json({ error: "unauthorized" }, 401);
-								const orgId = policy.tenant.orgId ?? tenantOrgId(tenant);
-								const modelScope = policy.tenant.credentialScope ?? "user";
-								tenantCredentials = await listSessionScopedCredentials({
-									credentials: options.modelCredentials,
-									orgId,
-									userId: policy.tenant.userId,
-									modelScope
-								});
-								let defaultModelId = policy.factoryDefaultModelId ?? null;
-								let personalThinkingLevel = null;
-								if (modelScope === "user") {
-									if (!options.modelDefaults) return c.json({ error: "model_defaults_unavailable" }, 503);
-									const ownerDefaults = await routedPersonalDefaults(policy.tenant, options.modelDefaults);
-									defaultModelId = ownerDefaults?.modelId ?? null;
-									personalThinkingLevel = ownerDefaults?.thinkingLevel ?? null;
-								}
+							const context = await resolveSessionModelContext(c, address.data);
+							if (context && "response" in context) return context.response;
+							if (context) {
+								tenantCredentials = context.tenantCredentials;
 								sessionPolicy = {
-									modelScope,
-									defaultModelId,
-									personalThinkingLevel
+									modelScope: context.modelScope,
+									defaultModelId: context.defaultModelId,
+									personalThinkingLevel: context.personalThinkingLevel
 								};
 							}
 						} else if (c.req.query("scope") !== void 0) {
@@ -972,6 +1036,8 @@ var ConfigRoutes = class extends Route {
 				requiresAuth: false,
 				handler: async (c) => {
 					const sessionId = c.req.query("sessionId");
+					const threadId = c.req.query("threadId");
+					const resourceId = c.req.query("resourceId");
 					const factoryProjectId = c.req.query("factoryId") || void 0;
 					const context = await resolveMemorySettingsContext({
 						c: loose(c),
@@ -987,9 +1053,15 @@ var ConfigRoutes = class extends Route {
 							userId: context.userId
 						});
 						const fallback = await factoryOmFallback(factoryProjectId);
-						const availableProviders = await resolveOMResponseContext(loose(c));
+						const responseContext = await resolveOMResponseContext(loose(c), {
+							sessionId,
+							threadId,
+							resourceId,
+							factoryProjectId
+						});
+						if ("response" in responseContext) return responseContext.response;
 						const sessionModelId = (sessionId ? await controller.getSession?.(sessionId) : void 0)?.model.get();
-						return c.json({ config: readStoredOMConfig(record, sessionModelId || fallback, sessionModelId ? "live-session" : "configured-default", availableProviders) });
+						return c.json({ config: readStoredOMConfig(record, sessionModelId || fallback, sessionModelId ? "live-session" : "configured-default", responseContext.availableProviders) });
 					} catch (error) {
 						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
 					}
@@ -1007,7 +1079,9 @@ var ConfigRoutes = class extends Route {
 					} catch {
 						return c.json({ error: "Invalid JSON body" }, 400);
 					}
-					const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+					const sessionId = typeof body.sessionId === "string" ? body.sessionId : void 0;
+					const threadId = typeof body.threadId === "string" ? body.threadId : void 0;
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : void 0;
 					const factoryProjectId = typeof body.factoryId === "string" && body.factoryId ? body.factoryId : void 0;
 					const model = typeof body.modelId === "string" ? body.modelId.trim() : "";
 					if (!model) return c.json({ error: "Missing required field: modelId" }, 400);
@@ -1020,7 +1094,13 @@ var ConfigRoutes = class extends Route {
 						factoryProjects: options.factoryProjects
 					});
 					if ("response" in context) return context.response;
-					const availableProviders = await resolveOMResponseContext(loose(c));
+					const responseContext = await resolveOMResponseContext(loose(c), {
+						sessionId,
+						threadId,
+						resourceId,
+						factoryProjectId
+					});
+					if ("response" in responseContext) return responseContext.response;
 					try {
 						await persistMemorySettings(context, { [role === "observer" ? "observerModelId" : "reflectorModelId"]: wantsAuto ? null : model });
 						const record = await context.storage.get({
@@ -1028,7 +1108,7 @@ var ConfigRoutes = class extends Route {
 							userId: context.userId
 						});
 						const sessionModelId = (sessionId ? await controller.getSession?.(sessionId) : void 0)?.model.get();
-						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", availableProviders);
+						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", responseContext.availableProviders);
 						return c.json({
 							ok: true,
 							config
@@ -1048,11 +1128,14 @@ var ConfigRoutes = class extends Route {
 					} catch {
 						return c.json({ error: "Invalid JSON body" }, 400);
 					}
-					const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+					const sessionId = typeof body.sessionId === "string" ? body.sessionId : void 0;
+					const threadId = typeof body.threadId === "string" ? body.threadId : void 0;
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : void 0;
 					const factoryProjectId = typeof body.factoryId === "string" && body.factoryId ? body.factoryId : void 0;
 					const observation = typeof body.observationThreshold === "number" && body.observationThreshold > 0 ? Math.round(body.observationThreshold) : void 0;
 					const reflection = typeof body.reflectionThreshold === "number" && body.reflectionThreshold > 0 ? Math.round(body.reflectionThreshold) : void 0;
 					if (observation === void 0 && reflection === void 0) return c.json({ error: "Provide observationThreshold and/or reflectionThreshold (positive numbers)" }, 400);
+					if (observation !== void 0 && observation < MIN_OBSERVATION_THRESHOLD) return c.json({ error: `observationThreshold must be greater than ${MIN_OBSERVATION_THRESHOLD - 1} tokens` }, 400);
 					const context = await resolveMemorySettingsContext({
 						c: loose(c),
 						auth,
@@ -1061,7 +1144,13 @@ var ConfigRoutes = class extends Route {
 						factoryProjects: options.factoryProjects
 					});
 					if ("response" in context) return context.response;
-					const availableProviders = await resolveOMResponseContext(loose(c));
+					const responseContext = await resolveOMResponseContext(loose(c), {
+						sessionId,
+						threadId,
+						resourceId,
+						factoryProjectId
+					});
+					if ("response" in responseContext) return responseContext.response;
 					try {
 						await persistMemorySettings(context, {
 							...observation !== void 0 ? { observationThreshold: observation } : {},
@@ -1072,7 +1161,7 @@ var ConfigRoutes = class extends Route {
 							userId: context.userId
 						});
 						const sessionModelId = (sessionId ? await controller.getSession?.(sessionId) : void 0)?.model.get();
-						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", availableProviders);
+						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", responseContext.availableProviders);
 						return c.json({
 							ok: true,
 							config
@@ -1092,7 +1181,9 @@ var ConfigRoutes = class extends Route {
 					} catch {
 						return c.json({ error: "Invalid JSON body" }, 400);
 					}
-					const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+					const sessionId = typeof body.sessionId === "string" ? body.sessionId : void 0;
+					const threadId = typeof body.threadId === "string" ? body.threadId : void 0;
+					const resourceId = typeof body.resourceId === "string" ? body.resourceId : void 0;
 					const factoryProjectId = typeof body.factoryId === "string" && body.factoryId ? body.factoryId : void 0;
 					const raw = body.value;
 					const value = raw === "auto" || raw === true || raw === false ? raw : "auto";
@@ -1105,7 +1196,13 @@ var ConfigRoutes = class extends Route {
 						factoryProjects: options.factoryProjects
 					});
 					if ("response" in context) return context.response;
-					const availableProviders = await resolveOMResponseContext(loose(c));
+					const responseContext = await resolveOMResponseContext(loose(c), {
+						sessionId,
+						threadId,
+						resourceId,
+						factoryProjectId
+					});
+					if ("response" in responseContext) return responseContext.response;
 					try {
 						await persistMemorySettings(context, { observeAttachments: value });
 						const record = await context.storage.get({
@@ -1113,7 +1210,7 @@ var ConfigRoutes = class extends Route {
 							userId: context.userId
 						});
 						const sessionModelId = (sessionId ? await controller.getSession?.(sessionId) : void 0)?.model.get();
-						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", availableProviders);
+						const config = readStoredOMConfig(record, sessionModelId || await factoryOmFallback(factoryProjectId), sessionModelId ? "live-session" : "configured-default", responseContext.availableProviders);
 						return c.json({
 							ok: true,
 							config