import type { AuthStorage } from '@mastra/code-sdk/auth/storage';
import type { ProviderAccess } from '@mastra/code-sdk/onboarding/packs';
import type { ThinkingLevelSetting } from '@mastra/code-sdk/onboarding/settings';
import type { ApiRoute } from '@mastra/core/server';
import type { CredentialRecord, LoginSessionKind, ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
import type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';
import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
import type { ModelDefaultsStorage } from '../storage/domains/model-defaults/base.js';
import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
import { Route } from './route.js';
import type { RouteDependencies } from './route.js';
/**
 * Server-side configuration routes for the web app.
 *
 * The browser has no access to the credential store or the model catalog, so
 * the web settings panel asks the server — which owns both — to list providers
 * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the
 * same `AuthStorage`-backed key management over HTTP.
 *
 * Keys are never returned to the client; only their presence and source.
 */
/**
 * Where a provider's active credential comes from, as seen by the caller.
 * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode
 * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).
 * `deployment` (tenant mode) marks a provider the operator opted in to run on
 * the server process's own credentials (e.g. Amazon Bedrock's AWS chain).
 */
export type ProviderCredentialSource = 'deployment' | 'oauth' | 'stored' | 'env' | 'none' | 'oauth-user' | 'oauth-org' | 'stored-user' | 'stored-org';
/** A model provider with the current source of its credentials. */
export interface ProviderInfo {
    provider: string;
    /** Env var the provider's key is read from, if any. */
    envVar?: string;
    /** Where the active credential comes from. */
    source: ProviderCredentialSource;
    /**
     * Tenant mode: whether an org-wide API key exists for this provider, even
     * when the caller's personal credential shadows it. Lets the UI tell
     * "shared with the org" apart from "only works for me".
     */
    orgKey?: boolean;
    /**
     * Tenant mode: the caller's personal credential for this provider, if any.
     * Reported independently of `source` so the UI can manage each scope even
     * when one shadows the other.
     */
    userCredential?: 'oauth' | 'api_key';
    /** Tenant mode: the shared org credential for this provider, if any. */
    orgCredential?: 'oauth' | 'api_key';
    /** Web OAuth sign-in capability, when the provider supports it. */
    oauth?: {
        supported: true;
        modes: LoginSessionKind[];
    };
}
/** Minimal session surface the config routes touch. */
export interface OMSession {
    /** `get()` returns '' when no model is selected, so callers fall back on falsy. */
    model: {
        get: () => string;
    };
}
/** Minimal controller surface this module needs (model catalog + modes + sessions). */
interface ModelCatalog {
    listAvailableModels: () => Promise<Array<{
        id?: string;
        modelName?: string;
        provider: string;
        hasApiKey: boolean;
        apiKeyEnvVar?: string;
    }>>;
    listModes?: () => Array<{
        id: string;
        defaultModelId?: string;
    }>;
    getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;
}
/**
 * Build a deduplicated, sorted list of providers from the model catalog,
 * annotated with where each provider's credential currently comes from.
 * Mirrors the TUI's `/api-keys` provider list.
 *
 * When `tenantCredentials` is given (deployed mode), sources reflect the
 * *caller's* tenant rows with user > org precedence and the server-global
 * `authStorage` is ignored; otherwise the local `auth.json` view is reported.
 */
export declare function listProviders({ controller, authStorage, tenantCredentials, deploymentProviders, }: {
    controller: ModelCatalog;
    authStorage?: AuthStorage;
    tenantCredentials?: CredentialRecord[];
    deploymentProviders?: ReadonlySet<string>;
}): Promise<ProviderInfo[]>;
/** A user-defined OpenAI-compatible provider, with key presence (never the key). */
export interface CustomProviderInfo {
    id: string;
    name: string;
    url: string;
    hasApiKey: boolean;
    models: string[];
}
/**
 * Providers whose credentials can only come from the server process (Amazon
 * Bedrock authenticates through the AWS credential chain). In tenant mode they
 * are usable only when the operator lists them in
 * `MastraFactoryConfig.deploymentModelProviders`.
 */
export declare const DEPLOYMENT_MODEL_PROVIDERS: readonly string[];
export declare function isDeploymentModelProvider(provider: string): boolean;
/**
 * Normalize the operator's `deploymentModelProviders` list. Unsupported ids are
 * ignored with a warning rather than failing boot.
 */
export declare function resolveDeploymentModelProviders(providers: readonly string[] | undefined): ReadonlySet<string>;
/**
 * Compute which providers the user can reach, mirroring the TUI's
 * `/models-pack` access derivation: OAuth/api-key from the credential store for
 * the named providers, plus any other provider that has a usable key.
 */
export declare function buildProviderAccess({ controller, authStorage, tenantCredentials, deploymentProviders, }: {
    controller: ModelCatalog;
    authStorage?: AuthStorage;
    tenantCredentials?: CredentialRecord[];
    deploymentProviders?: ReadonlySet<string>;
}): Promise<ProviderAccess>;
/** Per-user default model context for the current request. */
export interface ModelDefaultsContext {
    storage: ModelDefaultsStorage;
    orgId: string;
    userId: string;
}
export interface OMRoleConfigInfo {
    model: 'auto' | string;
    effectiveModelId: string;
    effectiveModelSource: 'explicit' | 'live-session' | 'configured-default';
    providerStatus: 'available' | 'unavailable';
}
/** Persisted intent plus the concrete models the current Factory configuration resolves. */
export interface OMConfigInfo {
    observer: OMRoleConfigInfo;
    reflector: OMRoleConfigInfo;
    /** @deprecated Use `observer.effectiveModelId`. */
    observerModelId: string;
    /** @deprecated Use `reflector.effectiveModelId`. */
    reflectorModelId: string;
    observationThreshold: number;
    reflectionThreshold: number;
    observeAttachments: 'auto' | boolean;
}
export interface ProviderOMDefaultsResponse {
    ok: true;
    config: OMConfigInfo;
}
/** `GET /web/config/thinking` — deployment-scoped reasoning-effort defaults. */
export interface ThinkingConfigInfo {
    /** All selectable levels, in escalation order. */
    levels: readonly ThinkingLevelSetting[];
    /** `preferences.thinkingLevel` — what every run uses without a session override. */
    globalDefault: ThinkingLevelSetting;
    /** False when the deployment refuses writes, so the UI can render read-only rows. */
    editable: boolean;
}
/** `PUT /web/config/thinking` success payload. */
export interface UpdateThinkingConfigResponse {
    ok: true;
    globalDefault: ThinkingLevelSetting;
}
/** Dependencies injected into {@link ConfigRoutes}. */
export interface ConfigRoutesDeps extends RouteDependencies {
    controller: ModelCatalog;
    features?: {
        knowledge: boolean;
    };
    authStorage?: AuthStorage;
    /** Tenant credential domain handle; absent in local (no-DB) mode. */
    modelCredentials?: ModelCredentialsStorage;
    /** Tenant model-defaults domain handle; absent in local (no-DB) mode. */
    modelDefaults?: ModelDefaultsStorage;
    /** Source-control sessions available to config route integrations. */
    sourceControlSessions?: Pick<SourceControlStorageHandle['sessions'], 'getBySessionId'>;
    /** Thread membership used to resolve the same model policy as an invocation. */
    workItems?: WorkItemsStorage;
    /** Tenant memory-settings domain handle; absent in local (no-DB) mode. */
    memorySettings?: MemorySettingsStorage;
    /** Factory projects domain, used to derive OM fallbacks from a factory's default model. */
    factoryProjects?: FactoryProjectsStorage;
    /** Custom-providers domain handle; absent when the app database is missing. */
    customProviders?: CustomProvidersStorage;
    /** Notifies the host after tenant credentials change so caches can be dropped. */
    onCredentialsChanged?: (tenant: {
        orgId: string;
        userId?: string;
    }) => void;
    /** Notifies the host after custom providers change so model-router caches can be dropped. */
    onCustomProvidersChanged?: (tenant: {
        orgId: string;
    }) => void;
    /**
     * Tenant mode: providers the operator opted in to run on the server process's
     * own credentials (see `DEPLOYMENT_MODEL_PROVIDERS`).
     */
    deploymentProviders?: ReadonlySet<string>;
    /**
     * Path of the server's settings.json backing the deployment-scoped thinking
     * defaults. Defaults to the standard app-data location; injectable for tests.
     */
    settingsPath?: string;
    /**
     * Organization this deployment serves (`MASTRACODE_DEPLOYMENT_ORGANIZATION_ID`).
     * When auth is enabled, only admins of this organization may write
     * deployment-wide settings; without it those writes stay blocked.
     */
    deploymentOrganizationId?: string;
}
/**
 * The web config routes as Mastra `apiRoutes`:
 *   - `GET    /web/config/features`               — list server-enabled product features
 *   - `GET    /web/config/providers`              — list providers + key source
 *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key
 *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key
 *   - `GET    /web/config/models`                  — list available models (credentialed providers)
 *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers
 *   - `POST   /web/config/custom-providers`        — create/update a custom provider
 *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider
 *   - `GET    /web/config/thinking`                — read thinking (reasoning-effort) defaults
 *   - `PUT    /web/config/thinking`                — set the global thinking default
 *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments
 *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model
 *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds
 *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)
 */
export declare class ConfigRoutes extends Route<ConfigRoutesDeps> {
    routes(): ApiRoute[];
}
export {};
//# sourceMappingURL=config.d.ts.map