@mastra/auth-better-auth 1.1.2-alpha.1 → 1.1.2-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/CHANGELOG.md +24 -0
  2. package/dist/_types/@internal_auth/dist/ee/fga-check.d.ts +2 -5
  3. package/dist/_types/@internal_auth/dist/ee/interfaces/fga.d.ts +47 -0
  4. package/dist/_types/@internal_auth/dist/index.d.ts +66 -0
  5. package/dist/_types/@internal_auth/dist/provider/index.d.ts +8 -1
  6. package/dist/index.cjs +250 -13
  7. package/dist/index.cjs.map +1 -1
  8. package/dist/index.d.ts +60 -5
  9. package/dist/index.d.ts.map +1 -1
  10. package/dist/index.js +248 -11
  11. package/dist/index.js.map +1 -1
  12. package/package.json +3 -2
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../../packages/_internal-core/src/logger/index.ts","../../../packages/_internal-core/src/base/MastraBase.ts","../../../packages/_internals/auth/src/provider/index.ts","../src/index.ts"],"names":["getRequestHeader"],"mappings":";;;AAEO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACgBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAiD;AAC1G,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;AC/FA,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,mBAAmB,KAAK,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAASA,iBAAAA,CAAiB,SAA4B,IAAA,EAA6B;AACjF,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AACjG;AAcA,SAAS,0BAA0B,IAAA,EAAoB;AACrD,EAAA,OAAO;AAAA,IACL,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,SAAA,EAAW,KAAK,KAAA,IAAS,MAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA;AAClB,GACF;AACF;AAsDO,IAAM,oBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACY,IAAA;AAAA,EACA,mBAAA;AAAA,EACH,iBAAA;AAAA,EAEP,YAAY,OAAA,EAAsC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,eAAe,CAAA;AAE9C,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,aAAA,IAAiB,IAAA;AAGpD,IAAA,MAAM,kBAAkB,IAAA,CAAK,IAAA;AAC7B,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,OAAA,EAAS,QAAA,EAAU,YAAA,IAAgB,aAAA;AAClE,IAAA,IAAA,CAAK,iBAAA,GAAoB,GAAG,MAAM,CAAA,cAAA,CAAA;AAElC,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAA2B;AACzB,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,eAAe,OAAA,EAA0C;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAI3C,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AAC9C,MAAA,MAAM,WAAA,GACJ,UAAA,IAAc,UAAA,CAAW,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,WAAA,EAAY,KAAM,YAAY,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,MAAK,GAAI,MAAA;AAClG,MAAA,MAAM,IAAA,CAAK,mBAAA,CAAoB,OAAA,EAAS,WAAW,CAAA;AAEnD,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,OAAO,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QAAQ,MAAA,EAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,MAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AAEjB,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,eAAA,CAAgB,aAAa,MAAM,CAAA;AAC1D,MAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,MAAA,OAAO,0BAA0B,IAAI,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,SAAS,OAAA,EAAkD;AAC/D,IAAA,OAAO,OAAA,CAAQ,IAAI,OAAA,CAAQ,GAAA,CAAI,YAAU,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,cAAA,GAAoD;AAChE,IAAA,IAAI;AACF,MAAA,OAAQ,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,IAAM,IAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,mBAAA,CAAoB,OAAA,EAAkB,KAAA,EAA0C;AAC5F,IAAA,IAAI,CAAC,KAAA,EAAO;AAEZ,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,IAAA,MAAM,UAAA,GAAa,GAAA,EAAK,WAAA,CAAY,YAAA,CAAa,QAAQ,IAAA,CAAK,iBAAA;AAC9D,IAAA,MAAM,SAAS,GAAA,EAAK,MAAA;AAEpB,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACzC,IAAA,MAAM,gBAAA,GAAmB,CAAC,CAAC,YAAA,EAAc,MAAM,GAAG,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ;AAC/D,MAAA,MAAM,CAAC,GAAG,CAAA,GAAI,KAAK,IAAA,EAAK,CAAE,MAAM,GAAG,CAAA;AACnC,MAAA,OAAO,GAAA,EAAK,MAAK,KAAM,UAAA;AAAA,IACzB,CAAC,CAAA;AACD,IAAA,IAAI,gBAAA,EAAkB;AAGtB,IAAA,IAAI,WAAA,GAAc,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,GAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA,GAAI,KAAA,GAAS,KAAA;AAC3F,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,KAAK,MAAA,EAAQ;AAClC,MAAA,WAAA,GAAc,GAAG,KAAK,CAAA,CAAA,EAAI,MAAM,aAAA,CAAc,KAAA,EAAO,MAAM,CAAC,CAAA,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,EAAG,YAAY,CAAA,EAAA,CAAA,GAAO,EAAA;AAC7D,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,CAAA,EAAG,eAAe,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,kBAAA,CAAmB,WAAW,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAA4D;AACjG,IAAA,IAAI;AAEF,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,MAAA,MAAM,YAAA,GAAeA,iBAAAA,CAAiB,OAAA,EAAS,QAAQ,CAAA;AACvD,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,MACpC;AAIA,MAAA,MAAM,IAAA,CAAK,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAE7C,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,IAAA,EAAM;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO;AAAA,QACL,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAM,MAAA,CAAO;AAAA,OACf;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAwC;AAE1D,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,OAAA,EAAS,MAAM,CAAC,CAAC,MAAM,IAAA,EAAM,EAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,MAAA,CAAO,KAAA,EAAe,QAAA,EAAkB,OAAA,EAAsD;AAClG,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAS;AAAA,MACxB,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CACJ,KAAA,EACA,QAAA,EACA,MACA,OAAA,EACoC;AACpC,IAAA,MAAM,cAAc,IAAA,IAAQ,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,MAAA;AACnD,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,WAAA,EAAY;AAAA,MAC3C,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,0BAA0B,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,sBAAA,GAAiD;AAE/C,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,CAAA,EAAG,KAAK,iBAAiB,CAAA,4CAAA,CAAA;AAAA,MACzB,CAAA,EAAG,KAAK,iBAAiB,CAAA,gDAAA;AAAA,KAC3B;AACA,IAAA,OAAO;AAAA,MACL,YAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI;AAAA,KACjC;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n AGENT: 'AGENT',\n OBSERVABILITY: 'OBSERVABILITY',\n AUTH: 'AUTH',\n BROWSER: 'BROWSER',\n NETWORK: 'NETWORK',\n WORKFLOW: 'WORKFLOW',\n LLM: 'LLM',\n TTS: 'TTS',\n VOICE: 'VOICE',\n VECTOR: 'VECTOR',\n BUNDLER: 'BUNDLER',\n DEPLOYER: 'DEPLOYER',\n MEMORY: 'MEMORY',\n STORAGE: 'STORAGE',\n EMBEDDINGS: 'EMBEDDINGS',\n MCP_SERVER: 'MCP_SERVER',\n SERVER_CACHE: 'SERVER_CACHE',\n SERVER: 'SERVER',\n WORKSPACE: 'WORKSPACE',\n CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n DEBUG: 'debug',\n INFO: 'info',\n WARN: 'warn',\n ERROR: 'error',\n NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n runId?: string;\n msg: string;\n level: LogLevel;\n time: Date;\n pid: number;\n hostname: string;\n name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n constructor(opts: any = {}) {\n super({ ...opts, objectMode: true });\n }\n\n async listLogsByRunId(_args: {\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n\n async listLogs(_args?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n returnPaginationResults?: boolean;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n}\n\nexport const createCustomTransport = (\n stream: Transform,\n listLogs?: LoggerTransport['listLogs'],\n listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n let transport = stream as LoggerTransport;\n if (listLogs) {\n transport.listLogs = listLogs;\n }\n if (listLogsByRunId) {\n transport.listLogsByRunId = listLogsByRunId;\n }\n return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n debug(message: string, ...args: any[]): void;\n info(message: string, ...args: any[]): void;\n warn(message: string, ...args: any[]): void;\n error(message: string, ...args: any[]): void;\n trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n getTransports(): Map<string, LoggerTransport>;\n listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n protected name: string;\n protected level: LogLevel;\n protected transports: Map<string, LoggerTransport>;\n\n constructor(\n options: {\n name?: string;\n level?: LogLevel;\n transports?: Record<string, LoggerTransport>;\n } = {},\n ) {\n this.name = options.name || 'Mastra';\n this.level = options.level || LogLevel.ERROR;\n this.transports = new Map(Object.entries(options.transports || {}));\n }\n\n abstract debug(message: string, ...args: any[]): void;\n abstract info(message: string, ...args: any[]): void;\n abstract warn(message: string, ...args: any[]): void;\n abstract error(message: string, ...args: any[]): void;\n\n getTransports() {\n return this.transports;\n }\n\n trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n async listLogs(\n transportId: string,\n params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n if (!transportId || !this.transports.has(transportId)) {\n return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports.get(transportId)!.listLogs?.(params) ?? {\n logs: [],\n total: 0,\n page: params?.page ?? 1,\n perPage: params?.perPage ?? 100,\n hasMore: false,\n }\n );\n }\n\n async listLogsByRunId({\n transportId,\n runId,\n fromDate,\n toDate,\n logLevel,\n filters,\n page,\n perPage,\n }: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n if (!transportId || !this.transports.has(transportId) || !runId) {\n return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports\n .get(transportId)!\n .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n logs: [],\n total: 0,\n page: page ?? 1,\n perPage: perPage ?? 100,\n hasMore: false,\n }\n );\n }\n}\n\nexport type LogFilterContext = {\n component?: RegisteredLogger;\n level: LogLevel;\n message: string;\n args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n name?: string;\n level?: LogLevel;\n component?: RegisteredLogger;\n filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n protected component?: RegisteredLogger;\n protected filter?: LogFilter;\n\n constructor(options: ConsoleLoggerOptions = {}) {\n super(options);\n this.component = options.component;\n this.filter = options.filter;\n }\n\n child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n const component =\n typeof componentOrBindings === 'string'\n ? componentOrBindings\n : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n return new ConsoleLogger({\n name: this.name,\n level: this.level,\n component,\n filter: this.filter,\n });\n }\n\n private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n if (!this.filter) return true;\n try {\n return this.filter({ component: this.component, level, message, args });\n } catch (e) {\n console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n return true;\n }\n }\n\n private prefix(): string {\n return this.component ? `[${this.component}] ` : '';\n }\n\n debug(message: string, ...args: any[]): void {\n if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n info(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.INFO, message, args)\n ) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n warn(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.WARN, message, args)\n ) {\n console.warn(`${this.prefix()}${message}`, ...args);\n }\n }\n\n error(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.ERROR ||\n this.level === LogLevel.WARN ||\n this.level === LogLevel.INFO ||\n this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.ERROR, message, args)\n ) {\n console.error(`${this.prefix()}${message}`, ...args);\n }\n }\n\n async listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n }\n\n async listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n component: RegisteredLogger = RegisteredLogger.LLM;\n protected logger: IMastraLogger;\n name?: string;\n #rawConfig?: Record<string, unknown>;\n\n constructor({\n component,\n name,\n rawConfig,\n }: {\n component?: RegisteredLogger;\n name?: string;\n rawConfig?: Record<string, unknown>;\n }) {\n this.component = component || RegisteredLogger.LLM;\n this.name = name;\n this.#rawConfig = rawConfig;\n this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n }\n\n /**\n * Returns the raw storage configuration this primitive was created from,\n * or undefined if it was created from code.\n */\n toRawConfig(): Record<string, unknown> | undefined {\n return this.#rawConfig;\n }\n\n /**\n * Sets the raw storage configuration for this primitive.\n * @internal\n */\n __setRawConfig(rawConfig: Record<string, unknown>): void {\n this.#rawConfig = rawConfig;\n }\n\n /**\n * Set the logger for the agent\n * @param logger\n */\n __setLogger(logger: IMastraLogger) {\n this.logger =\n 'child' in logger && typeof (logger as any).child === 'function'\n ? (logger as any).child({ component: this.component })\n : logger;\n }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n CredentialsResult,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n name?: string;\n authorizeUser?: AuthorizeUserFn<TUser>;\n mapUserToResourceId?(user: TUser): string | undefined | null;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n}\n\n/**\n * Structural description of the public surface of a `MastraAuthProvider`.\n *\n * Auth provider packages bundle their own copy of the `MastraAuthProvider`\n * declaration, so provider class types cannot be compared nominally across\n * package boundaries — `#private`/`protected` members would make otherwise\n * identical copies mutually unassignable. Positions that accept user-supplied\n * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface\n * instead of the class.\n *\n * Note: methods intentionally use method syntax (not property syntax) so they\n * are checked bivariantly — providers with a narrower `TUser` must remain\n * assignable to `IMastraAuthProvider<unknown>`.\n */\nexport interface IMastraAuthProvider<TUser = unknown> {\n name?: string;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n /**\n * Authenticate a token and return the payload\n */\n authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n /**\n * Authorize a user for a path and method\n */\n authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n /**\n * Map an authenticated user to a memory resource id\n */\n mapUserToResourceId?(user: TUser): string | undefined | null;\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {\n public protected?: MastraAuthConfig['protected'];\n public public?: MastraAuthConfig['public'];\n public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n constructor(options?: MastraAuthProviderOptions<TUser>) {\n super({ component: 'AUTH', name: options?.name });\n\n if (options?.authorizeUser) {\n this.authorizeUser = options.authorizeUser.bind(this);\n }\n\n this.protected = options?.protected;\n this.public = options?.public;\n this.mapUserToResourceId = options?.mapUserToResourceId;\n }\n\n /**\n * Authenticate a token and return the payload\n * @param token - The token to authenticate\n * @param request - The request\n * @returns The payload\n */\n abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n /**\n * Authorize a user for a path and method\n * @param user - The user to authorize\n * @param request - The request\n * @returns The authorization result\n */\n abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n if (opts?.authorizeUser) {\n this.authorizeUser = opts.authorizeUser.bind(this);\n }\n if (opts?.mapUserToResourceId) {\n this.mapUserToResourceId = opts.mapUserToResourceId;\n }\n if (opts?.protected) {\n this.protected = opts.protected;\n }\n if (opts?.public) {\n this.public = opts.public;\n }\n }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).getLoginUrl === 'function' &&\n typeof (p as any).handleCallback === 'function'\n );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).validateSession === 'function' &&\n typeof (p as any).createSession === 'function'\n );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n extends MastraAuthProvider\n implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n private providers: IMastraAuthProvider[];\n private authenticatedProviderByObject = new WeakMap<object, IMastraAuthProvider>();\n private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, IMastraAuthProvider>();\n\n constructor(providers: IMastraAuthProvider[]) {\n const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n super({\n public: combinedPublic,\n protected: combinedProtected,\n });\n\n this.providers = providers;\n if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n }\n\n // Null out interface methods when no inner provider supports them.\n // This ensures duck-typing checks (typeof auth.method === 'function')\n // accurately reflect the composite's actual capabilities — preventing\n // Studio from showing login options that no provider can handle.\n if (!providers.some(isSSOProvider)) {\n this.getLoginUrl = undefined as any;\n this.handleCallback = undefined as any;\n this.getLoginButtonConfig = undefined as any;\n }\n if (!providers.some(isSessionProvider)) {\n this.createSession = undefined as any;\n this.validateSession = undefined as any;\n this.getSessionIdFromRequest = undefined as any;\n }\n if (!providers.some(isUserProvider)) {\n this.getCurrentUser = undefined as any;\n this.getUser = undefined as any;\n this.getUsers = undefined as any;\n }\n // Proxy credentials provider methods if any inner provider supports them.\n const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is IMastraAuthProvider) as any;\n if (credProvider) {\n (this as any).signIn = credProvider.signIn.bind(credProvider);\n if (typeof credProvider.signUp === 'function') {\n (this as any).signUp = credProvider.signUp.bind(credProvider);\n }\n if (typeof credProvider.requestPasswordReset === 'function') {\n (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n }\n if (typeof credProvider.resetPassword === 'function') {\n (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n }\n (this as any).isSignUpEnabled =\n typeof credProvider.isSignUpEnabled === 'function'\n ? credProvider.isSignUpEnabled.bind(credProvider)\n : () => true;\n } else {\n (this as any).signIn = undefined;\n (this as any).signUp = undefined;\n (this as any).requestPasswordReset = undefined;\n (this as any).resetPassword = undefined;\n (this as any).isSignUpEnabled = undefined;\n }\n }\n\n // Find first provider implementing an interface\n private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n return this.providers.find(check) as T | undefined;\n }\n\n private rememberAuthenticatedProvider(user: unknown, provider: IMastraAuthProvider): void {\n if (isObjectLike(user)) {\n this.authenticatedProviderByObject.set(user, provider);\n return;\n }\n\n this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n }\n\n private takeAuthenticatedProvider(user: unknown): IMastraAuthProvider | undefined {\n if (isObjectLike(user)) {\n const provider = this.authenticatedProviderByObject.get(user);\n this.authenticatedProviderByObject.delete(user);\n return provider;\n }\n\n const primitiveUser = user as PrimitiveAuthUser;\n const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n this.authenticatedProviderByPrimitive.delete(primitiveUser);\n return provider;\n }\n\n private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n const provider = this.takeAuthenticatedProvider(user);\n return provider?.mapUserToResourceId?.(user);\n }\n\n // ============================================================================\n // License Exemption Markers\n // Expose these if any underlying provider has them\n // ============================================================================\n\n /**\n * True if any provider is MastraCloudAuth (exempt from license requirement).\n */\n get isMastraCloudAuth(): boolean {\n return this.providers.some(\n p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n );\n }\n\n /**\n * True if any provider is SimpleAuth (exempt from license requirement).\n */\n get isSimpleAuth(): boolean {\n return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n for (const provider of this.providers) {\n try {\n const user = await provider.authenticateToken(token, request);\n if (user) {\n this.rememberAuthenticatedProvider(user, provider);\n return user;\n }\n } catch {\n // ignore error, try next provider\n }\n }\n return null;\n }\n\n async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n for (const provider of this.providers) {\n const authorized = await provider.authorizeUser(user, request);\n if (authorized) {\n return true;\n }\n }\n return false;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /**\n * Forward cookie header to SSO provider for PKCE validation.\n * Called by auth handler before handleCallback().\n */\n setCallbackCookieHeader(cookieHeader: string | null): void {\n const sso = this.findProvider(isSSOProvider);\n if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n (sso as any).setCallbackCookieHeader(cookieHeader);\n }\n }\n\n getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.getLoginUrl(redirectUri, state);\n }\n\n getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n const sso = this.findProvider(isSSOProvider);\n return sso?.getLoginCookies?.(redirectUri, state);\n }\n\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) return { provider: 'unknown', text: 'Sign in' };\n return sso.getLoginButtonConfig();\n }\n\n async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n // Try each SSO provider until one returns a logout URL\n for (const provider of this.providers) {\n if (isSSOProvider(provider) && provider.getLogoutUrl) {\n try {\n const url = await provider.getLogoutUrl(redirectUri, request);\n if (url) return url;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const session = this.findProvider(isSessionProvider);\n if (!session) throw new Error('No session provider configured in CompositeAuth');\n return session.createSession(userId, metadata);\n }\n\n async validateSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one validates\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.validateSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async destroySession(sessionId: string): Promise<void> {\n // Destroy session on ALL providers (user may have sessions in multiple stores)\n const destroyPromises: Promise<void>[] = [];\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n destroyPromises.push(\n provider.destroySession(sessionId).catch(() => {\n // Ignore errors, session may not exist in this provider\n }),\n );\n }\n }\n await Promise.all(destroyPromises);\n }\n\n async refreshSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one refreshes\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.refreshSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionIdFromRequest(request: Request): string | null {\n // Try each session provider until one finds a session ID\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const sessionId = provider.getSessionIdFromRequest(request);\n if (sessionId) return sessionId;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n // Intentionally uses only the first session provider: a session is created by one\n // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n // no stale cookies remain.\n const sessionProvider = this.findProvider(isSessionProvider);\n return sessionProvider?.getSessionHeaders(session) ?? {};\n }\n\n getClearSessionHeaders(): Record<string, string> {\n // Merge clear headers from ALL providers to ensure no stale session cookies remain\n const headers: Record<string, string> = {};\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const providerHeaders = provider.getClearSessionHeaders();\n Object.assign(headers, providerHeaders);\n } catch {\n // Ignore errors\n }\n }\n }\n return headers;\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // Try each provider until one returns a user (like authenticateToken)\n // ============================================================================\n\n async getCurrentUser(request: Request): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getCurrentUser(request);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUser(userId: string): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getUser(userId);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<User | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n /**\n * Valid tokens to authenticate against\n */\n tokens: TokenToUser<TUser>;\n /**\n * Headers to check for authentication\n * @default ['Authorization', 'X-Playground-Access']\n */\n headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n /**\n * Marker to exempt SimpleAuth from EE license requirement.\n * SimpleAuth is for development/testing and should work without a license.\n */\n readonly isSimpleAuth = true;\n\n private tokens: TokenToUser<TUser>;\n private headers: string[];\n private users: TUser[];\n private userById: Map<string, TUser>;\n\n constructor(options: SimpleAuthOptions<TUser>) {\n super(options);\n this.tokens = options.tokens;\n this.users = Object.values(this.tokens);\n this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n }\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n const requestTokens = this.getTokensFromHeaders(token, request);\n\n for (const requestToken of requestTokens) {\n const tokenToUser = this.tokens[requestToken];\n if (tokenToUser) {\n return tokenToUser;\n }\n }\n\n return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n }\n\n async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n return this.users.includes(user);\n }\n\n /** Get current user from request headers or cookie. */\n async getCurrentUser(request: Request): Promise<TUser | null> {\n // Check headers first\n for (const headerName of this.headers) {\n const headerValue = request.headers.get(headerName);\n if (headerValue) {\n const token = this.stripBearerPrefix(headerValue);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n\n return this.getUserFromCookie(request.headers.get('Cookie'));\n }\n\n private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n if (!cookieHeader) return null;\n\n const cookies = cookieHeader.split(';').map(c => c.trim());\n for (const cookie of cookies) {\n if (cookie.startsWith('mastra-token=')) {\n const token = cookie.slice('mastra-token='.length);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n return null;\n }\n\n /** Get user by ID. */\n async getUser(userId: string): Promise<TUser | null> {\n return this.userById.get(userId) ?? null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n return userIds.map(userId => this.userById.get(userId) ?? null);\n }\n\n /**\n * Sign in with token (passed as password field).\n * The email field is ignored - only the token matters.\n */\n async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n const token = password;\n const user = this.tokens[token];\n\n if (!user) {\n throw new Error('Invalid token');\n }\n\n // Set cookie so the token persists across requests\n const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n return {\n user,\n token,\n cookies: [cookie],\n };\n }\n\n async signUp(): Promise<CredentialsResult<TUser>> {\n throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n }\n\n isSignUpEnabled(): boolean {\n return false;\n }\n\n /**\n * Get headers to clear the session cookie on logout.\n * Partial ISessionProvider implementation for logout support.\n */\n getClearSessionHeaders(): Record<string, string> {\n return {\n 'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n };\n }\n\n private stripBearerPrefix(token: string): string {\n return token.startsWith('Bearer ') ? token.slice(7) : token;\n }\n\n private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n const tokens = [token];\n for (const headerName of this.headers) {\n const headerValue = getRequestHeader(request, headerName);\n if (headerValue) {\n tokens.push(this.stripBearerPrefix(headerValue));\n }\n }\n return tokens;\n }\n}\n","import type { IUserProvider, ICredentialsProvider, CredentialsResult } from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\n\nimport type { Auth, Session, User } from 'better-auth';\nimport { makeSignature } from 'better-auth/crypto';\n\ntype HonoRequestLike = {\n raw?: Request;\n headers?: Headers;\n header(name: string): string | undefined;\n};\n\ntype MastraAuthRequest = Request | HonoRequestLike;\n\ntype BetterAuthContext = Awaited<Auth['$context']>;\n\nfunction tryDecode(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\nfunction getRequestHeader(request: MastraAuthRequest, name: string): string | null {\n if (request instanceof Request) {\n return request.headers.get(name);\n }\n\n return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;\n}\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n session: Session;\n user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n return {\n id: user.id,\n email: user.email,\n name: user.name,\n avatarUrl: user.image ?? undefined,\n metadata: {\n emailVerified: user.emailVerified,\n createdAt: user.createdAt,\n updatedAt: user.updatedAt,\n },\n };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n /**\n * The Better Auth instance to use for authentication.\n * This should be the result of calling `betterAuth({ ... })`.\n */\n auth: Auth;\n\n /**\n * Whether to allow new user registration via sign-up.\n * Set to false to disable public registration.\n * @default true\n */\n signUpEnabled?: boolean;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n * database: {\n * provider: 'postgresql',\n * url: process.env.DATABASE_URL!,\n * },\n * emailAndPassword: {\n * enabled: true,\n * },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n * auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n * server: {\n * auth: mastraAuth,\n * },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n extends MastraAuthProvider<BetterAuthUser>\n implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>\n{\n protected auth: Auth;\n protected signUpEnabledConfig: boolean;\n public sessionCookieName: string;\n\n constructor(options: MastraAuthBetterAuthOptions) {\n super({ name: options?.name ?? 'better-auth' });\n\n if (!options.auth) {\n throw new Error(\n 'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... })',\n );\n }\n\n this.auth = options.auth;\n this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n // Derive the session cookie name from Better Auth's cookiePrefix option\n const authWithOptions = this.auth as unknown as { options?: { advanced?: { cookiePrefix?: string } } };\n const prefix = authWithOptions.options?.advanced?.cookiePrefix ?? 'better-auth';\n this.sessionCookieName = `${prefix}.session_token`;\n\n this.registerOptions(options);\n }\n\n /**\n * Check if sign-up is enabled.\n * Implements ICredentialsProvider.isSignUpEnabled.\n */\n isSignUpEnabled(): boolean {\n return this.signUpEnabledConfig;\n }\n\n // ============================================\n // IUserProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Get current user from request.\n * Implements IUserProvider for EE user awareness in Studio.\n *\n * Supports both cookie-based sessions and `Authorization: Bearer <token>`\n * requests (e.g. API clients using the token returned by `signIn`).\n *\n * @param request - Incoming HTTP request\n * @returns EE User object or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<EEUser | null> {\n try {\n const headers = new Headers(request.headers);\n\n // If the request authenticates via Bearer token instead of cookies,\n // convert the token to a signed session cookie so getSession accepts it.\n const authHeader = headers.get('Authorization');\n const bearerToken =\n authHeader && authHeader.slice(0, 7).toLowerCase() === 'bearer ' ? authHeader.slice(7).trim() : undefined;\n await this.ensureSessionCookie(headers, bearerToken);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result?.user) return null;\n return mapBetterAuthUserToEEUser(result.user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Implements IUserProvider for EE user awareness.\n *\n * Uses Better Auth's internal adapter to look up the user record,\n * so it works with whichever database Better Auth is configured with.\n *\n * @param userId - User identifier\n * @returns EE User object or null if not found\n */\n async getUser(userId: string): Promise<EEUser | null> {\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return null;\n\n const user = await ctx.internalAdapter.findUserById(userId);\n if (!user) return null;\n return mapBetterAuthUserToEEUser(user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get multiple users by ID.\n * Optional IUserProvider method used for batch author enrichment.\n *\n * @param userIds - User identifiers\n * @returns EE User objects (null for missing users, order preserved)\n */\n async getUsers(userIds: string[]): Promise<Array<EEUser | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n\n /**\n * Get URL to user's profile page.\n * Optional IUserProvider method.\n */\n getUserProfileUrl(user: EEUser): string {\n return `/profile/${user.id}`;\n }\n\n /**\n * Get the resolved Better Auth context, or null when unavailable\n * (e.g. a partial mock without `$context`).\n */\n private async getAuthContext(): Promise<BetterAuthContext | null> {\n try {\n return (await Promise.resolve(this.auth.$context)) ?? null;\n } catch {\n return null;\n }\n }\n\n /**\n * Ensure the Cookie header on `headers` carries a Better Auth session cookie\n * for the given token.\n *\n * Better Auth's `getSession` reads the session from a *signed* cookie\n * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the\n * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens\n * are signed with the instance secret before being set as the session cookie.\n */\n private async ensureSessionCookie(headers: Headers, token: string | undefined): Promise<void> {\n if (!token) return;\n\n const ctx = await this.getAuthContext();\n const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;\n const secret = ctx?.secret;\n\n const cookieHeader = headers.get('Cookie');\n const hasSessionCookie = !!cookieHeader?.split(';').some(pair => {\n const [key] = pair.trim().split('=');\n return key?.trim() === cookieName;\n });\n if (hasSessionCookie) return;\n\n // Tokens containing \".\" are already signed (and may be URI-encoded).\n let cookieValue = token.includes('.') ? (token.includes('%') ? tryDecode(token) : token) : token;\n if (!token.includes('.') && secret) {\n cookieValue = `${token}.${await makeSignature(token, secret)}`;\n }\n\n const existingCookies = cookieHeader ? `${cookieHeader}; ` : '';\n headers.set('Cookie', `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);\n }\n\n /**\n * Authenticate a bearer token by verifying the session with Better Auth.\n *\n * This method extracts the session from the request headers using\n * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —\n * as returned by `signIn`/`signUp` — are signed before being passed to\n * Better Auth as a session cookie, matching the bearer plugin's semantics.\n *\n * @param token - The bearer token (session token) to authenticate\n * @param request - The request containing headers\n * @returns The authenticated user and session, or null if authentication fails\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<BetterAuthUser | null> {\n try {\n // Better Auth's api.getSession() reads session tokens from the Cookie header\n const headers = new Headers();\n\n const cookieHeader = getRequestHeader(request, 'Cookie');\n if (cookieHeader) {\n headers.set('Cookie', cookieHeader);\n }\n\n // Convert Bearer token to a signed session cookie if not already present.\n // better-auth ignores the Authorization header — it only reads from Cookie.\n await this.ensureSessionCookie(headers, token);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result || !result.session || !result.user) {\n return null;\n }\n\n return {\n session: result.session,\n user: result.user,\n };\n } catch {\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * By default, any authenticated user with a valid session is authorized.\n * You can override this behavior by providing a custom `authorizeUser` function\n * in the constructor options.\n *\n * @param user - The authenticated user and session\n * @returns True if the user is authorized, false otherwise\n */\n async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n // By default, any authenticated user with a valid session is authorized\n return !!user?.session?.id && !!user?.user?.id;\n }\n\n // ============================================\n // ICredentialsProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Sign in with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param request - Incoming HTTP request\n * @returns Result with user and session cookies\n * @throws Error if credentials are invalid\n */\n async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signInEmail({\n body: { email, password },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Invalid email or password');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Invalid email or password');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Sign up with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param name - Optional display name\n * @param request - Incoming HTTP request\n * @returns Result with new user and session cookies\n * @throws Error if sign up fails\n */\n async signUp(\n email: string,\n password: string,\n name: string | undefined,\n request: Request,\n ): Promise<CredentialsResult<EEUser>> {\n const displayName = name ?? email.split('@')[0] ?? 'User';\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signUpEmail({\n body: { email, password, name: displayName },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Failed to create account');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Failed to create account');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Get the underlying Better Auth instance.\n * Useful for accessing Better Auth APIs directly.\n */\n getAuth(): Auth {\n return this.auth;\n }\n\n /**\n * Get headers to clear the session cookies on logout.\n * Partial ISessionProvider implementation for logout support.\n *\n * Clears Better Auth's default session cookies.\n */\n getClearSessionHeaders(): Record<string, string> {\n // Clear both the session token and its signature cookie\n const cookies = [\n `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`,\n `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`,\n ];\n return {\n 'Set-Cookie': cookies.join(', '),\n };\n }\n}\n"]}
1
+ {"version":3,"sources":["../../../packages/_internal-core/src/logger/index.ts","../../../packages/_internal-core/src/base/MastraBase.ts","../../../packages/_internals/auth/src/provider/index.ts","../src/index.ts"],"names":["getRequestHeader"],"mappings":";;;;;;;AAEO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACoBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAiD;AAC1G,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;ACvFA,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,mBAAmB,KAAK,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAASA,iBAAAA,CAAiB,SAA4B,IAAA,EAA6B;AACjF,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AACjG;AAcA,SAAS,0BAA0B,IAAA,EAAoB;AACrD,EAAA,OAAO;AAAA,IACL,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,SAAA,EAAW,KAAK,KAAA,IAAS,MAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,eAAe,IAAA,CAAK,aAAA;AAAA,MACpB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA;AAClB,GACF;AACF;AAqFO,IAAM,oBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACE,KAAA;AAAA,EACA,OAAA;AAAA;AAAA,EAEA,aAAA,GAAgB,KAAA;AAAA;AAAA,EAEhB,SAAA;AAAA;AAAA,EAEA,SAAA,uBAAgB,GAAA,EAAoB;AAAA;AAAA,EAEpC,UAAA,GAAa,KAAA;AAAA,EACH,mBAAA;AAAA,EAEV,YAAY,OAAA,EAAsC;AAChD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,eAAe,CAAA;AAE9C,IAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,IAAQ,CAAC,QAAQ,MAAA,EAAQ;AACpC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,IAAA;AACrB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,MAAA;AACvB,IAAA,IAAA,CAAK,mBAAA,GAAsB,QAAQ,aAAA,IAAiB,IAAA;AAEpD,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAc,IAAA,GAAa;AACzB,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,iBAAA,GAA4B;AAC9B,IAAA,MAAM,OAAA,GAAW,KAAK,KAAA,EAClB,OAAA;AACJ,IAAA,MAAM,WAAW,OAAA,EAAS,QAAA;AAO1B,IAAA,MAAM,MAAA,GAAS,UAAU,YAAA,IAAgB,aAAA;AACzC,IAAA,MAAM,SAAS,QAAA,EAAU,gBAAA,IAAoB,SAAS,OAAA,EAAS,UAAA,CAAW,UAAU,CAAA,IAAK,KAAA;AACzF,IAAA,MAAM,WAAW,QAAA,EAAU,OAAA,EAAS,aAAA,EAAe,IAAA,IAAQ,GAAG,MAAM,CAAA,cAAA,CAAA;AACpE,IAAA,OAAO,CAAA,EAAG,MAAA,GAAS,WAAA,GAAc,EAAE,GAAG,QAAQ,CAAA,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,KAAK,GAAA,EAAqC;AAC9C,IAAA,IAAA,CAAK,UAAA,GAAA,CAAc,GAAA,CAAI,cAAA,EAAgB,MAAA,IAAU,CAAA,IAAK,CAAA;AACtD,IAAA,IAAI,KAAK,KAAA,EAAO;AAEhB,IAAA,MAAM,SAAS,GAAA,CAAI,QAAA;AACnB,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AAIA,IAAA,MAAM,QAAA,GACJ,OAAO,OAAA,KAAY,UAAA,GACd,OAAO,IAAA,GACR,MAAA,CAAO,YAAY,QAAA,GACjB;AAAA,MACE,SAAS,IAAI,aAAA,CAAc,EAAE,MAAA,EAAQ,MAAA,CAAO,QAA0D,CAAA;AAAA,MACtG,IAAA,EAAM;AAAA,QAEP,MAAA,CAAO,QAAA;AAChB,IAAA,MAAM,cAAA,GAAiB,GAAA,CAAI,cAAA,IAAkB,EAAC;AAI9C,IAAA,MAAM,OAAA,GAA6B;AAAA,MACjC,QAAA;AAAA,MACA,QAAQ,IAAA,CAAK,OAAA;AAAA;AAAA;AAAA,MAGb,QAAA,EAAU,WAAA;AAAA,MACV,GAAI,IAAI,SAAA,GAAY,EAAE,SAAS,GAAA,CAAI,SAAA,KAAc,EAAC;AAAA;AAAA;AAAA;AAAA,MAIlD,GAAI,cAAA,CAAe,MAAA,GAAS,EAAE,cAAA,EAAgB,cAAA,KAAmB,EAAC;AAAA,MAClE,kBAAkB,EAAE,OAAA,EAAS,MAAM,aAAA,EAAe,CAAC,KAAK,mBAAA,EAAoB;AAAA,MAC5E,OAAA,EAAS,CAAC,YAAA,EAAc,CAAA;AAAA;AAAA;AAAA,MAGxB,GAAI,IAAA,CAAK,UAAA,GAAa,EAAE,UAAU,EAAE,uBAAA,EAAyB,EAAE,QAAA,EAAU,QAAQ,MAAA,EAAQ,IAAA,EAAK,EAAE,KAAM;AAAC,KACzG;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,WAAW,OAAO,CAAA;AAC/B,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAA,GAAgC;AACpC,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACzB,IAAA,IAAA,CAAK,eAAe,YAAY;AAC9B,MAAA,MAAM,EAAE,aAAA,EAAc,GAAI,MAAM,aAAA,CAAc,IAAA,CAAK,KAAK,OAA4B,CAAA;AACpF,MAAA,MAAM,aAAA,EAAc;AAAA,IACtB,CAAA,GAAG;AACH,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,SAAA;AAAA,IACb,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,MAAA,OAAA,CAAQ,KAAK,gGAAgG,CAAA;AAC7G,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBAAkB,OAAA,EAAqC;AAC3D,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,cAAA,EAAe;AAAA,IAC5B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,kBAAA,EAAoB,CAAA,EAAG;AAAA,QACjE,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,mBAAmB,MAAA,EAA6C;AACpE,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,IAAI,QAAQ,OAAO,MAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,cAAA,EAAe;AAC1B,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,MAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AAEjB,MAAA,MAAM,WAAA,GAAe,MAAM,GAAA,CAAI,OAAA,CAAQ,QAAA,CAAS;AAAA,QAC9C,KAAA,EAAO,QAAA;AAAA,QACP,OAAO,CAAC,EAAE,OAAO,QAAA,EAAU,KAAA,EAAO,QAAQ;AAAA,OAC3C,CAAA;AACD,MAAA,MAAM,gBAAgB,WAAA,CAAY,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,cAAc,CAAA,EAAG,cAAA;AAC/D,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAA,EAAQ,aAAa,CAAA;AACxC,QAAA,OAAO,aAAA;AAAA,MACT;AAGA,MAAA,MAAM,UAAA,GAAa,MAAM,GAAA,CAAI,eAAA,CAAgB,aAAa,MAAM,CAAA,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAClF,MAAA,MAAM,KAAA,GAAQ,UAAA,EAAY,KAAA,IAAS,UAAA,EAAY,IAAA,IAAQ,MAAA;AACvD,MAAA,MAAM,OAAA,GAAU,GAAG,KAAK,CAAA,MAAA,CAAA;AACxB,MAAA,MAAM,UAAU,OAAO;AAAA,QACrB,IAAA,EAAM,OAAA;AAAA,QACN,SAAA,sBAAe,IAAA,EAAK;AAAA,QACpB,UAAU,IAAA,CAAK,SAAA,CAAU,EAAE,iBAAA,EAAmB,QAAQ;AAAA,OACxD,CAAA;AAKA,MAAA,MAAM,IAAA,GAAO,YAAY,MAAM,CAAA,CAAA;AAC/B,MAAA,IAAI,cAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAW,MAAM,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO;AAAA,UACxC,KAAA,EAAO,cAAA;AAAA,UACP,IAAA,EAAM,EAAE,GAAG,OAAA,IAAW,IAAA;AAAK,SAC5B,CAAA;AACD,QAAA,cAAA,GAAiB,OAAA,CAAQ,EAAA;AAAA,MAC3B,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,QAAA,GAAY,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ;AAAA,UAC1C,KAAA,EAAO,cAAA;AAAA,UACP,OAAO,CAAC,EAAE,OAAO,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,SACvC,CAAA;AACD,QAAA,IAAI,CAAC,UAAU,MAAM,KAAA;AAIrB,QAAA,MAAM,eAAA,GAAmB,MAAM,GAAA,CAAI,OAAA,CAAQ,QAAA,CAAS;AAAA,UAClD,KAAA,EAAO,QAAA;AAAA,UACP,KAAA,EAAO,CAAC,EAAE,KAAA,EAAO,kBAAkB,KAAA,EAAO,QAAA,CAAS,IAAI;AAAA,SACxD,CAAA;AACD,QAAA,MAAM,gBAAgB,eAAA,CAAgB,IAAA,CAAK,CAAA,CAAA,KAAK,CAAA,CAAE,WAAW,MAAM,CAAA;AACnE,QAAA,IAAI,aAAA,EAAe;AACjB,UAAA,MAAM,QAAA,GAAY,MAAM,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO;AAAA,YACzC,KAAA,EAAO,cAAA;AAAA,YACP,IAAA,EAAM,EAAE,GAAG,OAAA,EAAQ,EAAG,IAAA,EAAM,CAAA,SAAA,EAAY,MAAM,CAAA,CAAA,EAAI,MAAA,CAAO,UAAA,EAAY,CAAA,CAAA;AAAG,WACzE,CAAA;AACD,UAAA,cAAA,GAAiB,QAAA,CAAS,EAAA;AAAA,QAC5B,CAAA,MAAO;AACL,UAAA,cAAA,GAAiB,QAAA,CAAS,EAAA;AAAA,QAC5B;AAAA,MACF;AAIA,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,QAAQ,MAAA,CAAO;AAAA,UACvB,KAAA,EAAO,QAAA;AAAA,UACP,IAAA,EAAM,EAAE,cAAA,EAAgB,MAAA,EAAQ,MAAM,OAAA,EAAS,SAAA,kBAAW,IAAI,IAAA,EAAK;AAAE,SACtE,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ;AAAA,UACvC,KAAA,EAAO,QAAA;AAAA,UACP,KAAA,EAAO;AAAA,YACL,EAAE,KAAA,EAAO,gBAAA,EAAkB,KAAA,EAAO,cAAA,EAAe;AAAA,YACjD,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,MAAA;AAAO;AACnC,SACD,CAAA;AACD,QAAA,IAAI,CAAC,QAAQ,MAAM,KAAA;AAAA,MACrB;AAEA,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAA,EAAQ,cAAc,CAAA;AACzC,MAAA,OAAO,cAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,mEAAmE,MAAM,CAAA,8DAAA,CAAA;AAAA,QAEzE;AAAA,OACF;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,mBAAA,CAAoB,cAAA,EAAwB,MAAA,EAAkC;AAClF,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,cAAA,EAAe;AAC1B,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,MAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,MAAA,MAAM,UAAA,GAAc,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ;AAAA,QAC5C,KAAA,EAAO,QAAA;AAAA,QACP,KAAA,EAAO;AAAA,UACL,EAAE,KAAA,EAAO,gBAAA,EAAkB,KAAA,EAAO,cAAA,EAAe;AAAA,UACjD,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,MAAA;AAAO;AACnC,OACD,CAAA;AACD,MAAA,OAAO,UAAA,EAAY,IAAA,KAAS,OAAA,IAAW,UAAA,EAAY,IAAA,KAAS,OAAA;AAAA,IAC9D,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAA,GAA2B;AACzB,IAAA,OAAO,IAAA,CAAK,mBAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,eAAe,OAAA,EAA0C;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,cAAA,EAAe;AAC1B,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAI3C,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AAC9C,MAAA,MAAM,WAAA,GACJ,UAAA,IAAc,UAAA,CAAW,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,WAAA,EAAY,KAAM,YAAY,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,MAAK,GAAI,MAAA;AAClG,MAAA,MAAM,IAAA,CAAK,mBAAA,CAAoB,OAAA,EAAS,WAAW,CAAA;AAEnD,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA;AAC1B,MAAA,OAAO,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QAAQ,MAAA,EAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,MAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AAEjB,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,eAAA,CAAgB,aAAa,MAAM,CAAA;AAC1D,MAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,MAAA,OAAO,0BAA0B,IAAI,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,SAAS,OAAA,EAAkD;AAC/D,IAAA,OAAO,OAAA,CAAQ,IAAI,OAAA,CAAQ,GAAA,CAAI,YAAU,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAC,CAAC,CAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,IAAA,EAAsB;AACtC,IAAA,OAAO,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,cAAA,GAAoD;AAChE,IAAA,IAAI;AACF,MAAA,OAAQ,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,IAAM,IAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,mBAAA,CAAoB,OAAA,EAAkB,KAAA,EAA0C;AAC5F,IAAA,IAAI,CAAC,KAAA,EAAO;AAEZ,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,cAAA,EAAe;AACtC,IAAA,MAAM,UAAA,GAAa,GAAA,EAAK,WAAA,CAAY,YAAA,CAAa,QAAQ,IAAA,CAAK,iBAAA;AAC9D,IAAA,MAAM,SAAS,GAAA,EAAK,MAAA;AAEpB,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACzC,IAAA,MAAM,gBAAA,GAAmB,CAAC,CAAC,YAAA,EAAc,MAAM,GAAG,CAAA,CAAE,KAAK,CAAA,IAAA,KAAQ;AAC/D,MAAA,MAAM,CAAC,GAAG,CAAA,GAAI,KAAK,IAAA,EAAK,CAAE,MAAM,GAAG,CAAA;AACnC,MAAA,OAAO,GAAA,EAAK,MAAK,KAAM,UAAA;AAAA,IACzB,CAAC,CAAA;AACD,IAAA,IAAI,gBAAA,EAAkB;AAGtB,IAAA,IAAI,WAAA,GAAc,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,GAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA,GAAI,KAAA,GAAS,KAAA;AAC3F,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,KAAK,MAAA,EAAQ;AAClC,MAAA,WAAA,GAAc,GAAG,KAAK,CAAA,CAAA,EAAI,MAAM,aAAA,CAAc,KAAA,EAAO,MAAM,CAAC,CAAA,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,eAAA,GAAkB,YAAA,GAAe,CAAA,EAAG,YAAY,CAAA,EAAA,CAAA,GAAO,EAAA;AAC7D,IAAA,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAU,CAAA,EAAG,eAAe,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,kBAAA,CAAmB,WAAW,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAA4D;AACjG,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,cAAA,EAAe;AAG1B,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAE5B,MAAA,MAAM,YAAA,GAAeA,iBAAAA,CAAiB,OAAA,EAAS,QAAQ,CAAA;AACvD,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAAA,MACpC;AAIA,MAAA,MAAM,IAAA,CAAK,mBAAA,CAAoB,OAAA,EAAS,KAAK,CAAA;AAE7C,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,UAAA,CAAW;AAAA,QAC5C;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,IAAA,EAAM;AAC9C,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,OAAO;AAAA,QACL,SAAS,MAAA,CAAO,OAAA;AAAA,QAChB,MAAM,MAAA,CAAO;AAAA,OACf;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,cAAc,IAAA,EAAwC;AAE1D,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,OAAA,EAAS,MAAM,CAAC,CAAC,MAAM,IAAA,EAAM,EAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,MAAA,CAAO,KAAA,EAAe,QAAA,EAAkB,OAAA,EAAsD;AAClG,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAS;AAAA,MACxB,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,2BAA2B,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CACJ,KAAA,EACA,QAAA,EACA,MACA,OAAA,EACoC;AACpC,IAAA,MAAM,cAAc,IAAA,IAAQ,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,MAAA;AACnD,IAAA,MAAM,OAAA,GAAU,OAAA,EAAS,OAAA,IAAW,IAAI,OAAA,EAAQ;AAGhD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,WAAA,CAAY;AAAA,MAC/C,IAAA,EAAM,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,WAAA,EAAY;AAAA,MAC3C,OAAA;AAAA,MACA,UAAA,EAAY;AAAA,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AACzD,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,OAAA,IAAW,0BAA0B,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AAEpC,IAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AACjB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC5C;AAGA,IAAA,MAAM,UAAoB,EAAC;AAC3B,IAAA,MAAM,eAAA,GAAkB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,eAAA,EAAiB;AAEnB,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,eAAA,CAAgB,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,yBAAA,CAA0B,MAAA,CAAO,IAAI,CAAA;AAAA,MAC3C,KAAA,EAAO,OAAO,KAAA,IAAS,MAAA;AAAA,MACvB;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,sBAAA,GAAiD;AAG/C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,UAAA,GAAa,cAAA,GAAiB,KAAA;AAEpD,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAA,8BAAA,EAAiC,QAAQ,CAAA,WAAA,CAAA;AAAA,MAClE,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAA,kCAAA,EAAqC,QAAQ,CAAA,WAAA;AAAA,KACxE;AACA,IAAA,OAAO;AAAA,MACL,YAAA,EAAc,OAAA,CAAQ,IAAA,CAAK,IAAI;AAAA,KACjC;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n AGENT: 'AGENT',\n OBSERVABILITY: 'OBSERVABILITY',\n AUTH: 'AUTH',\n BROWSER: 'BROWSER',\n NETWORK: 'NETWORK',\n WORKFLOW: 'WORKFLOW',\n LLM: 'LLM',\n TTS: 'TTS',\n VOICE: 'VOICE',\n VECTOR: 'VECTOR',\n BUNDLER: 'BUNDLER',\n DEPLOYER: 'DEPLOYER',\n MEMORY: 'MEMORY',\n STORAGE: 'STORAGE',\n EMBEDDINGS: 'EMBEDDINGS',\n MCP_SERVER: 'MCP_SERVER',\n SERVER_CACHE: 'SERVER_CACHE',\n SERVER: 'SERVER',\n WORKSPACE: 'WORKSPACE',\n CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n DEBUG: 'debug',\n INFO: 'info',\n WARN: 'warn',\n ERROR: 'error',\n NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n runId?: string;\n msg: string;\n level: LogLevel;\n time: Date;\n pid: number;\n hostname: string;\n name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n constructor(opts: any = {}) {\n super({ ...opts, objectMode: true });\n }\n\n async listLogsByRunId(_args: {\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n\n async listLogs(_args?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n returnPaginationResults?: boolean;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n}\n\nexport const createCustomTransport = (\n stream: Transform,\n listLogs?: LoggerTransport['listLogs'],\n listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n let transport = stream as LoggerTransport;\n if (listLogs) {\n transport.listLogs = listLogs;\n }\n if (listLogsByRunId) {\n transport.listLogsByRunId = listLogsByRunId;\n }\n return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n debug(message: string, ...args: any[]): void;\n info(message: string, ...args: any[]): void;\n warn(message: string, ...args: any[]): void;\n error(message: string, ...args: any[]): void;\n trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n getTransports(): Map<string, LoggerTransport>;\n listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n protected name: string;\n protected level: LogLevel;\n protected transports: Map<string, LoggerTransport>;\n\n constructor(\n options: {\n name?: string;\n level?: LogLevel;\n transports?: Record<string, LoggerTransport>;\n } = {},\n ) {\n this.name = options.name || 'Mastra';\n this.level = options.level || LogLevel.ERROR;\n this.transports = new Map(Object.entries(options.transports || {}));\n }\n\n abstract debug(message: string, ...args: any[]): void;\n abstract info(message: string, ...args: any[]): void;\n abstract warn(message: string, ...args: any[]): void;\n abstract error(message: string, ...args: any[]): void;\n\n getTransports() {\n return this.transports;\n }\n\n trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n async listLogs(\n transportId: string,\n params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n if (!transportId || !this.transports.has(transportId)) {\n return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports.get(transportId)!.listLogs?.(params) ?? {\n logs: [],\n total: 0,\n page: params?.page ?? 1,\n perPage: params?.perPage ?? 100,\n hasMore: false,\n }\n );\n }\n\n async listLogsByRunId({\n transportId,\n runId,\n fromDate,\n toDate,\n logLevel,\n filters,\n page,\n perPage,\n }: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n if (!transportId || !this.transports.has(transportId) || !runId) {\n return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports\n .get(transportId)!\n .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n logs: [],\n total: 0,\n page: page ?? 1,\n perPage: perPage ?? 100,\n hasMore: false,\n }\n );\n }\n}\n\nexport type LogFilterContext = {\n component?: RegisteredLogger;\n level: LogLevel;\n message: string;\n args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n name?: string;\n level?: LogLevel;\n component?: RegisteredLogger;\n filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n protected component?: RegisteredLogger;\n protected filter?: LogFilter;\n\n constructor(options: ConsoleLoggerOptions = {}) {\n super(options);\n this.component = options.component;\n this.filter = options.filter;\n }\n\n child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n const component =\n typeof componentOrBindings === 'string'\n ? componentOrBindings\n : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n return new ConsoleLogger({\n name: this.name,\n level: this.level,\n component,\n filter: this.filter,\n });\n }\n\n private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n if (!this.filter) return true;\n try {\n return this.filter({ component: this.component, level, message, args });\n } catch (e) {\n console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n return true;\n }\n }\n\n private prefix(): string {\n return this.component ? `[${this.component}] ` : '';\n }\n\n debug(message: string, ...args: any[]): void {\n if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n info(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.INFO, message, args)\n ) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n warn(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.WARN, message, args)\n ) {\n console.warn(`${this.prefix()}${message}`, ...args);\n }\n }\n\n error(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.ERROR ||\n this.level === LogLevel.WARN ||\n this.level === LogLevel.INFO ||\n this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.ERROR, message, args)\n ) {\n console.error(`${this.prefix()}${message}`, ...args);\n }\n }\n\n async listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n }\n\n async listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n component: RegisteredLogger = RegisteredLogger.LLM;\n protected logger: IMastraLogger;\n name?: string;\n #rawConfig?: Record<string, unknown>;\n\n constructor({\n component,\n name,\n rawConfig,\n }: {\n component?: RegisteredLogger;\n name?: string;\n rawConfig?: Record<string, unknown>;\n }) {\n this.component = component || RegisteredLogger.LLM;\n this.name = name;\n this.#rawConfig = rawConfig;\n this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n }\n\n /**\n * Returns the raw storage configuration this primitive was created from,\n * or undefined if it was created from code.\n */\n toRawConfig(): Record<string, unknown> | undefined {\n return this.#rawConfig;\n }\n\n /**\n * Sets the raw storage configuration for this primitive.\n * @internal\n */\n __setRawConfig(rawConfig: Record<string, unknown>): void {\n this.#rawConfig = rawConfig;\n }\n\n /**\n * Set the logger for the agent\n * @param logger\n */\n __setLogger(logger: IMastraLogger) {\n this.logger =\n 'child' in logger && typeof (logger as any).child === 'function'\n ? (logger as any).child({ component: this.component })\n : logger;\n }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n CredentialsResult,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n name?: string;\n authorizeUser?: AuthorizeUserFn<TUser>;\n mapUserToResourceId?(user: TUser): string | undefined | null;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n}\n\n/**\n * Structural description of the public surface of a `MastraAuthProvider`.\n *\n * Auth provider packages bundle their own copy of the `MastraAuthProvider`\n * declaration, so provider class types cannot be compared nominally across\n * package boundaries — `#private`/`protected` members would make otherwise\n * identical copies mutually unassignable. Positions that accept user-supplied\n * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface\n * instead of the class.\n *\n * Note: methods intentionally use method syntax (not property syntax) so they\n * are checked bivariantly — providers with a narrower `TUser` must remain\n * assignable to `IMastraAuthProvider<unknown>`.\n */\nexport interface IMastraAuthProvider<TUser = unknown> {\n name?: string;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n /**\n * Authenticate a token and return the payload\n */\n authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n /**\n * Authorize a user for a path and method\n */\n authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n /**\n * Map an authenticated user to a memory resource id\n */\n mapUserToResourceId?(user: TUser): string | undefined | null;\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {\n public protected?: MastraAuthConfig['protected'];\n public public?: MastraAuthConfig['public'];\n public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n constructor(options?: MastraAuthProviderOptions<TUser>) {\n super({ component: 'AUTH', name: options?.name });\n\n if (options?.authorizeUser) {\n this.authorizeUser = options.authorizeUser.bind(this);\n }\n\n this.protected = options?.protected;\n this.public = options?.public;\n this.mapUserToResourceId = options?.mapUserToResourceId;\n }\n\n /**\n * Authenticate a token and return the payload\n * @param token - The token to authenticate\n * @param request - The request\n * @returns The payload\n */\n abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n /**\n * Authorize a user for a path and method\n * @param user - The user to authorize\n * @param request - The request\n * @returns The authorization result\n */\n abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n if (opts?.authorizeUser) {\n this.authorizeUser = opts.authorizeUser.bind(this);\n }\n if (opts?.mapUserToResourceId) {\n this.mapUserToResourceId = opts.mapUserToResourceId;\n }\n if (opts?.protected) {\n this.protected = opts.protected;\n }\n if (opts?.public) {\n this.public = opts.public;\n }\n }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nexport function isSSOProvider(p: unknown): p is ISSOProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).getLoginUrl === 'function' &&\n typeof (p as any).handleCallback === 'function'\n );\n}\n\nexport function isSessionProvider(p: unknown): p is ISessionProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).validateSession === 'function' &&\n typeof (p as any).createSession === 'function'\n );\n}\n\nexport function isUserProvider(p: unknown): p is IUserProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nexport function isCredentialsProvider(p: unknown): p is ICredentialsProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nexport function isOrganizationsProvider(p: unknown): p is IOrganizationsProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).ensureOrganization === 'function' &&\n typeof (p as any).isOrganizationAdmin === 'function'\n );\n}\n\nexport function isAuthHttpHandler(p: unknown): p is IAuthHttpHandler {\n return p !== null && typeof p === 'object' && typeof (p as any).handleAuthRequest === 'function';\n}\n\nexport function hasAuthInit(p: unknown): p is IAuthInit {\n return p !== null && typeof p === 'object' && typeof (p as any).init === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n extends MastraAuthProvider\n implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n private providers: IMastraAuthProvider[];\n private authenticatedProviderByObject = new WeakMap<object, IMastraAuthProvider>();\n private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, IMastraAuthProvider>();\n\n constructor(providers: IMastraAuthProvider[]) {\n const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n super({\n public: combinedPublic,\n protected: combinedProtected,\n });\n\n this.providers = providers;\n if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n }\n\n // Null out interface methods when no inner provider supports them.\n // This ensures duck-typing checks (typeof auth.method === 'function')\n // accurately reflect the composite's actual capabilities — preventing\n // Studio from showing login options that no provider can handle.\n if (!providers.some(isSSOProvider)) {\n this.getLoginUrl = undefined as any;\n this.handleCallback = undefined as any;\n this.getLoginButtonConfig = undefined as any;\n }\n if (!providers.some(isSessionProvider)) {\n this.createSession = undefined as any;\n this.validateSession = undefined as any;\n this.getSessionIdFromRequest = undefined as any;\n }\n if (!providers.some(isUserProvider)) {\n this.getCurrentUser = undefined as any;\n this.getUser = undefined as any;\n this.getUsers = undefined as any;\n }\n // Proxy credentials provider methods if any inner provider supports them.\n const credProvider = providers.find(isCredentialsProvider) as any;\n if (credProvider) {\n (this as any).signIn = credProvider.signIn.bind(credProvider);\n if (typeof credProvider.signUp === 'function') {\n (this as any).signUp = credProvider.signUp.bind(credProvider);\n }\n if (typeof credProvider.requestPasswordReset === 'function') {\n (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n }\n if (typeof credProvider.resetPassword === 'function') {\n (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n }\n (this as any).isSignUpEnabled =\n typeof credProvider.isSignUpEnabled === 'function'\n ? credProvider.isSignUpEnabled.bind(credProvider)\n : () => true;\n } else {\n (this as any).signIn = undefined;\n (this as any).signUp = undefined;\n (this as any).requestPasswordReset = undefined;\n (this as any).resetPassword = undefined;\n (this as any).isSignUpEnabled = undefined;\n }\n }\n\n // Find first provider implementing an interface\n private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n return this.providers.find(check) as T | undefined;\n }\n\n private rememberAuthenticatedProvider(user: unknown, provider: IMastraAuthProvider): void {\n if (isObjectLike(user)) {\n this.authenticatedProviderByObject.set(user, provider);\n return;\n }\n\n this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n }\n\n private takeAuthenticatedProvider(user: unknown): IMastraAuthProvider | undefined {\n if (isObjectLike(user)) {\n const provider = this.authenticatedProviderByObject.get(user);\n this.authenticatedProviderByObject.delete(user);\n return provider;\n }\n\n const primitiveUser = user as PrimitiveAuthUser;\n const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n this.authenticatedProviderByPrimitive.delete(primitiveUser);\n return provider;\n }\n\n private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n const provider = this.takeAuthenticatedProvider(user);\n return provider?.mapUserToResourceId?.(user);\n }\n\n // ============================================================================\n // License Exemption Markers\n // Expose these if any underlying provider has them\n // ============================================================================\n\n /**\n * True if any provider is MastraCloudAuth (exempt from license requirement).\n */\n get isMastraCloudAuth(): boolean {\n return this.providers.some(\n p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n );\n }\n\n /**\n * True if any provider is SimpleAuth (exempt from license requirement).\n */\n get isSimpleAuth(): boolean {\n return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n for (const provider of this.providers) {\n try {\n const user = await provider.authenticateToken(token, request);\n if (user) {\n this.rememberAuthenticatedProvider(user, provider);\n return user;\n }\n } catch {\n // ignore error, try next provider\n }\n }\n return null;\n }\n\n async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n for (const provider of this.providers) {\n const authorized = await provider.authorizeUser(user, request);\n if (authorized) {\n return true;\n }\n }\n return false;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /**\n * Forward cookie header to SSO provider for PKCE validation.\n * Called by auth handler before handleCallback().\n */\n setCallbackCookieHeader(cookieHeader: string | null): void {\n const sso = this.findProvider(isSSOProvider);\n if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n (sso as any).setCallbackCookieHeader(cookieHeader);\n }\n }\n\n getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.getLoginUrl(redirectUri, state);\n }\n\n getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n const sso = this.findProvider(isSSOProvider);\n return sso?.getLoginCookies?.(redirectUri, state);\n }\n\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) return { provider: 'unknown', text: 'Sign in' };\n return sso.getLoginButtonConfig();\n }\n\n async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n // Try each SSO provider until one returns a logout URL\n for (const provider of this.providers) {\n if (isSSOProvider(provider) && provider.getLogoutUrl) {\n try {\n const url = await provider.getLogoutUrl(redirectUri, request);\n if (url) return url;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const session = this.findProvider(isSessionProvider);\n if (!session) throw new Error('No session provider configured in CompositeAuth');\n return session.createSession(userId, metadata);\n }\n\n async validateSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one validates\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.validateSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async destroySession(sessionId: string): Promise<void> {\n // Destroy session on ALL providers (user may have sessions in multiple stores)\n const destroyPromises: Promise<void>[] = [];\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n destroyPromises.push(\n provider.destroySession(sessionId).catch(() => {\n // Ignore errors, session may not exist in this provider\n }),\n );\n }\n }\n await Promise.all(destroyPromises);\n }\n\n async refreshSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one refreshes\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.refreshSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionIdFromRequest(request: Request): string | null {\n // Try each session provider until one finds a session ID\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const sessionId = provider.getSessionIdFromRequest(request);\n if (sessionId) return sessionId;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n // Intentionally uses only the first session provider: a session is created by one\n // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n // no stale cookies remain.\n const sessionProvider = this.findProvider(isSessionProvider);\n return sessionProvider?.getSessionHeaders(session) ?? {};\n }\n\n getClearSessionHeaders(): Record<string, string> {\n // Merge clear headers from ALL providers to ensure no stale session cookies remain\n const headers: Record<string, string> = {};\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const providerHeaders = provider.getClearSessionHeaders();\n Object.assign(headers, providerHeaders);\n } catch {\n // Ignore errors\n }\n }\n }\n return headers;\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // Try each provider until one returns a user (like authenticateToken)\n // ============================================================================\n\n async getCurrentUser(request: Request): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getCurrentUser(request);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUser(userId: string): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getUser(userId);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<User | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n /**\n * Valid tokens to authenticate against\n */\n tokens: TokenToUser<TUser>;\n /**\n * Headers to check for authentication\n * @default ['Authorization', 'X-Playground-Access']\n */\n headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n /**\n * Marker to exempt SimpleAuth from EE license requirement.\n * SimpleAuth is for development/testing and should work without a license.\n */\n readonly isSimpleAuth = true;\n\n private tokens: TokenToUser<TUser>;\n private headers: string[];\n private users: TUser[];\n private userById: Map<string, TUser>;\n\n constructor(options: SimpleAuthOptions<TUser>) {\n super(options);\n this.tokens = options.tokens;\n this.users = Object.values(this.tokens);\n this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n }\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n const requestTokens = this.getTokensFromHeaders(token, request);\n\n for (const requestToken of requestTokens) {\n const tokenToUser = this.tokens[requestToken];\n if (tokenToUser) {\n return tokenToUser;\n }\n }\n\n return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n }\n\n async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n return this.users.includes(user);\n }\n\n /** Get current user from request headers or cookie. */\n async getCurrentUser(request: Request): Promise<TUser | null> {\n // Check headers first\n for (const headerName of this.headers) {\n const headerValue = request.headers.get(headerName);\n if (headerValue) {\n const token = this.stripBearerPrefix(headerValue);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n\n return this.getUserFromCookie(request.headers.get('Cookie'));\n }\n\n private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n if (!cookieHeader) return null;\n\n const cookies = cookieHeader.split(';').map(c => c.trim());\n for (const cookie of cookies) {\n if (cookie.startsWith('mastra-token=')) {\n const token = cookie.slice('mastra-token='.length);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n return null;\n }\n\n /** Get user by ID. */\n async getUser(userId: string): Promise<TUser | null> {\n return this.userById.get(userId) ?? null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n return userIds.map(userId => this.userById.get(userId) ?? null);\n }\n\n /**\n * Sign in with token (passed as password field).\n * The email field is ignored - only the token matters.\n */\n async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n const token = password;\n const user = this.tokens[token];\n\n if (!user) {\n throw new Error('Invalid token');\n }\n\n // Set cookie so the token persists across requests\n const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n return {\n user,\n token,\n cookies: [cookie],\n };\n }\n\n async signUp(): Promise<CredentialsResult<TUser>> {\n throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n }\n\n isSignUpEnabled(): boolean {\n return false;\n }\n\n /**\n * Get headers to clear the session cookie on logout.\n * Partial ISessionProvider implementation for logout support.\n */\n getClearSessionHeaders(): Record<string, string> {\n return {\n 'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n };\n }\n\n private stripBearerPrefix(token: string): string {\n return token.startsWith('Bearer ') ? token.slice(7) : token;\n }\n\n private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n const tokens = [token];\n for (const headerName of this.headers) {\n const headerValue = getRequestHeader(request, headerName);\n if (headerValue) {\n tokens.push(this.stripBearerPrefix(headerValue));\n }\n }\n return tokens;\n }\n}\n","import type {\n AuthInitContext,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n IUserProvider,\n CredentialsResult,\n} from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { LibsqlDialect } from '@libsql/kysely-libsql';\n\nimport { betterAuth } from 'better-auth';\nimport type { Auth, BetterAuthOptions, Session, User } from 'better-auth';\nimport { makeSignature } from 'better-auth/crypto';\nimport { getMigrations } from 'better-auth/db/migration';\nimport { organization } from 'better-auth/plugins';\n\ntype HonoRequestLike = {\n raw?: Request;\n headers?: Headers;\n header(name: string): string | undefined;\n};\n\ntype MastraAuthRequest = Request | HonoRequestLike;\n\ntype BetterAuthContext = Awaited<Auth['$context']>;\n\nfunction tryDecode(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\nfunction getRequestHeader(request: MastraAuthRequest, name: string): string | null {\n if (request instanceof Request) {\n return request.headers.get(name);\n }\n\n return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;\n}\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n session: Session;\n user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n return {\n id: user.id,\n email: user.email,\n name: user.name,\n avatarUrl: user.image ?? undefined,\n metadata: {\n emailVerified: user.emailVerified,\n createdAt: user.createdAt,\n updatedAt: user.updatedAt,\n },\n };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n /**\n * The Better Auth instance to use for authentication.\n * This should be the result of calling `betterAuth({ ... })`.\n *\n * Optional when `secret` is provided: the provider then builds its own\n * `betterAuth()` instance in `init()` on the host's auth database (deferred\n * instance mode) and owns its schema migrations.\n */\n auth?: Auth;\n\n /**\n * Secret used for session signing by the provider-built `betterAuth()`\n * instance (deferred instance mode). Ignored when `auth` is provided.\n */\n secret?: string;\n\n /**\n * Whether to allow new user registration via sign-up.\n * Set to false to disable public registration.\n * @default true\n */\n signUpEnabled?: boolean;\n}\n\n/** Loose row shapes read back from better-auth's internal DB adapter. */\ninterface MemberRow {\n organizationId?: string;\n role?: string;\n userId?: string;\n}\ninterface OrganizationRow {\n id: string;\n}\n\n/**\n * Tagged auth-database handle shape hosts may pass as `AuthInitContext.database`\n * (e.g. the Mastra Code web factory's storage backends).\n */\ninterface TaggedAuthDatabase {\n dialect?: string;\n pool?: unknown;\n client?: unknown;\n database?: unknown;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n * database: {\n * provider: 'postgresql',\n * url: process.env.DATABASE_URL!,\n * },\n * emailAndPassword: {\n * enabled: true,\n * },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n * auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n * server: {\n * auth: mastraAuth,\n * },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n extends MastraAuthProvider<BetterAuthUser>\n implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>, IOrganizationsProvider, IAuthInit, IAuthHttpHandler\n{\n #auth: Auth | undefined;\n #secret: string | undefined;\n /** True when `init()` built the instance — then we also own its migrations. */\n #ownsInstance = false;\n /** Once-per-process migration latch; reset on failure so a later call retries. */\n #migrated: Promise<void> | undefined;\n /** In-process `userId → orgId` cache so hosts can call `ensureOrganization` per request. */\n #orgCache = new Map<string, string>();\n /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */\n #crossSite = false;\n protected signUpEnabledConfig: boolean;\n\n constructor(options: MastraAuthBetterAuthOptions) {\n super({ name: options?.name ?? 'better-auth' });\n\n if (!options.auth && !options.secret) {\n throw new Error(\n 'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), ' +\n 'or provide `secret` so the provider can build its own instance in init() on the host database.',\n );\n }\n\n this.#auth = options.auth;\n this.#secret = options.secret;\n this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n this.registerOptions(options);\n }\n\n /**\n * The active Better Auth instance. Throws before `init()` in deferred\n * instance mode (constructed with `secret` instead of `auth`).\n */\n protected get auth(): Auth {\n if (!this.#auth) {\n throw new Error(\n 'MastraAuthBetterAuth is not initialized — init() must run first (or pass a configured `auth` instance).',\n );\n }\n return this.#auth;\n }\n\n /**\n * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller\n * override via `advanced.cookies.session_token.name`, and the `__Secure-`\n * prefix Better Auth applies when secure cookies are active.\n */\n get sessionCookieName(): string {\n const options = (this.#auth as { options?: { baseURL?: string; advanced?: Record<string, unknown> } } | undefined)\n ?.options;\n const advanced = options?.advanced as\n | {\n cookiePrefix?: string;\n useSecureCookies?: boolean;\n cookies?: { session_token?: { name?: string } };\n }\n | undefined;\n const prefix = advanced?.cookiePrefix ?? 'better-auth';\n const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith('https://') ?? false;\n const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;\n return `${secure ? '__Secure-' : ''}${baseName}`;\n }\n\n // ============================================\n // IAuthInit implementation\n // ============================================\n\n /**\n * One-time host initialization. In deferred instance mode (no `auth` in the\n * options) this builds the provider-owned `betterAuth()` instance on the\n * host's auth database; schema migrations then run lazily behind a\n * once-per-process latch on first use.\n *\n * Bring-your-own `auth` instances skip construction entirely — the caller\n * owns their database and migrations.\n */\n async init(ctx: AuthInitContext): Promise<void> {\n this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;\n if (this.#auth) return; // bring-your-own instance: nothing to build\n\n const authDb = ctx.database as TaggedAuthDatabase | undefined;\n if (!authDb) {\n throw new Error(\n 'MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. ' +\n 'Use a storage backend that exposes an auth database, or pass your own configured `auth` instance.',\n );\n }\n // Map the host's tagged auth-database handle onto better-auth's `database`\n // option: pg pool directly, libsql via its kysely dialect, anything else\n // passed through as-is (the host owns its compatibility).\n const database: BetterAuthOptions['database'] =\n authDb.dialect === 'postgres'\n ? (authDb.pool as Extract<BetterAuthOptions['database'], { query: unknown }>)\n : authDb.dialect === 'libsql'\n ? {\n dialect: new LibsqlDialect({ client: authDb.client } as ConstructorParameters<typeof LibsqlDialect>[0]),\n type: 'sqlite' as const,\n }\n : (authDb.database as BetterAuthOptions['database']);\n const allowedOrigins = ctx.allowedOrigins ?? [];\n // Widen to BetterAuthOptions before calling betterAuth(): its return type\n // is generic over the exact options object, which would make the instance\n // incompatible with the plain `Auth` alias we store.\n const options: BetterAuthOptions = {\n database,\n secret: this.#secret,\n // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,\n // where hosts mount handleAuthRequest.\n basePath: '/auth/api',\n ...(ctx.publicUrl ? { baseURL: ctx.publicUrl } : {}),\n // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the\n // cookie — better-auth still rejects requests from origins outside its\n // own allow-list, so the SPA origins must be trusted too.\n ...(allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {}),\n emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },\n plugins: [organization()],\n // Cross-origin SPA deploys need SameSite=None; Secure for the browser to\n // send the session cookie.\n ...(this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: 'none', secure: true } } } : {}),\n };\n this.#auth = betterAuth(options);\n this.#ownsInstance = true;\n }\n\n /**\n * Ensure better-auth's tables exist in the host database. Only for instances\n * this provider built — bring-your-own instances manage their own migrations.\n */\n async #ensureDbReady(): Promise<void> {\n if (!this.#ownsInstance) return;\n this.#migrated ??= (async () => {\n const { runMigrations } = await getMigrations(this.auth.options as BetterAuthOptions);\n await runMigrations();\n })();\n try {\n await this.#migrated;\n } catch (error) {\n this.#migrated = undefined; // allow a later call to retry\n console.warn('[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.');\n throw error;\n }\n }\n\n // ============================================\n // IAuthHttpHandler implementation\n // ============================================\n\n /**\n * Proxy a raw HTTP request to Better Auth's own API surface\n * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.\n */\n async handleAuthRequest(request: Request): Promise<Response> {\n try {\n await this.#ensureDbReady();\n } catch {\n return new Response(JSON.stringify({ error: 'auth_unavailable' }), {\n status: 503,\n headers: { 'content-type': 'application/json' },\n });\n }\n return this.auth.handler(request);\n }\n\n // ============================================\n // IOrganizationsProvider implementation\n // ============================================\n\n /**\n * Ensure the user belongs to an organization, mirroring the WorkOS\n * personal-org bootstrap on better-auth's organization tables:\n * ≥1 membership → first org id; 0 → create a personal org with an\n * idempotent slug derived from the user id.\n *\n * Concurrent/retried first logins recover via the unique slug instead of\n * creating duplicates. Slug alone is NOT proof of ownership though: the\n * organization API is reachable by any authenticated user, so an attacker\n * could squat `personal-<victimId>`. The slug-matched org is only adopted\n * when nobody else is a member; otherwise a fresh org with an unguessable\n * slug is created instead.\n *\n * Best-effort: any failure is swallowed and leaves the user no-org.\n */\n async ensureOrganization(userId: string): Promise<string | undefined> {\n const cached = this.#orgCache.get(userId);\n if (cached) return cached;\n\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n\n const memberships = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'userId', value: userId }],\n })) as MemberRow[];\n const firstExisting = memberships.find(m => m.organizationId)?.organizationId;\n if (firstExisting) {\n this.#orgCache.set(userId, firstExisting);\n return firstExisting;\n }\n\n // Build a predictable personal-org name from the user's profile.\n const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);\n const label = userRecord?.email ?? userRecord?.name ?? userId;\n const orgName = `${label}'s org`;\n const orgData = () => ({\n name: orgName,\n createdAt: new Date(),\n metadata: JSON.stringify({ mastraPersonalOrg: 'true' }),\n });\n\n // Create the personal org. The slug is derived from the user id, so a\n // concurrent/prior bootstrap that already created it makes the insert\n // reject on the unique slug — recover by looking the org up instead.\n const slug = `personal-${userId}`;\n let organizationId: string;\n try {\n const created = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug },\n })) as OrganizationRow;\n organizationId = created.id;\n } catch (error) {\n const existing = (await ctx.adapter.findOne({\n model: 'organization',\n where: [{ field: 'slug', value: slug }],\n })) as OrganizationRow | null;\n if (!existing) throw error;\n // Only adopt the slug-matched org when nobody else is a member (zero\n // members = a concurrent bootstrap of this same user that hasn't\n // attached yet). Otherwise fall back to an unguessable slug.\n const existingMembers = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'organizationId', value: existing.id }],\n })) as MemberRow[];\n const foreignMember = existingMembers.some(m => m.userId !== userId);\n if (foreignMember) {\n const fallback = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` },\n })) as OrganizationRow;\n organizationId = fallback.id;\n } else {\n organizationId = existing.id;\n }\n }\n\n // Idempotently attach the user: tolerate a membership a concurrent\n // bootstrap already created.\n try {\n await ctx.adapter.create({\n model: 'member',\n data: { organizationId, userId, role: 'owner', createdAt: new Date() },\n });\n } catch (error) {\n const member = await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n });\n if (!member) throw error;\n }\n\n this.#orgCache.set(userId, organizationId);\n return organizationId;\n } catch (error) {\n console.warn(\n `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. ` +\n 'The user will see organization_required until this succeeds.',\n error,\n );\n return undefined;\n }\n }\n\n /**\n * Whether the user holds an admin-equivalent role (`owner` or `admin`) in\n * the organization. Provider errors resolve to `false`.\n */\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return false;\n const membership = (await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n })) as MemberRow | null;\n return membership?.role === 'owner' || membership?.role === 'admin';\n } catch {\n return false;\n }\n }\n\n /**\n * Check if sign-up is enabled.\n * Implements ICredentialsProvider.isSignUpEnabled.\n */\n isSignUpEnabled(): boolean {\n return this.signUpEnabledConfig;\n }\n\n // ============================================\n // IUserProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Get current user from request.\n * Implements IUserProvider for EE user awareness in Studio.\n *\n * Supports both cookie-based sessions and `Authorization: Bearer <token>`\n * requests (e.g. API clients using the token returned by `signIn`).\n *\n * @param request - Incoming HTTP request\n * @returns EE User object or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<EEUser | null> {\n try {\n await this.#ensureDbReady();\n const headers = new Headers(request.headers);\n\n // If the request authenticates via Bearer token instead of cookies,\n // convert the token to a signed session cookie so getSession accepts it.\n const authHeader = headers.get('Authorization');\n const bearerToken =\n authHeader && authHeader.slice(0, 7).toLowerCase() === 'bearer ' ? authHeader.slice(7).trim() : undefined;\n await this.ensureSessionCookie(headers, bearerToken);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result?.user) return null;\n return mapBetterAuthUserToEEUser(result.user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Implements IUserProvider for EE user awareness.\n *\n * Uses Better Auth's internal adapter to look up the user record,\n * so it works with whichever database Better Auth is configured with.\n *\n * @param userId - User identifier\n * @returns EE User object or null if not found\n */\n async getUser(userId: string): Promise<EEUser | null> {\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return null;\n\n const user = await ctx.internalAdapter.findUserById(userId);\n if (!user) return null;\n return mapBetterAuthUserToEEUser(user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get multiple users by ID.\n * Optional IUserProvider method used for batch author enrichment.\n *\n * @param userIds - User identifiers\n * @returns EE User objects (null for missing users, order preserved)\n */\n async getUsers(userIds: string[]): Promise<Array<EEUser | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n\n /**\n * Get URL to user's profile page.\n * Optional IUserProvider method.\n */\n getUserProfileUrl(user: EEUser): string {\n return `/profile/${user.id}`;\n }\n\n /**\n * Get the resolved Better Auth context, or null when unavailable\n * (e.g. a partial mock without `$context`).\n */\n private async getAuthContext(): Promise<BetterAuthContext | null> {\n try {\n return (await Promise.resolve(this.auth.$context)) ?? null;\n } catch {\n return null;\n }\n }\n\n /**\n * Ensure the Cookie header on `headers` carries a Better Auth session cookie\n * for the given token.\n *\n * Better Auth's `getSession` reads the session from a *signed* cookie\n * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the\n * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens\n * are signed with the instance secret before being set as the session cookie.\n */\n private async ensureSessionCookie(headers: Headers, token: string | undefined): Promise<void> {\n if (!token) return;\n\n const ctx = await this.getAuthContext();\n const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;\n const secret = ctx?.secret;\n\n const cookieHeader = headers.get('Cookie');\n const hasSessionCookie = !!cookieHeader?.split(';').some(pair => {\n const [key] = pair.trim().split('=');\n return key?.trim() === cookieName;\n });\n if (hasSessionCookie) return;\n\n // Tokens containing \".\" are already signed (and may be URI-encoded).\n let cookieValue = token.includes('.') ? (token.includes('%') ? tryDecode(token) : token) : token;\n if (!token.includes('.') && secret) {\n cookieValue = `${token}.${await makeSignature(token, secret)}`;\n }\n\n const existingCookies = cookieHeader ? `${cookieHeader}; ` : '';\n headers.set('Cookie', `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);\n }\n\n /**\n * Authenticate a bearer token by verifying the session with Better Auth.\n *\n * This method extracts the session from the request headers using\n * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —\n * as returned by `signIn`/`signUp` — are signed before being passed to\n * Better Auth as a session cookie, matching the bearer plugin's semantics.\n *\n * @param token - The bearer token (session token) to authenticate\n * @param request - The request containing headers\n * @returns The authenticated user and session, or null if authentication fails\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<BetterAuthUser | null> {\n try {\n await this.#ensureDbReady();\n\n // Better Auth's api.getSession() reads session tokens from the Cookie header\n const headers = new Headers();\n\n const cookieHeader = getRequestHeader(request, 'Cookie');\n if (cookieHeader) {\n headers.set('Cookie', cookieHeader);\n }\n\n // Convert Bearer token to a signed session cookie if not already present.\n // better-auth ignores the Authorization header — it only reads from Cookie.\n await this.ensureSessionCookie(headers, token);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result || !result.session || !result.user) {\n return null;\n }\n\n return {\n session: result.session,\n user: result.user,\n };\n } catch {\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * By default, any authenticated user with a valid session is authorized.\n * You can override this behavior by providing a custom `authorizeUser` function\n * in the constructor options.\n *\n * @param user - The authenticated user and session\n * @returns True if the user is authorized, false otherwise\n */\n async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n // By default, any authenticated user with a valid session is authorized\n return !!user?.session?.id && !!user?.user?.id;\n }\n\n // ============================================\n // ICredentialsProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Sign in with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param request - Incoming HTTP request\n * @returns Result with user and session cookies\n * @throws Error if credentials are invalid\n */\n async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signInEmail({\n body: { email, password },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Invalid email or password');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Invalid email or password');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Sign up with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param name - Optional display name\n * @param request - Incoming HTTP request\n * @returns Result with new user and session cookies\n * @throws Error if sign up fails\n */\n async signUp(\n email: string,\n password: string,\n name: string | undefined,\n request: Request,\n ): Promise<CredentialsResult<EEUser>> {\n const displayName = name ?? email.split('@')[0] ?? 'User';\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signUpEmail({\n body: { email, password, name: displayName },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Failed to create account');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Failed to create account');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Get the underlying Better Auth instance.\n * Useful for accessing Better Auth APIs directly.\n */\n getAuth(): Auth {\n return this.auth;\n }\n\n /**\n * Get headers to clear the session cookies on logout.\n * Partial ISessionProvider implementation for logout support.\n *\n * Clears Better Auth's default session cookies.\n */\n getClearSessionHeaders(): Record<string, string> {\n // Cross-site deploys set the session cookie with SameSite=None; Secure —\n // the clearing cookie must match those attributes to overwrite it.\n const sameSite = this.#crossSite ? 'None; Secure' : 'Lax';\n // Clear both the session token and its signature cookie\n const cookies = [\n `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n ];\n return {\n 'Set-Cookie': cookies.join(', '),\n };\n }\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mastra/auth-better-auth",
3
- "version": "1.1.2-alpha.1",
3
+ "version": "1.1.2-alpha.2",
4
4
  "description": "Mastra Better Auth integration - self-hosted authentication",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -20,6 +20,7 @@
20
20
  },
21
21
  "license": "Apache-2.0",
22
22
  "dependencies": {
23
+ "@libsql/kysely-libsql": "^0.4.1",
23
24
  "better-auth": "^1.6.13"
24
25
  },
25
26
  "peerDependencies": {
@@ -29,7 +30,7 @@
29
30
  "@types/node": "22.20.1",
30
31
  "@vitest/coverage-v8": "4.1.10",
31
32
  "@vitest/ui": "4.1.10",
32
- "eslint": "^10.4.1",
33
+ "eslint": "^10.7.0",
33
34
  "tsup": "^8.5.1",
34
35
  "typescript": "^6.0.3",
35
36
  "vitest": "4.1.10",