@mastra/auth-better-auth 1.1.8-alpha.0 → 1.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.cjs.map +1 -1
  2. package/dist/index.js.map +1 -1
  3. package/package.json +6 -7
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.cjs","names":["#adapterContext","#correlate","#export","#rawConfig","#orgCache","#auth","#secret","#crossSite","LibsqlDialect","#ownsInstance","#ensureDbReady","#migrated","#findMembershipOrgId","#storeOrgId","#resolveActiveOrganizationId","#cachedOrgId"],"sources":["../../../packages/_internals/auth/dist/types/index.js","../../../packages/_internal-core/dist/logger/index.js","../../../packages/_internal-core/dist/base/index.js","../../../packages/_internals/auth/dist/provider/index.js","../src/index.ts"],"sourcesContent":["//#region src/types/index.ts\nfunction headerFromPlainObject(headers, name) {\n\tconst normalizedName = name.toLowerCase();\n\tconst matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);\n\tconst value = matchingKey === void 0 ? void 0 : headers[matchingKey];\n\treturn Array.isArray(value) ? value[0] ?? null : value ?? null;\n}\n/**\n* Read a request header across fetch, Hono, and Express-style request shapes.\n* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).\n*/\nfunction getRequestHeader(request, name) {\n\tif (request instanceof Request) return request.headers.get(name);\n\tif (request.raw instanceof Request) return request.raw.headers.get(name);\n\tconst headers = request.headers;\n\tif (headers instanceof Headers) return headers.get(name);\n\tif (typeof request.header === \"function\") return request.header(name) ?? null;\n\tif (headers && typeof headers === \"object\") return headerFromPlainObject(headers, name);\n\treturn null;\n}\nfunction getWebRequest(request) {\n\tif (request instanceof Request) return request;\n\treturn request.raw instanceof Request ? request.raw : void 0;\n}\n//#endregion\nexport { getRequestHeader, getWebRequest };\n\n//# sourceMappingURL=index.js.map","import { Transform } from \"stream\";\n//#region src/logger/adapter.ts\nfunction isAdaptableLogger(logger) {\n\treturn typeof logger.__attachObservability === \"function\";\n}\n/**\n* Export a tracked exception through the adapter sink, mirroring the\n* DualLogger dual-write shape (`errorId`/`domain`/`category`/`details`/`cause`\n* when present on a MastraError-like value). Never throws into the caller.\n*/\nfunction exportTrackedException(ctx, error, metadata) {\n\tif (!ctx?.options.export) return;\n\ttry {\n\t\tconst mastraError = error;\n\t\tctx.getLogSink()?.error(error.message, {\n\t\t\t...mastraError.id !== void 0 ? { errorId: mastraError.id } : {},\n\t\t\t...mastraError.domain !== void 0 ? { domain: mastraError.domain } : {},\n\t\t\t...mastraError.category !== void 0 ? { category: mastraError.category } : {},\n\t\t\t...mastraError.details !== void 0 ? { details: mastraError.details } : {},\n\t\t\t...error.cause instanceof Error ? { cause: error.cause.message } : {},\n\t\t\t...metadata\n\t\t});\n\t} catch {}\n}\n/**\n* Adapt IMastraLogger's variadic args into the structured `data` payload of\n* an exported log record. Extracts the first plain object as data,\n* serializes an Error arg, and collects remaining primitives under `args`\n* so the derived record preserves all context from the native call.\n*/\nfunction buildLogRecordData(args) {\n\tconst objectData = args.find((arg) => arg !== null && typeof arg === \"object\" && !Array.isArray(arg) && !(arg instanceof Error));\n\tconst errorArg = args.find((arg) => arg instanceof Error);\n\tconst extraArgs = args.filter((arg) => arg !== objectData && arg !== errorArg);\n\tif (!objectData && !errorArg && extraArgs.length === 0) return void 0;\n\treturn {\n\t\t...objectData ?? {},\n\t\t...errorArg ? { error: {\n\t\t\tname: errorArg.name,\n\t\t\tmessage: errorArg.message,\n\t\t\tstack: errorArg.stack\n\t\t} } : {},\n\t\t...extraArgs.length > 0 ? { args: extraArgs } : {}\n\t};\n}\n//#endregion\n//#region src/logger/index.ts\nconst RegisteredLogger = {\n\tAGENT: \"AGENT\",\n\tOBSERVABILITY: \"OBSERVABILITY\",\n\tAUTH: \"AUTH\",\n\tBROWSER: \"BROWSER\",\n\tNETWORK: \"NETWORK\",\n\tWORKFLOW: \"WORKFLOW\",\n\tLLM: \"LLM\",\n\tTTS: \"TTS\",\n\tVOICE: \"VOICE\",\n\tVECTOR: \"VECTOR\",\n\tBUNDLER: \"BUNDLER\",\n\tDEPLOYER: \"DEPLOYER\",\n\tMEMORY: \"MEMORY\",\n\tSTORAGE: \"STORAGE\",\n\tEMBEDDINGS: \"EMBEDDINGS\",\n\tMCP_SERVER: \"MCP_SERVER\",\n\tSERVER_CACHE: \"SERVER_CACHE\",\n\tSERVER: \"SERVER\",\n\tWORKSPACE: \"WORKSPACE\",\n\tCHANNEL: \"CHANNEL\"\n};\nconst LogLevel = {\n\tDEBUG: \"debug\",\n\tINFO: \"info\",\n\tWARN: \"warn\",\n\tERROR: \"error\",\n\tNONE: \"silent\"\n};\nvar LoggerTransport = class extends Transform {\n\tconstructor(opts = {}) {\n\t\tsuper({\n\t\t\t...opts,\n\t\t\tobjectMode: true\n\t\t});\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogs(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nconst createCustomTransport = (stream, listLogs, listLogsByRunId) => {\n\tlet transport = stream;\n\tif (listLogs) transport.listLogs = listLogs;\n\tif (listLogsByRunId) transport.listLogsByRunId = listLogsByRunId;\n\treturn transport;\n};\nvar MastraLogger = class {\n\tname;\n\tlevel;\n\ttransports;\n\tconstructor(options = {}) {\n\t\tthis.name = options.name || \"Mastra\";\n\t\tthis.level = options.level || LogLevel.ERROR;\n\t\tthis.transports = new Map(Object.entries(options.transports || {}));\n\t}\n\tgetTransports() {\n\t\treturn this.transports;\n\t}\n\ttrackException(_error, _metadata) {}\n\tasync listLogs(transportId, params) {\n\t\tif (!transportId || !this.transports.has(transportId)) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogs?.(params) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {\n\t\tif (!transportId || !this.transports.has(transportId) || !runId) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogsByRunId?.({\n\t\t\trunId,\n\t\t\tfromDate,\n\t\t\ttoDate,\n\t\t\tlogLevel,\n\t\t\tfilters,\n\t\t\tpage,\n\t\t\tperPage\n\t\t}) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nvar ConsoleLogger = class ConsoleLogger extends MastraLogger {\n\tcomponent;\n\tfilter;\n\t#adapterContext;\n\tconstructor(options = {}) {\n\t\tsuper(options);\n\t\tthis.component = options.component;\n\t\tthis.filter = options.filter;\n\t}\n\t/**\n\t* Adapter hook (see `AdaptableLogger`): enables native trace correlation\n\t* (trace_id/span_id appended to console output) and observability export\n\t* derived from the same record. Called by Mastra during setup.\n\t*/\n\t__attachObservability(ctx) {\n\t\tthis.#adapterContext = ctx;\n\t}\n\tchild(componentOrBindings) {\n\t\tconst component = typeof componentOrBindings === \"string\" ? componentOrBindings : componentOrBindings?.component ?? this.component;\n\t\tconst child = new ConsoleLogger({\n\t\t\tname: this.name,\n\t\t\tlevel: this.level,\n\t\t\tcomponent,\n\t\t\tfilter: this.filter\n\t\t});\n\t\tif (this.#adapterContext) child.__attachObservability(this.#adapterContext);\n\t\treturn child;\n\t}\n\t/**\n\t* Native-record correlation: when a span is active, append the trace\n\t* fields object to the console args so every destination sees them.\n\t*/\n\t#correlate(args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.correlation) return args;\n\t\ttry {\n\t\t\tconst fields = ctx.resolveTraceFields();\n\t\t\treturn fields ? [...args, fields] : args;\n\t\t} catch {\n\t\t\treturn args;\n\t\t}\n\t}\n\t/**\n\t* Export the record derived from the same native call to observability.\n\t* Mirrors DualLogger semantics: export is independent of the console\n\t* level filter, and never throws into the caller.\n\t*/\n\t#export(level, message, args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.export) return;\n\t\ttry {\n\t\t\tctx.getLogSink()?.[level](message, buildLogRecordData(args));\n\t\t} catch {}\n\t}\n\tshouldLog(level, message, args) {\n\t\tif (!this.filter) return true;\n\t\ttry {\n\t\t\treturn this.filter({\n\t\t\t\tcomponent: this.component,\n\t\t\t\tlevel,\n\t\t\t\tmessage,\n\t\t\t\targs\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tconsole.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n\t\t\treturn true;\n\t\t}\n\t}\n\tprefix() {\n\t\treturn this.component ? `[${this.component}] ` : \"\";\n\t}\n\tdebug(message, ...args) {\n\t\tif (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"debug\", message, args);\n\t}\n\tinfo(message, ...args) {\n\t\tif ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"info\", message, args);\n\t}\n\twarn(message, ...args) {\n\t\tif ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"warn\", message, args);\n\t}\n\terror(message, ...args) {\n\t\tif ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"error\", message, args);\n\t}\n\ttrackException(error, metadata) {\n\t\texportTrackedException(this.#adapterContext, error, metadata);\n\t}\n\tasync listLogs(_transportId, _params) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _params?.page ?? 1,\n\t\t\tperPage: _params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args.page ?? 1,\n\t\t\tperPage: _args.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\n//#endregion\nexport { ConsoleLogger, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, buildLogRecordData, createCustomTransport, exportTrackedException, isAdaptableLogger };\n\n//# sourceMappingURL=index.js.map","import { ConsoleLogger, RegisteredLogger } from \"../logger/index.js\";\n//#region src/base/MastraBase.ts\nvar MastraBase = class {\n\tcomponent = RegisteredLogger.LLM;\n\tlogger;\n\tname;\n\t#rawConfig;\n\tconstructor({ component, name, rawConfig }) {\n\t\tthis.component = component || RegisteredLogger.LLM;\n\t\tthis.name = name;\n\t\tthis.#rawConfig = rawConfig;\n\t\tthis.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n\t}\n\t/**\n\t* Returns the raw storage configuration this primitive was created from,\n\t* or undefined if it was created from code.\n\t*/\n\ttoRawConfig() {\n\t\treturn this.#rawConfig;\n\t}\n\t/**\n\t* Sets the raw storage configuration for this primitive.\n\t* @internal\n\t*/\n\t__setRawConfig(rawConfig) {\n\t\tthis.#rawConfig = rawConfig;\n\t}\n\t/**\n\t* Set the logger for the agent\n\t* @param logger\n\t*/\n\t__setLogger(logger) {\n\t\tthis.logger = \"child\" in logger && typeof logger.child === \"function\" ? logger.child({ component: this.component }) : logger;\n\t}\n};\n//#endregion\nexport { MastraBase };\n\n//# sourceMappingURL=index.js.map","import { getRequestHeader } from \"../types/index.js\";\nimport { MastraBase } from \"@internal/core/base\";\n//#region src/provider/index.ts\nvar MastraAuthProvider = class extends MastraBase {\n\tprotected;\n\tpublic;\n\tconstructor(options) {\n\t\tsuper({\n\t\t\tcomponent: \"AUTH\",\n\t\t\tname: options?.name\n\t\t});\n\t\tif (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);\n\t\tthis.protected = options?.protected;\n\t\tthis.public = options?.public;\n\t\tthis.mapUserToResourceId = options?.mapUserToResourceId;\n\t}\n\tregisterOptions(opts) {\n\t\tif (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);\n\t\tif (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;\n\t\tif (opts?.protected) this.protected = opts.protected;\n\t\tif (opts?.public) this.public = opts.public;\n\t}\n};\nfunction isSSOProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getLoginUrl === \"function\" && typeof p.handleCallback === \"function\";\n}\nfunction isSessionProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.validateSession === \"function\" && typeof p.createSession === \"function\";\n}\nfunction isUserProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getCurrentUser === \"function\";\n}\nfunction isCredentialsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.signIn === \"function\";\n}\nfunction isOrganizationsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.ensureOrganization === \"function\" && typeof p.isOrganizationAdmin === \"function\";\n}\nfunction isAuthHttpHandler(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.handleAuthRequest === \"function\";\n}\nfunction hasAuthInit(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.init === \"function\";\n}\nfunction isObjectLike(value) {\n\treturn typeof value === \"object\" && value !== null || typeof value === \"function\";\n}\nvar CompositeAuth = class CompositeAuth extends MastraAuthProvider {\n\tproviders;\n\tauthenticatedProviderByObject = /* @__PURE__ */ new WeakMap();\n\tauthenticatedProviderByPrimitive = /* @__PURE__ */ new Map();\n\tconstructor(providers) {\n\t\tconst combinedPublic = providers.flatMap((provider) => provider.public ?? []);\n\t\tconst combinedProtected = providers.flatMap((provider) => provider.protected ?? []);\n\t\tsuper({\n\t\t\tpublic: combinedPublic,\n\t\t\tprotected: combinedProtected\n\t\t});\n\t\tthis.providers = providers;\n\t\tif (providers.some((provider) => typeof provider.mapUserToResourceId === \"function\")) this.mapUserToResourceId = (user) => this.mapAuthenticatedUserToResourceId(user);\n\t\tif (!providers.some(isSSOProvider)) {\n\t\t\tthis.getLoginUrl = void 0;\n\t\t\tthis.handleCallback = void 0;\n\t\t\tthis.getLoginButtonConfig = void 0;\n\t\t}\n\t\tif (!providers.some(isSessionProvider)) {\n\t\t\tthis.createSession = void 0;\n\t\t\tthis.validateSession = void 0;\n\t\t\tthis.getSessionIdFromRequest = void 0;\n\t\t}\n\t\tif (!providers.some(isUserProvider)) {\n\t\t\tthis.getCurrentUser = void 0;\n\t\t\tthis.getUser = void 0;\n\t\t\tthis.getUsers = void 0;\n\t\t}\n\t\tconst credProvider = providers.find(isCredentialsProvider);\n\t\tif (credProvider) {\n\t\t\tthis.signIn = credProvider.signIn.bind(credProvider);\n\t\t\tif (typeof credProvider.signUp === \"function\") this.signUp = credProvider.signUp.bind(credProvider);\n\t\t\tif (typeof credProvider.requestPasswordReset === \"function\") this.requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n\t\t\tif (typeof credProvider.resetPassword === \"function\") this.resetPassword = credProvider.resetPassword.bind(credProvider);\n\t\t\tthis.isSignUpEnabled = typeof credProvider.isSignUpEnabled === \"function\" ? credProvider.isSignUpEnabled.bind(credProvider) : () => true;\n\t\t} else {\n\t\t\tthis.signIn = void 0;\n\t\t\tthis.signUp = void 0;\n\t\t\tthis.requestPasswordReset = void 0;\n\t\t\tthis.resetPassword = void 0;\n\t\t\tthis.isSignUpEnabled = void 0;\n\t\t}\n\t}\n\tfindProvider(check) {\n\t\treturn this.providers.find(check);\n\t}\n\trememberAuthenticatedProvider(user, provider) {\n\t\tif (isObjectLike(user)) {\n\t\t\tthis.authenticatedProviderByObject.set(user, provider);\n\t\t\treturn;\n\t\t}\n\t\tthis.authenticatedProviderByPrimitive.set(user, provider);\n\t}\n\ttakeAuthenticatedProvider(user) {\n\t\tif (isObjectLike(user)) {\n\t\t\tconst provider = this.authenticatedProviderByObject.get(user);\n\t\t\tthis.authenticatedProviderByObject.delete(user);\n\t\t\treturn provider;\n\t\t}\n\t\tconst primitiveUser = user;\n\t\tconst provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n\t\tthis.authenticatedProviderByPrimitive.delete(primitiveUser);\n\t\treturn provider;\n\t}\n\tmapAuthenticatedUserToResourceId(user) {\n\t\tconst provider = this.takeAuthenticatedProvider(user);\n\t\tif (typeof provider?.mapUserToResourceId !== \"function\") return;\n\t\tconst resourceId = provider.mapUserToResourceId(user);\n\t\tif (resourceId === void 0 && provider instanceof CompositeAuth) return;\n\t\tif (typeof resourceId !== \"string\" || !resourceId.trim()) throw new Error(\"mapUserToResourceId must return a non-empty string for the authenticated user\");\n\t\treturn resourceId;\n\t}\n\t/**\n\t* True if any provider is MastraCloudAuth (exempt from license requirement).\n\t*/\n\tget isMastraCloudAuth() {\n\t\treturn this.providers.some((p) => \"isMastraCloudAuth\" in p && p.isMastraCloudAuth === true);\n\t}\n\t/**\n\t* True if any provider is SimpleAuth (exempt from license requirement).\n\t*/\n\tget isSimpleAuth() {\n\t\treturn this.providers.some((p) => \"isSimpleAuth\" in p && p.isSimpleAuth === true);\n\t}\n\tasync authenticateToken(token, request) {\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst user = await provider.authenticateToken(token, request);\n\t\t\tif (user) {\n\t\t\t\tthis.rememberAuthenticatedProvider(user, provider);\n\t\t\t\treturn user;\n\t\t\t}\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tconsumePendingResponseHeaders(request) {\n\t\tlet merged;\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst pending = provider.consumePendingResponseHeaders?.(request);\n\t\t\tif (pending) merged = {\n\t\t\t\t...merged ?? {},\n\t\t\t\t...pending\n\t\t\t};\n\t\t} catch {}\n\t\treturn merged;\n\t}\n\tasync authorizeUser(user, request) {\n\t\tfor (const provider of this.providers) if (await provider.authorizeUser(user, request)) return true;\n\t\treturn false;\n\t}\n\t/**\n\t* Forward cookie header to SSO provider for PKCE validation.\n\t* Called by auth handler before handleCallback().\n\t*/\n\tsetCallbackCookieHeader(cookieHeader) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (sso && typeof sso.setCallbackCookieHeader === \"function\") sso.setCallbackCookieHeader(cookieHeader);\n\t}\n\tgetLoginUrl(redirectUri, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.getLoginUrl(redirectUri, state);\n\t}\n\tgetLoginCookies(redirectUri, state) {\n\t\treturn this.findProvider(isSSOProvider)?.getLoginCookies?.(redirectUri, state);\n\t}\n\tasync handleCallback(code, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.handleCallback(code, state);\n\t}\n\tgetLoginButtonConfig() {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) return {\n\t\t\tprovider: \"unknown\",\n\t\t\ttext: \"Sign in\"\n\t\t};\n\t\treturn sso.getLoginButtonConfig();\n\t}\n\tasync getLogoutUrl(redirectUri, request) {\n\t\tfor (const provider of this.providers) if (isSSOProvider(provider) && provider.getLogoutUrl) try {\n\t\t\tconst url = await provider.getLogoutUrl(redirectUri, request);\n\t\t\tif (url) return url;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync createSession(userId, metadata) {\n\t\tconst session = this.findProvider(isSessionProvider);\n\t\tif (!session) throw new Error(\"No session provider configured in CompositeAuth\");\n\t\treturn session.createSession(userId, metadata);\n\t}\n\tasync validateSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.validateSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync destroySession(sessionId) {\n\t\tconst destroyPromises = [];\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) destroyPromises.push(provider.destroySession(sessionId).catch(() => {}));\n\t\tawait Promise.all(destroyPromises);\n\t}\n\tasync refreshSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.refreshSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionIdFromRequest(request) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst sessionId = provider.getSessionIdFromRequest(request);\n\t\t\tif (sessionId) return sessionId;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionHeaders(session) {\n\t\treturn this.findProvider(isSessionProvider)?.getSessionHeaders(session) ?? {};\n\t}\n\tgetClearSessionHeaders() {\n\t\tconst headers = {};\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst providerHeaders = provider.getClearSessionHeaders();\n\t\t\tObject.assign(headers, providerHeaders);\n\t\t} catch {}\n\t\treturn headers;\n\t}\n\tasync getCurrentUser(request) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getCurrentUser(request);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUser(userId) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getUser(userId);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn Promise.all(userIds.map((userId) => this.getUser(userId)));\n\t}\n};\nconst DEFAULT_HEADERS = [\"Authorization\", \"X-Playground-Access\"];\nvar SimpleAuth = class extends MastraAuthProvider {\n\t/**\n\t* Marker to exempt SimpleAuth from EE license requirement.\n\t* SimpleAuth is for development/testing and should work without a license.\n\t*/\n\tisSimpleAuth = true;\n\ttokens;\n\theaders;\n\tusers;\n\tuserById;\n\tconstructor(options) {\n\t\tsuper(options);\n\t\tthis.tokens = options.tokens;\n\t\tthis.users = Object.values(this.tokens);\n\t\tthis.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n\t\tthis.userById = new Map(this.users.map((u) => [String(u?.id), u]));\n\t}\n\tasync authenticateToken(token, request) {\n\t\tconst requestTokens = this.getTokensFromHeaders(token, request);\n\t\tfor (const requestToken of requestTokens) {\n\t\t\tconst tokenToUser = this.tokens[requestToken];\n\t\t\tif (tokenToUser) return tokenToUser;\n\t\t}\n\t\treturn this.getUserFromCookie(getRequestHeader(request, \"Cookie\"));\n\t}\n\tasync authorizeUser(user, _request) {\n\t\treturn this.users.includes(user);\n\t}\n\t/** Get current user from request headers or cookie. */\n\tasync getCurrentUser(request) {\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = request.headers.get(headerName);\n\t\t\tif (headerValue) {\n\t\t\t\tconst token = this.stripBearerPrefix(headerValue);\n\t\t\t\tconst user = this.tokens[token];\n\t\t\t\tif (user) return user;\n\t\t\t}\n\t\t}\n\t\treturn this.getUserFromCookie(request.headers.get(\"Cookie\"));\n\t}\n\tgetUserFromCookie(cookieHeader) {\n\t\tif (!cookieHeader) return null;\n\t\tconst cookies = cookieHeader.split(\";\").map((c) => c.trim());\n\t\tfor (const cookie of cookies) if (cookie.startsWith(\"mastra-token=\")) {\n\t\t\tconst token = cookie.slice(13);\n\t\t\tconst user = this.tokens[token];\n\t\t\tif (user) return user;\n\t\t}\n\t\treturn null;\n\t}\n\t/** Get user by ID. */\n\tasync getUser(userId) {\n\t\treturn this.userById.get(userId) ?? null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn userIds.map((userId) => this.userById.get(userId) ?? null);\n\t}\n\t/**\n\t* Sign in with token (passed as password field).\n\t* The email field is ignored - only the token matters.\n\t*/\n\tasync signIn(_email, password, _request) {\n\t\tconst token = password;\n\t\tconst user = this.tokens[token];\n\t\tif (!user) throw new Error(\"Invalid token\");\n\t\treturn {\n\t\t\tuser,\n\t\t\ttoken,\n\t\t\tcookies: [`mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`]\n\t\t};\n\t}\n\tasync signUp() {\n\t\tthrow new Error(\"Sign up is not supported with SimpleAuth. Use pre-configured tokens.\");\n\t}\n\tisSignUpEnabled() {\n\t\treturn false;\n\t}\n\t/**\n\t* Get headers to clear the session cookie on logout.\n\t* Partial ISessionProvider implementation for logout support.\n\t*/\n\tgetClearSessionHeaders() {\n\t\treturn { \"Set-Cookie\": \"mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\" };\n\t}\n\tstripBearerPrefix(token) {\n\t\treturn token.startsWith(\"Bearer \") ? token.slice(7) : token;\n\t}\n\tgetTokensFromHeaders(token, request) {\n\t\tconst tokens = [token];\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = getRequestHeader(request, headerName);\n\t\t\tif (headerValue) tokens.push(this.stripBearerPrefix(headerValue));\n\t\t}\n\t\treturn tokens;\n\t}\n};\n//#endregion\nexport { CompositeAuth, MastraAuthProvider, SimpleAuth, hasAuthInit, isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider };\n\n//# sourceMappingURL=index.js.map","import type {\n AuthInitContext,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n IUserProvider,\n CredentialsResult,\n MastraAuthRequest,\n} from '@internal/auth';\nimport { getRequestHeader } from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { LibsqlDialect } from '@libsql/kysely-libsql';\n\nimport { betterAuth } from 'better-auth';\nimport type { Auth, BetterAuthOptions, Session, User } from 'better-auth';\nimport { makeSignature } from 'better-auth/crypto';\nimport { getMigrations } from 'better-auth/db/migration';\nimport { organization } from 'better-auth/plugins';\n\ntype BetterAuthContext = Awaited<Auth['$context']>;\n\nfunction tryDecode(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n /**\n * The better-auth session. `activeOrganizationId` comes from the\n * organization plugin (registered unconditionally by this provider); when\n * the stored session never had one set, `authenticateToken` resolves a\n * default from the user's existing memberships.\n */\n session: Session & { activeOrganizationId?: string | null };\n user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n return {\n id: user.id,\n email: user.email,\n name: user.name,\n avatarUrl: user.image ?? undefined,\n metadata: {\n emailVerified: user.emailVerified,\n createdAt: user.createdAt,\n updatedAt: user.updatedAt,\n },\n };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n /**\n * The Better Auth instance to use for authentication.\n * This should be the result of calling `betterAuth({ ... })`.\n *\n * Optional when `secret` is provided: the provider then builds its own\n * `betterAuth()` instance in `init()` on the host's auth database (deferred\n * instance mode) and owns its schema migrations.\n */\n auth?: Auth;\n\n /**\n * Secret used for session signing by the provider-built `betterAuth()`\n * instance (deferred instance mode). Ignored when `auth` is provided.\n */\n secret?: string;\n\n /**\n * Whether to allow new user registration via sign-up.\n * Set to false to disable public registration.\n * @default true\n */\n signUpEnabled?: boolean;\n}\n\n/** Loose row shapes read back from better-auth's internal DB adapter. */\n/**\n * How long a resolved `userId → orgId` mapping stays cached. Bounded so an\n * administrator revoking a membership takes effect on new sessions within a\n * minute, rather than persisting until process restart.\n */\nconst ORG_CACHE_TTL_MS = 60_000;\n\ninterface MemberRow {\n organizationId?: string;\n role?: string;\n userId?: string;\n}\ninterface OrganizationRow {\n id: string;\n}\n\n/**\n * Tagged auth-database handle shape hosts may pass as `AuthInitContext.database`\n * (e.g. the Mastra Code web factory's storage backends).\n */\ninterface TaggedAuthDatabase {\n dialect?: string;\n pool?: unknown;\n client?: unknown;\n database?: unknown;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n * database: {\n * provider: 'postgresql',\n * url: process.env.DATABASE_URL!,\n * },\n * emailAndPassword: {\n * enabled: true,\n * },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n * auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n * server: {\n * auth: mastraAuth,\n * },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n extends MastraAuthProvider<BetterAuthUser>\n implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>, IOrganizationsProvider, IAuthInit, IAuthHttpHandler\n{\n #auth: Auth | undefined;\n #secret: string | undefined;\n /** True when `init()` built the instance — then we also own its migrations. */\n #ownsInstance = false;\n /** Once-per-process migration latch; reset on failure so a later call retries. */\n #migrated: Promise<void> | undefined;\n /**\n * In-process `userId → orgId` cache, shared by `ensureOrganization` and the\n * `authenticateToken` default-org resolution. Only successes are cached, so\n * membership-less users re-run the lookup per request. Entries expire after\n * `ORG_CACHE_TTL_MS` so a membership revoked by an administrator stops being\n * injected into new sessions within the TTL window instead of persisting for\n * the process lifetime.\n */\n #orgCache = new Map<string, { orgId: string; expiresAt: number }>();\n\n #cachedOrgId(userId: string): string | undefined {\n const entry = this.#orgCache.get(userId);\n if (!entry) return undefined;\n if (Date.now() >= entry.expiresAt) {\n this.#orgCache.delete(userId);\n return undefined;\n }\n return entry.orgId;\n }\n\n /**\n * Cache a resolved `userId → orgId` mapping. The map is kept in expiry\n * order: writes delete-then-set so refreshed entries move to the back, and\n * since every entry uses the same TTL, iteration order is ascending\n * `expiresAt`. The sweep therefore stops at the first live entry, making\n * each write amortized O(1) instead of a full scan.\n */\n #storeOrgId(userId: string, orgId: string): void {\n const now = Date.now();\n for (const [key, entry] of this.#orgCache) {\n if (now < entry.expiresAt) break;\n this.#orgCache.delete(key);\n }\n this.#orgCache.delete(userId);\n this.#orgCache.set(userId, { orgId, expiresAt: now + ORG_CACHE_TTL_MS });\n }\n\n /** @internal Test hook: current org-cache cardinality. */\n get orgCacheSize(): number {\n return this.#orgCache.size;\n }\n /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */\n #crossSite = false;\n protected signUpEnabledConfig: boolean;\n\n constructor(options: MastraAuthBetterAuthOptions) {\n super({ name: options?.name ?? 'better-auth' });\n\n if (!options.auth && !options.secret) {\n throw new Error(\n 'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), ' +\n 'or provide `secret` so the provider can build its own instance in init() on the host database.',\n );\n }\n\n this.#auth = options.auth;\n this.#secret = options.secret;\n this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n this.registerOptions(options);\n }\n\n /**\n * The active Better Auth instance. Throws before `init()` in deferred\n * instance mode (constructed with `secret` instead of `auth`).\n */\n protected get auth(): Auth {\n if (!this.#auth) {\n throw new Error(\n 'MastraAuthBetterAuth is not initialized — init() must run first (or pass a configured `auth` instance).',\n );\n }\n return this.#auth;\n }\n\n /**\n * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller\n * override via `advanced.cookies.session_token.name`, and the `__Secure-`\n * prefix Better Auth applies when secure cookies are active.\n */\n get sessionCookieName(): string {\n const options = (this.#auth as { options?: { baseURL?: string; advanced?: Record<string, unknown> } } | undefined)\n ?.options;\n const advanced = options?.advanced as\n | {\n cookiePrefix?: string;\n useSecureCookies?: boolean;\n cookies?: { session_token?: { name?: string } };\n }\n | undefined;\n const prefix = advanced?.cookiePrefix ?? 'better-auth';\n const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith('https://') ?? false;\n const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;\n return `${secure ? '__Secure-' : ''}${baseName}`;\n }\n\n // ============================================\n // IAuthInit implementation\n // ============================================\n\n /**\n * One-time host initialization. In deferred instance mode (no `auth` in the\n * options) this builds the provider-owned `betterAuth()` instance on the\n * host's auth database; schema migrations then run lazily behind a\n * once-per-process latch on first use.\n *\n * Bring-your-own `auth` instances skip construction entirely — the caller\n * owns their database and migrations.\n */\n async init(ctx: AuthInitContext): Promise<void> {\n this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;\n if (this.#auth) return; // bring-your-own instance: nothing to build\n\n const authDb = ctx.database as TaggedAuthDatabase | undefined;\n if (!authDb) {\n throw new Error(\n 'MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. ' +\n 'Use a storage backend that exposes an auth database, or pass your own configured `auth` instance.',\n );\n }\n // Map the host's tagged auth-database handle onto better-auth's `database`\n // option: pg pool directly, libsql via its kysely dialect, anything else\n // passed through as-is (the host owns its compatibility).\n const database: BetterAuthOptions['database'] =\n authDb.dialect === 'postgres'\n ? (authDb.pool as Extract<BetterAuthOptions['database'], { query: unknown }>)\n : authDb.dialect === 'libsql'\n ? {\n dialect: new LibsqlDialect({ client: authDb.client } as ConstructorParameters<typeof LibsqlDialect>[0]),\n type: 'sqlite' as const,\n }\n : (authDb.database as BetterAuthOptions['database']);\n const allowedOrigins = ctx.allowedOrigins ?? [];\n // Widen to BetterAuthOptions before calling betterAuth(): its return type\n // is generic over the exact options object, which would make the instance\n // incompatible with the plain `Auth` alias we store.\n const options: BetterAuthOptions = {\n database,\n secret: this.#secret,\n // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,\n // where hosts mount handleAuthRequest.\n basePath: '/auth/api',\n ...(ctx.publicUrl ? { baseURL: ctx.publicUrl } : {}),\n // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the\n // cookie — better-auth still rejects requests from origins outside its\n // own allow-list, so the SPA origins must be trusted too.\n ...(allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {}),\n emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },\n plugins: [organization()],\n // Cross-origin SPA deploys need SameSite=None; Secure for the browser to\n // send the session cookie.\n ...(this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: 'none', secure: true } } } : {}),\n };\n this.#auth = betterAuth(options);\n this.#ownsInstance = true;\n }\n\n /**\n * Ensure better-auth's tables exist in the host database. Only for instances\n * this provider built — bring-your-own instances manage their own migrations.\n */\n async #ensureDbReady(): Promise<void> {\n if (!this.#ownsInstance) return;\n this.#migrated ??= (async () => {\n const { runMigrations } = await getMigrations(this.auth.options as BetterAuthOptions);\n await runMigrations();\n })();\n try {\n await this.#migrated;\n } catch (error) {\n this.#migrated = undefined; // allow a later call to retry\n console.warn('[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.');\n throw error;\n }\n }\n\n // ============================================\n // IAuthHttpHandler implementation\n // ============================================\n\n /**\n * Proxy a raw HTTP request to Better Auth's own API surface\n * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.\n */\n async handleAuthRequest(request: Request): Promise<Response> {\n try {\n await this.#ensureDbReady();\n } catch {\n return new Response(JSON.stringify({ error: 'auth_unavailable' }), {\n status: 503,\n headers: { 'content-type': 'application/json' },\n });\n }\n return this.auth.handler(request);\n }\n\n // ============================================\n // IOrganizationsProvider implementation\n // ============================================\n\n /**\n * Read-only half of org resolution: the user's oldest existing membership,\n * cached in `#orgCache`. Never creates anything. Ordered by `createdAt` so\n * the resolved default is stable across processes for multi-org users.\n */\n async #findMembershipOrgId(ctx: BetterAuthContext, userId: string): Promise<string | undefined> {\n const memberships = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'userId', value: userId }],\n sortBy: { field: 'createdAt', direction: 'asc' },\n })) as MemberRow[];\n const orgId = memberships.find(m => m.organizationId)?.organizationId;\n if (orgId) this.#storeOrgId(userId, orgId);\n return orgId;\n }\n\n /**\n * Resolve the organization a session should act under when better-auth's\n * `activeOrganizationId` was never set (nothing in this provider or a\n * default sign-in flow calls the organization plugin's `setActive`).\n * Read-only and best-effort: an existing membership or nothing.\n *\n * Callers must run `#ensureDbReady` first (authenticateToken does); this\n * method deliberately swallows failures, so an unmigrated DB would\n * otherwise fail silently.\n */\n async #resolveActiveOrganizationId(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n return await this.#findMembershipOrgId(ctx, userId);\n } catch {\n return undefined;\n }\n }\n\n /**\n * Ensure the user belongs to an organization, mirroring the WorkOS\n * personal-org bootstrap on better-auth's organization tables:\n * ≥1 membership → oldest org id; 0 → create a personal org with an\n * idempotent slug derived from the user id.\n *\n * Concurrent/retried first logins recover via the unique slug instead of\n * creating duplicates. Slug alone is NOT proof of ownership though: the\n * organization API is reachable by any authenticated user, so an attacker\n * could squat `personal-<victimId>`. The slug-matched org is only adopted\n * when nobody else is a member; otherwise a fresh org with an unguessable\n * slug is created instead.\n *\n * Best-effort: any failure is swallowed and leaves the user no-org.\n */\n async ensureOrganization(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n\n const firstExisting = await this.#findMembershipOrgId(ctx, userId);\n if (firstExisting) return firstExisting;\n\n // Build a predictable personal-org name from the user's profile.\n const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);\n const label = userRecord?.email ?? userRecord?.name ?? userId;\n const orgName = `${label}'s org`;\n const orgData = () => ({\n name: orgName,\n createdAt: new Date(),\n metadata: JSON.stringify({ mastraPersonalOrg: 'true' }),\n });\n\n // Create the personal org. The slug is derived from the user id, so a\n // concurrent/prior bootstrap that already created it makes the insert\n // reject on the unique slug — recover by looking the org up instead.\n const slug = `personal-${userId}`;\n let organizationId: string;\n try {\n const created = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug },\n })) as OrganizationRow;\n organizationId = created.id;\n } catch (error) {\n const existing = (await ctx.adapter.findOne({\n model: 'organization',\n where: [{ field: 'slug', value: slug }],\n })) as OrganizationRow | null;\n if (!existing) throw error;\n // Only adopt the slug-matched org when nobody else is a member (zero\n // members = a concurrent bootstrap of this same user that hasn't\n // attached yet). Otherwise fall back to an unguessable slug.\n const existingMembers = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'organizationId', value: existing.id }],\n })) as MemberRow[];\n const foreignMember = existingMembers.some(m => m.userId !== userId);\n if (foreignMember) {\n const fallback = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` },\n })) as OrganizationRow;\n organizationId = fallback.id;\n } else {\n organizationId = existing.id;\n }\n }\n\n // Idempotently attach the user: tolerate a membership a concurrent\n // bootstrap already created.\n try {\n await ctx.adapter.create({\n model: 'member',\n data: { organizationId, userId, role: 'owner', createdAt: new Date() },\n });\n } catch (error) {\n const member = await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n });\n if (!member) throw error;\n }\n\n this.#storeOrgId(userId, organizationId);\n return organizationId;\n } catch (error) {\n console.warn(\n `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. ` +\n 'The user will see organization_required until this succeeds.',\n error,\n );\n return undefined;\n }\n }\n\n /**\n * Whether the user holds an admin-equivalent role (`owner` or `admin`) in\n * the organization. Provider errors resolve to `false`.\n */\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return false;\n const membership = (await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n })) as MemberRow | null;\n return membership?.role === 'owner' || membership?.role === 'admin';\n } catch {\n return false;\n }\n }\n\n /**\n * Check if sign-up is enabled.\n * Implements ICredentialsProvider.isSignUpEnabled.\n */\n isSignUpEnabled(): boolean {\n return this.signUpEnabledConfig;\n }\n\n // ============================================\n // IUserProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Get current user from request.\n * Implements IUserProvider for EE user awareness in Studio.\n *\n * Supports both cookie-based sessions and `Authorization: Bearer <token>`\n * requests (e.g. API clients using the token returned by `signIn`).\n *\n * @param request - Incoming HTTP request\n * @returns EE User object or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<EEUser | null> {\n try {\n await this.#ensureDbReady();\n const headers = new Headers(request.headers);\n\n // If the request authenticates via Bearer token instead of cookies,\n // convert the token to a signed session cookie so getSession accepts it.\n const authHeader = headers.get('Authorization');\n const bearerToken =\n authHeader && authHeader.slice(0, 7).toLowerCase() === 'bearer ' ? authHeader.slice(7).trim() : undefined;\n await this.ensureSessionCookie(headers, bearerToken);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result?.user) return null;\n return mapBetterAuthUserToEEUser(result.user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Implements IUserProvider for EE user awareness.\n *\n * Uses Better Auth's internal adapter to look up the user record,\n * so it works with whichever database Better Auth is configured with.\n *\n * @param userId - User identifier\n * @returns EE User object or null if not found\n */\n async getUser(userId: string): Promise<EEUser | null> {\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return null;\n\n const user = await ctx.internalAdapter.findUserById(userId);\n if (!user) return null;\n return mapBetterAuthUserToEEUser(user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get multiple users by ID.\n * Optional IUserProvider method used for batch author enrichment.\n *\n * @param userIds - User identifiers\n * @returns EE User objects (null for missing users, order preserved)\n */\n async getUsers(userIds: string[]): Promise<Array<EEUser | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n\n /**\n * Get URL to user's profile page.\n * Optional IUserProvider method.\n */\n getUserProfileUrl(user: EEUser): string {\n return `/profile/${user.id}`;\n }\n\n /**\n * Get the resolved Better Auth context, or null when unavailable\n * (e.g. a partial mock without `$context`).\n */\n private async getAuthContext(): Promise<BetterAuthContext | null> {\n try {\n return (await Promise.resolve(this.auth.$context)) ?? null;\n } catch {\n return null;\n }\n }\n\n /**\n * Ensure the Cookie header on `headers` carries a Better Auth session cookie\n * for the given token.\n *\n * Better Auth's `getSession` reads the session from a *signed* cookie\n * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the\n * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens\n * are signed with the instance secret before being set as the session cookie.\n */\n private async ensureSessionCookie(headers: Headers, token: string | undefined): Promise<void> {\n if (!token) return;\n\n const ctx = await this.getAuthContext();\n const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;\n const secret = ctx?.secret;\n\n const cookieHeader = headers.get('Cookie');\n const hasSessionCookie = !!cookieHeader?.split(';').some(pair => {\n const [key] = pair.trim().split('=');\n return key?.trim() === cookieName;\n });\n if (hasSessionCookie) return;\n\n // Tokens containing \".\" are already signed (and may be URI-encoded).\n let cookieValue = token.includes('.') ? (token.includes('%') ? tryDecode(token) : token) : token;\n if (!token.includes('.') && secret) {\n cookieValue = `${token}.${await makeSignature(token, secret)}`;\n }\n\n const existingCookies = cookieHeader ? `${cookieHeader}; ` : '';\n headers.set('Cookie', `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);\n }\n\n /**\n * Authenticate a bearer token by verifying the session with Better Auth.\n *\n * This method extracts the session from the request headers using\n * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —\n * as returned by `signIn`/`signUp` — are signed before being passed to\n * Better Auth as a session cookie, matching the bearer plugin's semantics.\n *\n * @param token - The bearer token (session token) to authenticate\n * @param request - The request containing headers\n * @returns The authenticated user and session, or null if authentication fails\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<BetterAuthUser | null> {\n try {\n await this.#ensureDbReady();\n\n // Better Auth's api.getSession() reads session tokens from the Cookie header\n const headers = new Headers();\n\n const cookieHeader = getRequestHeader(request, 'Cookie');\n if (cookieHeader) {\n headers.set('Cookie', cookieHeader);\n }\n\n // Convert Bearer token to a signed session cookie if not already present.\n // better-auth ignores the Authorization header — it only reads from Cookie.\n await this.ensureSessionCookie(headers, token);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result || !result.session || !result.user) {\n return null;\n }\n\n // Better-auth never populates `activeOrganizationId` unless the host app\n // wires the organization plugin's `setActive` itself, which leaves every\n // org-scoped consumer with a user that has no organization. Resolve a\n // default from the user's existing memberships (read-only; the session\n // row is not mutated). See mastra-ai/mastra#21481.\n let session: BetterAuthUser['session'] = result.session;\n if (!session.activeOrganizationId) {\n const organizationId = await this.#resolveActiveOrganizationId(result.user.id);\n if (organizationId) session = { ...session, activeOrganizationId: organizationId };\n }\n\n return {\n session,\n user: result.user,\n };\n } catch {\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * By default, any authenticated user with a valid session is authorized.\n * You can override this behavior by providing a custom `authorizeUser` function\n * in the constructor options.\n *\n * @param user - The authenticated user and session\n * @returns True if the user is authorized, false otherwise\n */\n async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n // By default, any authenticated user with a valid session is authorized\n return !!user?.session?.id && !!user?.user?.id;\n }\n\n // ============================================\n // ICredentialsProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Sign in with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param request - Incoming HTTP request\n * @returns Result with user and session cookies\n * @throws Error if credentials are invalid\n */\n async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signInEmail({\n body: { email, password },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Invalid email or password');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Invalid email or password');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Sign up with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param name - Optional display name\n * @param request - Incoming HTTP request\n * @returns Result with new user and session cookies\n * @throws Error if sign up fails\n */\n async signUp(\n email: string,\n password: string,\n name: string | undefined,\n request: Request,\n ): Promise<CredentialsResult<EEUser>> {\n const displayName = name ?? email.split('@')[0] ?? 'User';\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signUpEmail({\n body: { email, password, name: displayName },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Failed to create account');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Failed to create account');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Get the underlying Better Auth instance.\n * Useful for accessing Better Auth APIs directly.\n */\n getAuth(): Auth {\n return this.auth;\n }\n\n /**\n * Get headers to clear the session cookies on logout.\n * Partial ISessionProvider implementation for logout support.\n *\n * Clears Better Auth's default session cookies.\n */\n getClearSessionHeaders(): Record<string, string> {\n // Cross-site deploys set the session cookie with SameSite=None; Secure —\n // the clearing cookie must match those attributes to overwrite it.\n const sameSite = this.#crossSite ? 'None; Secure' : 'Lax';\n // Clear both the session token and its signature cookie\n const cookies = [\n `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n ];\n return {\n 'Set-Cookie': cookies.join(', '),\n };\n }\n}\n"],"mappings":";;;;;;;AACA,SAAS,sBAAsB,SAAS,MAAM;CAC7C,MAAM,iBAAiB,KAAK,YAAY;CACxC,MAAM,cAAc,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,MAAM,cAAc;CAC3F,MAAM,QAAQ,gBAAgB,KAAK,IAAI,KAAK,IAAI,QAAQ;CACxD,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,OAAO,SAAS;AAC3D;;;;;AAKA,SAAS,iBAAiB,SAAS,MAAM;CACxC,IAAI,mBAAmB,SAAS,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAC/D,IAAI,QAAQ,eAAe,SAAS,OAAO,QAAQ,IAAI,QAAQ,IAAI,IAAI;CACvE,MAAM,UAAU,QAAQ;CACxB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI;CACvD,IAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,OAAO,IAAI,KAAK;CACzE,IAAI,WAAW,OAAO,YAAY,UAAU,OAAO,sBAAsB,SAAS,IAAI;CACtF,OAAO;AACR;;;;;;;;ACTA,SAAS,uBAAuB,KAAK,OAAO,UAAU;CACrD,IAAI,CAAC,KAAK,QAAQ,QAAQ;CAC1B,IAAI;EACH,MAAM,cAAc;EACpB,IAAI,WAAW,CAAC,EAAE,MAAM,MAAM,SAAS;GACtC,GAAG,YAAY,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY,GAAG,IAAI,CAAC;GAC9D,GAAG,YAAY,WAAW,KAAK,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;GACrE,GAAG,YAAY,aAAa,KAAK,IAAI,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;GAC3E,GAAG,YAAY,YAAY,KAAK,IAAI,EAAE,SAAS,YAAY,QAAQ,IAAI,CAAC;GACxE,GAAG,MAAM,iBAAiB,QAAQ,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,CAAC;GACpE,GAAG;EACJ,CAAC;CACF,QAAQ,CAAC;AACV;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,MAAM,aAAa,KAAK,MAAM,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,MAAM;CAC/H,MAAM,WAAW,KAAK,MAAM,QAAQ,eAAe,KAAK;CACxD,MAAM,YAAY,KAAK,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,QAAQ;CAC7E,IAAI,CAAC,cAAc,CAAC,YAAY,UAAU,WAAW,GAAG,OAAO,KAAK;CACpE,OAAO;EACN,GAAG,cAAc,CAAC;EAClB,GAAG,WAAW,EAAE,OAAO;GACtB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,OAAO,SAAS;EACjB,EAAE,IAAI,CAAC;EACP,GAAG,UAAU,SAAS,IAAI,EAAE,MAAM,UAAU,IAAI,CAAC;CAClD;AACD;AAGA,MAAM,mBAAmB;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACT,SAAS;CACT,UAAU;CACV,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,cAAc;CACd,QAAQ;CACR,WAAW;CACX,SAAS;AACV;AACA,MAAM,WAAW;CAChB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,MAAM;AACP;AAiCA,IAAI,eAAe,MAAM;CACxB;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,QAAQ,QAAQ,SAAS,SAAS;EACvC,KAAK,aAAa,IAAI,IAAI,OAAO,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAAC;CACnE;CACA,gBAAgB;EACf,OAAO,KAAK;CACb;CACA,eAAe,QAAQ,WAAW,CAAC;CACnC,MAAM,SAAS,aAAa,QAAQ;EACnC,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,GAAG,OAAO;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,WAAW,MAAM,KAAK;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,EAAE,aAAa,OAAO,UAAU,QAAQ,UAAU,SAAS,MAAM,WAAW;EACjG,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,OAAO,OAAO;GACvE,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,kBAAkB;GACzD;GACA;GACA;GACA;GACA;GACA;GACA;EACD,CAAC,KAAK;GACL,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;CACD;AACD;AACA,IAAI,gBAAgB,MAAM,sBAAsB,aAAa;CAC5D;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,MAAM,OAAO;EACb,KAAK,YAAY,QAAQ;EACzB,KAAK,SAAS,QAAQ;CACvB;;;;;;CAMA,sBAAsB,KAAK;EAC1B,KAAKA,kBAAkB;CACxB;CACA,MAAM,qBAAqB;EAC1B,MAAM,YAAY,OAAO,wBAAwB,WAAW,sBAAsB,qBAAqB,aAAa,KAAK;EACzH,MAAM,QAAQ,IAAI,cAAc;GAC/B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ;GACA,QAAQ,KAAK;EACd,CAAC;EACD,IAAI,KAAKA,iBAAiB,MAAM,sBAAsB,KAAKA,eAAe;EAC1E,OAAO;CACR;;;;;CAKA,WAAW,MAAM;EAChB,MAAM,MAAM,KAAKA;EACjB,IAAI,CAAC,KAAK,QAAQ,aAAa,OAAO;EACtC,IAAI;GACH,MAAM,SAAS,IAAI,mBAAmB;GACtC,OAAO,SAAS,CAAC,GAAG,MAAM,MAAM,IAAI;EACrC,QAAQ;GACP,OAAO;EACR;CACD;;;;;;CAMA,QAAQ,OAAO,SAAS,MAAM;EAC7B,MAAM,MAAM,KAAKA;EACjB,IAAI,CAAC,KAAK,QAAQ,QAAQ;EAC1B,IAAI;GACH,IAAI,WAAW,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;EAC5D,QAAQ,CAAC;CACV;CACA,UAAU,OAAO,SAAS,MAAM;EAC/B,IAAI,CAAC,KAAK,QAAQ,OAAO;EACzB,IAAI;GACH,OAAO,KAAK,OAAO;IAClB,WAAW,KAAK;IAChB;IACA;IACA;GACD,CAAC;EACF,SAAS,GAAG;GACX,QAAQ,MAAM,uCAAuC,KAAK,UAAU,SAAS,MAAM,IAAI,CAAC;GACxF,OAAO;EACR;CACD;CACA,SAAS;EACR,OAAO,KAAK,YAAY,IAAI,KAAK,UAAU,MAAM;CAClD;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,IAAI,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKC,WAAW,IAAI,CAAC;EACvJ,KAAKC,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKD,WAAW,IAAI,CAAC;EACxL,KAAKC,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKD,WAAW,IAAI,CAAC;EACxN,KAAKC,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,KAAK,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKD,WAAW,IAAI,CAAC;EAC3P,KAAKC,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,eAAe,OAAO,UAAU;EAC/B,uBAAuB,KAAKF,iBAAiB,OAAO,QAAQ;CAC7D;CACA,MAAM,SAAS,cAAc,SAAS;EACrC,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,SAAS,QAAQ;GACvB,SAAS,SAAS,WAAW;GAC7B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,OAAO;EAC5B,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,MAAM,QAAQ;GACpB,SAAS,MAAM,WAAW;GAC1B,SAAS;EACV;CACD;AACD;;;AC5QA,IAAI,aAAa,MAAM;CACtB,YAAY,iBAAiB;CAC7B;CACA;CACA;CACA,YAAY,EAAE,WAAW,MAAM,aAAa;EAC3C,KAAK,YAAY,aAAa,iBAAiB;EAC/C,KAAK,OAAO;EACZ,KAAKG,aAAa;EAClB,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC;CAC7E;;;;;CAKA,cAAc;EACb,OAAO,KAAKA;CACb;;;;;CAKA,eAAe,WAAW;EACzB,KAAKA,aAAa;CACnB;;;;;CAKA,YAAY,QAAQ;EACnB,KAAK,SAAS,WAAW,UAAU,OAAO,OAAO,UAAU,aAAa,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI;CACvH;AACD;;;AC/BA,IAAI,qBAAqB,cAAc,WAAW;CACjD;CACA;CACA,YAAY,SAAS;EACpB,MAAM;GACL,WAAW;GACX,MAAM,SAAS;EAChB,CAAC;EACD,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ,cAAc,KAAK,IAAI;EAChF,KAAK,YAAY,SAAS;EAC1B,KAAK,SAAS,SAAS;EACvB,KAAK,sBAAsB,SAAS;CACrC;CACA,gBAAgB,MAAM;EACrB,IAAI,MAAM,eAAe,KAAK,gBAAgB,KAAK,cAAc,KAAK,IAAI;EAC1E,IAAI,MAAM,qBAAqB,KAAK,sBAAsB,KAAK;EAC/D,IAAI,MAAM,WAAW,KAAK,YAAY,KAAK;EAC3C,IAAI,MAAM,QAAQ,KAAK,SAAS,KAAK;CACtC;AACD;;;ACEA,SAAS,UAAU,OAAuB;CACxC,IAAI;EACF,OAAO,mBAAmB,KAAK;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;;;AAoBA,SAAS,0BAA0B,MAAoB;CACrD,OAAO;EACL,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,WAAW,KAAK,SAAS,KAAA;EACzB,UAAU;GACR,eAAe,KAAK;GACpB,WAAW,KAAK;GAChB,WAAW,KAAK;EAClB;CACF;AACF;;;;;;;AAiCA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DzB,IAAa,uBAAb,cACU,mBAEV;CACE;CACA;;CAEA,gBAAgB;;CAEhB;;;;;;;;;CASA,4BAAY,IAAI,IAAkD;CAElE,aAAa,QAAoC;EAC/C,MAAM,QAAQ,KAAKC,UAAU,IAAI,MAAM;EACvC,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,IAAI,KAAK,IAAI,KAAK,MAAM,WAAW;GACjC,KAAKA,UAAU,OAAO,MAAM;GAC5B;EACF;EACA,OAAO,MAAM;CACf;;;;;;;;CASA,YAAY,QAAgB,OAAqB;EAC/C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,CAAC,KAAK,UAAU,KAAKA,WAAW;GACzC,IAAI,MAAM,MAAM,WAAW;GAC3B,KAAKA,UAAU,OAAO,GAAG;EAC3B;EACA,KAAKA,UAAU,OAAO,MAAM;EAC5B,KAAKA,UAAU,IAAI,QAAQ;GAAE;GAAO,WAAW,MAAM;EAAiB,CAAC;CACzE;;CAGA,IAAI,eAAuB;EACzB,OAAO,KAAKA,UAAU;CACxB;;CAEA,aAAa;CACb;CAEA,YAAY,SAAsC;EAChD,MAAM,EAAE,MAAM,SAAS,QAAQ,cAAc,CAAC;EAE9C,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,MACR,iOAEF;EAGF,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,UAAU,QAAQ;EACvB,KAAK,sBAAsB,QAAQ,iBAAiB;EAEpD,KAAK,gBAAgB,OAAO;CAC9B;;;;;CAMA,IAAc,OAAa;EACzB,IAAI,CAAC,KAAKD,OACR,MAAM,IAAI,MACR,yGACF;EAEF,OAAO,KAAKA;CACd;;;;;;CAOA,IAAI,oBAA4B;EAC9B,MAAM,UAAW,KAAKA,OAClB;EACJ,MAAM,WAAW,SAAS;EAO1B,MAAM,SAAS,UAAU,gBAAgB;EACzC,MAAM,SAAS,UAAU,oBAAoB,SAAS,SAAS,WAAW,UAAU,KAAK;EACzF,MAAM,WAAW,UAAU,SAAS,eAAe,QAAQ,GAAG,OAAO;EACrE,OAAO,GAAG,SAAS,cAAc,KAAK;CACxC;;;;;;;;;;CAeA,MAAM,KAAK,KAAqC;EAC9C,KAAKE,cAAc,IAAI,gBAAgB,UAAU,KAAK;EACtD,IAAI,KAAKF,OAAO;EAEhB,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,QACH,MAAM,IAAI,MACR,0MAEF;EAKF,MAAM,WACJ,OAAO,YAAY,aACd,OAAO,OACR,OAAO,YAAY,WACjB;GACE,SAAS,IAAIG,sBAAAA,cAAc,EAAE,QAAQ,OAAO,OAAO,CAAmD;GACtG,MAAM;EACR,IACC,OAAO;EAChB,MAAM,iBAAiB,IAAI,kBAAkB,CAAC;EAI9C,MAAM,UAA6B;GACjC;GACA,QAAQ,KAAKF;GAGb,UAAU;GACV,GAAI,IAAI,YAAY,EAAE,SAAS,IAAI,UAAU,IAAI,CAAC;GAIlD,GAAI,eAAe,SAAS,EAAE,gBAAgB,eAAe,IAAI,CAAC;GAClE,kBAAkB;IAAE,SAAS;IAAM,eAAe,CAAC,KAAK;GAAoB;GAC5E,SAAS,EAAA,GAAA,oBAAA,aAAA,CAAc,CAAC;GAGxB,GAAI,KAAKC,aAAa,EAAE,UAAU,EAAE,yBAAyB;IAAE,UAAU;IAAQ,QAAQ;GAAK,EAAE,EAAE,IAAI,CAAC;EACzG;EACA,KAAKF,SAAAA,GAAAA,YAAAA,WAAAA,CAAmB,OAAO;EAC/B,KAAKI,gBAAgB;CACvB;;;;;CAMA,MAAMC,iBAAgC;EACpC,IAAI,CAAC,KAAKD,eAAe;EACzB,KAAKE,eAAe,YAAY;GAC9B,MAAM,EAAE,kBAAkB,OAAA,GAAA,yBAAA,cAAA,CAAoB,KAAK,KAAK,OAA4B;GACpF,MAAM,cAAc;EACtB,EAAA,CAAG;EACH,IAAI;GACF,MAAM,KAAKA;EACb,SAAS,OAAO;GACd,KAAKA,YAAY,KAAA;GACjB,QAAQ,KAAK,gGAAgG;GAC7G,MAAM;EACR;CACF;;;;;CAUA,MAAM,kBAAkB,SAAqC;EAC3D,IAAI;GACF,MAAM,KAAKD,eAAe;EAC5B,QAAQ;GACN,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,mBAAmB,CAAC,GAAG;IACjE,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;GAChD,CAAC;EACH;EACA,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;;;;;;CAWA,MAAME,qBAAqB,KAAwB,QAA6C;EAM9F,MAAM,SAAQ,MALa,IAAI,QAAQ,SAAS;GAC9C,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAU,OAAO;GAAO,CAAC;GAC1C,QAAQ;IAAE,OAAO;IAAa,WAAW;GAAM;EACjD,CAAC,EAAA,CACyB,MAAK,MAAK,EAAE,cAAc,CAAC,EAAE;EACvD,IAAI,OAAO,KAAKC,YAAY,QAAQ,KAAK;EACzC,OAAO;CACT;;;;;;;;;;;CAYA,MAAMC,6BAA6B,QAA6C;EAC9E,MAAM,SAAS,KAAKC,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EACnB,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GACjB,OAAO,MAAM,KAAKH,qBAAqB,KAAK,MAAM;EACpD,QAAQ;GACN;EACF;CACF;;;;;;;;;;;;;;;;CAiBA,MAAM,mBAAmB,QAA6C;EACpE,MAAM,SAAS,KAAKG,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EAEnB,IAAI;GACF,MAAM,KAAKL,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GAEjB,MAAM,gBAAgB,MAAM,KAAKE,qBAAqB,KAAK,MAAM;GACjE,IAAI,eAAe,OAAO;GAG1B,MAAM,aAAa,MAAM,IAAI,gBAAgB,aAAa,MAAM,CAAC,CAAC,YAAY,IAAI;GAElF,MAAM,UAAU,GADF,YAAY,SAAS,YAAY,QAAQ,OAC9B;GACzB,MAAM,iBAAiB;IACrB,MAAM;IACN,2BAAW,IAAI,KAAK;IACpB,UAAU,KAAK,UAAU,EAAE,mBAAmB,OAAO,CAAC;GACxD;GAKA,MAAM,OAAO,YAAY;GACzB,IAAI;GACJ,IAAI;IAKF,kBAAiB,MAJM,IAAI,QAAQ,OAAO;KACxC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG;KAAK;IAC7B,CAAC,EAAA,CACwB;GAC3B,SAAS,OAAO;IACd,MAAM,WAAY,MAAM,IAAI,QAAQ,QAAQ;KAC1C,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAQ,OAAO;KAAK,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,UAAU,MAAM;IASrB,KADsB,MAJS,IAAI,QAAQ,SAAS;KAClD,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAkB,OAAO,SAAS;KAAG,CAAC;IACzD,CAAC,EAAA,CACqC,MAAK,MAAK,EAAE,WAAW,MAC7C,GAKd,kBAAiB,MAJO,IAAI,QAAQ,OAAO;KACzC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG,MAAM,YAAY,OAAO,GAAG,OAAO,WAAW;KAAI;IAC1E,CAAC,EAAA,CACyB;SAE1B,iBAAiB,SAAS;GAE9B;GAIA,IAAI;IACF,MAAM,IAAI,QAAQ,OAAO;KACvB,OAAO;KACP,MAAM;MAAE;MAAgB;MAAQ,MAAM;MAAS,2BAAW,IAAI,KAAK;KAAE;IACvE,CAAC;GACH,SAAS,OAAO;IAQd,IAAI,CAAC,MAPgB,IAAI,QAAQ,QAAQ;KACvC,OAAO;KACP,OAAO,CACL;MAAE,OAAO;MAAkB,OAAO;KAAe,GACjD;MAAE,OAAO;MAAU,OAAO;KAAO,CACnC;IACF,CAAC,GACY,MAAM;GACrB;GAEA,KAAKC,YAAY,QAAQ,cAAc;GACvC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,mEAAmE,OAAO,iEAE1E,KACF;GACA;EACF;CACF;;;;;CAMA,MAAM,oBAAoB,gBAAwB,QAAkC;EAClF,IAAI;GACF,MAAM,KAAKH,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GACjB,MAAM,aAAc,MAAM,IAAI,QAAQ,QAAQ;IAC5C,OAAO;IACP,OAAO,CACL;KAAE,OAAO;KAAkB,OAAO;IAAe,GACjD;KAAE,OAAO;KAAU,OAAO;IAAO,CACnC;GACF,CAAC;GACD,OAAO,YAAY,SAAS,WAAW,YAAY,SAAS;EAC9D,QAAQ;GACN,OAAO;EACT;CACF;;;;;CAMA,kBAA2B;EACzB,OAAO,KAAK;CACd;;;;;;;;;;;CAiBA,MAAM,eAAe,SAA0C;EAC7D,IAAI;GACF,MAAM,KAAKA,eAAe;GAC1B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAI3C,MAAM,aAAa,QAAQ,IAAI,eAAe;GAC9C,MAAM,cACJ,cAAc,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,MAAM,YAAY,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,KAAA;GAClG,MAAM,KAAK,oBAAoB,SAAS,WAAW;GAEnD,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,QAAQ,MAAM,OAAO;GAC1B,OAAO,0BAA0B,OAAO,IAAI;EAC9C,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,QAAQ,QAAwC;EACpD,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GAEjB,MAAM,OAAO,MAAM,IAAI,gBAAgB,aAAa,MAAM;GAC1D,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,0BAA0B,IAAI;EACvC,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;CASA,MAAM,SAAS,SAAkD;EAC/D,OAAO,QAAQ,IAAI,QAAQ,KAAI,WAAU,KAAK,QAAQ,MAAM,CAAC,CAAC;CAChE;;;;;CAMA,kBAAkB,MAAsB;EACtC,OAAO,YAAY,KAAK;CAC1B;;;;;CAMA,MAAc,iBAAoD;EAChE,IAAI;GACF,OAAQ,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,KAAM;EACxD,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;CAWA,MAAc,oBAAoB,SAAkB,OAA0C;EAC5F,IAAI,CAAC,OAAO;EAEZ,MAAM,MAAM,MAAM,KAAK,eAAe;EACtC,MAAM,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK;EAC9D,MAAM,SAAS,KAAK;EAEpB,MAAM,eAAe,QAAQ,IAAI,QAAQ;EAKzC,IAAI,CAJsB,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,MAAK,SAAQ;GAC/D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG;GACnC,OAAO,KAAK,KAAK,MAAM;EACzB,CAAC,GACqB;EAGtB,IAAI,cAAc,MAAM,SAAS,GAAG,IAAK,MAAM,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI,QAAS;EAC3F,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,QAC1B,cAAc,GAAG,MAAM,GAAG,OAAA,GAAA,mBAAA,cAAA,CAAoB,OAAO,MAAM;EAG7D,MAAM,kBAAkB,eAAe,GAAG,aAAa,MAAM;EAC7D,QAAQ,IAAI,UAAU,GAAG,kBAAkB,WAAW,GAAG,mBAAmB,WAAW,GAAG;CAC5F;;;;;;;;;;;;;CAcA,MAAM,kBAAkB,OAAe,SAA4D;EACjG,IAAI;GACF,MAAM,KAAKA,eAAe;GAG1B,MAAM,UAAU,IAAI,QAAQ;GAE5B,MAAM,eAAe,iBAAiB,SAAS,QAAQ;GACvD,IAAI,cACF,QAAQ,IAAI,UAAU,YAAY;GAKpC,MAAM,KAAK,oBAAoB,SAAS,KAAK;GAE7C,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,OAAO,MACxC,OAAO;GAQT,IAAI,UAAqC,OAAO;GAChD,IAAI,CAAC,QAAQ,sBAAsB;IACjC,MAAM,iBAAiB,MAAM,KAAKI,6BAA6B,OAAO,KAAK,EAAE;IAC7E,IAAI,gBAAgB,UAAU;KAAE,GAAG;KAAS,sBAAsB;IAAe;GACnF;GAEA,OAAO;IACL;IACA,MAAM,OAAO;GACf;EACF,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,cAAc,MAAwC;EAE1D,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;CAC9C;;;;;;;;;;;CAiBA,MAAM,OAAO,OAAe,UAAkB,SAAsD;EAClG,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;GAAS;GACxB;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,2BAA2B;EAClE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,2BAA2B;EAI7C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;;;;;;;;CAaA,MAAM,OACJ,OACA,UACA,MACA,SACoC;EACpC,MAAM,cAAc,QAAQ,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;EACnD,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;IAAU,MAAM;GAAY;GAC3C;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,0BAA0B;EACjE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,0BAA0B;EAI5C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;CAMA,UAAgB;EACd,OAAO,KAAK;CACd;;;;;;;CAQA,yBAAiD;EAG/C,MAAM,WAAW,KAAKP,aAAa,iBAAiB;EAMpD,OAAO,EACL,cAAc,CAJd,GAAG,KAAK,kBAAkB,gCAAgC,SAAS,cACnE,GAAG,KAAK,kBAAkB,oCAAoC,SAAS,YAGnD,CAAC,CAAC,KAAK,IAAI,EACjC;CACF;AACF"}
1
+ {"version":3,"file":"index.cjs","names":["LibsqlDialect","organization","betterAuth","getMigrations","makeSignature"],"sources":["../../../packages/_internals/auth/dist/types/index.js","../../../packages/_internal-core/dist/logger/index.js","../../../packages/_internal-core/dist/base/index.js","../../../packages/_internals/auth/dist/provider/index.js","../src/index.ts"],"sourcesContent":["//#region src/types/index.ts\nfunction headerFromPlainObject(headers, name) {\n\tconst normalizedName = name.toLowerCase();\n\tconst matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);\n\tconst value = matchingKey === void 0 ? void 0 : headers[matchingKey];\n\treturn Array.isArray(value) ? value[0] ?? null : value ?? null;\n}\n/**\n* Read a request header across fetch, Hono, and Express-style request shapes.\n* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).\n*/\nfunction getRequestHeader(request, name) {\n\tif (request instanceof Request) return request.headers.get(name);\n\tif (request.raw instanceof Request) return request.raw.headers.get(name);\n\tconst headers = request.headers;\n\tif (headers instanceof Headers) return headers.get(name);\n\tif (typeof request.header === \"function\") return request.header(name) ?? null;\n\tif (headers && typeof headers === \"object\") return headerFromPlainObject(headers, name);\n\treturn null;\n}\nfunction getWebRequest(request) {\n\tif (request instanceof Request) return request;\n\treturn request.raw instanceof Request ? request.raw : void 0;\n}\n//#endregion\nexport { getRequestHeader, getWebRequest };\n\n//# sourceMappingURL=index.js.map","import { Transform } from \"stream\";\n//#region src/logger/adapter.ts\nfunction isAdaptableLogger(logger) {\n\treturn typeof logger.__attachObservability === \"function\";\n}\n/**\n* Export a tracked exception through the adapter sink, mirroring the\n* DualLogger dual-write shape (`errorId`/`domain`/`category`/`details`/`cause`\n* when present on a MastraError-like value). Never throws into the caller.\n*/\nfunction exportTrackedException(ctx, error, metadata) {\n\tif (!ctx?.options.export) return;\n\ttry {\n\t\tconst mastraError = error;\n\t\tctx.getLogSink()?.error(error.message, {\n\t\t\t...mastraError.id !== void 0 ? { errorId: mastraError.id } : {},\n\t\t\t...mastraError.domain !== void 0 ? { domain: mastraError.domain } : {},\n\t\t\t...mastraError.category !== void 0 ? { category: mastraError.category } : {},\n\t\t\t...mastraError.details !== void 0 ? { details: mastraError.details } : {},\n\t\t\t...error.cause instanceof Error ? { cause: error.cause.message } : {},\n\t\t\t...metadata\n\t\t});\n\t} catch {}\n}\n/**\n* Adapt IMastraLogger's variadic args into the structured `data` payload of\n* an exported log record. Extracts the first plain object as data,\n* serializes an Error arg, and collects remaining primitives under `args`\n* so the derived record preserves all context from the native call.\n*/\nfunction buildLogRecordData(args) {\n\tconst objectData = args.find((arg) => arg !== null && typeof arg === \"object\" && !Array.isArray(arg) && !(arg instanceof Error));\n\tconst errorArg = args.find((arg) => arg instanceof Error);\n\tconst extraArgs = args.filter((arg) => arg !== objectData && arg !== errorArg);\n\tif (!objectData && !errorArg && extraArgs.length === 0) return void 0;\n\treturn {\n\t\t...objectData ?? {},\n\t\t...errorArg ? { error: {\n\t\t\tname: errorArg.name,\n\t\t\tmessage: errorArg.message,\n\t\t\tstack: errorArg.stack\n\t\t} } : {},\n\t\t...extraArgs.length > 0 ? { args: extraArgs } : {}\n\t};\n}\n//#endregion\n//#region src/logger/index.ts\nconst RegisteredLogger = {\n\tAGENT: \"AGENT\",\n\tOBSERVABILITY: \"OBSERVABILITY\",\n\tAUTH: \"AUTH\",\n\tBROWSER: \"BROWSER\",\n\tNETWORK: \"NETWORK\",\n\tWORKFLOW: \"WORKFLOW\",\n\tLLM: \"LLM\",\n\tTTS: \"TTS\",\n\tVOICE: \"VOICE\",\n\tVECTOR: \"VECTOR\",\n\tBUNDLER: \"BUNDLER\",\n\tDEPLOYER: \"DEPLOYER\",\n\tMEMORY: \"MEMORY\",\n\tSTORAGE: \"STORAGE\",\n\tEMBEDDINGS: \"EMBEDDINGS\",\n\tMCP_SERVER: \"MCP_SERVER\",\n\tSERVER_CACHE: \"SERVER_CACHE\",\n\tSERVER: \"SERVER\",\n\tWORKSPACE: \"WORKSPACE\",\n\tCHANNEL: \"CHANNEL\"\n};\nconst LogLevel = {\n\tDEBUG: \"debug\",\n\tINFO: \"info\",\n\tWARN: \"warn\",\n\tERROR: \"error\",\n\tNONE: \"silent\"\n};\nvar LoggerTransport = class extends Transform {\n\tconstructor(opts = {}) {\n\t\tsuper({\n\t\t\t...opts,\n\t\t\tobjectMode: true\n\t\t});\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogs(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nconst createCustomTransport = (stream, listLogs, listLogsByRunId) => {\n\tlet transport = stream;\n\tif (listLogs) transport.listLogs = listLogs;\n\tif (listLogsByRunId) transport.listLogsByRunId = listLogsByRunId;\n\treturn transport;\n};\nvar MastraLogger = class {\n\tname;\n\tlevel;\n\ttransports;\n\tconstructor(options = {}) {\n\t\tthis.name = options.name || \"Mastra\";\n\t\tthis.level = options.level || LogLevel.ERROR;\n\t\tthis.transports = new Map(Object.entries(options.transports || {}));\n\t}\n\tgetTransports() {\n\t\treturn this.transports;\n\t}\n\ttrackException(_error, _metadata) {}\n\tasync listLogs(transportId, params) {\n\t\tif (!transportId || !this.transports.has(transportId)) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogs?.(params) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {\n\t\tif (!transportId || !this.transports.has(transportId) || !runId) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogsByRunId?.({\n\t\t\trunId,\n\t\t\tfromDate,\n\t\t\ttoDate,\n\t\t\tlogLevel,\n\t\t\tfilters,\n\t\t\tpage,\n\t\t\tperPage\n\t\t}) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nvar ConsoleLogger = class ConsoleLogger extends MastraLogger {\n\tcomponent;\n\tfilter;\n\t#adapterContext;\n\tconstructor(options = {}) {\n\t\tsuper(options);\n\t\tthis.component = options.component;\n\t\tthis.filter = options.filter;\n\t}\n\t/**\n\t* Adapter hook (see `AdaptableLogger`): enables native trace correlation\n\t* (trace_id/span_id appended to console output) and observability export\n\t* derived from the same record. Called by Mastra during setup.\n\t*/\n\t__attachObservability(ctx) {\n\t\tthis.#adapterContext = ctx;\n\t}\n\tchild(componentOrBindings) {\n\t\tconst component = typeof componentOrBindings === \"string\" ? componentOrBindings : componentOrBindings?.component ?? this.component;\n\t\tconst child = new ConsoleLogger({\n\t\t\tname: this.name,\n\t\t\tlevel: this.level,\n\t\t\tcomponent,\n\t\t\tfilter: this.filter\n\t\t});\n\t\tif (this.#adapterContext) child.__attachObservability(this.#adapterContext);\n\t\treturn child;\n\t}\n\t/**\n\t* Native-record correlation: when a span is active, append the trace\n\t* fields object to the console args so every destination sees them.\n\t*/\n\t#correlate(args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.correlation) return args;\n\t\ttry {\n\t\t\tconst fields = ctx.resolveTraceFields();\n\t\t\treturn fields ? [...args, fields] : args;\n\t\t} catch {\n\t\t\treturn args;\n\t\t}\n\t}\n\t/**\n\t* Export the record derived from the same native call to observability.\n\t* Mirrors DualLogger semantics: export is independent of the console\n\t* level filter, and never throws into the caller.\n\t*/\n\t#export(level, message, args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.export) return;\n\t\ttry {\n\t\t\tctx.getLogSink()?.[level](message, buildLogRecordData(args));\n\t\t} catch {}\n\t}\n\tshouldLog(level, message, args) {\n\t\tif (!this.filter) return true;\n\t\ttry {\n\t\t\treturn this.filter({\n\t\t\t\tcomponent: this.component,\n\t\t\t\tlevel,\n\t\t\t\tmessage,\n\t\t\t\targs\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tconsole.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n\t\t\treturn true;\n\t\t}\n\t}\n\tprefix() {\n\t\treturn this.component ? `[${this.component}] ` : \"\";\n\t}\n\tdebug(message, ...args) {\n\t\tif (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"debug\", message, args);\n\t}\n\tinfo(message, ...args) {\n\t\tif ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"info\", message, args);\n\t}\n\twarn(message, ...args) {\n\t\tif ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"warn\", message, args);\n\t}\n\terror(message, ...args) {\n\t\tif ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"error\", message, args);\n\t}\n\ttrackException(error, metadata) {\n\t\texportTrackedException(this.#adapterContext, error, metadata);\n\t}\n\tasync listLogs(_transportId, _params) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _params?.page ?? 1,\n\t\t\tperPage: _params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args.page ?? 1,\n\t\t\tperPage: _args.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\n//#endregion\nexport { ConsoleLogger, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, buildLogRecordData, createCustomTransport, exportTrackedException, isAdaptableLogger };\n\n//# sourceMappingURL=index.js.map","import { ConsoleLogger, RegisteredLogger } from \"../logger/index.js\";\n//#region src/base/MastraBase.ts\nvar MastraBase = class {\n\tcomponent = RegisteredLogger.LLM;\n\tlogger;\n\tname;\n\t#rawConfig;\n\tconstructor({ component, name, rawConfig }) {\n\t\tthis.component = component || RegisteredLogger.LLM;\n\t\tthis.name = name;\n\t\tthis.#rawConfig = rawConfig;\n\t\tthis.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n\t}\n\t/**\n\t* Returns the raw storage configuration this primitive was created from,\n\t* or undefined if it was created from code.\n\t*/\n\ttoRawConfig() {\n\t\treturn this.#rawConfig;\n\t}\n\t/**\n\t* Sets the raw storage configuration for this primitive.\n\t* @internal\n\t*/\n\t__setRawConfig(rawConfig) {\n\t\tthis.#rawConfig = rawConfig;\n\t}\n\t/**\n\t* Set the logger for the agent\n\t* @param logger\n\t*/\n\t__setLogger(logger) {\n\t\tthis.logger = \"child\" in logger && typeof logger.child === \"function\" ? logger.child({ component: this.component }) : logger;\n\t}\n};\n//#endregion\nexport { MastraBase };\n\n//# sourceMappingURL=index.js.map","import { getRequestHeader } from \"../types/index.js\";\nimport { MastraBase } from \"@internal/core/base\";\n//#region src/provider/index.ts\nvar MastraAuthProvider = class extends MastraBase {\n\tprotected;\n\tpublic;\n\tconstructor(options) {\n\t\tsuper({\n\t\t\tcomponent: \"AUTH\",\n\t\t\tname: options?.name\n\t\t});\n\t\tif (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);\n\t\tthis.protected = options?.protected;\n\t\tthis.public = options?.public;\n\t\tthis.mapUserToResourceId = options?.mapUserToResourceId;\n\t}\n\tregisterOptions(opts) {\n\t\tif (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);\n\t\tif (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;\n\t\tif (opts?.protected) this.protected = opts.protected;\n\t\tif (opts?.public) this.public = opts.public;\n\t}\n};\nfunction isSSOProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getLoginUrl === \"function\" && typeof p.handleCallback === \"function\";\n}\nfunction isSessionProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.validateSession === \"function\" && typeof p.createSession === \"function\";\n}\nfunction isUserProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getCurrentUser === \"function\";\n}\nfunction isCredentialsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.signIn === \"function\";\n}\nfunction isOrganizationsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.ensureOrganization === \"function\" && typeof p.isOrganizationAdmin === \"function\";\n}\nfunction isAuthHttpHandler(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.handleAuthRequest === \"function\";\n}\nfunction hasAuthInit(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.init === \"function\";\n}\nfunction isObjectLike(value) {\n\treturn typeof value === \"object\" && value !== null || typeof value === \"function\";\n}\nvar CompositeAuth = class CompositeAuth extends MastraAuthProvider {\n\tproviders;\n\tauthenticatedProviderByObject = /* @__PURE__ */ new WeakMap();\n\tauthenticatedProviderByPrimitive = /* @__PURE__ */ new Map();\n\tconstructor(providers) {\n\t\tconst combinedPublic = providers.flatMap((provider) => provider.public ?? []);\n\t\tconst combinedProtected = providers.flatMap((provider) => provider.protected ?? []);\n\t\tsuper({\n\t\t\tpublic: combinedPublic,\n\t\t\tprotected: combinedProtected\n\t\t});\n\t\tthis.providers = providers;\n\t\tif (providers.some((provider) => typeof provider.mapUserToResourceId === \"function\")) this.mapUserToResourceId = (user) => this.mapAuthenticatedUserToResourceId(user);\n\t\tif (!providers.some(isSSOProvider)) {\n\t\t\tthis.getLoginUrl = void 0;\n\t\t\tthis.handleCallback = void 0;\n\t\t\tthis.getLoginButtonConfig = void 0;\n\t\t}\n\t\tif (!providers.some(isSessionProvider)) {\n\t\t\tthis.createSession = void 0;\n\t\t\tthis.validateSession = void 0;\n\t\t\tthis.getSessionIdFromRequest = void 0;\n\t\t}\n\t\tif (!providers.some(isUserProvider)) {\n\t\t\tthis.getCurrentUser = void 0;\n\t\t\tthis.getUser = void 0;\n\t\t\tthis.getUsers = void 0;\n\t\t}\n\t\tconst credProvider = providers.find(isCredentialsProvider);\n\t\tif (credProvider) {\n\t\t\tthis.signIn = credProvider.signIn.bind(credProvider);\n\t\t\tif (typeof credProvider.signUp === \"function\") this.signUp = credProvider.signUp.bind(credProvider);\n\t\t\tif (typeof credProvider.requestPasswordReset === \"function\") this.requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n\t\t\tif (typeof credProvider.resetPassword === \"function\") this.resetPassword = credProvider.resetPassword.bind(credProvider);\n\t\t\tthis.isSignUpEnabled = typeof credProvider.isSignUpEnabled === \"function\" ? credProvider.isSignUpEnabled.bind(credProvider) : () => true;\n\t\t} else {\n\t\t\tthis.signIn = void 0;\n\t\t\tthis.signUp = void 0;\n\t\t\tthis.requestPasswordReset = void 0;\n\t\t\tthis.resetPassword = void 0;\n\t\t\tthis.isSignUpEnabled = void 0;\n\t\t}\n\t}\n\tfindProvider(check) {\n\t\treturn this.providers.find(check);\n\t}\n\trememberAuthenticatedProvider(user, provider) {\n\t\tif (isObjectLike(user)) {\n\t\t\tthis.authenticatedProviderByObject.set(user, provider);\n\t\t\treturn;\n\t\t}\n\t\tthis.authenticatedProviderByPrimitive.set(user, provider);\n\t}\n\ttakeAuthenticatedProvider(user) {\n\t\tif (isObjectLike(user)) {\n\t\t\tconst provider = this.authenticatedProviderByObject.get(user);\n\t\t\tthis.authenticatedProviderByObject.delete(user);\n\t\t\treturn provider;\n\t\t}\n\t\tconst primitiveUser = user;\n\t\tconst provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n\t\tthis.authenticatedProviderByPrimitive.delete(primitiveUser);\n\t\treturn provider;\n\t}\n\tmapAuthenticatedUserToResourceId(user) {\n\t\tconst provider = this.takeAuthenticatedProvider(user);\n\t\tif (typeof provider?.mapUserToResourceId !== \"function\") return;\n\t\tconst resourceId = provider.mapUserToResourceId(user);\n\t\tif (resourceId === void 0 && provider instanceof CompositeAuth) return;\n\t\tif (typeof resourceId !== \"string\" || !resourceId.trim()) throw new Error(\"mapUserToResourceId must return a non-empty string for the authenticated user\");\n\t\treturn resourceId;\n\t}\n\t/**\n\t* True if any provider is MastraCloudAuth (exempt from license requirement).\n\t*/\n\tget isMastraCloudAuth() {\n\t\treturn this.providers.some((p) => \"isMastraCloudAuth\" in p && p.isMastraCloudAuth === true);\n\t}\n\t/**\n\t* True if any provider is SimpleAuth (exempt from license requirement).\n\t*/\n\tget isSimpleAuth() {\n\t\treturn this.providers.some((p) => \"isSimpleAuth\" in p && p.isSimpleAuth === true);\n\t}\n\tasync authenticateToken(token, request) {\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst user = await provider.authenticateToken(token, request);\n\t\t\tif (user) {\n\t\t\t\tthis.rememberAuthenticatedProvider(user, provider);\n\t\t\t\treturn user;\n\t\t\t}\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tconsumePendingResponseHeaders(request) {\n\t\tlet merged;\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst pending = provider.consumePendingResponseHeaders?.(request);\n\t\t\tif (pending) merged = {\n\t\t\t\t...merged ?? {},\n\t\t\t\t...pending\n\t\t\t};\n\t\t} catch {}\n\t\treturn merged;\n\t}\n\tasync authorizeUser(user, request) {\n\t\tfor (const provider of this.providers) if (await provider.authorizeUser(user, request)) return true;\n\t\treturn false;\n\t}\n\t/**\n\t* Forward cookie header to SSO provider for PKCE validation.\n\t* Called by auth handler before handleCallback().\n\t*/\n\tsetCallbackCookieHeader(cookieHeader) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (sso && typeof sso.setCallbackCookieHeader === \"function\") sso.setCallbackCookieHeader(cookieHeader);\n\t}\n\tgetLoginUrl(redirectUri, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.getLoginUrl(redirectUri, state);\n\t}\n\tgetLoginCookies(redirectUri, state) {\n\t\treturn this.findProvider(isSSOProvider)?.getLoginCookies?.(redirectUri, state);\n\t}\n\tasync handleCallback(code, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.handleCallback(code, state);\n\t}\n\tgetLoginButtonConfig() {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) return {\n\t\t\tprovider: \"unknown\",\n\t\t\ttext: \"Sign in\"\n\t\t};\n\t\treturn sso.getLoginButtonConfig();\n\t}\n\tasync getLogoutUrl(redirectUri, request) {\n\t\tfor (const provider of this.providers) if (isSSOProvider(provider) && provider.getLogoutUrl) try {\n\t\t\tconst url = await provider.getLogoutUrl(redirectUri, request);\n\t\t\tif (url) return url;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync createSession(userId, metadata) {\n\t\tconst session = this.findProvider(isSessionProvider);\n\t\tif (!session) throw new Error(\"No session provider configured in CompositeAuth\");\n\t\treturn session.createSession(userId, metadata);\n\t}\n\tasync validateSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.validateSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync destroySession(sessionId) {\n\t\tconst destroyPromises = [];\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) destroyPromises.push(provider.destroySession(sessionId).catch(() => {}));\n\t\tawait Promise.all(destroyPromises);\n\t}\n\tasync refreshSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.refreshSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionIdFromRequest(request) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst sessionId = provider.getSessionIdFromRequest(request);\n\t\t\tif (sessionId) return sessionId;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionHeaders(session) {\n\t\treturn this.findProvider(isSessionProvider)?.getSessionHeaders(session) ?? {};\n\t}\n\tgetClearSessionHeaders() {\n\t\tconst headers = {};\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst providerHeaders = provider.getClearSessionHeaders();\n\t\t\tObject.assign(headers, providerHeaders);\n\t\t} catch {}\n\t\treturn headers;\n\t}\n\tasync getCurrentUser(request) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getCurrentUser(request);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUser(userId) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getUser(userId);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn Promise.all(userIds.map((userId) => this.getUser(userId)));\n\t}\n};\nconst DEFAULT_HEADERS = [\"Authorization\", \"X-Playground-Access\"];\nvar SimpleAuth = class extends MastraAuthProvider {\n\t/**\n\t* Marker to exempt SimpleAuth from EE license requirement.\n\t* SimpleAuth is for development/testing and should work without a license.\n\t*/\n\tisSimpleAuth = true;\n\ttokens;\n\theaders;\n\tusers;\n\tuserById;\n\tconstructor(options) {\n\t\tsuper(options);\n\t\tthis.tokens = options.tokens;\n\t\tthis.users = Object.values(this.tokens);\n\t\tthis.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n\t\tthis.userById = new Map(this.users.map((u) => [String(u?.id), u]));\n\t}\n\tasync authenticateToken(token, request) {\n\t\tconst requestTokens = this.getTokensFromHeaders(token, request);\n\t\tfor (const requestToken of requestTokens) {\n\t\t\tconst tokenToUser = this.tokens[requestToken];\n\t\t\tif (tokenToUser) return tokenToUser;\n\t\t}\n\t\treturn this.getUserFromCookie(getRequestHeader(request, \"Cookie\"));\n\t}\n\tasync authorizeUser(user, _request) {\n\t\treturn this.users.includes(user);\n\t}\n\t/** Get current user from request headers or cookie. */\n\tasync getCurrentUser(request) {\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = request.headers.get(headerName);\n\t\t\tif (headerValue) {\n\t\t\t\tconst token = this.stripBearerPrefix(headerValue);\n\t\t\t\tconst user = this.tokens[token];\n\t\t\t\tif (user) return user;\n\t\t\t}\n\t\t}\n\t\treturn this.getUserFromCookie(request.headers.get(\"Cookie\"));\n\t}\n\tgetUserFromCookie(cookieHeader) {\n\t\tif (!cookieHeader) return null;\n\t\tconst cookies = cookieHeader.split(\";\").map((c) => c.trim());\n\t\tfor (const cookie of cookies) if (cookie.startsWith(\"mastra-token=\")) {\n\t\t\tconst token = cookie.slice(13);\n\t\t\tconst user = this.tokens[token];\n\t\t\tif (user) return user;\n\t\t}\n\t\treturn null;\n\t}\n\t/** Get user by ID. */\n\tasync getUser(userId) {\n\t\treturn this.userById.get(userId) ?? null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn userIds.map((userId) => this.userById.get(userId) ?? null);\n\t}\n\t/**\n\t* Sign in with token (passed as password field).\n\t* The email field is ignored - only the token matters.\n\t*/\n\tasync signIn(_email, password, _request) {\n\t\tconst token = password;\n\t\tconst user = this.tokens[token];\n\t\tif (!user) throw new Error(\"Invalid token\");\n\t\treturn {\n\t\t\tuser,\n\t\t\ttoken,\n\t\t\tcookies: [`mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`]\n\t\t};\n\t}\n\tasync signUp() {\n\t\tthrow new Error(\"Sign up is not supported with SimpleAuth. Use pre-configured tokens.\");\n\t}\n\tisSignUpEnabled() {\n\t\treturn false;\n\t}\n\t/**\n\t* Get headers to clear the session cookie on logout.\n\t* Partial ISessionProvider implementation for logout support.\n\t*/\n\tgetClearSessionHeaders() {\n\t\treturn { \"Set-Cookie\": \"mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\" };\n\t}\n\tstripBearerPrefix(token) {\n\t\treturn token.startsWith(\"Bearer \") ? token.slice(7) : token;\n\t}\n\tgetTokensFromHeaders(token, request) {\n\t\tconst tokens = [token];\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = getRequestHeader(request, headerName);\n\t\t\tif (headerValue) tokens.push(this.stripBearerPrefix(headerValue));\n\t\t}\n\t\treturn tokens;\n\t}\n};\n//#endregion\nexport { CompositeAuth, MastraAuthProvider, SimpleAuth, hasAuthInit, isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider };\n\n//# sourceMappingURL=index.js.map","import type {\n AuthInitContext,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n IUserProvider,\n CredentialsResult,\n MastraAuthRequest,\n} from '@internal/auth';\nimport { getRequestHeader } from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { LibsqlDialect } from '@libsql/kysely-libsql';\n\nimport { betterAuth } from 'better-auth';\nimport type { Auth, BetterAuthOptions, Session, User } from 'better-auth';\nimport { makeSignature } from 'better-auth/crypto';\nimport { getMigrations } from 'better-auth/db/migration';\nimport { organization } from 'better-auth/plugins';\n\ntype BetterAuthContext = Awaited<Auth['$context']>;\n\nfunction tryDecode(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n /**\n * The better-auth session. `activeOrganizationId` comes from the\n * organization plugin (registered unconditionally by this provider); when\n * the stored session never had one set, `authenticateToken` resolves a\n * default from the user's existing memberships.\n */\n session: Session & { activeOrganizationId?: string | null };\n user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n return {\n id: user.id,\n email: user.email,\n name: user.name,\n avatarUrl: user.image ?? undefined,\n metadata: {\n emailVerified: user.emailVerified,\n createdAt: user.createdAt,\n updatedAt: user.updatedAt,\n },\n };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n /**\n * The Better Auth instance to use for authentication.\n * This should be the result of calling `betterAuth({ ... })`.\n *\n * Optional when `secret` is provided: the provider then builds its own\n * `betterAuth()` instance in `init()` on the host's auth database (deferred\n * instance mode) and owns its schema migrations.\n */\n auth?: Auth;\n\n /**\n * Secret used for session signing by the provider-built `betterAuth()`\n * instance (deferred instance mode). Ignored when `auth` is provided.\n */\n secret?: string;\n\n /**\n * Whether to allow new user registration via sign-up.\n * Set to false to disable public registration.\n * @default true\n */\n signUpEnabled?: boolean;\n}\n\n/** Loose row shapes read back from better-auth's internal DB adapter. */\n/**\n * How long a resolved `userId → orgId` mapping stays cached. Bounded so an\n * administrator revoking a membership takes effect on new sessions within a\n * minute, rather than persisting until process restart.\n */\nconst ORG_CACHE_TTL_MS = 60_000;\n\ninterface MemberRow {\n organizationId?: string;\n role?: string;\n userId?: string;\n}\ninterface OrganizationRow {\n id: string;\n}\n\n/**\n * Tagged auth-database handle shape hosts may pass as `AuthInitContext.database`\n * (e.g. the Mastra Code web factory's storage backends).\n */\ninterface TaggedAuthDatabase {\n dialect?: string;\n pool?: unknown;\n client?: unknown;\n database?: unknown;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n * database: {\n * provider: 'postgresql',\n * url: process.env.DATABASE_URL!,\n * },\n * emailAndPassword: {\n * enabled: true,\n * },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n * auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n * server: {\n * auth: mastraAuth,\n * },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n extends MastraAuthProvider<BetterAuthUser>\n implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>, IOrganizationsProvider, IAuthInit, IAuthHttpHandler\n{\n #auth: Auth | undefined;\n #secret: string | undefined;\n /** True when `init()` built the instance — then we also own its migrations. */\n #ownsInstance = false;\n /** Once-per-process migration latch; reset on failure so a later call retries. */\n #migrated: Promise<void> | undefined;\n /**\n * In-process `userId → orgId` cache, shared by `ensureOrganization` and the\n * `authenticateToken` default-org resolution. Only successes are cached, so\n * membership-less users re-run the lookup per request. Entries expire after\n * `ORG_CACHE_TTL_MS` so a membership revoked by an administrator stops being\n * injected into new sessions within the TTL window instead of persisting for\n * the process lifetime.\n */\n #orgCache = new Map<string, { orgId: string; expiresAt: number }>();\n\n #cachedOrgId(userId: string): string | undefined {\n const entry = this.#orgCache.get(userId);\n if (!entry) return undefined;\n if (Date.now() >= entry.expiresAt) {\n this.#orgCache.delete(userId);\n return undefined;\n }\n return entry.orgId;\n }\n\n /**\n * Cache a resolved `userId → orgId` mapping. The map is kept in expiry\n * order: writes delete-then-set so refreshed entries move to the back, and\n * since every entry uses the same TTL, iteration order is ascending\n * `expiresAt`. The sweep therefore stops at the first live entry, making\n * each write amortized O(1) instead of a full scan.\n */\n #storeOrgId(userId: string, orgId: string): void {\n const now = Date.now();\n for (const [key, entry] of this.#orgCache) {\n if (now < entry.expiresAt) break;\n this.#orgCache.delete(key);\n }\n this.#orgCache.delete(userId);\n this.#orgCache.set(userId, { orgId, expiresAt: now + ORG_CACHE_TTL_MS });\n }\n\n /** @internal Test hook: current org-cache cardinality. */\n get orgCacheSize(): number {\n return this.#orgCache.size;\n }\n /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */\n #crossSite = false;\n protected signUpEnabledConfig: boolean;\n\n constructor(options: MastraAuthBetterAuthOptions) {\n super({ name: options?.name ?? 'better-auth' });\n\n if (!options.auth && !options.secret) {\n throw new Error(\n 'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), ' +\n 'or provide `secret` so the provider can build its own instance in init() on the host database.',\n );\n }\n\n this.#auth = options.auth;\n this.#secret = options.secret;\n this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n this.registerOptions(options);\n }\n\n /**\n * The active Better Auth instance. Throws before `init()` in deferred\n * instance mode (constructed with `secret` instead of `auth`).\n */\n protected get auth(): Auth {\n if (!this.#auth) {\n throw new Error(\n 'MastraAuthBetterAuth is not initialized — init() must run first (or pass a configured `auth` instance).',\n );\n }\n return this.#auth;\n }\n\n /**\n * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller\n * override via `advanced.cookies.session_token.name`, and the `__Secure-`\n * prefix Better Auth applies when secure cookies are active.\n */\n get sessionCookieName(): string {\n const options = (this.#auth as { options?: { baseURL?: string; advanced?: Record<string, unknown> } } | undefined)\n ?.options;\n const advanced = options?.advanced as\n | {\n cookiePrefix?: string;\n useSecureCookies?: boolean;\n cookies?: { session_token?: { name?: string } };\n }\n | undefined;\n const prefix = advanced?.cookiePrefix ?? 'better-auth';\n const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith('https://') ?? false;\n const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;\n return `${secure ? '__Secure-' : ''}${baseName}`;\n }\n\n // ============================================\n // IAuthInit implementation\n // ============================================\n\n /**\n * One-time host initialization. In deferred instance mode (no `auth` in the\n * options) this builds the provider-owned `betterAuth()` instance on the\n * host's auth database; schema migrations then run lazily behind a\n * once-per-process latch on first use.\n *\n * Bring-your-own `auth` instances skip construction entirely — the caller\n * owns their database and migrations.\n */\n async init(ctx: AuthInitContext): Promise<void> {\n this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;\n if (this.#auth) return; // bring-your-own instance: nothing to build\n\n const authDb = ctx.database as TaggedAuthDatabase | undefined;\n if (!authDb) {\n throw new Error(\n 'MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. ' +\n 'Use a storage backend that exposes an auth database, or pass your own configured `auth` instance.',\n );\n }\n // Map the host's tagged auth-database handle onto better-auth's `database`\n // option: pg pool directly, libsql via its kysely dialect, anything else\n // passed through as-is (the host owns its compatibility).\n const database: BetterAuthOptions['database'] =\n authDb.dialect === 'postgres'\n ? (authDb.pool as Extract<BetterAuthOptions['database'], { query: unknown }>)\n : authDb.dialect === 'libsql'\n ? {\n dialect: new LibsqlDialect({ client: authDb.client } as ConstructorParameters<typeof LibsqlDialect>[0]),\n type: 'sqlite' as const,\n }\n : (authDb.database as BetterAuthOptions['database']);\n const allowedOrigins = ctx.allowedOrigins ?? [];\n // Widen to BetterAuthOptions before calling betterAuth(): its return type\n // is generic over the exact options object, which would make the instance\n // incompatible with the plain `Auth` alias we store.\n const options: BetterAuthOptions = {\n database,\n secret: this.#secret,\n // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,\n // where hosts mount handleAuthRequest.\n basePath: '/auth/api',\n ...(ctx.publicUrl ? { baseURL: ctx.publicUrl } : {}),\n // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the\n // cookie — better-auth still rejects requests from origins outside its\n // own allow-list, so the SPA origins must be trusted too.\n ...(allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {}),\n emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },\n plugins: [organization()],\n // Cross-origin SPA deploys need SameSite=None; Secure for the browser to\n // send the session cookie.\n ...(this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: 'none', secure: true } } } : {}),\n };\n this.#auth = betterAuth(options);\n this.#ownsInstance = true;\n }\n\n /**\n * Ensure better-auth's tables exist in the host database. Only for instances\n * this provider built — bring-your-own instances manage their own migrations.\n */\n async #ensureDbReady(): Promise<void> {\n if (!this.#ownsInstance) return;\n this.#migrated ??= (async () => {\n const { runMigrations } = await getMigrations(this.auth.options as BetterAuthOptions);\n await runMigrations();\n })();\n try {\n await this.#migrated;\n } catch (error) {\n this.#migrated = undefined; // allow a later call to retry\n console.warn('[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.');\n throw error;\n }\n }\n\n // ============================================\n // IAuthHttpHandler implementation\n // ============================================\n\n /**\n * Proxy a raw HTTP request to Better Auth's own API surface\n * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.\n */\n async handleAuthRequest(request: Request): Promise<Response> {\n try {\n await this.#ensureDbReady();\n } catch {\n return new Response(JSON.stringify({ error: 'auth_unavailable' }), {\n status: 503,\n headers: { 'content-type': 'application/json' },\n });\n }\n return this.auth.handler(request);\n }\n\n // ============================================\n // IOrganizationsProvider implementation\n // ============================================\n\n /**\n * Read-only half of org resolution: the user's oldest existing membership,\n * cached in `#orgCache`. Never creates anything. Ordered by `createdAt` so\n * the resolved default is stable across processes for multi-org users.\n */\n async #findMembershipOrgId(ctx: BetterAuthContext, userId: string): Promise<string | undefined> {\n const memberships = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'userId', value: userId }],\n sortBy: { field: 'createdAt', direction: 'asc' },\n })) as MemberRow[];\n const orgId = memberships.find(m => m.organizationId)?.organizationId;\n if (orgId) this.#storeOrgId(userId, orgId);\n return orgId;\n }\n\n /**\n * Resolve the organization a session should act under when better-auth's\n * `activeOrganizationId` was never set (nothing in this provider or a\n * default sign-in flow calls the organization plugin's `setActive`).\n * Read-only and best-effort: an existing membership or nothing.\n *\n * Callers must run `#ensureDbReady` first (authenticateToken does); this\n * method deliberately swallows failures, so an unmigrated DB would\n * otherwise fail silently.\n */\n async #resolveActiveOrganizationId(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n return await this.#findMembershipOrgId(ctx, userId);\n } catch {\n return undefined;\n }\n }\n\n /**\n * Ensure the user belongs to an organization, mirroring the WorkOS\n * personal-org bootstrap on better-auth's organization tables:\n * ≥1 membership → oldest org id; 0 → create a personal org with an\n * idempotent slug derived from the user id.\n *\n * Concurrent/retried first logins recover via the unique slug instead of\n * creating duplicates. Slug alone is NOT proof of ownership though: the\n * organization API is reachable by any authenticated user, so an attacker\n * could squat `personal-<victimId>`. The slug-matched org is only adopted\n * when nobody else is a member; otherwise a fresh org with an unguessable\n * slug is created instead.\n *\n * Best-effort: any failure is swallowed and leaves the user no-org.\n */\n async ensureOrganization(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n\n const firstExisting = await this.#findMembershipOrgId(ctx, userId);\n if (firstExisting) return firstExisting;\n\n // Build a predictable personal-org name from the user's profile.\n const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);\n const label = userRecord?.email ?? userRecord?.name ?? userId;\n const orgName = `${label}'s org`;\n const orgData = () => ({\n name: orgName,\n createdAt: new Date(),\n metadata: JSON.stringify({ mastraPersonalOrg: 'true' }),\n });\n\n // Create the personal org. The slug is derived from the user id, so a\n // concurrent/prior bootstrap that already created it makes the insert\n // reject on the unique slug — recover by looking the org up instead.\n const slug = `personal-${userId}`;\n let organizationId: string;\n try {\n const created = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug },\n })) as OrganizationRow;\n organizationId = created.id;\n } catch (error) {\n const existing = (await ctx.adapter.findOne({\n model: 'organization',\n where: [{ field: 'slug', value: slug }],\n })) as OrganizationRow | null;\n if (!existing) throw error;\n // Only adopt the slug-matched org when nobody else is a member (zero\n // members = a concurrent bootstrap of this same user that hasn't\n // attached yet). Otherwise fall back to an unguessable slug.\n const existingMembers = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'organizationId', value: existing.id }],\n })) as MemberRow[];\n const foreignMember = existingMembers.some(m => m.userId !== userId);\n if (foreignMember) {\n const fallback = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` },\n })) as OrganizationRow;\n organizationId = fallback.id;\n } else {\n organizationId = existing.id;\n }\n }\n\n // Idempotently attach the user: tolerate a membership a concurrent\n // bootstrap already created.\n try {\n await ctx.adapter.create({\n model: 'member',\n data: { organizationId, userId, role: 'owner', createdAt: new Date() },\n });\n } catch (error) {\n const member = await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n });\n if (!member) throw error;\n }\n\n this.#storeOrgId(userId, organizationId);\n return organizationId;\n } catch (error) {\n console.warn(\n `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. ` +\n 'The user will see organization_required until this succeeds.',\n error,\n );\n return undefined;\n }\n }\n\n /**\n * Whether the user holds an admin-equivalent role (`owner` or `admin`) in\n * the organization. Provider errors resolve to `false`.\n */\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return false;\n const membership = (await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n })) as MemberRow | null;\n return membership?.role === 'owner' || membership?.role === 'admin';\n } catch {\n return false;\n }\n }\n\n /**\n * Check if sign-up is enabled.\n * Implements ICredentialsProvider.isSignUpEnabled.\n */\n isSignUpEnabled(): boolean {\n return this.signUpEnabledConfig;\n }\n\n // ============================================\n // IUserProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Get current user from request.\n * Implements IUserProvider for EE user awareness in Studio.\n *\n * Supports both cookie-based sessions and `Authorization: Bearer <token>`\n * requests (e.g. API clients using the token returned by `signIn`).\n *\n * @param request - Incoming HTTP request\n * @returns EE User object or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<EEUser | null> {\n try {\n await this.#ensureDbReady();\n const headers = new Headers(request.headers);\n\n // If the request authenticates via Bearer token instead of cookies,\n // convert the token to a signed session cookie so getSession accepts it.\n const authHeader = headers.get('Authorization');\n const bearerToken =\n authHeader && authHeader.slice(0, 7).toLowerCase() === 'bearer ' ? authHeader.slice(7).trim() : undefined;\n await this.ensureSessionCookie(headers, bearerToken);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result?.user) return null;\n return mapBetterAuthUserToEEUser(result.user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Implements IUserProvider for EE user awareness.\n *\n * Uses Better Auth's internal adapter to look up the user record,\n * so it works with whichever database Better Auth is configured with.\n *\n * @param userId - User identifier\n * @returns EE User object or null if not found\n */\n async getUser(userId: string): Promise<EEUser | null> {\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return null;\n\n const user = await ctx.internalAdapter.findUserById(userId);\n if (!user) return null;\n return mapBetterAuthUserToEEUser(user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get multiple users by ID.\n * Optional IUserProvider method used for batch author enrichment.\n *\n * @param userIds - User identifiers\n * @returns EE User objects (null for missing users, order preserved)\n */\n async getUsers(userIds: string[]): Promise<Array<EEUser | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n\n /**\n * Get URL to user's profile page.\n * Optional IUserProvider method.\n */\n getUserProfileUrl(user: EEUser): string {\n return `/profile/${user.id}`;\n }\n\n /**\n * Get the resolved Better Auth context, or null when unavailable\n * (e.g. a partial mock without `$context`).\n */\n private async getAuthContext(): Promise<BetterAuthContext | null> {\n try {\n return (await Promise.resolve(this.auth.$context)) ?? null;\n } catch {\n return null;\n }\n }\n\n /**\n * Ensure the Cookie header on `headers` carries a Better Auth session cookie\n * for the given token.\n *\n * Better Auth's `getSession` reads the session from a *signed* cookie\n * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the\n * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens\n * are signed with the instance secret before being set as the session cookie.\n */\n private async ensureSessionCookie(headers: Headers, token: string | undefined): Promise<void> {\n if (!token) return;\n\n const ctx = await this.getAuthContext();\n const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;\n const secret = ctx?.secret;\n\n const cookieHeader = headers.get('Cookie');\n const hasSessionCookie = !!cookieHeader?.split(';').some(pair => {\n const [key] = pair.trim().split('=');\n return key?.trim() === cookieName;\n });\n if (hasSessionCookie) return;\n\n // Tokens containing \".\" are already signed (and may be URI-encoded).\n let cookieValue = token.includes('.') ? (token.includes('%') ? tryDecode(token) : token) : token;\n if (!token.includes('.') && secret) {\n cookieValue = `${token}.${await makeSignature(token, secret)}`;\n }\n\n const existingCookies = cookieHeader ? `${cookieHeader}; ` : '';\n headers.set('Cookie', `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);\n }\n\n /**\n * Authenticate a bearer token by verifying the session with Better Auth.\n *\n * This method extracts the session from the request headers using\n * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —\n * as returned by `signIn`/`signUp` — are signed before being passed to\n * Better Auth as a session cookie, matching the bearer plugin's semantics.\n *\n * @param token - The bearer token (session token) to authenticate\n * @param request - The request containing headers\n * @returns The authenticated user and session, or null if authentication fails\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<BetterAuthUser | null> {\n try {\n await this.#ensureDbReady();\n\n // Better Auth's api.getSession() reads session tokens from the Cookie header\n const headers = new Headers();\n\n const cookieHeader = getRequestHeader(request, 'Cookie');\n if (cookieHeader) {\n headers.set('Cookie', cookieHeader);\n }\n\n // Convert Bearer token to a signed session cookie if not already present.\n // better-auth ignores the Authorization header — it only reads from Cookie.\n await this.ensureSessionCookie(headers, token);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result || !result.session || !result.user) {\n return null;\n }\n\n // Better-auth never populates `activeOrganizationId` unless the host app\n // wires the organization plugin's `setActive` itself, which leaves every\n // org-scoped consumer with a user that has no organization. Resolve a\n // default from the user's existing memberships (read-only; the session\n // row is not mutated). See mastra-ai/mastra#21481.\n let session: BetterAuthUser['session'] = result.session;\n if (!session.activeOrganizationId) {\n const organizationId = await this.#resolveActiveOrganizationId(result.user.id);\n if (organizationId) session = { ...session, activeOrganizationId: organizationId };\n }\n\n return {\n session,\n user: result.user,\n };\n } catch {\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * By default, any authenticated user with a valid session is authorized.\n * You can override this behavior by providing a custom `authorizeUser` function\n * in the constructor options.\n *\n * @param user - The authenticated user and session\n * @returns True if the user is authorized, false otherwise\n */\n async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n // By default, any authenticated user with a valid session is authorized\n return !!user?.session?.id && !!user?.user?.id;\n }\n\n // ============================================\n // ICredentialsProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Sign in with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param request - Incoming HTTP request\n * @returns Result with user and session cookies\n * @throws Error if credentials are invalid\n */\n async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signInEmail({\n body: { email, password },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Invalid email or password');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Invalid email or password');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Sign up with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param name - Optional display name\n * @param request - Incoming HTTP request\n * @returns Result with new user and session cookies\n * @throws Error if sign up fails\n */\n async signUp(\n email: string,\n password: string,\n name: string | undefined,\n request: Request,\n ): Promise<CredentialsResult<EEUser>> {\n const displayName = name ?? email.split('@')[0] ?? 'User';\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signUpEmail({\n body: { email, password, name: displayName },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Failed to create account');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Failed to create account');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Get the underlying Better Auth instance.\n * Useful for accessing Better Auth APIs directly.\n */\n getAuth(): Auth {\n return this.auth;\n }\n\n /**\n * Get headers to clear the session cookies on logout.\n * Partial ISessionProvider implementation for logout support.\n *\n * Clears Better Auth's default session cookies.\n */\n getClearSessionHeaders(): Record<string, string> {\n // Cross-site deploys set the session cookie with SameSite=None; Secure —\n // the clearing cookie must match those attributes to overwrite it.\n const sameSite = this.#crossSite ? 'None; Secure' : 'Lax';\n // Clear both the session token and its signature cookie\n const cookies = [\n `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n ];\n return {\n 'Set-Cookie': cookies.join(', '),\n };\n }\n}\n"],"mappings":";;;;;;;AACA,SAAS,sBAAsB,SAAS,MAAM;CAC7C,MAAM,iBAAiB,KAAK,YAAY;CACxC,MAAM,cAAc,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,MAAM,cAAc;CAC3F,MAAM,QAAQ,gBAAgB,KAAK,IAAI,KAAK,IAAI,QAAQ;CACxD,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,OAAO,SAAS;AAC3D;;;;;AAKA,SAAS,iBAAiB,SAAS,MAAM;CACxC,IAAI,mBAAmB,SAAS,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAC/D,IAAI,QAAQ,eAAe,SAAS,OAAO,QAAQ,IAAI,QAAQ,IAAI,IAAI;CACvE,MAAM,UAAU,QAAQ;CACxB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI;CACvD,IAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,OAAO,IAAI,KAAK;CACzE,IAAI,WAAW,OAAO,YAAY,UAAU,OAAO,sBAAsB,SAAS,IAAI;CACtF,OAAO;AACR;;;;;;;;ACTA,SAAS,uBAAuB,KAAK,OAAO,UAAU;CACrD,IAAI,CAAC,KAAK,QAAQ,QAAQ;CAC1B,IAAI;EACH,MAAM,cAAc;EACpB,IAAI,WAAW,CAAC,EAAE,MAAM,MAAM,SAAS;GACtC,GAAG,YAAY,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY,GAAG,IAAI,CAAC;GAC9D,GAAG,YAAY,WAAW,KAAK,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;GACrE,GAAG,YAAY,aAAa,KAAK,IAAI,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;GAC3E,GAAG,YAAY,YAAY,KAAK,IAAI,EAAE,SAAS,YAAY,QAAQ,IAAI,CAAC;GACxE,GAAG,MAAM,iBAAiB,QAAQ,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,CAAC;GACpE,GAAG;EACJ,CAAC;CACF,QAAQ,CAAC;AACV;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,MAAM,aAAa,KAAK,MAAM,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,MAAM;CAC/H,MAAM,WAAW,KAAK,MAAM,QAAQ,eAAe,KAAK;CACxD,MAAM,YAAY,KAAK,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,QAAQ;CAC7E,IAAI,CAAC,cAAc,CAAC,YAAY,UAAU,WAAW,GAAG,OAAO,KAAK;CACpE,OAAO;EACN,GAAG,cAAc,CAAC;EAClB,GAAG,WAAW,EAAE,OAAO;GACtB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,OAAO,SAAS;EACjB,EAAE,IAAI,CAAC;EACP,GAAG,UAAU,SAAS,IAAI,EAAE,MAAM,UAAU,IAAI,CAAC;CAClD;AACD;AAGA,MAAM,mBAAmB;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACT,SAAS;CACT,UAAU;CACV,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,cAAc;CACd,QAAQ;CACR,WAAW;CACX,SAAS;AACV;AACA,MAAM,WAAW;CAChB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,MAAM;AACP;AAiCA,IAAI,eAAe,MAAM;CACxB;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,QAAQ,QAAQ,SAAS,SAAS;EACvC,KAAK,aAAa,IAAI,IAAI,OAAO,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAAC;CACnE;CACA,gBAAgB;EACf,OAAO,KAAK;CACb;CACA,eAAe,QAAQ,WAAW,CAAC;CACnC,MAAM,SAAS,aAAa,QAAQ;EACnC,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,GAAG,OAAO;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,WAAW,MAAM,KAAK;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,EAAE,aAAa,OAAO,UAAU,QAAQ,UAAU,SAAS,MAAM,WAAW;EACjG,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,OAAO,OAAO;GACvE,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,kBAAkB;GACzD;GACA;GACA;GACA;GACA;GACA;GACA;EACD,CAAC,KAAK;GACL,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;CACD;AACD;AACA,IAAI,gBAAgB,MAAM,sBAAsB,aAAa;CAC5D;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,MAAM,OAAO;EACb,KAAK,YAAY,QAAQ;EACzB,KAAK,SAAS,QAAQ;CACvB;;;;;;CAMA,sBAAsB,KAAK;EAC1B,KAAK,kBAAkB;CACxB;CACA,MAAM,qBAAqB;EAC1B,MAAM,YAAY,OAAO,wBAAwB,WAAW,sBAAsB,qBAAqB,aAAa,KAAK;EACzH,MAAM,QAAQ,IAAI,cAAc;GAC/B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ;GACA,QAAQ,KAAK;EACd,CAAC;EACD,IAAI,KAAK,iBAAiB,MAAM,sBAAsB,KAAK,eAAe;EAC1E,OAAO;CACR;;;;;CAKA,WAAW,MAAM;EAChB,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,QAAQ,aAAa,OAAO;EACtC,IAAI;GACH,MAAM,SAAS,IAAI,mBAAmB;GACtC,OAAO,SAAS,CAAC,GAAG,MAAM,MAAM,IAAI;EACrC,QAAQ;GACP,OAAO;EACR;CACD;;;;;;CAMA,QAAQ,OAAO,SAAS,MAAM;EAC7B,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,QAAQ,QAAQ;EAC1B,IAAI;GACH,IAAI,WAAW,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;EAC5D,QAAQ,CAAC;CACV;CACA,UAAU,OAAO,SAAS,MAAM;EAC/B,IAAI,CAAC,KAAK,QAAQ,OAAO;EACzB,IAAI;GACH,OAAO,KAAK,OAAO;IAClB,WAAW,KAAK;IAChB;IACA;IACA;GACD,CAAC;EACF,SAAS,GAAG;GACX,QAAQ,MAAM,uCAAuC,KAAK,UAAU,SAAS,MAAM,IAAI,CAAC;GACxF,OAAO;EACR;CACD;CACA,SAAS;EACR,OAAO,KAAK,YAAY,IAAI,KAAK,UAAU,MAAM;CAClD;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,IAAI,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACvJ,KAAK,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACxL,KAAK,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACxN,KAAK,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,KAAK,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EAC3P,KAAK,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,eAAe,OAAO,UAAU;EAC/B,uBAAuB,KAAK,iBAAiB,OAAO,QAAQ;CAC7D;CACA,MAAM,SAAS,cAAc,SAAS;EACrC,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,SAAS,QAAQ;GACvB,SAAS,SAAS,WAAW;GAC7B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,OAAO;EAC5B,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,MAAM,QAAQ;GACpB,SAAS,MAAM,WAAW;GAC1B,SAAS;EACV;CACD;AACD;;;AC5QA,IAAI,aAAa,MAAM;CACtB,YAAY,iBAAiB;CAC7B;CACA;CACA;CACA,YAAY,EAAE,WAAW,MAAM,aAAa;EAC3C,KAAK,YAAY,aAAa,iBAAiB;EAC/C,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC;CAC7E;;;;;CAKA,cAAc;EACb,OAAO,KAAK;CACb;;;;;CAKA,eAAe,WAAW;EACzB,KAAK,aAAa;CACnB;;;;;CAKA,YAAY,QAAQ;EACnB,KAAK,SAAS,WAAW,UAAU,OAAO,OAAO,UAAU,aAAa,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI;CACvH;AACD;;;AC/BA,IAAI,qBAAqB,cAAc,WAAW;CACjD;CACA;CACA,YAAY,SAAS;EACpB,MAAM;GACL,WAAW;GACX,MAAM,SAAS;EAChB,CAAC;EACD,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ,cAAc,KAAK,IAAI;EAChF,KAAK,YAAY,SAAS;EAC1B,KAAK,SAAS,SAAS;EACvB,KAAK,sBAAsB,SAAS;CACrC;CACA,gBAAgB,MAAM;EACrB,IAAI,MAAM,eAAe,KAAK,gBAAgB,KAAK,cAAc,KAAK,IAAI;EAC1E,IAAI,MAAM,qBAAqB,KAAK,sBAAsB,KAAK;EAC/D,IAAI,MAAM,WAAW,KAAK,YAAY,KAAK;EAC3C,IAAI,MAAM,QAAQ,KAAK,SAAS,KAAK;CACtC;AACD;;;ACEA,SAAS,UAAU,OAAuB;CACxC,IAAI;EACF,OAAO,mBAAmB,KAAK;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;;;AAoBA,SAAS,0BAA0B,MAAoB;CACrD,OAAO;EACL,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,WAAW,KAAK,SAAS,KAAA;EACzB,UAAU;GACR,eAAe,KAAK;GACpB,WAAW,KAAK;GAChB,WAAW,KAAK;EAClB;CACF;AACF;;;;;;;AAiCA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DzB,IAAa,uBAAb,cACU,mBAEV;CACE;CACA;;CAEA,gBAAgB;;CAEhB;;;;;;;;;CASA,4BAAY,IAAI,IAAkD;CAElE,aAAa,QAAoC;EAC/C,MAAM,QAAQ,KAAK,UAAU,IAAI,MAAM;EACvC,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,IAAI,KAAK,IAAI,KAAK,MAAM,WAAW;GACjC,KAAK,UAAU,OAAO,MAAM;GAC5B;EACF;EACA,OAAO,MAAM;CACf;;;;;;;;CASA,YAAY,QAAgB,OAAqB;EAC/C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,CAAC,KAAK,UAAU,KAAK,WAAW;GACzC,IAAI,MAAM,MAAM,WAAW;GAC3B,KAAK,UAAU,OAAO,GAAG;EAC3B;EACA,KAAK,UAAU,OAAO,MAAM;EAC5B,KAAK,UAAU,IAAI,QAAQ;GAAE;GAAO,WAAW,MAAM;EAAiB,CAAC;CACzE;;CAGA,IAAI,eAAuB;EACzB,OAAO,KAAK,UAAU;CACxB;;CAEA,aAAa;CACb;CAEA,YAAY,SAAsC;EAChD,MAAM,EAAE,MAAM,SAAS,QAAQ,cAAc,CAAC;EAE9C,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,MACR,iOAEF;EAGF,KAAK,QAAQ,QAAQ;EACrB,KAAK,UAAU,QAAQ;EACvB,KAAK,sBAAsB,QAAQ,iBAAiB;EAEpD,KAAK,gBAAgB,OAAO;CAC9B;;;;;CAMA,IAAc,OAAa;EACzB,IAAI,CAAC,KAAK,OACR,MAAM,IAAI,MACR,yGACF;EAEF,OAAO,KAAK;CACd;;;;;;CAOA,IAAI,oBAA4B;EAC9B,MAAM,UAAW,KAAK,OAClB;EACJ,MAAM,WAAW,SAAS;EAO1B,MAAM,SAAS,UAAU,gBAAgB;EACzC,MAAM,SAAS,UAAU,oBAAoB,SAAS,SAAS,WAAW,UAAU,KAAK;EACzF,MAAM,WAAW,UAAU,SAAS,eAAe,QAAQ,GAAG,OAAO;EACrE,OAAO,GAAG,SAAS,cAAc,KAAK;CACxC;;;;;;;;;;CAeA,MAAM,KAAK,KAAqC;EAC9C,KAAK,cAAc,IAAI,gBAAgB,UAAU,KAAK;EACtD,IAAI,KAAK,OAAO;EAEhB,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,QACH,MAAM,IAAI,MACR,0MAEF;EAKF,MAAM,WACJ,OAAO,YAAY,aACd,OAAO,OACR,OAAO,YAAY,WACjB;GACE,SAAS,IAAIA,sBAAAA,cAAc,EAAE,QAAQ,OAAO,OAAO,CAAmD;GACtG,MAAM;EACR,IACC,OAAO;EAChB,MAAM,iBAAiB,IAAI,kBAAkB,CAAC;EAI9C,MAAM,UAA6B;GACjC;GACA,QAAQ,KAAK;GAGb,UAAU;GACV,GAAI,IAAI,YAAY,EAAE,SAAS,IAAI,UAAU,IAAI,CAAC;GAIlD,GAAI,eAAe,SAAS,EAAE,gBAAgB,eAAe,IAAI,CAAC;GAClE,kBAAkB;IAAE,SAAS;IAAM,eAAe,CAAC,KAAK;GAAoB;GAC5E,SAAS,EAAA,GAACC,oBAAAA,aAAAA,CAAa,CAAC;GAGxB,GAAI,KAAK,aAAa,EAAE,UAAU,EAAE,yBAAyB;IAAE,UAAU;IAAQ,QAAQ;GAAK,EAAE,EAAE,IAAI,CAAC;EACzG;EACA,KAAK,SAAA,GAAQC,YAAAA,WAAAA,CAAW,OAAO;EAC/B,KAAK,gBAAgB;CACvB;;;;;CAMA,MAAM,iBAAgC;EACpC,IAAI,CAAC,KAAK,eAAe;EACzB,KAAK,eAAe,YAAY;GAC9B,MAAM,EAAE,kBAAkB,OAAA,GAAMC,yBAAAA,cAAAA,CAAc,KAAK,KAAK,OAA4B;GACpF,MAAM,cAAc;EACtB,EAAA,CAAG;EACH,IAAI;GACF,MAAM,KAAK;EACb,SAAS,OAAO;GACd,KAAK,YAAY,KAAA;GACjB,QAAQ,KAAK,gGAAgG;GAC7G,MAAM;EACR;CACF;;;;;CAUA,MAAM,kBAAkB,SAAqC;EAC3D,IAAI;GACF,MAAM,KAAK,eAAe;EAC5B,QAAQ;GACN,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,mBAAmB,CAAC,GAAG;IACjE,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;GAChD,CAAC;EACH;EACA,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;;;;;;CAWA,MAAM,qBAAqB,KAAwB,QAA6C;EAM9F,MAAM,SAAQ,MALa,IAAI,QAAQ,SAAS;GAC9C,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAU,OAAO;GAAO,CAAC;GAC1C,QAAQ;IAAE,OAAO;IAAa,WAAW;GAAM;EACjD,CAAC,EAAA,CACyB,MAAK,MAAK,EAAE,cAAc,CAAC,EAAE;EACvD,IAAI,OAAO,KAAK,YAAY,QAAQ,KAAK;EACzC,OAAO;CACT;;;;;;;;;;;CAYA,MAAM,6BAA6B,QAA6C;EAC9E,MAAM,SAAS,KAAK,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EACnB,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GACjB,OAAO,MAAM,KAAK,qBAAqB,KAAK,MAAM;EACpD,QAAQ;GACN;EACF;CACF;;;;;;;;;;;;;;;;CAiBA,MAAM,mBAAmB,QAA6C;EACpE,MAAM,SAAS,KAAK,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EAEnB,IAAI;GACF,MAAM,KAAK,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GAEjB,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,KAAK,MAAM;GACjE,IAAI,eAAe,OAAO;GAG1B,MAAM,aAAa,MAAM,IAAI,gBAAgB,aAAa,MAAM,CAAC,CAAC,YAAY,IAAI;GAElF,MAAM,UAAU,GADF,YAAY,SAAS,YAAY,QAAQ,OAC9B;GACzB,MAAM,iBAAiB;IACrB,MAAM;IACN,2BAAW,IAAI,KAAK;IACpB,UAAU,KAAK,UAAU,EAAE,mBAAmB,OAAO,CAAC;GACxD;GAKA,MAAM,OAAO,YAAY;GACzB,IAAI;GACJ,IAAI;IAKF,kBAAiB,MAJM,IAAI,QAAQ,OAAO;KACxC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG;KAAK;IAC7B,CAAC,EAAA,CACwB;GAC3B,SAAS,OAAO;IACd,MAAM,WAAY,MAAM,IAAI,QAAQ,QAAQ;KAC1C,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAQ,OAAO;KAAK,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,UAAU,MAAM;IASrB,KADsB,MAJS,IAAI,QAAQ,SAAS;KAClD,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAkB,OAAO,SAAS;KAAG,CAAC;IACzD,CAAC,EAAA,CACqC,MAAK,MAAK,EAAE,WAAW,MAC7C,GAKd,kBAAiB,MAJO,IAAI,QAAQ,OAAO;KACzC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG,MAAM,YAAY,OAAO,GAAG,OAAO,WAAW;KAAI;IAC1E,CAAC,EAAA,CACyB;SAE1B,iBAAiB,SAAS;GAE9B;GAIA,IAAI;IACF,MAAM,IAAI,QAAQ,OAAO;KACvB,OAAO;KACP,MAAM;MAAE;MAAgB;MAAQ,MAAM;MAAS,2BAAW,IAAI,KAAK;KAAE;IACvE,CAAC;GACH,SAAS,OAAO;IAQd,IAAI,CAAC,MAPgB,IAAI,QAAQ,QAAQ;KACvC,OAAO;KACP,OAAO,CACL;MAAE,OAAO;MAAkB,OAAO;KAAe,GACjD;MAAE,OAAO;MAAU,OAAO;KAAO,CACnC;IACF,CAAC,GACY,MAAM;GACrB;GAEA,KAAK,YAAY,QAAQ,cAAc;GACvC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,mEAAmE,OAAO,iEAE1E,KACF;GACA;EACF;CACF;;;;;CAMA,MAAM,oBAAoB,gBAAwB,QAAkC;EAClF,IAAI;GACF,MAAM,KAAK,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GACjB,MAAM,aAAc,MAAM,IAAI,QAAQ,QAAQ;IAC5C,OAAO;IACP,OAAO,CACL;KAAE,OAAO;KAAkB,OAAO;IAAe,GACjD;KAAE,OAAO;KAAU,OAAO;IAAO,CACnC;GACF,CAAC;GACD,OAAO,YAAY,SAAS,WAAW,YAAY,SAAS;EAC9D,QAAQ;GACN,OAAO;EACT;CACF;;;;;CAMA,kBAA2B;EACzB,OAAO,KAAK;CACd;;;;;;;;;;;CAiBA,MAAM,eAAe,SAA0C;EAC7D,IAAI;GACF,MAAM,KAAK,eAAe;GAC1B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAI3C,MAAM,aAAa,QAAQ,IAAI,eAAe;GAC9C,MAAM,cACJ,cAAc,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,MAAM,YAAY,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,KAAA;GAClG,MAAM,KAAK,oBAAoB,SAAS,WAAW;GAEnD,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,QAAQ,MAAM,OAAO;GAC1B,OAAO,0BAA0B,OAAO,IAAI;EAC9C,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,QAAQ,QAAwC;EACpD,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GAEjB,MAAM,OAAO,MAAM,IAAI,gBAAgB,aAAa,MAAM;GAC1D,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,0BAA0B,IAAI;EACvC,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;CASA,MAAM,SAAS,SAAkD;EAC/D,OAAO,QAAQ,IAAI,QAAQ,KAAI,WAAU,KAAK,QAAQ,MAAM,CAAC,CAAC;CAChE;;;;;CAMA,kBAAkB,MAAsB;EACtC,OAAO,YAAY,KAAK;CAC1B;;;;;CAMA,MAAc,iBAAoD;EAChE,IAAI;GACF,OAAQ,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,KAAM;EACxD,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;CAWA,MAAc,oBAAoB,SAAkB,OAA0C;EAC5F,IAAI,CAAC,OAAO;EAEZ,MAAM,MAAM,MAAM,KAAK,eAAe;EACtC,MAAM,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK;EAC9D,MAAM,SAAS,KAAK;EAEpB,MAAM,eAAe,QAAQ,IAAI,QAAQ;EAKzC,IAAI,CAJsB,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,MAAK,SAAQ;GAC/D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG;GACnC,OAAO,KAAK,KAAK,MAAM;EACzB,CAAC,GACqB;EAGtB,IAAI,cAAc,MAAM,SAAS,GAAG,IAAK,MAAM,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI,QAAS;EAC3F,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,QAC1B,cAAc,GAAG,MAAM,GAAG,OAAA,GAAMC,mBAAAA,cAAAA,CAAc,OAAO,MAAM;EAG7D,MAAM,kBAAkB,eAAe,GAAG,aAAa,MAAM;EAC7D,QAAQ,IAAI,UAAU,GAAG,kBAAkB,WAAW,GAAG,mBAAmB,WAAW,GAAG;CAC5F;;;;;;;;;;;;;CAcA,MAAM,kBAAkB,OAAe,SAA4D;EACjG,IAAI;GACF,MAAM,KAAK,eAAe;GAG1B,MAAM,UAAU,IAAI,QAAQ;GAE5B,MAAM,eAAe,iBAAiB,SAAS,QAAQ;GACvD,IAAI,cACF,QAAQ,IAAI,UAAU,YAAY;GAKpC,MAAM,KAAK,oBAAoB,SAAS,KAAK;GAE7C,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,OAAO,MACxC,OAAO;GAQT,IAAI,UAAqC,OAAO;GAChD,IAAI,CAAC,QAAQ,sBAAsB;IACjC,MAAM,iBAAiB,MAAM,KAAK,6BAA6B,OAAO,KAAK,EAAE;IAC7E,IAAI,gBAAgB,UAAU;KAAE,GAAG;KAAS,sBAAsB;IAAe;GACnF;GAEA,OAAO;IACL;IACA,MAAM,OAAO;GACf;EACF,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,cAAc,MAAwC;EAE1D,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;CAC9C;;;;;;;;;;;CAiBA,MAAM,OAAO,OAAe,UAAkB,SAAsD;EAClG,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;GAAS;GACxB;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,2BAA2B;EAClE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,2BAA2B;EAI7C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;;;;;;;;CAaA,MAAM,OACJ,OACA,UACA,MACA,SACoC;EACpC,MAAM,cAAc,QAAQ,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;EACnD,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;IAAU,MAAM;GAAY;GAC3C;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,0BAA0B;EACjE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,0BAA0B;EAI5C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;CAMA,UAAgB;EACd,OAAO,KAAK;CACd;;;;;;;CAQA,yBAAiD;EAG/C,MAAM,WAAW,KAAK,aAAa,iBAAiB;EAMpD,OAAO,EACL,cAAc,CAJd,GAAG,KAAK,kBAAkB,gCAAgC,SAAS,cACnE,GAAG,KAAK,kBAAkB,oCAAoC,SAAS,YAGnD,CAAC,CAAC,KAAK,IAAI,EACjC;CACF;AACF"}
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","names":["#adapterContext","#correlate","#export","#rawConfig","#orgCache","#auth","#secret","#crossSite","#ownsInstance","#ensureDbReady","#migrated","#findMembershipOrgId","#storeOrgId","#resolveActiveOrganizationId","#cachedOrgId"],"sources":["../../../packages/_internals/auth/dist/types/index.js","../../../packages/_internal-core/dist/logger/index.js","../../../packages/_internal-core/dist/base/index.js","../../../packages/_internals/auth/dist/provider/index.js","../src/index.ts"],"sourcesContent":["//#region src/types/index.ts\nfunction headerFromPlainObject(headers, name) {\n\tconst normalizedName = name.toLowerCase();\n\tconst matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);\n\tconst value = matchingKey === void 0 ? void 0 : headers[matchingKey];\n\treturn Array.isArray(value) ? value[0] ?? null : value ?? null;\n}\n/**\n* Read a request header across fetch, Hono, and Express-style request shapes.\n* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).\n*/\nfunction getRequestHeader(request, name) {\n\tif (request instanceof Request) return request.headers.get(name);\n\tif (request.raw instanceof Request) return request.raw.headers.get(name);\n\tconst headers = request.headers;\n\tif (headers instanceof Headers) return headers.get(name);\n\tif (typeof request.header === \"function\") return request.header(name) ?? null;\n\tif (headers && typeof headers === \"object\") return headerFromPlainObject(headers, name);\n\treturn null;\n}\nfunction getWebRequest(request) {\n\tif (request instanceof Request) return request;\n\treturn request.raw instanceof Request ? request.raw : void 0;\n}\n//#endregion\nexport { getRequestHeader, getWebRequest };\n\n//# sourceMappingURL=index.js.map","import { Transform } from \"stream\";\n//#region src/logger/adapter.ts\nfunction isAdaptableLogger(logger) {\n\treturn typeof logger.__attachObservability === \"function\";\n}\n/**\n* Export a tracked exception through the adapter sink, mirroring the\n* DualLogger dual-write shape (`errorId`/`domain`/`category`/`details`/`cause`\n* when present on a MastraError-like value). Never throws into the caller.\n*/\nfunction exportTrackedException(ctx, error, metadata) {\n\tif (!ctx?.options.export) return;\n\ttry {\n\t\tconst mastraError = error;\n\t\tctx.getLogSink()?.error(error.message, {\n\t\t\t...mastraError.id !== void 0 ? { errorId: mastraError.id } : {},\n\t\t\t...mastraError.domain !== void 0 ? { domain: mastraError.domain } : {},\n\t\t\t...mastraError.category !== void 0 ? { category: mastraError.category } : {},\n\t\t\t...mastraError.details !== void 0 ? { details: mastraError.details } : {},\n\t\t\t...error.cause instanceof Error ? { cause: error.cause.message } : {},\n\t\t\t...metadata\n\t\t});\n\t} catch {}\n}\n/**\n* Adapt IMastraLogger's variadic args into the structured `data` payload of\n* an exported log record. Extracts the first plain object as data,\n* serializes an Error arg, and collects remaining primitives under `args`\n* so the derived record preserves all context from the native call.\n*/\nfunction buildLogRecordData(args) {\n\tconst objectData = args.find((arg) => arg !== null && typeof arg === \"object\" && !Array.isArray(arg) && !(arg instanceof Error));\n\tconst errorArg = args.find((arg) => arg instanceof Error);\n\tconst extraArgs = args.filter((arg) => arg !== objectData && arg !== errorArg);\n\tif (!objectData && !errorArg && extraArgs.length === 0) return void 0;\n\treturn {\n\t\t...objectData ?? {},\n\t\t...errorArg ? { error: {\n\t\t\tname: errorArg.name,\n\t\t\tmessage: errorArg.message,\n\t\t\tstack: errorArg.stack\n\t\t} } : {},\n\t\t...extraArgs.length > 0 ? { args: extraArgs } : {}\n\t};\n}\n//#endregion\n//#region src/logger/index.ts\nconst RegisteredLogger = {\n\tAGENT: \"AGENT\",\n\tOBSERVABILITY: \"OBSERVABILITY\",\n\tAUTH: \"AUTH\",\n\tBROWSER: \"BROWSER\",\n\tNETWORK: \"NETWORK\",\n\tWORKFLOW: \"WORKFLOW\",\n\tLLM: \"LLM\",\n\tTTS: \"TTS\",\n\tVOICE: \"VOICE\",\n\tVECTOR: \"VECTOR\",\n\tBUNDLER: \"BUNDLER\",\n\tDEPLOYER: \"DEPLOYER\",\n\tMEMORY: \"MEMORY\",\n\tSTORAGE: \"STORAGE\",\n\tEMBEDDINGS: \"EMBEDDINGS\",\n\tMCP_SERVER: \"MCP_SERVER\",\n\tSERVER_CACHE: \"SERVER_CACHE\",\n\tSERVER: \"SERVER\",\n\tWORKSPACE: \"WORKSPACE\",\n\tCHANNEL: \"CHANNEL\"\n};\nconst LogLevel = {\n\tDEBUG: \"debug\",\n\tINFO: \"info\",\n\tWARN: \"warn\",\n\tERROR: \"error\",\n\tNONE: \"silent\"\n};\nvar LoggerTransport = class extends Transform {\n\tconstructor(opts = {}) {\n\t\tsuper({\n\t\t\t...opts,\n\t\t\tobjectMode: true\n\t\t});\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogs(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nconst createCustomTransport = (stream, listLogs, listLogsByRunId) => {\n\tlet transport = stream;\n\tif (listLogs) transport.listLogs = listLogs;\n\tif (listLogsByRunId) transport.listLogsByRunId = listLogsByRunId;\n\treturn transport;\n};\nvar MastraLogger = class {\n\tname;\n\tlevel;\n\ttransports;\n\tconstructor(options = {}) {\n\t\tthis.name = options.name || \"Mastra\";\n\t\tthis.level = options.level || LogLevel.ERROR;\n\t\tthis.transports = new Map(Object.entries(options.transports || {}));\n\t}\n\tgetTransports() {\n\t\treturn this.transports;\n\t}\n\ttrackException(_error, _metadata) {}\n\tasync listLogs(transportId, params) {\n\t\tif (!transportId || !this.transports.has(transportId)) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogs?.(params) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {\n\t\tif (!transportId || !this.transports.has(transportId) || !runId) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogsByRunId?.({\n\t\t\trunId,\n\t\t\tfromDate,\n\t\t\ttoDate,\n\t\t\tlogLevel,\n\t\t\tfilters,\n\t\t\tpage,\n\t\t\tperPage\n\t\t}) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nvar ConsoleLogger = class ConsoleLogger extends MastraLogger {\n\tcomponent;\n\tfilter;\n\t#adapterContext;\n\tconstructor(options = {}) {\n\t\tsuper(options);\n\t\tthis.component = options.component;\n\t\tthis.filter = options.filter;\n\t}\n\t/**\n\t* Adapter hook (see `AdaptableLogger`): enables native trace correlation\n\t* (trace_id/span_id appended to console output) and observability export\n\t* derived from the same record. Called by Mastra during setup.\n\t*/\n\t__attachObservability(ctx) {\n\t\tthis.#adapterContext = ctx;\n\t}\n\tchild(componentOrBindings) {\n\t\tconst component = typeof componentOrBindings === \"string\" ? componentOrBindings : componentOrBindings?.component ?? this.component;\n\t\tconst child = new ConsoleLogger({\n\t\t\tname: this.name,\n\t\t\tlevel: this.level,\n\t\t\tcomponent,\n\t\t\tfilter: this.filter\n\t\t});\n\t\tif (this.#adapterContext) child.__attachObservability(this.#adapterContext);\n\t\treturn child;\n\t}\n\t/**\n\t* Native-record correlation: when a span is active, append the trace\n\t* fields object to the console args so every destination sees them.\n\t*/\n\t#correlate(args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.correlation) return args;\n\t\ttry {\n\t\t\tconst fields = ctx.resolveTraceFields();\n\t\t\treturn fields ? [...args, fields] : args;\n\t\t} catch {\n\t\t\treturn args;\n\t\t}\n\t}\n\t/**\n\t* Export the record derived from the same native call to observability.\n\t* Mirrors DualLogger semantics: export is independent of the console\n\t* level filter, and never throws into the caller.\n\t*/\n\t#export(level, message, args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.export) return;\n\t\ttry {\n\t\t\tctx.getLogSink()?.[level](message, buildLogRecordData(args));\n\t\t} catch {}\n\t}\n\tshouldLog(level, message, args) {\n\t\tif (!this.filter) return true;\n\t\ttry {\n\t\t\treturn this.filter({\n\t\t\t\tcomponent: this.component,\n\t\t\t\tlevel,\n\t\t\t\tmessage,\n\t\t\t\targs\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tconsole.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n\t\t\treturn true;\n\t\t}\n\t}\n\tprefix() {\n\t\treturn this.component ? `[${this.component}] ` : \"\";\n\t}\n\tdebug(message, ...args) {\n\t\tif (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"debug\", message, args);\n\t}\n\tinfo(message, ...args) {\n\t\tif ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"info\", message, args);\n\t}\n\twarn(message, ...args) {\n\t\tif ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"warn\", message, args);\n\t}\n\terror(message, ...args) {\n\t\tif ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"error\", message, args);\n\t}\n\ttrackException(error, metadata) {\n\t\texportTrackedException(this.#adapterContext, error, metadata);\n\t}\n\tasync listLogs(_transportId, _params) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _params?.page ?? 1,\n\t\t\tperPage: _params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args.page ?? 1,\n\t\t\tperPage: _args.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\n//#endregion\nexport { ConsoleLogger, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, buildLogRecordData, createCustomTransport, exportTrackedException, isAdaptableLogger };\n\n//# sourceMappingURL=index.js.map","import { ConsoleLogger, RegisteredLogger } from \"../logger/index.js\";\n//#region src/base/MastraBase.ts\nvar MastraBase = class {\n\tcomponent = RegisteredLogger.LLM;\n\tlogger;\n\tname;\n\t#rawConfig;\n\tconstructor({ component, name, rawConfig }) {\n\t\tthis.component = component || RegisteredLogger.LLM;\n\t\tthis.name = name;\n\t\tthis.#rawConfig = rawConfig;\n\t\tthis.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n\t}\n\t/**\n\t* Returns the raw storage configuration this primitive was created from,\n\t* or undefined if it was created from code.\n\t*/\n\ttoRawConfig() {\n\t\treturn this.#rawConfig;\n\t}\n\t/**\n\t* Sets the raw storage configuration for this primitive.\n\t* @internal\n\t*/\n\t__setRawConfig(rawConfig) {\n\t\tthis.#rawConfig = rawConfig;\n\t}\n\t/**\n\t* Set the logger for the agent\n\t* @param logger\n\t*/\n\t__setLogger(logger) {\n\t\tthis.logger = \"child\" in logger && typeof logger.child === \"function\" ? logger.child({ component: this.component }) : logger;\n\t}\n};\n//#endregion\nexport { MastraBase };\n\n//# sourceMappingURL=index.js.map","import { getRequestHeader } from \"../types/index.js\";\nimport { MastraBase } from \"@internal/core/base\";\n//#region src/provider/index.ts\nvar MastraAuthProvider = class extends MastraBase {\n\tprotected;\n\tpublic;\n\tconstructor(options) {\n\t\tsuper({\n\t\t\tcomponent: \"AUTH\",\n\t\t\tname: options?.name\n\t\t});\n\t\tif (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);\n\t\tthis.protected = options?.protected;\n\t\tthis.public = options?.public;\n\t\tthis.mapUserToResourceId = options?.mapUserToResourceId;\n\t}\n\tregisterOptions(opts) {\n\t\tif (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);\n\t\tif (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;\n\t\tif (opts?.protected) this.protected = opts.protected;\n\t\tif (opts?.public) this.public = opts.public;\n\t}\n};\nfunction isSSOProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getLoginUrl === \"function\" && typeof p.handleCallback === \"function\";\n}\nfunction isSessionProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.validateSession === \"function\" && typeof p.createSession === \"function\";\n}\nfunction isUserProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getCurrentUser === \"function\";\n}\nfunction isCredentialsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.signIn === \"function\";\n}\nfunction isOrganizationsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.ensureOrganization === \"function\" && typeof p.isOrganizationAdmin === \"function\";\n}\nfunction isAuthHttpHandler(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.handleAuthRequest === \"function\";\n}\nfunction hasAuthInit(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.init === \"function\";\n}\nfunction isObjectLike(value) {\n\treturn typeof value === \"object\" && value !== null || typeof value === \"function\";\n}\nvar CompositeAuth = class CompositeAuth extends MastraAuthProvider {\n\tproviders;\n\tauthenticatedProviderByObject = /* @__PURE__ */ new WeakMap();\n\tauthenticatedProviderByPrimitive = /* @__PURE__ */ new Map();\n\tconstructor(providers) {\n\t\tconst combinedPublic = providers.flatMap((provider) => provider.public ?? []);\n\t\tconst combinedProtected = providers.flatMap((provider) => provider.protected ?? []);\n\t\tsuper({\n\t\t\tpublic: combinedPublic,\n\t\t\tprotected: combinedProtected\n\t\t});\n\t\tthis.providers = providers;\n\t\tif (providers.some((provider) => typeof provider.mapUserToResourceId === \"function\")) this.mapUserToResourceId = (user) => this.mapAuthenticatedUserToResourceId(user);\n\t\tif (!providers.some(isSSOProvider)) {\n\t\t\tthis.getLoginUrl = void 0;\n\t\t\tthis.handleCallback = void 0;\n\t\t\tthis.getLoginButtonConfig = void 0;\n\t\t}\n\t\tif (!providers.some(isSessionProvider)) {\n\t\t\tthis.createSession = void 0;\n\t\t\tthis.validateSession = void 0;\n\t\t\tthis.getSessionIdFromRequest = void 0;\n\t\t}\n\t\tif (!providers.some(isUserProvider)) {\n\t\t\tthis.getCurrentUser = void 0;\n\t\t\tthis.getUser = void 0;\n\t\t\tthis.getUsers = void 0;\n\t\t}\n\t\tconst credProvider = providers.find(isCredentialsProvider);\n\t\tif (credProvider) {\n\t\t\tthis.signIn = credProvider.signIn.bind(credProvider);\n\t\t\tif (typeof credProvider.signUp === \"function\") this.signUp = credProvider.signUp.bind(credProvider);\n\t\t\tif (typeof credProvider.requestPasswordReset === \"function\") this.requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n\t\t\tif (typeof credProvider.resetPassword === \"function\") this.resetPassword = credProvider.resetPassword.bind(credProvider);\n\t\t\tthis.isSignUpEnabled = typeof credProvider.isSignUpEnabled === \"function\" ? credProvider.isSignUpEnabled.bind(credProvider) : () => true;\n\t\t} else {\n\t\t\tthis.signIn = void 0;\n\t\t\tthis.signUp = void 0;\n\t\t\tthis.requestPasswordReset = void 0;\n\t\t\tthis.resetPassword = void 0;\n\t\t\tthis.isSignUpEnabled = void 0;\n\t\t}\n\t}\n\tfindProvider(check) {\n\t\treturn this.providers.find(check);\n\t}\n\trememberAuthenticatedProvider(user, provider) {\n\t\tif (isObjectLike(user)) {\n\t\t\tthis.authenticatedProviderByObject.set(user, provider);\n\t\t\treturn;\n\t\t}\n\t\tthis.authenticatedProviderByPrimitive.set(user, provider);\n\t}\n\ttakeAuthenticatedProvider(user) {\n\t\tif (isObjectLike(user)) {\n\t\t\tconst provider = this.authenticatedProviderByObject.get(user);\n\t\t\tthis.authenticatedProviderByObject.delete(user);\n\t\t\treturn provider;\n\t\t}\n\t\tconst primitiveUser = user;\n\t\tconst provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n\t\tthis.authenticatedProviderByPrimitive.delete(primitiveUser);\n\t\treturn provider;\n\t}\n\tmapAuthenticatedUserToResourceId(user) {\n\t\tconst provider = this.takeAuthenticatedProvider(user);\n\t\tif (typeof provider?.mapUserToResourceId !== \"function\") return;\n\t\tconst resourceId = provider.mapUserToResourceId(user);\n\t\tif (resourceId === void 0 && provider instanceof CompositeAuth) return;\n\t\tif (typeof resourceId !== \"string\" || !resourceId.trim()) throw new Error(\"mapUserToResourceId must return a non-empty string for the authenticated user\");\n\t\treturn resourceId;\n\t}\n\t/**\n\t* True if any provider is MastraCloudAuth (exempt from license requirement).\n\t*/\n\tget isMastraCloudAuth() {\n\t\treturn this.providers.some((p) => \"isMastraCloudAuth\" in p && p.isMastraCloudAuth === true);\n\t}\n\t/**\n\t* True if any provider is SimpleAuth (exempt from license requirement).\n\t*/\n\tget isSimpleAuth() {\n\t\treturn this.providers.some((p) => \"isSimpleAuth\" in p && p.isSimpleAuth === true);\n\t}\n\tasync authenticateToken(token, request) {\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst user = await provider.authenticateToken(token, request);\n\t\t\tif (user) {\n\t\t\t\tthis.rememberAuthenticatedProvider(user, provider);\n\t\t\t\treturn user;\n\t\t\t}\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tconsumePendingResponseHeaders(request) {\n\t\tlet merged;\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst pending = provider.consumePendingResponseHeaders?.(request);\n\t\t\tif (pending) merged = {\n\t\t\t\t...merged ?? {},\n\t\t\t\t...pending\n\t\t\t};\n\t\t} catch {}\n\t\treturn merged;\n\t}\n\tasync authorizeUser(user, request) {\n\t\tfor (const provider of this.providers) if (await provider.authorizeUser(user, request)) return true;\n\t\treturn false;\n\t}\n\t/**\n\t* Forward cookie header to SSO provider for PKCE validation.\n\t* Called by auth handler before handleCallback().\n\t*/\n\tsetCallbackCookieHeader(cookieHeader) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (sso && typeof sso.setCallbackCookieHeader === \"function\") sso.setCallbackCookieHeader(cookieHeader);\n\t}\n\tgetLoginUrl(redirectUri, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.getLoginUrl(redirectUri, state);\n\t}\n\tgetLoginCookies(redirectUri, state) {\n\t\treturn this.findProvider(isSSOProvider)?.getLoginCookies?.(redirectUri, state);\n\t}\n\tasync handleCallback(code, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.handleCallback(code, state);\n\t}\n\tgetLoginButtonConfig() {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) return {\n\t\t\tprovider: \"unknown\",\n\t\t\ttext: \"Sign in\"\n\t\t};\n\t\treturn sso.getLoginButtonConfig();\n\t}\n\tasync getLogoutUrl(redirectUri, request) {\n\t\tfor (const provider of this.providers) if (isSSOProvider(provider) && provider.getLogoutUrl) try {\n\t\t\tconst url = await provider.getLogoutUrl(redirectUri, request);\n\t\t\tif (url) return url;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync createSession(userId, metadata) {\n\t\tconst session = this.findProvider(isSessionProvider);\n\t\tif (!session) throw new Error(\"No session provider configured in CompositeAuth\");\n\t\treturn session.createSession(userId, metadata);\n\t}\n\tasync validateSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.validateSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync destroySession(sessionId) {\n\t\tconst destroyPromises = [];\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) destroyPromises.push(provider.destroySession(sessionId).catch(() => {}));\n\t\tawait Promise.all(destroyPromises);\n\t}\n\tasync refreshSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.refreshSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionIdFromRequest(request) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst sessionId = provider.getSessionIdFromRequest(request);\n\t\t\tif (sessionId) return sessionId;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionHeaders(session) {\n\t\treturn this.findProvider(isSessionProvider)?.getSessionHeaders(session) ?? {};\n\t}\n\tgetClearSessionHeaders() {\n\t\tconst headers = {};\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst providerHeaders = provider.getClearSessionHeaders();\n\t\t\tObject.assign(headers, providerHeaders);\n\t\t} catch {}\n\t\treturn headers;\n\t}\n\tasync getCurrentUser(request) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getCurrentUser(request);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUser(userId) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getUser(userId);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn Promise.all(userIds.map((userId) => this.getUser(userId)));\n\t}\n};\nconst DEFAULT_HEADERS = [\"Authorization\", \"X-Playground-Access\"];\nvar SimpleAuth = class extends MastraAuthProvider {\n\t/**\n\t* Marker to exempt SimpleAuth from EE license requirement.\n\t* SimpleAuth is for development/testing and should work without a license.\n\t*/\n\tisSimpleAuth = true;\n\ttokens;\n\theaders;\n\tusers;\n\tuserById;\n\tconstructor(options) {\n\t\tsuper(options);\n\t\tthis.tokens = options.tokens;\n\t\tthis.users = Object.values(this.tokens);\n\t\tthis.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n\t\tthis.userById = new Map(this.users.map((u) => [String(u?.id), u]));\n\t}\n\tasync authenticateToken(token, request) {\n\t\tconst requestTokens = this.getTokensFromHeaders(token, request);\n\t\tfor (const requestToken of requestTokens) {\n\t\t\tconst tokenToUser = this.tokens[requestToken];\n\t\t\tif (tokenToUser) return tokenToUser;\n\t\t}\n\t\treturn this.getUserFromCookie(getRequestHeader(request, \"Cookie\"));\n\t}\n\tasync authorizeUser(user, _request) {\n\t\treturn this.users.includes(user);\n\t}\n\t/** Get current user from request headers or cookie. */\n\tasync getCurrentUser(request) {\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = request.headers.get(headerName);\n\t\t\tif (headerValue) {\n\t\t\t\tconst token = this.stripBearerPrefix(headerValue);\n\t\t\t\tconst user = this.tokens[token];\n\t\t\t\tif (user) return user;\n\t\t\t}\n\t\t}\n\t\treturn this.getUserFromCookie(request.headers.get(\"Cookie\"));\n\t}\n\tgetUserFromCookie(cookieHeader) {\n\t\tif (!cookieHeader) return null;\n\t\tconst cookies = cookieHeader.split(\";\").map((c) => c.trim());\n\t\tfor (const cookie of cookies) if (cookie.startsWith(\"mastra-token=\")) {\n\t\t\tconst token = cookie.slice(13);\n\t\t\tconst user = this.tokens[token];\n\t\t\tif (user) return user;\n\t\t}\n\t\treturn null;\n\t}\n\t/** Get user by ID. */\n\tasync getUser(userId) {\n\t\treturn this.userById.get(userId) ?? null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn userIds.map((userId) => this.userById.get(userId) ?? null);\n\t}\n\t/**\n\t* Sign in with token (passed as password field).\n\t* The email field is ignored - only the token matters.\n\t*/\n\tasync signIn(_email, password, _request) {\n\t\tconst token = password;\n\t\tconst user = this.tokens[token];\n\t\tif (!user) throw new Error(\"Invalid token\");\n\t\treturn {\n\t\t\tuser,\n\t\t\ttoken,\n\t\t\tcookies: [`mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`]\n\t\t};\n\t}\n\tasync signUp() {\n\t\tthrow new Error(\"Sign up is not supported with SimpleAuth. Use pre-configured tokens.\");\n\t}\n\tisSignUpEnabled() {\n\t\treturn false;\n\t}\n\t/**\n\t* Get headers to clear the session cookie on logout.\n\t* Partial ISessionProvider implementation for logout support.\n\t*/\n\tgetClearSessionHeaders() {\n\t\treturn { \"Set-Cookie\": \"mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\" };\n\t}\n\tstripBearerPrefix(token) {\n\t\treturn token.startsWith(\"Bearer \") ? token.slice(7) : token;\n\t}\n\tgetTokensFromHeaders(token, request) {\n\t\tconst tokens = [token];\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = getRequestHeader(request, headerName);\n\t\t\tif (headerValue) tokens.push(this.stripBearerPrefix(headerValue));\n\t\t}\n\t\treturn tokens;\n\t}\n};\n//#endregion\nexport { CompositeAuth, MastraAuthProvider, SimpleAuth, hasAuthInit, isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider };\n\n//# sourceMappingURL=index.js.map","import type {\n AuthInitContext,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n IUserProvider,\n CredentialsResult,\n MastraAuthRequest,\n} from '@internal/auth';\nimport { getRequestHeader } from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { LibsqlDialect } from '@libsql/kysely-libsql';\n\nimport { betterAuth } from 'better-auth';\nimport type { Auth, BetterAuthOptions, Session, User } from 'better-auth';\nimport { makeSignature } from 'better-auth/crypto';\nimport { getMigrations } from 'better-auth/db/migration';\nimport { organization } from 'better-auth/plugins';\n\ntype BetterAuthContext = Awaited<Auth['$context']>;\n\nfunction tryDecode(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n /**\n * The better-auth session. `activeOrganizationId` comes from the\n * organization plugin (registered unconditionally by this provider); when\n * the stored session never had one set, `authenticateToken` resolves a\n * default from the user's existing memberships.\n */\n session: Session & { activeOrganizationId?: string | null };\n user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n return {\n id: user.id,\n email: user.email,\n name: user.name,\n avatarUrl: user.image ?? undefined,\n metadata: {\n emailVerified: user.emailVerified,\n createdAt: user.createdAt,\n updatedAt: user.updatedAt,\n },\n };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n /**\n * The Better Auth instance to use for authentication.\n * This should be the result of calling `betterAuth({ ... })`.\n *\n * Optional when `secret` is provided: the provider then builds its own\n * `betterAuth()` instance in `init()` on the host's auth database (deferred\n * instance mode) and owns its schema migrations.\n */\n auth?: Auth;\n\n /**\n * Secret used for session signing by the provider-built `betterAuth()`\n * instance (deferred instance mode). Ignored when `auth` is provided.\n */\n secret?: string;\n\n /**\n * Whether to allow new user registration via sign-up.\n * Set to false to disable public registration.\n * @default true\n */\n signUpEnabled?: boolean;\n}\n\n/** Loose row shapes read back from better-auth's internal DB adapter. */\n/**\n * How long a resolved `userId → orgId` mapping stays cached. Bounded so an\n * administrator revoking a membership takes effect on new sessions within a\n * minute, rather than persisting until process restart.\n */\nconst ORG_CACHE_TTL_MS = 60_000;\n\ninterface MemberRow {\n organizationId?: string;\n role?: string;\n userId?: string;\n}\ninterface OrganizationRow {\n id: string;\n}\n\n/**\n * Tagged auth-database handle shape hosts may pass as `AuthInitContext.database`\n * (e.g. the Mastra Code web factory's storage backends).\n */\ninterface TaggedAuthDatabase {\n dialect?: string;\n pool?: unknown;\n client?: unknown;\n database?: unknown;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n * database: {\n * provider: 'postgresql',\n * url: process.env.DATABASE_URL!,\n * },\n * emailAndPassword: {\n * enabled: true,\n * },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n * auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n * server: {\n * auth: mastraAuth,\n * },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n extends MastraAuthProvider<BetterAuthUser>\n implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>, IOrganizationsProvider, IAuthInit, IAuthHttpHandler\n{\n #auth: Auth | undefined;\n #secret: string | undefined;\n /** True when `init()` built the instance — then we also own its migrations. */\n #ownsInstance = false;\n /** Once-per-process migration latch; reset on failure so a later call retries. */\n #migrated: Promise<void> | undefined;\n /**\n * In-process `userId → orgId` cache, shared by `ensureOrganization` and the\n * `authenticateToken` default-org resolution. Only successes are cached, so\n * membership-less users re-run the lookup per request. Entries expire after\n * `ORG_CACHE_TTL_MS` so a membership revoked by an administrator stops being\n * injected into new sessions within the TTL window instead of persisting for\n * the process lifetime.\n */\n #orgCache = new Map<string, { orgId: string; expiresAt: number }>();\n\n #cachedOrgId(userId: string): string | undefined {\n const entry = this.#orgCache.get(userId);\n if (!entry) return undefined;\n if (Date.now() >= entry.expiresAt) {\n this.#orgCache.delete(userId);\n return undefined;\n }\n return entry.orgId;\n }\n\n /**\n * Cache a resolved `userId → orgId` mapping. The map is kept in expiry\n * order: writes delete-then-set so refreshed entries move to the back, and\n * since every entry uses the same TTL, iteration order is ascending\n * `expiresAt`. The sweep therefore stops at the first live entry, making\n * each write amortized O(1) instead of a full scan.\n */\n #storeOrgId(userId: string, orgId: string): void {\n const now = Date.now();\n for (const [key, entry] of this.#orgCache) {\n if (now < entry.expiresAt) break;\n this.#orgCache.delete(key);\n }\n this.#orgCache.delete(userId);\n this.#orgCache.set(userId, { orgId, expiresAt: now + ORG_CACHE_TTL_MS });\n }\n\n /** @internal Test hook: current org-cache cardinality. */\n get orgCacheSize(): number {\n return this.#orgCache.size;\n }\n /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */\n #crossSite = false;\n protected signUpEnabledConfig: boolean;\n\n constructor(options: MastraAuthBetterAuthOptions) {\n super({ name: options?.name ?? 'better-auth' });\n\n if (!options.auth && !options.secret) {\n throw new Error(\n 'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), ' +\n 'or provide `secret` so the provider can build its own instance in init() on the host database.',\n );\n }\n\n this.#auth = options.auth;\n this.#secret = options.secret;\n this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n this.registerOptions(options);\n }\n\n /**\n * The active Better Auth instance. Throws before `init()` in deferred\n * instance mode (constructed with `secret` instead of `auth`).\n */\n protected get auth(): Auth {\n if (!this.#auth) {\n throw new Error(\n 'MastraAuthBetterAuth is not initialized — init() must run first (or pass a configured `auth` instance).',\n );\n }\n return this.#auth;\n }\n\n /**\n * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller\n * override via `advanced.cookies.session_token.name`, and the `__Secure-`\n * prefix Better Auth applies when secure cookies are active.\n */\n get sessionCookieName(): string {\n const options = (this.#auth as { options?: { baseURL?: string; advanced?: Record<string, unknown> } } | undefined)\n ?.options;\n const advanced = options?.advanced as\n | {\n cookiePrefix?: string;\n useSecureCookies?: boolean;\n cookies?: { session_token?: { name?: string } };\n }\n | undefined;\n const prefix = advanced?.cookiePrefix ?? 'better-auth';\n const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith('https://') ?? false;\n const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;\n return `${secure ? '__Secure-' : ''}${baseName}`;\n }\n\n // ============================================\n // IAuthInit implementation\n // ============================================\n\n /**\n * One-time host initialization. In deferred instance mode (no `auth` in the\n * options) this builds the provider-owned `betterAuth()` instance on the\n * host's auth database; schema migrations then run lazily behind a\n * once-per-process latch on first use.\n *\n * Bring-your-own `auth` instances skip construction entirely — the caller\n * owns their database and migrations.\n */\n async init(ctx: AuthInitContext): Promise<void> {\n this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;\n if (this.#auth) return; // bring-your-own instance: nothing to build\n\n const authDb = ctx.database as TaggedAuthDatabase | undefined;\n if (!authDb) {\n throw new Error(\n 'MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. ' +\n 'Use a storage backend that exposes an auth database, or pass your own configured `auth` instance.',\n );\n }\n // Map the host's tagged auth-database handle onto better-auth's `database`\n // option: pg pool directly, libsql via its kysely dialect, anything else\n // passed through as-is (the host owns its compatibility).\n const database: BetterAuthOptions['database'] =\n authDb.dialect === 'postgres'\n ? (authDb.pool as Extract<BetterAuthOptions['database'], { query: unknown }>)\n : authDb.dialect === 'libsql'\n ? {\n dialect: new LibsqlDialect({ client: authDb.client } as ConstructorParameters<typeof LibsqlDialect>[0]),\n type: 'sqlite' as const,\n }\n : (authDb.database as BetterAuthOptions['database']);\n const allowedOrigins = ctx.allowedOrigins ?? [];\n // Widen to BetterAuthOptions before calling betterAuth(): its return type\n // is generic over the exact options object, which would make the instance\n // incompatible with the plain `Auth` alias we store.\n const options: BetterAuthOptions = {\n database,\n secret: this.#secret,\n // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,\n // where hosts mount handleAuthRequest.\n basePath: '/auth/api',\n ...(ctx.publicUrl ? { baseURL: ctx.publicUrl } : {}),\n // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the\n // cookie — better-auth still rejects requests from origins outside its\n // own allow-list, so the SPA origins must be trusted too.\n ...(allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {}),\n emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },\n plugins: [organization()],\n // Cross-origin SPA deploys need SameSite=None; Secure for the browser to\n // send the session cookie.\n ...(this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: 'none', secure: true } } } : {}),\n };\n this.#auth = betterAuth(options);\n this.#ownsInstance = true;\n }\n\n /**\n * Ensure better-auth's tables exist in the host database. Only for instances\n * this provider built — bring-your-own instances manage their own migrations.\n */\n async #ensureDbReady(): Promise<void> {\n if (!this.#ownsInstance) return;\n this.#migrated ??= (async () => {\n const { runMigrations } = await getMigrations(this.auth.options as BetterAuthOptions);\n await runMigrations();\n })();\n try {\n await this.#migrated;\n } catch (error) {\n this.#migrated = undefined; // allow a later call to retry\n console.warn('[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.');\n throw error;\n }\n }\n\n // ============================================\n // IAuthHttpHandler implementation\n // ============================================\n\n /**\n * Proxy a raw HTTP request to Better Auth's own API surface\n * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.\n */\n async handleAuthRequest(request: Request): Promise<Response> {\n try {\n await this.#ensureDbReady();\n } catch {\n return new Response(JSON.stringify({ error: 'auth_unavailable' }), {\n status: 503,\n headers: { 'content-type': 'application/json' },\n });\n }\n return this.auth.handler(request);\n }\n\n // ============================================\n // IOrganizationsProvider implementation\n // ============================================\n\n /**\n * Read-only half of org resolution: the user's oldest existing membership,\n * cached in `#orgCache`. Never creates anything. Ordered by `createdAt` so\n * the resolved default is stable across processes for multi-org users.\n */\n async #findMembershipOrgId(ctx: BetterAuthContext, userId: string): Promise<string | undefined> {\n const memberships = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'userId', value: userId }],\n sortBy: { field: 'createdAt', direction: 'asc' },\n })) as MemberRow[];\n const orgId = memberships.find(m => m.organizationId)?.organizationId;\n if (orgId) this.#storeOrgId(userId, orgId);\n return orgId;\n }\n\n /**\n * Resolve the organization a session should act under when better-auth's\n * `activeOrganizationId` was never set (nothing in this provider or a\n * default sign-in flow calls the organization plugin's `setActive`).\n * Read-only and best-effort: an existing membership or nothing.\n *\n * Callers must run `#ensureDbReady` first (authenticateToken does); this\n * method deliberately swallows failures, so an unmigrated DB would\n * otherwise fail silently.\n */\n async #resolveActiveOrganizationId(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n return await this.#findMembershipOrgId(ctx, userId);\n } catch {\n return undefined;\n }\n }\n\n /**\n * Ensure the user belongs to an organization, mirroring the WorkOS\n * personal-org bootstrap on better-auth's organization tables:\n * ≥1 membership → oldest org id; 0 → create a personal org with an\n * idempotent slug derived from the user id.\n *\n * Concurrent/retried first logins recover via the unique slug instead of\n * creating duplicates. Slug alone is NOT proof of ownership though: the\n * organization API is reachable by any authenticated user, so an attacker\n * could squat `personal-<victimId>`. The slug-matched org is only adopted\n * when nobody else is a member; otherwise a fresh org with an unguessable\n * slug is created instead.\n *\n * Best-effort: any failure is swallowed and leaves the user no-org.\n */\n async ensureOrganization(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n\n const firstExisting = await this.#findMembershipOrgId(ctx, userId);\n if (firstExisting) return firstExisting;\n\n // Build a predictable personal-org name from the user's profile.\n const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);\n const label = userRecord?.email ?? userRecord?.name ?? userId;\n const orgName = `${label}'s org`;\n const orgData = () => ({\n name: orgName,\n createdAt: new Date(),\n metadata: JSON.stringify({ mastraPersonalOrg: 'true' }),\n });\n\n // Create the personal org. The slug is derived from the user id, so a\n // concurrent/prior bootstrap that already created it makes the insert\n // reject on the unique slug — recover by looking the org up instead.\n const slug = `personal-${userId}`;\n let organizationId: string;\n try {\n const created = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug },\n })) as OrganizationRow;\n organizationId = created.id;\n } catch (error) {\n const existing = (await ctx.adapter.findOne({\n model: 'organization',\n where: [{ field: 'slug', value: slug }],\n })) as OrganizationRow | null;\n if (!existing) throw error;\n // Only adopt the slug-matched org when nobody else is a member (zero\n // members = a concurrent bootstrap of this same user that hasn't\n // attached yet). Otherwise fall back to an unguessable slug.\n const existingMembers = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'organizationId', value: existing.id }],\n })) as MemberRow[];\n const foreignMember = existingMembers.some(m => m.userId !== userId);\n if (foreignMember) {\n const fallback = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` },\n })) as OrganizationRow;\n organizationId = fallback.id;\n } else {\n organizationId = existing.id;\n }\n }\n\n // Idempotently attach the user: tolerate a membership a concurrent\n // bootstrap already created.\n try {\n await ctx.adapter.create({\n model: 'member',\n data: { organizationId, userId, role: 'owner', createdAt: new Date() },\n });\n } catch (error) {\n const member = await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n });\n if (!member) throw error;\n }\n\n this.#storeOrgId(userId, organizationId);\n return organizationId;\n } catch (error) {\n console.warn(\n `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. ` +\n 'The user will see organization_required until this succeeds.',\n error,\n );\n return undefined;\n }\n }\n\n /**\n * Whether the user holds an admin-equivalent role (`owner` or `admin`) in\n * the organization. Provider errors resolve to `false`.\n */\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return false;\n const membership = (await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n })) as MemberRow | null;\n return membership?.role === 'owner' || membership?.role === 'admin';\n } catch {\n return false;\n }\n }\n\n /**\n * Check if sign-up is enabled.\n * Implements ICredentialsProvider.isSignUpEnabled.\n */\n isSignUpEnabled(): boolean {\n return this.signUpEnabledConfig;\n }\n\n // ============================================\n // IUserProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Get current user from request.\n * Implements IUserProvider for EE user awareness in Studio.\n *\n * Supports both cookie-based sessions and `Authorization: Bearer <token>`\n * requests (e.g. API clients using the token returned by `signIn`).\n *\n * @param request - Incoming HTTP request\n * @returns EE User object or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<EEUser | null> {\n try {\n await this.#ensureDbReady();\n const headers = new Headers(request.headers);\n\n // If the request authenticates via Bearer token instead of cookies,\n // convert the token to a signed session cookie so getSession accepts it.\n const authHeader = headers.get('Authorization');\n const bearerToken =\n authHeader && authHeader.slice(0, 7).toLowerCase() === 'bearer ' ? authHeader.slice(7).trim() : undefined;\n await this.ensureSessionCookie(headers, bearerToken);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result?.user) return null;\n return mapBetterAuthUserToEEUser(result.user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Implements IUserProvider for EE user awareness.\n *\n * Uses Better Auth's internal adapter to look up the user record,\n * so it works with whichever database Better Auth is configured with.\n *\n * @param userId - User identifier\n * @returns EE User object or null if not found\n */\n async getUser(userId: string): Promise<EEUser | null> {\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return null;\n\n const user = await ctx.internalAdapter.findUserById(userId);\n if (!user) return null;\n return mapBetterAuthUserToEEUser(user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get multiple users by ID.\n * Optional IUserProvider method used for batch author enrichment.\n *\n * @param userIds - User identifiers\n * @returns EE User objects (null for missing users, order preserved)\n */\n async getUsers(userIds: string[]): Promise<Array<EEUser | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n\n /**\n * Get URL to user's profile page.\n * Optional IUserProvider method.\n */\n getUserProfileUrl(user: EEUser): string {\n return `/profile/${user.id}`;\n }\n\n /**\n * Get the resolved Better Auth context, or null when unavailable\n * (e.g. a partial mock without `$context`).\n */\n private async getAuthContext(): Promise<BetterAuthContext | null> {\n try {\n return (await Promise.resolve(this.auth.$context)) ?? null;\n } catch {\n return null;\n }\n }\n\n /**\n * Ensure the Cookie header on `headers` carries a Better Auth session cookie\n * for the given token.\n *\n * Better Auth's `getSession` reads the session from a *signed* cookie\n * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the\n * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens\n * are signed with the instance secret before being set as the session cookie.\n */\n private async ensureSessionCookie(headers: Headers, token: string | undefined): Promise<void> {\n if (!token) return;\n\n const ctx = await this.getAuthContext();\n const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;\n const secret = ctx?.secret;\n\n const cookieHeader = headers.get('Cookie');\n const hasSessionCookie = !!cookieHeader?.split(';').some(pair => {\n const [key] = pair.trim().split('=');\n return key?.trim() === cookieName;\n });\n if (hasSessionCookie) return;\n\n // Tokens containing \".\" are already signed (and may be URI-encoded).\n let cookieValue = token.includes('.') ? (token.includes('%') ? tryDecode(token) : token) : token;\n if (!token.includes('.') && secret) {\n cookieValue = `${token}.${await makeSignature(token, secret)}`;\n }\n\n const existingCookies = cookieHeader ? `${cookieHeader}; ` : '';\n headers.set('Cookie', `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);\n }\n\n /**\n * Authenticate a bearer token by verifying the session with Better Auth.\n *\n * This method extracts the session from the request headers using\n * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —\n * as returned by `signIn`/`signUp` — are signed before being passed to\n * Better Auth as a session cookie, matching the bearer plugin's semantics.\n *\n * @param token - The bearer token (session token) to authenticate\n * @param request - The request containing headers\n * @returns The authenticated user and session, or null if authentication fails\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<BetterAuthUser | null> {\n try {\n await this.#ensureDbReady();\n\n // Better Auth's api.getSession() reads session tokens from the Cookie header\n const headers = new Headers();\n\n const cookieHeader = getRequestHeader(request, 'Cookie');\n if (cookieHeader) {\n headers.set('Cookie', cookieHeader);\n }\n\n // Convert Bearer token to a signed session cookie if not already present.\n // better-auth ignores the Authorization header — it only reads from Cookie.\n await this.ensureSessionCookie(headers, token);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result || !result.session || !result.user) {\n return null;\n }\n\n // Better-auth never populates `activeOrganizationId` unless the host app\n // wires the organization plugin's `setActive` itself, which leaves every\n // org-scoped consumer with a user that has no organization. Resolve a\n // default from the user's existing memberships (read-only; the session\n // row is not mutated). See mastra-ai/mastra#21481.\n let session: BetterAuthUser['session'] = result.session;\n if (!session.activeOrganizationId) {\n const organizationId = await this.#resolveActiveOrganizationId(result.user.id);\n if (organizationId) session = { ...session, activeOrganizationId: organizationId };\n }\n\n return {\n session,\n user: result.user,\n };\n } catch {\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * By default, any authenticated user with a valid session is authorized.\n * You can override this behavior by providing a custom `authorizeUser` function\n * in the constructor options.\n *\n * @param user - The authenticated user and session\n * @returns True if the user is authorized, false otherwise\n */\n async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n // By default, any authenticated user with a valid session is authorized\n return !!user?.session?.id && !!user?.user?.id;\n }\n\n // ============================================\n // ICredentialsProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Sign in with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param request - Incoming HTTP request\n * @returns Result with user and session cookies\n * @throws Error if credentials are invalid\n */\n async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signInEmail({\n body: { email, password },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Invalid email or password');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Invalid email or password');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Sign up with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param name - Optional display name\n * @param request - Incoming HTTP request\n * @returns Result with new user and session cookies\n * @throws Error if sign up fails\n */\n async signUp(\n email: string,\n password: string,\n name: string | undefined,\n request: Request,\n ): Promise<CredentialsResult<EEUser>> {\n const displayName = name ?? email.split('@')[0] ?? 'User';\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signUpEmail({\n body: { email, password, name: displayName },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Failed to create account');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Failed to create account');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Get the underlying Better Auth instance.\n * Useful for accessing Better Auth APIs directly.\n */\n getAuth(): Auth {\n return this.auth;\n }\n\n /**\n * Get headers to clear the session cookies on logout.\n * Partial ISessionProvider implementation for logout support.\n *\n * Clears Better Auth's default session cookies.\n */\n getClearSessionHeaders(): Record<string, string> {\n // Cross-site deploys set the session cookie with SameSite=None; Secure —\n // the clearing cookie must match those attributes to overwrite it.\n const sameSite = this.#crossSite ? 'None; Secure' : 'Lax';\n // Clear both the session token and its signature cookie\n const cookies = [\n `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n ];\n return {\n 'Set-Cookie': cookies.join(', '),\n };\n }\n}\n"],"mappings":";;;;;;AACA,SAAS,sBAAsB,SAAS,MAAM;CAC7C,MAAM,iBAAiB,KAAK,YAAY;CACxC,MAAM,cAAc,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,MAAM,cAAc;CAC3F,MAAM,QAAQ,gBAAgB,KAAK,IAAI,KAAK,IAAI,QAAQ;CACxD,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,OAAO,SAAS;AAC3D;;;;;AAKA,SAAS,iBAAiB,SAAS,MAAM;CACxC,IAAI,mBAAmB,SAAS,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAC/D,IAAI,QAAQ,eAAe,SAAS,OAAO,QAAQ,IAAI,QAAQ,IAAI,IAAI;CACvE,MAAM,UAAU,QAAQ;CACxB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI;CACvD,IAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,OAAO,IAAI,KAAK;CACzE,IAAI,WAAW,OAAO,YAAY,UAAU,OAAO,sBAAsB,SAAS,IAAI;CACtF,OAAO;AACR;;;;;;;;ACTA,SAAS,uBAAuB,KAAK,OAAO,UAAU;CACrD,IAAI,CAAC,KAAK,QAAQ,QAAQ;CAC1B,IAAI;EACH,MAAM,cAAc;EACpB,IAAI,WAAW,CAAC,EAAE,MAAM,MAAM,SAAS;GACtC,GAAG,YAAY,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY,GAAG,IAAI,CAAC;GAC9D,GAAG,YAAY,WAAW,KAAK,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;GACrE,GAAG,YAAY,aAAa,KAAK,IAAI,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;GAC3E,GAAG,YAAY,YAAY,KAAK,IAAI,EAAE,SAAS,YAAY,QAAQ,IAAI,CAAC;GACxE,GAAG,MAAM,iBAAiB,QAAQ,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,CAAC;GACpE,GAAG;EACJ,CAAC;CACF,QAAQ,CAAC;AACV;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,MAAM,aAAa,KAAK,MAAM,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,MAAM;CAC/H,MAAM,WAAW,KAAK,MAAM,QAAQ,eAAe,KAAK;CACxD,MAAM,YAAY,KAAK,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,QAAQ;CAC7E,IAAI,CAAC,cAAc,CAAC,YAAY,UAAU,WAAW,GAAG,OAAO,KAAK;CACpE,OAAO;EACN,GAAG,cAAc,CAAC;EAClB,GAAG,WAAW,EAAE,OAAO;GACtB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,OAAO,SAAS;EACjB,EAAE,IAAI,CAAC;EACP,GAAG,UAAU,SAAS,IAAI,EAAE,MAAM,UAAU,IAAI,CAAC;CAClD;AACD;AAGA,MAAM,mBAAmB;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACT,SAAS;CACT,UAAU;CACV,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,cAAc;CACd,QAAQ;CACR,WAAW;CACX,SAAS;AACV;AACA,MAAM,WAAW;CAChB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,MAAM;AACP;AAiCA,IAAI,eAAe,MAAM;CACxB;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,QAAQ,QAAQ,SAAS,SAAS;EACvC,KAAK,aAAa,IAAI,IAAI,OAAO,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAAC;CACnE;CACA,gBAAgB;EACf,OAAO,KAAK;CACb;CACA,eAAe,QAAQ,WAAW,CAAC;CACnC,MAAM,SAAS,aAAa,QAAQ;EACnC,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,GAAG,OAAO;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,WAAW,MAAM,KAAK;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,EAAE,aAAa,OAAO,UAAU,QAAQ,UAAU,SAAS,MAAM,WAAW;EACjG,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,OAAO,OAAO;GACvE,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,kBAAkB;GACzD;GACA;GACA;GACA;GACA;GACA;GACA;EACD,CAAC,KAAK;GACL,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;CACD;AACD;AACA,IAAI,gBAAgB,MAAM,sBAAsB,aAAa;CAC5D;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,MAAM,OAAO;EACb,KAAK,YAAY,QAAQ;EACzB,KAAK,SAAS,QAAQ;CACvB;;;;;;CAMA,sBAAsB,KAAK;EAC1B,KAAKA,kBAAkB;CACxB;CACA,MAAM,qBAAqB;EAC1B,MAAM,YAAY,OAAO,wBAAwB,WAAW,sBAAsB,qBAAqB,aAAa,KAAK;EACzH,MAAM,QAAQ,IAAI,cAAc;GAC/B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ;GACA,QAAQ,KAAK;EACd,CAAC;EACD,IAAI,KAAKA,iBAAiB,MAAM,sBAAsB,KAAKA,eAAe;EAC1E,OAAO;CACR;;;;;CAKA,WAAW,MAAM;EAChB,MAAM,MAAM,KAAKA;EACjB,IAAI,CAAC,KAAK,QAAQ,aAAa,OAAO;EACtC,IAAI;GACH,MAAM,SAAS,IAAI,mBAAmB;GACtC,OAAO,SAAS,CAAC,GAAG,MAAM,MAAM,IAAI;EACrC,QAAQ;GACP,OAAO;EACR;CACD;;;;;;CAMA,QAAQ,OAAO,SAAS,MAAM;EAC7B,MAAM,MAAM,KAAKA;EACjB,IAAI,CAAC,KAAK,QAAQ,QAAQ;EAC1B,IAAI;GACH,IAAI,WAAW,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;EAC5D,QAAQ,CAAC;CACV;CACA,UAAU,OAAO,SAAS,MAAM;EAC/B,IAAI,CAAC,KAAK,QAAQ,OAAO;EACzB,IAAI;GACH,OAAO,KAAK,OAAO;IAClB,WAAW,KAAK;IAChB;IACA;IACA;GACD,CAAC;EACF,SAAS,GAAG;GACX,QAAQ,MAAM,uCAAuC,KAAK,UAAU,SAAS,MAAM,IAAI,CAAC;GACxF,OAAO;EACR;CACD;CACA,SAAS;EACR,OAAO,KAAK,YAAY,IAAI,KAAK,UAAU,MAAM;CAClD;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,IAAI,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKC,WAAW,IAAI,CAAC;EACvJ,KAAKC,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKD,WAAW,IAAI,CAAC;EACxL,KAAKC,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKD,WAAW,IAAI,CAAC;EACxN,KAAKC,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,KAAK,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAKD,WAAW,IAAI,CAAC;EAC3P,KAAKC,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,eAAe,OAAO,UAAU;EAC/B,uBAAuB,KAAKF,iBAAiB,OAAO,QAAQ;CAC7D;CACA,MAAM,SAAS,cAAc,SAAS;EACrC,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,SAAS,QAAQ;GACvB,SAAS,SAAS,WAAW;GAC7B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,OAAO;EAC5B,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,MAAM,QAAQ;GACpB,SAAS,MAAM,WAAW;GAC1B,SAAS;EACV;CACD;AACD;;;AC5QA,IAAI,aAAa,MAAM;CACtB,YAAY,iBAAiB;CAC7B;CACA;CACA;CACA,YAAY,EAAE,WAAW,MAAM,aAAa;EAC3C,KAAK,YAAY,aAAa,iBAAiB;EAC/C,KAAK,OAAO;EACZ,KAAKG,aAAa;EAClB,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC;CAC7E;;;;;CAKA,cAAc;EACb,OAAO,KAAKA;CACb;;;;;CAKA,eAAe,WAAW;EACzB,KAAKA,aAAa;CACnB;;;;;CAKA,YAAY,QAAQ;EACnB,KAAK,SAAS,WAAW,UAAU,OAAO,OAAO,UAAU,aAAa,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI;CACvH;AACD;;;AC/BA,IAAI,qBAAqB,cAAc,WAAW;CACjD;CACA;CACA,YAAY,SAAS;EACpB,MAAM;GACL,WAAW;GACX,MAAM,SAAS;EAChB,CAAC;EACD,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ,cAAc,KAAK,IAAI;EAChF,KAAK,YAAY,SAAS;EAC1B,KAAK,SAAS,SAAS;EACvB,KAAK,sBAAsB,SAAS;CACrC;CACA,gBAAgB,MAAM;EACrB,IAAI,MAAM,eAAe,KAAK,gBAAgB,KAAK,cAAc,KAAK,IAAI;EAC1E,IAAI,MAAM,qBAAqB,KAAK,sBAAsB,KAAK;EAC/D,IAAI,MAAM,WAAW,KAAK,YAAY,KAAK;EAC3C,IAAI,MAAM,QAAQ,KAAK,SAAS,KAAK;CACtC;AACD;;;ACEA,SAAS,UAAU,OAAuB;CACxC,IAAI;EACF,OAAO,mBAAmB,KAAK;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;;;AAoBA,SAAS,0BAA0B,MAAoB;CACrD,OAAO;EACL,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,WAAW,KAAK,SAAS,KAAA;EACzB,UAAU;GACR,eAAe,KAAK;GACpB,WAAW,KAAK;GAChB,WAAW,KAAK;EAClB;CACF;AACF;;;;;;;AAiCA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DzB,IAAa,uBAAb,cACU,mBAEV;CACE;CACA;;CAEA,gBAAgB;;CAEhB;;;;;;;;;CASA,4BAAY,IAAI,IAAkD;CAElE,aAAa,QAAoC;EAC/C,MAAM,QAAQ,KAAKC,UAAU,IAAI,MAAM;EACvC,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,IAAI,KAAK,IAAI,KAAK,MAAM,WAAW;GACjC,KAAKA,UAAU,OAAO,MAAM;GAC5B;EACF;EACA,OAAO,MAAM;CACf;;;;;;;;CASA,YAAY,QAAgB,OAAqB;EAC/C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,CAAC,KAAK,UAAU,KAAKA,WAAW;GACzC,IAAI,MAAM,MAAM,WAAW;GAC3B,KAAKA,UAAU,OAAO,GAAG;EAC3B;EACA,KAAKA,UAAU,OAAO,MAAM;EAC5B,KAAKA,UAAU,IAAI,QAAQ;GAAE;GAAO,WAAW,MAAM;EAAiB,CAAC;CACzE;;CAGA,IAAI,eAAuB;EACzB,OAAO,KAAKA,UAAU;CACxB;;CAEA,aAAa;CACb;CAEA,YAAY,SAAsC;EAChD,MAAM,EAAE,MAAM,SAAS,QAAQ,cAAc,CAAC;EAE9C,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,MACR,iOAEF;EAGF,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,UAAU,QAAQ;EACvB,KAAK,sBAAsB,QAAQ,iBAAiB;EAEpD,KAAK,gBAAgB,OAAO;CAC9B;;;;;CAMA,IAAc,OAAa;EACzB,IAAI,CAAC,KAAKD,OACR,MAAM,IAAI,MACR,yGACF;EAEF,OAAO,KAAKA;CACd;;;;;;CAOA,IAAI,oBAA4B;EAC9B,MAAM,UAAW,KAAKA,OAClB;EACJ,MAAM,WAAW,SAAS;EAO1B,MAAM,SAAS,UAAU,gBAAgB;EACzC,MAAM,SAAS,UAAU,oBAAoB,SAAS,SAAS,WAAW,UAAU,KAAK;EACzF,MAAM,WAAW,UAAU,SAAS,eAAe,QAAQ,GAAG,OAAO;EACrE,OAAO,GAAG,SAAS,cAAc,KAAK;CACxC;;;;;;;;;;CAeA,MAAM,KAAK,KAAqC;EAC9C,KAAKE,cAAc,IAAI,gBAAgB,UAAU,KAAK;EACtD,IAAI,KAAKF,OAAO;EAEhB,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,QACH,MAAM,IAAI,MACR,0MAEF;EAKF,MAAM,WACJ,OAAO,YAAY,aACd,OAAO,OACR,OAAO,YAAY,WACjB;GACE,SAAS,IAAI,cAAc,EAAE,QAAQ,OAAO,OAAO,CAAmD;GACtG,MAAM;EACR,IACC,OAAO;EAChB,MAAM,iBAAiB,IAAI,kBAAkB,CAAC;EAI9C,MAAM,UAA6B;GACjC;GACA,QAAQ,KAAKC;GAGb,UAAU;GACV,GAAI,IAAI,YAAY,EAAE,SAAS,IAAI,UAAU,IAAI,CAAC;GAIlD,GAAI,eAAe,SAAS,EAAE,gBAAgB,eAAe,IAAI,CAAC;GAClE,kBAAkB;IAAE,SAAS;IAAM,eAAe,CAAC,KAAK;GAAoB;GAC5E,SAAS,CAAC,aAAa,CAAC;GAGxB,GAAI,KAAKC,aAAa,EAAE,UAAU,EAAE,yBAAyB;IAAE,UAAU;IAAQ,QAAQ;GAAK,EAAE,EAAE,IAAI,CAAC;EACzG;EACA,KAAKF,QAAQ,WAAW,OAAO;EAC/B,KAAKG,gBAAgB;CACvB;;;;;CAMA,MAAMC,iBAAgC;EACpC,IAAI,CAAC,KAAKD,eAAe;EACzB,KAAKE,eAAe,YAAY;GAC9B,MAAM,EAAE,kBAAkB,MAAM,cAAc,KAAK,KAAK,OAA4B;GACpF,MAAM,cAAc;EACtB,EAAA,CAAG;EACH,IAAI;GACF,MAAM,KAAKA;EACb,SAAS,OAAO;GACd,KAAKA,YAAY,KAAA;GACjB,QAAQ,KAAK,gGAAgG;GAC7G,MAAM;EACR;CACF;;;;;CAUA,MAAM,kBAAkB,SAAqC;EAC3D,IAAI;GACF,MAAM,KAAKD,eAAe;EAC5B,QAAQ;GACN,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,mBAAmB,CAAC,GAAG;IACjE,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;GAChD,CAAC;EACH;EACA,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;;;;;;CAWA,MAAME,qBAAqB,KAAwB,QAA6C;EAM9F,MAAM,SAAQ,MALa,IAAI,QAAQ,SAAS;GAC9C,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAU,OAAO;GAAO,CAAC;GAC1C,QAAQ;IAAE,OAAO;IAAa,WAAW;GAAM;EACjD,CAAC,EAAA,CACyB,MAAK,MAAK,EAAE,cAAc,CAAC,EAAE;EACvD,IAAI,OAAO,KAAKC,YAAY,QAAQ,KAAK;EACzC,OAAO;CACT;;;;;;;;;;;CAYA,MAAMC,6BAA6B,QAA6C;EAC9E,MAAM,SAAS,KAAKC,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EACnB,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GACjB,OAAO,MAAM,KAAKH,qBAAqB,KAAK,MAAM;EACpD,QAAQ;GACN;EACF;CACF;;;;;;;;;;;;;;;;CAiBA,MAAM,mBAAmB,QAA6C;EACpE,MAAM,SAAS,KAAKG,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EAEnB,IAAI;GACF,MAAM,KAAKL,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GAEjB,MAAM,gBAAgB,MAAM,KAAKE,qBAAqB,KAAK,MAAM;GACjE,IAAI,eAAe,OAAO;GAG1B,MAAM,aAAa,MAAM,IAAI,gBAAgB,aAAa,MAAM,CAAC,CAAC,YAAY,IAAI;GAElF,MAAM,UAAU,GADF,YAAY,SAAS,YAAY,QAAQ,OAC9B;GACzB,MAAM,iBAAiB;IACrB,MAAM;IACN,2BAAW,IAAI,KAAK;IACpB,UAAU,KAAK,UAAU,EAAE,mBAAmB,OAAO,CAAC;GACxD;GAKA,MAAM,OAAO,YAAY;GACzB,IAAI;GACJ,IAAI;IAKF,kBAAiB,MAJM,IAAI,QAAQ,OAAO;KACxC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG;KAAK;IAC7B,CAAC,EAAA,CACwB;GAC3B,SAAS,OAAO;IACd,MAAM,WAAY,MAAM,IAAI,QAAQ,QAAQ;KAC1C,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAQ,OAAO;KAAK,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,UAAU,MAAM;IASrB,KADsB,MAJS,IAAI,QAAQ,SAAS;KAClD,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAkB,OAAO,SAAS;KAAG,CAAC;IACzD,CAAC,EAAA,CACqC,MAAK,MAAK,EAAE,WAAW,MAC7C,GAKd,kBAAiB,MAJO,IAAI,QAAQ,OAAO;KACzC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG,MAAM,YAAY,OAAO,GAAG,OAAO,WAAW;KAAI;IAC1E,CAAC,EAAA,CACyB;SAE1B,iBAAiB,SAAS;GAE9B;GAIA,IAAI;IACF,MAAM,IAAI,QAAQ,OAAO;KACvB,OAAO;KACP,MAAM;MAAE;MAAgB;MAAQ,MAAM;MAAS,2BAAW,IAAI,KAAK;KAAE;IACvE,CAAC;GACH,SAAS,OAAO;IAQd,IAAI,CAAC,MAPgB,IAAI,QAAQ,QAAQ;KACvC,OAAO;KACP,OAAO,CACL;MAAE,OAAO;MAAkB,OAAO;KAAe,GACjD;MAAE,OAAO;MAAU,OAAO;KAAO,CACnC;IACF,CAAC,GACY,MAAM;GACrB;GAEA,KAAKC,YAAY,QAAQ,cAAc;GACvC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,mEAAmE,OAAO,iEAE1E,KACF;GACA;EACF;CACF;;;;;CAMA,MAAM,oBAAoB,gBAAwB,QAAkC;EAClF,IAAI;GACF,MAAM,KAAKH,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GACjB,MAAM,aAAc,MAAM,IAAI,QAAQ,QAAQ;IAC5C,OAAO;IACP,OAAO,CACL;KAAE,OAAO;KAAkB,OAAO;IAAe,GACjD;KAAE,OAAO;KAAU,OAAO;IAAO,CACnC;GACF,CAAC;GACD,OAAO,YAAY,SAAS,WAAW,YAAY,SAAS;EAC9D,QAAQ;GACN,OAAO;EACT;CACF;;;;;CAMA,kBAA2B;EACzB,OAAO,KAAK;CACd;;;;;;;;;;;CAiBA,MAAM,eAAe,SAA0C;EAC7D,IAAI;GACF,MAAM,KAAKA,eAAe;GAC1B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAI3C,MAAM,aAAa,QAAQ,IAAI,eAAe;GAC9C,MAAM,cACJ,cAAc,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,MAAM,YAAY,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,KAAA;GAClG,MAAM,KAAK,oBAAoB,SAAS,WAAW;GAEnD,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,QAAQ,MAAM,OAAO;GAC1B,OAAO,0BAA0B,OAAO,IAAI;EAC9C,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,QAAQ,QAAwC;EACpD,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GAEjB,MAAM,OAAO,MAAM,IAAI,gBAAgB,aAAa,MAAM;GAC1D,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,0BAA0B,IAAI;EACvC,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;CASA,MAAM,SAAS,SAAkD;EAC/D,OAAO,QAAQ,IAAI,QAAQ,KAAI,WAAU,KAAK,QAAQ,MAAM,CAAC,CAAC;CAChE;;;;;CAMA,kBAAkB,MAAsB;EACtC,OAAO,YAAY,KAAK;CAC1B;;;;;CAMA,MAAc,iBAAoD;EAChE,IAAI;GACF,OAAQ,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,KAAM;EACxD,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;CAWA,MAAc,oBAAoB,SAAkB,OAA0C;EAC5F,IAAI,CAAC,OAAO;EAEZ,MAAM,MAAM,MAAM,KAAK,eAAe;EACtC,MAAM,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK;EAC9D,MAAM,SAAS,KAAK;EAEpB,MAAM,eAAe,QAAQ,IAAI,QAAQ;EAKzC,IAAI,CAJsB,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,MAAK,SAAQ;GAC/D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG;GACnC,OAAO,KAAK,KAAK,MAAM;EACzB,CAAC,GACqB;EAGtB,IAAI,cAAc,MAAM,SAAS,GAAG,IAAK,MAAM,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI,QAAS;EAC3F,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,QAC1B,cAAc,GAAG,MAAM,GAAG,MAAM,cAAc,OAAO,MAAM;EAG7D,MAAM,kBAAkB,eAAe,GAAG,aAAa,MAAM;EAC7D,QAAQ,IAAI,UAAU,GAAG,kBAAkB,WAAW,GAAG,mBAAmB,WAAW,GAAG;CAC5F;;;;;;;;;;;;;CAcA,MAAM,kBAAkB,OAAe,SAA4D;EACjG,IAAI;GACF,MAAM,KAAKA,eAAe;GAG1B,MAAM,UAAU,IAAI,QAAQ;GAE5B,MAAM,eAAe,iBAAiB,SAAS,QAAQ;GACvD,IAAI,cACF,QAAQ,IAAI,UAAU,YAAY;GAKpC,MAAM,KAAK,oBAAoB,SAAS,KAAK;GAE7C,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,OAAO,MACxC,OAAO;GAQT,IAAI,UAAqC,OAAO;GAChD,IAAI,CAAC,QAAQ,sBAAsB;IACjC,MAAM,iBAAiB,MAAM,KAAKI,6BAA6B,OAAO,KAAK,EAAE;IAC7E,IAAI,gBAAgB,UAAU;KAAE,GAAG;KAAS,sBAAsB;IAAe;GACnF;GAEA,OAAO;IACL;IACA,MAAM,OAAO;GACf;EACF,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,cAAc,MAAwC;EAE1D,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;CAC9C;;;;;;;;;;;CAiBA,MAAM,OAAO,OAAe,UAAkB,SAAsD;EAClG,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;GAAS;GACxB;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,2BAA2B;EAClE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,2BAA2B;EAI7C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;;;;;;;;CAaA,MAAM,OACJ,OACA,UACA,MACA,SACoC;EACpC,MAAM,cAAc,QAAQ,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;EACnD,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;IAAU,MAAM;GAAY;GAC3C;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,0BAA0B;EACjE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,0BAA0B;EAI5C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;CAMA,UAAgB;EACd,OAAO,KAAK;CACd;;;;;;;CAQA,yBAAiD;EAG/C,MAAM,WAAW,KAAKN,aAAa,iBAAiB;EAMpD,OAAO,EACL,cAAc,CAJd,GAAG,KAAK,kBAAkB,gCAAgC,SAAS,cACnE,GAAG,KAAK,kBAAkB,oCAAoC,SAAS,YAGnD,CAAC,CAAC,KAAK,IAAI,EACjC;CACF;AACF"}
1
+ {"version":3,"file":"index.js","names":[],"sources":["../../../packages/_internals/auth/dist/types/index.js","../../../packages/_internal-core/dist/logger/index.js","../../../packages/_internal-core/dist/base/index.js","../../../packages/_internals/auth/dist/provider/index.js","../src/index.ts"],"sourcesContent":["//#region src/types/index.ts\nfunction headerFromPlainObject(headers, name) {\n\tconst normalizedName = name.toLowerCase();\n\tconst matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);\n\tconst value = matchingKey === void 0 ? void 0 : headers[matchingKey];\n\treturn Array.isArray(value) ? value[0] ?? null : value ?? null;\n}\n/**\n* Read a request header across fetch, Hono, and Express-style request shapes.\n* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).\n*/\nfunction getRequestHeader(request, name) {\n\tif (request instanceof Request) return request.headers.get(name);\n\tif (request.raw instanceof Request) return request.raw.headers.get(name);\n\tconst headers = request.headers;\n\tif (headers instanceof Headers) return headers.get(name);\n\tif (typeof request.header === \"function\") return request.header(name) ?? null;\n\tif (headers && typeof headers === \"object\") return headerFromPlainObject(headers, name);\n\treturn null;\n}\nfunction getWebRequest(request) {\n\tif (request instanceof Request) return request;\n\treturn request.raw instanceof Request ? request.raw : void 0;\n}\n//#endregion\nexport { getRequestHeader, getWebRequest };\n\n//# sourceMappingURL=index.js.map","import { Transform } from \"stream\";\n//#region src/logger/adapter.ts\nfunction isAdaptableLogger(logger) {\n\treturn typeof logger.__attachObservability === \"function\";\n}\n/**\n* Export a tracked exception through the adapter sink, mirroring the\n* DualLogger dual-write shape (`errorId`/`domain`/`category`/`details`/`cause`\n* when present on a MastraError-like value). Never throws into the caller.\n*/\nfunction exportTrackedException(ctx, error, metadata) {\n\tif (!ctx?.options.export) return;\n\ttry {\n\t\tconst mastraError = error;\n\t\tctx.getLogSink()?.error(error.message, {\n\t\t\t...mastraError.id !== void 0 ? { errorId: mastraError.id } : {},\n\t\t\t...mastraError.domain !== void 0 ? { domain: mastraError.domain } : {},\n\t\t\t...mastraError.category !== void 0 ? { category: mastraError.category } : {},\n\t\t\t...mastraError.details !== void 0 ? { details: mastraError.details } : {},\n\t\t\t...error.cause instanceof Error ? { cause: error.cause.message } : {},\n\t\t\t...metadata\n\t\t});\n\t} catch {}\n}\n/**\n* Adapt IMastraLogger's variadic args into the structured `data` payload of\n* an exported log record. Extracts the first plain object as data,\n* serializes an Error arg, and collects remaining primitives under `args`\n* so the derived record preserves all context from the native call.\n*/\nfunction buildLogRecordData(args) {\n\tconst objectData = args.find((arg) => arg !== null && typeof arg === \"object\" && !Array.isArray(arg) && !(arg instanceof Error));\n\tconst errorArg = args.find((arg) => arg instanceof Error);\n\tconst extraArgs = args.filter((arg) => arg !== objectData && arg !== errorArg);\n\tif (!objectData && !errorArg && extraArgs.length === 0) return void 0;\n\treturn {\n\t\t...objectData ?? {},\n\t\t...errorArg ? { error: {\n\t\t\tname: errorArg.name,\n\t\t\tmessage: errorArg.message,\n\t\t\tstack: errorArg.stack\n\t\t} } : {},\n\t\t...extraArgs.length > 0 ? { args: extraArgs } : {}\n\t};\n}\n//#endregion\n//#region src/logger/index.ts\nconst RegisteredLogger = {\n\tAGENT: \"AGENT\",\n\tOBSERVABILITY: \"OBSERVABILITY\",\n\tAUTH: \"AUTH\",\n\tBROWSER: \"BROWSER\",\n\tNETWORK: \"NETWORK\",\n\tWORKFLOW: \"WORKFLOW\",\n\tLLM: \"LLM\",\n\tTTS: \"TTS\",\n\tVOICE: \"VOICE\",\n\tVECTOR: \"VECTOR\",\n\tBUNDLER: \"BUNDLER\",\n\tDEPLOYER: \"DEPLOYER\",\n\tMEMORY: \"MEMORY\",\n\tSTORAGE: \"STORAGE\",\n\tEMBEDDINGS: \"EMBEDDINGS\",\n\tMCP_SERVER: \"MCP_SERVER\",\n\tSERVER_CACHE: \"SERVER_CACHE\",\n\tSERVER: \"SERVER\",\n\tWORKSPACE: \"WORKSPACE\",\n\tCHANNEL: \"CHANNEL\"\n};\nconst LogLevel = {\n\tDEBUG: \"debug\",\n\tINFO: \"info\",\n\tWARN: \"warn\",\n\tERROR: \"error\",\n\tNONE: \"silent\"\n};\nvar LoggerTransport = class extends Transform {\n\tconstructor(opts = {}) {\n\t\tsuper({\n\t\t\t...opts,\n\t\t\tobjectMode: true\n\t\t});\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogs(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nconst createCustomTransport = (stream, listLogs, listLogsByRunId) => {\n\tlet transport = stream;\n\tif (listLogs) transport.listLogs = listLogs;\n\tif (listLogsByRunId) transport.listLogsByRunId = listLogsByRunId;\n\treturn transport;\n};\nvar MastraLogger = class {\n\tname;\n\tlevel;\n\ttransports;\n\tconstructor(options = {}) {\n\t\tthis.name = options.name || \"Mastra\";\n\t\tthis.level = options.level || LogLevel.ERROR;\n\t\tthis.transports = new Map(Object.entries(options.transports || {}));\n\t}\n\tgetTransports() {\n\t\treturn this.transports;\n\t}\n\ttrackException(_error, _metadata) {}\n\tasync listLogs(transportId, params) {\n\t\tif (!transportId || !this.transports.has(transportId)) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogs?.(params) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {\n\t\tif (!transportId || !this.transports.has(transportId) || !runId) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogsByRunId?.({\n\t\t\trunId,\n\t\t\tfromDate,\n\t\t\ttoDate,\n\t\t\tlogLevel,\n\t\t\tfilters,\n\t\t\tpage,\n\t\t\tperPage\n\t\t}) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nvar ConsoleLogger = class ConsoleLogger extends MastraLogger {\n\tcomponent;\n\tfilter;\n\t#adapterContext;\n\tconstructor(options = {}) {\n\t\tsuper(options);\n\t\tthis.component = options.component;\n\t\tthis.filter = options.filter;\n\t}\n\t/**\n\t* Adapter hook (see `AdaptableLogger`): enables native trace correlation\n\t* (trace_id/span_id appended to console output) and observability export\n\t* derived from the same record. Called by Mastra during setup.\n\t*/\n\t__attachObservability(ctx) {\n\t\tthis.#adapterContext = ctx;\n\t}\n\tchild(componentOrBindings) {\n\t\tconst component = typeof componentOrBindings === \"string\" ? componentOrBindings : componentOrBindings?.component ?? this.component;\n\t\tconst child = new ConsoleLogger({\n\t\t\tname: this.name,\n\t\t\tlevel: this.level,\n\t\t\tcomponent,\n\t\t\tfilter: this.filter\n\t\t});\n\t\tif (this.#adapterContext) child.__attachObservability(this.#adapterContext);\n\t\treturn child;\n\t}\n\t/**\n\t* Native-record correlation: when a span is active, append the trace\n\t* fields object to the console args so every destination sees them.\n\t*/\n\t#correlate(args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.correlation) return args;\n\t\ttry {\n\t\t\tconst fields = ctx.resolveTraceFields();\n\t\t\treturn fields ? [...args, fields] : args;\n\t\t} catch {\n\t\t\treturn args;\n\t\t}\n\t}\n\t/**\n\t* Export the record derived from the same native call to observability.\n\t* Mirrors DualLogger semantics: export is independent of the console\n\t* level filter, and never throws into the caller.\n\t*/\n\t#export(level, message, args) {\n\t\tconst ctx = this.#adapterContext;\n\t\tif (!ctx?.options.export) return;\n\t\ttry {\n\t\t\tctx.getLogSink()?.[level](message, buildLogRecordData(args));\n\t\t} catch {}\n\t}\n\tshouldLog(level, message, args) {\n\t\tif (!this.filter) return true;\n\t\ttry {\n\t\t\treturn this.filter({\n\t\t\t\tcomponent: this.component,\n\t\t\t\tlevel,\n\t\t\t\tmessage,\n\t\t\t\targs\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tconsole.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n\t\t\treturn true;\n\t\t}\n\t}\n\tprefix() {\n\t\treturn this.component ? `[${this.component}] ` : \"\";\n\t}\n\tdebug(message, ...args) {\n\t\tif (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"debug\", message, args);\n\t}\n\tinfo(message, ...args) {\n\t\tif ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"info\", message, args);\n\t}\n\twarn(message, ...args) {\n\t\tif ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"warn\", message, args);\n\t}\n\terror(message, ...args) {\n\t\tif ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...this.#correlate(args));\n\t\tthis.#export(\"error\", message, args);\n\t}\n\ttrackException(error, metadata) {\n\t\texportTrackedException(this.#adapterContext, error, metadata);\n\t}\n\tasync listLogs(_transportId, _params) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _params?.page ?? 1,\n\t\t\tperPage: _params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args.page ?? 1,\n\t\t\tperPage: _args.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\n//#endregion\nexport { ConsoleLogger, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, buildLogRecordData, createCustomTransport, exportTrackedException, isAdaptableLogger };\n\n//# sourceMappingURL=index.js.map","import { ConsoleLogger, RegisteredLogger } from \"../logger/index.js\";\n//#region src/base/MastraBase.ts\nvar MastraBase = class {\n\tcomponent = RegisteredLogger.LLM;\n\tlogger;\n\tname;\n\t#rawConfig;\n\tconstructor({ component, name, rawConfig }) {\n\t\tthis.component = component || RegisteredLogger.LLM;\n\t\tthis.name = name;\n\t\tthis.#rawConfig = rawConfig;\n\t\tthis.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n\t}\n\t/**\n\t* Returns the raw storage configuration this primitive was created from,\n\t* or undefined if it was created from code.\n\t*/\n\ttoRawConfig() {\n\t\treturn this.#rawConfig;\n\t}\n\t/**\n\t* Sets the raw storage configuration for this primitive.\n\t* @internal\n\t*/\n\t__setRawConfig(rawConfig) {\n\t\tthis.#rawConfig = rawConfig;\n\t}\n\t/**\n\t* Set the logger for the agent\n\t* @param logger\n\t*/\n\t__setLogger(logger) {\n\t\tthis.logger = \"child\" in logger && typeof logger.child === \"function\" ? logger.child({ component: this.component }) : logger;\n\t}\n};\n//#endregion\nexport { MastraBase };\n\n//# sourceMappingURL=index.js.map","import { getRequestHeader } from \"../types/index.js\";\nimport { MastraBase } from \"@internal/core/base\";\n//#region src/provider/index.ts\nvar MastraAuthProvider = class extends MastraBase {\n\tprotected;\n\tpublic;\n\tconstructor(options) {\n\t\tsuper({\n\t\t\tcomponent: \"AUTH\",\n\t\t\tname: options?.name\n\t\t});\n\t\tif (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);\n\t\tthis.protected = options?.protected;\n\t\tthis.public = options?.public;\n\t\tthis.mapUserToResourceId = options?.mapUserToResourceId;\n\t}\n\tregisterOptions(opts) {\n\t\tif (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);\n\t\tif (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;\n\t\tif (opts?.protected) this.protected = opts.protected;\n\t\tif (opts?.public) this.public = opts.public;\n\t}\n};\nfunction isSSOProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getLoginUrl === \"function\" && typeof p.handleCallback === \"function\";\n}\nfunction isSessionProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.validateSession === \"function\" && typeof p.createSession === \"function\";\n}\nfunction isUserProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getCurrentUser === \"function\";\n}\nfunction isCredentialsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.signIn === \"function\";\n}\nfunction isOrganizationsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.ensureOrganization === \"function\" && typeof p.isOrganizationAdmin === \"function\";\n}\nfunction isAuthHttpHandler(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.handleAuthRequest === \"function\";\n}\nfunction hasAuthInit(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.init === \"function\";\n}\nfunction isObjectLike(value) {\n\treturn typeof value === \"object\" && value !== null || typeof value === \"function\";\n}\nvar CompositeAuth = class CompositeAuth extends MastraAuthProvider {\n\tproviders;\n\tauthenticatedProviderByObject = /* @__PURE__ */ new WeakMap();\n\tauthenticatedProviderByPrimitive = /* @__PURE__ */ new Map();\n\tconstructor(providers) {\n\t\tconst combinedPublic = providers.flatMap((provider) => provider.public ?? []);\n\t\tconst combinedProtected = providers.flatMap((provider) => provider.protected ?? []);\n\t\tsuper({\n\t\t\tpublic: combinedPublic,\n\t\t\tprotected: combinedProtected\n\t\t});\n\t\tthis.providers = providers;\n\t\tif (providers.some((provider) => typeof provider.mapUserToResourceId === \"function\")) this.mapUserToResourceId = (user) => this.mapAuthenticatedUserToResourceId(user);\n\t\tif (!providers.some(isSSOProvider)) {\n\t\t\tthis.getLoginUrl = void 0;\n\t\t\tthis.handleCallback = void 0;\n\t\t\tthis.getLoginButtonConfig = void 0;\n\t\t}\n\t\tif (!providers.some(isSessionProvider)) {\n\t\t\tthis.createSession = void 0;\n\t\t\tthis.validateSession = void 0;\n\t\t\tthis.getSessionIdFromRequest = void 0;\n\t\t}\n\t\tif (!providers.some(isUserProvider)) {\n\t\t\tthis.getCurrentUser = void 0;\n\t\t\tthis.getUser = void 0;\n\t\t\tthis.getUsers = void 0;\n\t\t}\n\t\tconst credProvider = providers.find(isCredentialsProvider);\n\t\tif (credProvider) {\n\t\t\tthis.signIn = credProvider.signIn.bind(credProvider);\n\t\t\tif (typeof credProvider.signUp === \"function\") this.signUp = credProvider.signUp.bind(credProvider);\n\t\t\tif (typeof credProvider.requestPasswordReset === \"function\") this.requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n\t\t\tif (typeof credProvider.resetPassword === \"function\") this.resetPassword = credProvider.resetPassword.bind(credProvider);\n\t\t\tthis.isSignUpEnabled = typeof credProvider.isSignUpEnabled === \"function\" ? credProvider.isSignUpEnabled.bind(credProvider) : () => true;\n\t\t} else {\n\t\t\tthis.signIn = void 0;\n\t\t\tthis.signUp = void 0;\n\t\t\tthis.requestPasswordReset = void 0;\n\t\t\tthis.resetPassword = void 0;\n\t\t\tthis.isSignUpEnabled = void 0;\n\t\t}\n\t}\n\tfindProvider(check) {\n\t\treturn this.providers.find(check);\n\t}\n\trememberAuthenticatedProvider(user, provider) {\n\t\tif (isObjectLike(user)) {\n\t\t\tthis.authenticatedProviderByObject.set(user, provider);\n\t\t\treturn;\n\t\t}\n\t\tthis.authenticatedProviderByPrimitive.set(user, provider);\n\t}\n\ttakeAuthenticatedProvider(user) {\n\t\tif (isObjectLike(user)) {\n\t\t\tconst provider = this.authenticatedProviderByObject.get(user);\n\t\t\tthis.authenticatedProviderByObject.delete(user);\n\t\t\treturn provider;\n\t\t}\n\t\tconst primitiveUser = user;\n\t\tconst provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n\t\tthis.authenticatedProviderByPrimitive.delete(primitiveUser);\n\t\treturn provider;\n\t}\n\tmapAuthenticatedUserToResourceId(user) {\n\t\tconst provider = this.takeAuthenticatedProvider(user);\n\t\tif (typeof provider?.mapUserToResourceId !== \"function\") return;\n\t\tconst resourceId = provider.mapUserToResourceId(user);\n\t\tif (resourceId === void 0 && provider instanceof CompositeAuth) return;\n\t\tif (typeof resourceId !== \"string\" || !resourceId.trim()) throw new Error(\"mapUserToResourceId must return a non-empty string for the authenticated user\");\n\t\treturn resourceId;\n\t}\n\t/**\n\t* True if any provider is MastraCloudAuth (exempt from license requirement).\n\t*/\n\tget isMastraCloudAuth() {\n\t\treturn this.providers.some((p) => \"isMastraCloudAuth\" in p && p.isMastraCloudAuth === true);\n\t}\n\t/**\n\t* True if any provider is SimpleAuth (exempt from license requirement).\n\t*/\n\tget isSimpleAuth() {\n\t\treturn this.providers.some((p) => \"isSimpleAuth\" in p && p.isSimpleAuth === true);\n\t}\n\tasync authenticateToken(token, request) {\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst user = await provider.authenticateToken(token, request);\n\t\t\tif (user) {\n\t\t\t\tthis.rememberAuthenticatedProvider(user, provider);\n\t\t\t\treturn user;\n\t\t\t}\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tconsumePendingResponseHeaders(request) {\n\t\tlet merged;\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst pending = provider.consumePendingResponseHeaders?.(request);\n\t\t\tif (pending) merged = {\n\t\t\t\t...merged ?? {},\n\t\t\t\t...pending\n\t\t\t};\n\t\t} catch {}\n\t\treturn merged;\n\t}\n\tasync authorizeUser(user, request) {\n\t\tfor (const provider of this.providers) if (await provider.authorizeUser(user, request)) return true;\n\t\treturn false;\n\t}\n\t/**\n\t* Forward cookie header to SSO provider for PKCE validation.\n\t* Called by auth handler before handleCallback().\n\t*/\n\tsetCallbackCookieHeader(cookieHeader) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (sso && typeof sso.setCallbackCookieHeader === \"function\") sso.setCallbackCookieHeader(cookieHeader);\n\t}\n\tgetLoginUrl(redirectUri, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.getLoginUrl(redirectUri, state);\n\t}\n\tgetLoginCookies(redirectUri, state) {\n\t\treturn this.findProvider(isSSOProvider)?.getLoginCookies?.(redirectUri, state);\n\t}\n\tasync handleCallback(code, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.handleCallback(code, state);\n\t}\n\tgetLoginButtonConfig() {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) return {\n\t\t\tprovider: \"unknown\",\n\t\t\ttext: \"Sign in\"\n\t\t};\n\t\treturn sso.getLoginButtonConfig();\n\t}\n\tasync getLogoutUrl(redirectUri, request) {\n\t\tfor (const provider of this.providers) if (isSSOProvider(provider) && provider.getLogoutUrl) try {\n\t\t\tconst url = await provider.getLogoutUrl(redirectUri, request);\n\t\t\tif (url) return url;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync createSession(userId, metadata) {\n\t\tconst session = this.findProvider(isSessionProvider);\n\t\tif (!session) throw new Error(\"No session provider configured in CompositeAuth\");\n\t\treturn session.createSession(userId, metadata);\n\t}\n\tasync validateSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.validateSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync destroySession(sessionId) {\n\t\tconst destroyPromises = [];\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) destroyPromises.push(provider.destroySession(sessionId).catch(() => {}));\n\t\tawait Promise.all(destroyPromises);\n\t}\n\tasync refreshSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.refreshSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionIdFromRequest(request) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst sessionId = provider.getSessionIdFromRequest(request);\n\t\t\tif (sessionId) return sessionId;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionHeaders(session) {\n\t\treturn this.findProvider(isSessionProvider)?.getSessionHeaders(session) ?? {};\n\t}\n\tgetClearSessionHeaders() {\n\t\tconst headers = {};\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst providerHeaders = provider.getClearSessionHeaders();\n\t\t\tObject.assign(headers, providerHeaders);\n\t\t} catch {}\n\t\treturn headers;\n\t}\n\tasync getCurrentUser(request) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getCurrentUser(request);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUser(userId) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getUser(userId);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn Promise.all(userIds.map((userId) => this.getUser(userId)));\n\t}\n};\nconst DEFAULT_HEADERS = [\"Authorization\", \"X-Playground-Access\"];\nvar SimpleAuth = class extends MastraAuthProvider {\n\t/**\n\t* Marker to exempt SimpleAuth from EE license requirement.\n\t* SimpleAuth is for development/testing and should work without a license.\n\t*/\n\tisSimpleAuth = true;\n\ttokens;\n\theaders;\n\tusers;\n\tuserById;\n\tconstructor(options) {\n\t\tsuper(options);\n\t\tthis.tokens = options.tokens;\n\t\tthis.users = Object.values(this.tokens);\n\t\tthis.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n\t\tthis.userById = new Map(this.users.map((u) => [String(u?.id), u]));\n\t}\n\tasync authenticateToken(token, request) {\n\t\tconst requestTokens = this.getTokensFromHeaders(token, request);\n\t\tfor (const requestToken of requestTokens) {\n\t\t\tconst tokenToUser = this.tokens[requestToken];\n\t\t\tif (tokenToUser) return tokenToUser;\n\t\t}\n\t\treturn this.getUserFromCookie(getRequestHeader(request, \"Cookie\"));\n\t}\n\tasync authorizeUser(user, _request) {\n\t\treturn this.users.includes(user);\n\t}\n\t/** Get current user from request headers or cookie. */\n\tasync getCurrentUser(request) {\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = request.headers.get(headerName);\n\t\t\tif (headerValue) {\n\t\t\t\tconst token = this.stripBearerPrefix(headerValue);\n\t\t\t\tconst user = this.tokens[token];\n\t\t\t\tif (user) return user;\n\t\t\t}\n\t\t}\n\t\treturn this.getUserFromCookie(request.headers.get(\"Cookie\"));\n\t}\n\tgetUserFromCookie(cookieHeader) {\n\t\tif (!cookieHeader) return null;\n\t\tconst cookies = cookieHeader.split(\";\").map((c) => c.trim());\n\t\tfor (const cookie of cookies) if (cookie.startsWith(\"mastra-token=\")) {\n\t\t\tconst token = cookie.slice(13);\n\t\t\tconst user = this.tokens[token];\n\t\t\tif (user) return user;\n\t\t}\n\t\treturn null;\n\t}\n\t/** Get user by ID. */\n\tasync getUser(userId) {\n\t\treturn this.userById.get(userId) ?? null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn userIds.map((userId) => this.userById.get(userId) ?? null);\n\t}\n\t/**\n\t* Sign in with token (passed as password field).\n\t* The email field is ignored - only the token matters.\n\t*/\n\tasync signIn(_email, password, _request) {\n\t\tconst token = password;\n\t\tconst user = this.tokens[token];\n\t\tif (!user) throw new Error(\"Invalid token\");\n\t\treturn {\n\t\t\tuser,\n\t\t\ttoken,\n\t\t\tcookies: [`mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`]\n\t\t};\n\t}\n\tasync signUp() {\n\t\tthrow new Error(\"Sign up is not supported with SimpleAuth. Use pre-configured tokens.\");\n\t}\n\tisSignUpEnabled() {\n\t\treturn false;\n\t}\n\t/**\n\t* Get headers to clear the session cookie on logout.\n\t* Partial ISessionProvider implementation for logout support.\n\t*/\n\tgetClearSessionHeaders() {\n\t\treturn { \"Set-Cookie\": \"mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\" };\n\t}\n\tstripBearerPrefix(token) {\n\t\treturn token.startsWith(\"Bearer \") ? token.slice(7) : token;\n\t}\n\tgetTokensFromHeaders(token, request) {\n\t\tconst tokens = [token];\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = getRequestHeader(request, headerName);\n\t\t\tif (headerValue) tokens.push(this.stripBearerPrefix(headerValue));\n\t\t}\n\t\treturn tokens;\n\t}\n};\n//#endregion\nexport { CompositeAuth, MastraAuthProvider, SimpleAuth, hasAuthInit, isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider };\n\n//# sourceMappingURL=index.js.map","import type {\n AuthInitContext,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n IUserProvider,\n CredentialsResult,\n MastraAuthRequest,\n} from '@internal/auth';\nimport { getRequestHeader } from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport { LibsqlDialect } from '@libsql/kysely-libsql';\n\nimport { betterAuth } from 'better-auth';\nimport type { Auth, BetterAuthOptions, Session, User } from 'better-auth';\nimport { makeSignature } from 'better-auth/crypto';\nimport { getMigrations } from 'better-auth/db/migration';\nimport { organization } from 'better-auth/plugins';\n\ntype BetterAuthContext = Awaited<Auth['$context']>;\n\nfunction tryDecode(value: string): string {\n try {\n return decodeURIComponent(value);\n } catch {\n return value;\n }\n}\n\n/**\n * User type returned by Better Auth session verification.\n * Used internally for authentication token verification.\n */\nexport interface BetterAuthUser {\n /**\n * The better-auth session. `activeOrganizationId` comes from the\n * organization plugin (registered unconditionally by this provider); when\n * the stored session never had one set, `authenticateToken` resolves a\n * default from the user's existing memberships.\n */\n session: Session & { activeOrganizationId?: string | null };\n user: User;\n}\n\n/**\n * Maps Better Auth User to EE User format.\n */\nfunction mapBetterAuthUserToEEUser(user: User): EEUser {\n return {\n id: user.id,\n email: user.email,\n name: user.name,\n avatarUrl: user.image ?? undefined,\n metadata: {\n emailVerified: user.emailVerified,\n createdAt: user.createdAt,\n updatedAt: user.updatedAt,\n },\n };\n}\n\ninterface MastraAuthBetterAuthOptions extends MastraAuthProviderOptions<BetterAuthUser> {\n /**\n * The Better Auth instance to use for authentication.\n * This should be the result of calling `betterAuth({ ... })`.\n *\n * Optional when `secret` is provided: the provider then builds its own\n * `betterAuth()` instance in `init()` on the host's auth database (deferred\n * instance mode) and owns its schema migrations.\n */\n auth?: Auth;\n\n /**\n * Secret used for session signing by the provider-built `betterAuth()`\n * instance (deferred instance mode). Ignored when `auth` is provided.\n */\n secret?: string;\n\n /**\n * Whether to allow new user registration via sign-up.\n * Set to false to disable public registration.\n * @default true\n */\n signUpEnabled?: boolean;\n}\n\n/** Loose row shapes read back from better-auth's internal DB adapter. */\n/**\n * How long a resolved `userId → orgId` mapping stays cached. Bounded so an\n * administrator revoking a membership takes effect on new sessions within a\n * minute, rather than persisting until process restart.\n */\nconst ORG_CACHE_TTL_MS = 60_000;\n\ninterface MemberRow {\n organizationId?: string;\n role?: string;\n userId?: string;\n}\ninterface OrganizationRow {\n id: string;\n}\n\n/**\n * Tagged auth-database handle shape hosts may pass as `AuthInitContext.database`\n * (e.g. the Mastra Code web factory's storage backends).\n */\ninterface TaggedAuthDatabase {\n dialect?: string;\n pool?: unknown;\n client?: unknown;\n database?: unknown;\n}\n\n/**\n * Mastra authentication provider for Better Auth.\n *\n * Better Auth is a self-hosted, open-source authentication framework\n * that gives you full control over your authentication system.\n *\n * @example\n * ```typescript\n * import { betterAuth } from 'better-auth';\n * import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';\n *\n * // Create your Better Auth instance\n * const auth = betterAuth({\n * database: {\n * provider: 'postgresql',\n * url: process.env.DATABASE_URL!,\n * },\n * emailAndPassword: {\n * enabled: true,\n * },\n * });\n *\n * // Create the Mastra auth provider\n * const mastraAuth = new MastraAuthBetterAuth({\n * auth,\n * });\n *\n * // Use with Mastra\n * const mastra = new Mastra({\n * server: {\n * auth: mastraAuth,\n * },\n * });\n * ```\n *\n * @see https://better-auth.com for Better Auth documentation\n */\nexport class MastraAuthBetterAuth\n extends MastraAuthProvider<BetterAuthUser>\n implements IUserProvider<EEUser>, ICredentialsProvider<EEUser>, IOrganizationsProvider, IAuthInit, IAuthHttpHandler\n{\n #auth: Auth | undefined;\n #secret: string | undefined;\n /** True when `init()` built the instance — then we also own its migrations. */\n #ownsInstance = false;\n /** Once-per-process migration latch; reset on failure so a later call retries. */\n #migrated: Promise<void> | undefined;\n /**\n * In-process `userId → orgId` cache, shared by `ensureOrganization` and the\n * `authenticateToken` default-org resolution. Only successes are cached, so\n * membership-less users re-run the lookup per request. Entries expire after\n * `ORG_CACHE_TTL_MS` so a membership revoked by an administrator stops being\n * injected into new sessions within the TTL window instead of persisting for\n * the process lifetime.\n */\n #orgCache = new Map<string, { orgId: string; expiresAt: number }>();\n\n #cachedOrgId(userId: string): string | undefined {\n const entry = this.#orgCache.get(userId);\n if (!entry) return undefined;\n if (Date.now() >= entry.expiresAt) {\n this.#orgCache.delete(userId);\n return undefined;\n }\n return entry.orgId;\n }\n\n /**\n * Cache a resolved `userId → orgId` mapping. The map is kept in expiry\n * order: writes delete-then-set so refreshed entries move to the back, and\n * since every entry uses the same TTL, iteration order is ascending\n * `expiresAt`. The sweep therefore stops at the first live entry, making\n * each write amortized O(1) instead of a full scan.\n */\n #storeOrgId(userId: string, orgId: string): void {\n const now = Date.now();\n for (const [key, entry] of this.#orgCache) {\n if (now < entry.expiresAt) break;\n this.#orgCache.delete(key);\n }\n this.#orgCache.delete(userId);\n this.#orgCache.set(userId, { orgId, expiresAt: now + ORG_CACHE_TTL_MS });\n }\n\n /** @internal Test hook: current org-cache cardinality. */\n get orgCacheSize(): number {\n return this.#orgCache.size;\n }\n /** Set from `init()`: cross-origin SPA deploys need SameSite=None; Secure cookies. */\n #crossSite = false;\n protected signUpEnabledConfig: boolean;\n\n constructor(options: MastraAuthBetterAuthOptions) {\n super({ name: options?.name ?? 'better-auth' });\n\n if (!options.auth && !options.secret) {\n throw new Error(\n 'Better Auth instance is required. Please provide the auth option with your Better Auth instance created via betterAuth({ ... }), ' +\n 'or provide `secret` so the provider can build its own instance in init() on the host database.',\n );\n }\n\n this.#auth = options.auth;\n this.#secret = options.secret;\n this.signUpEnabledConfig = options.signUpEnabled ?? true;\n\n this.registerOptions(options);\n }\n\n /**\n * The active Better Auth instance. Throws before `init()` in deferred\n * instance mode (constructed with `secret` instead of `auth`).\n */\n protected get auth(): Auth {\n if (!this.#auth) {\n throw new Error(\n 'MastraAuthBetterAuth is not initialized — init() must run first (or pass a configured `auth` instance).',\n );\n }\n return this.#auth;\n }\n\n /**\n * Session cookie name, honoring Better Auth's `cookiePrefix`, a caller\n * override via `advanced.cookies.session_token.name`, and the `__Secure-`\n * prefix Better Auth applies when secure cookies are active.\n */\n get sessionCookieName(): string {\n const options = (this.#auth as { options?: { baseURL?: string; advanced?: Record<string, unknown> } } | undefined)\n ?.options;\n const advanced = options?.advanced as\n | {\n cookiePrefix?: string;\n useSecureCookies?: boolean;\n cookies?: { session_token?: { name?: string } };\n }\n | undefined;\n const prefix = advanced?.cookiePrefix ?? 'better-auth';\n const secure = advanced?.useSecureCookies ?? options?.baseURL?.startsWith('https://') ?? false;\n const baseName = advanced?.cookies?.session_token?.name ?? `${prefix}.session_token`;\n return `${secure ? '__Secure-' : ''}${baseName}`;\n }\n\n // ============================================\n // IAuthInit implementation\n // ============================================\n\n /**\n * One-time host initialization. In deferred instance mode (no `auth` in the\n * options) this builds the provider-owned `betterAuth()` instance on the\n * host's auth database; schema migrations then run lazily behind a\n * once-per-process latch on first use.\n *\n * Bring-your-own `auth` instances skip construction entirely — the caller\n * owns their database and migrations.\n */\n async init(ctx: AuthInitContext): Promise<void> {\n this.#crossSite = (ctx.allowedOrigins?.length ?? 0) > 0;\n if (this.#auth) return; // bring-your-own instance: nothing to build\n\n const authDb = ctx.database as TaggedAuthDatabase | undefined;\n if (!authDb) {\n throw new Error(\n 'MastraAuthBetterAuth needs a database to build its own better-auth instance, but the host passed none. ' +\n 'Use a storage backend that exposes an auth database, or pass your own configured `auth` instance.',\n );\n }\n // Map the host's tagged auth-database handle onto better-auth's `database`\n // option: pg pool directly, libsql via its kysely dialect, anything else\n // passed through as-is (the host owns its compatibility).\n const database: BetterAuthOptions['database'] =\n authDb.dialect === 'postgres'\n ? (authDb.pool as Extract<BetterAuthOptions['database'], { query: unknown }>)\n : authDb.dialect === 'libsql'\n ? {\n dialect: new LibsqlDialect({ client: authDb.client } as ConstructorParameters<typeof LibsqlDialect>[0]),\n type: 'sqlite' as const,\n }\n : (authDb.database as BetterAuthOptions['database']);\n const allowedOrigins = ctx.allowedOrigins ?? [];\n // Widen to BetterAuthOptions before calling betterAuth(): its return type\n // is generic over the exact options object, which would make the instance\n // incompatible with the plain `Auth` alias we store.\n const options: BetterAuthOptions = {\n database,\n secret: this.#secret,\n // All provider endpoints (sign-in/up/out/session) live under /auth/api/*,\n // where hosts mount handleAuthRequest.\n basePath: '/auth/api',\n ...(ctx.publicUrl ? { baseURL: ctx.publicUrl } : {}),\n // Cross-origin SPA deploys: SameSite=None only lets the browser SEND the\n // cookie — better-auth still rejects requests from origins outside its\n // own allow-list, so the SPA origins must be trusted too.\n ...(allowedOrigins.length ? { trustedOrigins: allowedOrigins } : {}),\n emailAndPassword: { enabled: true, disableSignUp: !this.signUpEnabledConfig },\n plugins: [organization()],\n // Cross-origin SPA deploys need SameSite=None; Secure for the browser to\n // send the session cookie.\n ...(this.#crossSite ? { advanced: { defaultCookieAttributes: { sameSite: 'none', secure: true } } } : {}),\n };\n this.#auth = betterAuth(options);\n this.#ownsInstance = true;\n }\n\n /**\n * Ensure better-auth's tables exist in the host database. Only for instances\n * this provider built — bring-your-own instances manage their own migrations.\n */\n async #ensureDbReady(): Promise<void> {\n if (!this.#ownsInstance) return;\n this.#migrated ??= (async () => {\n const { runMigrations } = await getMigrations(this.auth.options as BetterAuthOptions);\n await runMigrations();\n })();\n try {\n await this.#migrated;\n } catch (error) {\n this.#migrated = undefined; // allow a later call to retry\n console.warn('[BetterAuth] Failed to run auth schema migrations; auth stays unavailable until this succeeds.');\n throw error;\n }\n }\n\n // ============================================\n // IAuthHttpHandler implementation\n // ============================================\n\n /**\n * Proxy a raw HTTP request to Better Auth's own API surface\n * (sign-in/up/out/session). Hosts mount this under `/auth/api/*`.\n */\n async handleAuthRequest(request: Request): Promise<Response> {\n try {\n await this.#ensureDbReady();\n } catch {\n return new Response(JSON.stringify({ error: 'auth_unavailable' }), {\n status: 503,\n headers: { 'content-type': 'application/json' },\n });\n }\n return this.auth.handler(request);\n }\n\n // ============================================\n // IOrganizationsProvider implementation\n // ============================================\n\n /**\n * Read-only half of org resolution: the user's oldest existing membership,\n * cached in `#orgCache`. Never creates anything. Ordered by `createdAt` so\n * the resolved default is stable across processes for multi-org users.\n */\n async #findMembershipOrgId(ctx: BetterAuthContext, userId: string): Promise<string | undefined> {\n const memberships = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'userId', value: userId }],\n sortBy: { field: 'createdAt', direction: 'asc' },\n })) as MemberRow[];\n const orgId = memberships.find(m => m.organizationId)?.organizationId;\n if (orgId) this.#storeOrgId(userId, orgId);\n return orgId;\n }\n\n /**\n * Resolve the organization a session should act under when better-auth's\n * `activeOrganizationId` was never set (nothing in this provider or a\n * default sign-in flow calls the organization plugin's `setActive`).\n * Read-only and best-effort: an existing membership or nothing.\n *\n * Callers must run `#ensureDbReady` first (authenticateToken does); this\n * method deliberately swallows failures, so an unmigrated DB would\n * otherwise fail silently.\n */\n async #resolveActiveOrganizationId(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n return await this.#findMembershipOrgId(ctx, userId);\n } catch {\n return undefined;\n }\n }\n\n /**\n * Ensure the user belongs to an organization, mirroring the WorkOS\n * personal-org bootstrap on better-auth's organization tables:\n * ≥1 membership → oldest org id; 0 → create a personal org with an\n * idempotent slug derived from the user id.\n *\n * Concurrent/retried first logins recover via the unique slug instead of\n * creating duplicates. Slug alone is NOT proof of ownership though: the\n * organization API is reachable by any authenticated user, so an attacker\n * could squat `personal-<victimId>`. The slug-matched org is only adopted\n * when nobody else is a member; otherwise a fresh org with an unguessable\n * slug is created instead.\n *\n * Best-effort: any failure is swallowed and leaves the user no-org.\n */\n async ensureOrganization(userId: string): Promise<string | undefined> {\n const cached = this.#cachedOrgId(userId);\n if (cached) return cached;\n\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return undefined;\n\n const firstExisting = await this.#findMembershipOrgId(ctx, userId);\n if (firstExisting) return firstExisting;\n\n // Build a predictable personal-org name from the user's profile.\n const userRecord = await ctx.internalAdapter.findUserById(userId).catch(() => null);\n const label = userRecord?.email ?? userRecord?.name ?? userId;\n const orgName = `${label}'s org`;\n const orgData = () => ({\n name: orgName,\n createdAt: new Date(),\n metadata: JSON.stringify({ mastraPersonalOrg: 'true' }),\n });\n\n // Create the personal org. The slug is derived from the user id, so a\n // concurrent/prior bootstrap that already created it makes the insert\n // reject on the unique slug — recover by looking the org up instead.\n const slug = `personal-${userId}`;\n let organizationId: string;\n try {\n const created = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug },\n })) as OrganizationRow;\n organizationId = created.id;\n } catch (error) {\n const existing = (await ctx.adapter.findOne({\n model: 'organization',\n where: [{ field: 'slug', value: slug }],\n })) as OrganizationRow | null;\n if (!existing) throw error;\n // Only adopt the slug-matched org when nobody else is a member (zero\n // members = a concurrent bootstrap of this same user that hasn't\n // attached yet). Otherwise fall back to an unguessable slug.\n const existingMembers = (await ctx.adapter.findMany({\n model: 'member',\n where: [{ field: 'organizationId', value: existing.id }],\n })) as MemberRow[];\n const foreignMember = existingMembers.some(m => m.userId !== userId);\n if (foreignMember) {\n const fallback = (await ctx.adapter.create({\n model: 'organization',\n data: { ...orgData(), slug: `personal-${userId}-${crypto.randomUUID()}` },\n })) as OrganizationRow;\n organizationId = fallback.id;\n } else {\n organizationId = existing.id;\n }\n }\n\n // Idempotently attach the user: tolerate a membership a concurrent\n // bootstrap already created.\n try {\n await ctx.adapter.create({\n model: 'member',\n data: { organizationId, userId, role: 'owner', createdAt: new Date() },\n });\n } catch (error) {\n const member = await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n });\n if (!member) throw error;\n }\n\n this.#storeOrgId(userId, organizationId);\n return organizationId;\n } catch (error) {\n console.warn(\n `[BetterAuth] Failed to bootstrap personal organization for user ${userId}. ` +\n 'The user will see organization_required until this succeeds.',\n error,\n );\n return undefined;\n }\n }\n\n /**\n * Whether the user holds an admin-equivalent role (`owner` or `admin`) in\n * the organization. Provider errors resolve to `false`.\n */\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n try {\n await this.#ensureDbReady();\n const ctx = await this.getAuthContext();\n if (!ctx) return false;\n const membership = (await ctx.adapter.findOne({\n model: 'member',\n where: [\n { field: 'organizationId', value: organizationId },\n { field: 'userId', value: userId },\n ],\n })) as MemberRow | null;\n return membership?.role === 'owner' || membership?.role === 'admin';\n } catch {\n return false;\n }\n }\n\n /**\n * Check if sign-up is enabled.\n * Implements ICredentialsProvider.isSignUpEnabled.\n */\n isSignUpEnabled(): boolean {\n return this.signUpEnabledConfig;\n }\n\n // ============================================\n // IUserProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Get current user from request.\n * Implements IUserProvider for EE user awareness in Studio.\n *\n * Supports both cookie-based sessions and `Authorization: Bearer <token>`\n * requests (e.g. API clients using the token returned by `signIn`).\n *\n * @param request - Incoming HTTP request\n * @returns EE User object or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<EEUser | null> {\n try {\n await this.#ensureDbReady();\n const headers = new Headers(request.headers);\n\n // If the request authenticates via Bearer token instead of cookies,\n // convert the token to a signed session cookie so getSession accepts it.\n const authHeader = headers.get('Authorization');\n const bearerToken =\n authHeader && authHeader.slice(0, 7).toLowerCase() === 'bearer ' ? authHeader.slice(7).trim() : undefined;\n await this.ensureSessionCookie(headers, bearerToken);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result?.user) return null;\n return mapBetterAuthUserToEEUser(result.user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Implements IUserProvider for EE user awareness.\n *\n * Uses Better Auth's internal adapter to look up the user record,\n * so it works with whichever database Better Auth is configured with.\n *\n * @param userId - User identifier\n * @returns EE User object or null if not found\n */\n async getUser(userId: string): Promise<EEUser | null> {\n try {\n const ctx = await this.getAuthContext();\n if (!ctx) return null;\n\n const user = await ctx.internalAdapter.findUserById(userId);\n if (!user) return null;\n return mapBetterAuthUserToEEUser(user);\n } catch {\n return null;\n }\n }\n\n /**\n * Get multiple users by ID.\n * Optional IUserProvider method used for batch author enrichment.\n *\n * @param userIds - User identifiers\n * @returns EE User objects (null for missing users, order preserved)\n */\n async getUsers(userIds: string[]): Promise<Array<EEUser | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n\n /**\n * Get URL to user's profile page.\n * Optional IUserProvider method.\n */\n getUserProfileUrl(user: EEUser): string {\n return `/profile/${user.id}`;\n }\n\n /**\n * Get the resolved Better Auth context, or null when unavailable\n * (e.g. a partial mock without `$context`).\n */\n private async getAuthContext(): Promise<BetterAuthContext | null> {\n try {\n return (await Promise.resolve(this.auth.$context)) ?? null;\n } catch {\n return null;\n }\n }\n\n /**\n * Ensure the Cookie header on `headers` carries a Better Auth session cookie\n * for the given token.\n *\n * Better Auth's `getSession` reads the session from a *signed* cookie\n * (`<token>.<HMAC-SHA256 signature>`), while `signIn`/`signUp` return the\n * raw unsigned token. Mirroring Better Auth's bearer plugin, unsigned tokens\n * are signed with the instance secret before being set as the session cookie.\n */\n private async ensureSessionCookie(headers: Headers, token: string | undefined): Promise<void> {\n if (!token) return;\n\n const ctx = await this.getAuthContext();\n const cookieName = ctx?.authCookies.sessionToken.name ?? this.sessionCookieName;\n const secret = ctx?.secret;\n\n const cookieHeader = headers.get('Cookie');\n const hasSessionCookie = !!cookieHeader?.split(';').some(pair => {\n const [key] = pair.trim().split('=');\n return key?.trim() === cookieName;\n });\n if (hasSessionCookie) return;\n\n // Tokens containing \".\" are already signed (and may be URI-encoded).\n let cookieValue = token.includes('.') ? (token.includes('%') ? tryDecode(token) : token) : token;\n if (!token.includes('.') && secret) {\n cookieValue = `${token}.${await makeSignature(token, secret)}`;\n }\n\n const existingCookies = cookieHeader ? `${cookieHeader}; ` : '';\n headers.set('Cookie', `${existingCookies}${cookieName}=${encodeURIComponent(cookieValue)}`);\n }\n\n /**\n * Authenticate a bearer token by verifying the session with Better Auth.\n *\n * This method extracts the session from the request headers using\n * Better Auth's `api.getSession()` endpoint. Raw (unsigned) session tokens —\n * as returned by `signIn`/`signUp` — are signed before being passed to\n * Better Auth as a session cookie, matching the bearer plugin's semantics.\n *\n * @param token - The bearer token (session token) to authenticate\n * @param request - The request containing headers\n * @returns The authenticated user and session, or null if authentication fails\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<BetterAuthUser | null> {\n try {\n await this.#ensureDbReady();\n\n // Better Auth's api.getSession() reads session tokens from the Cookie header\n const headers = new Headers();\n\n const cookieHeader = getRequestHeader(request, 'Cookie');\n if (cookieHeader) {\n headers.set('Cookie', cookieHeader);\n }\n\n // Convert Bearer token to a signed session cookie if not already present.\n // better-auth ignores the Authorization header — it only reads from Cookie.\n await this.ensureSessionCookie(headers, token);\n\n const result = await this.auth.api.getSession({\n headers,\n });\n\n if (!result || !result.session || !result.user) {\n return null;\n }\n\n // Better-auth never populates `activeOrganizationId` unless the host app\n // wires the organization plugin's `setActive` itself, which leaves every\n // org-scoped consumer with a user that has no organization. Resolve a\n // default from the user's existing memberships (read-only; the session\n // row is not mutated). See mastra-ai/mastra#21481.\n let session: BetterAuthUser['session'] = result.session;\n if (!session.activeOrganizationId) {\n const organizationId = await this.#resolveActiveOrganizationId(result.user.id);\n if (organizationId) session = { ...session, activeOrganizationId: organizationId };\n }\n\n return {\n session,\n user: result.user,\n };\n } catch {\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * By default, any authenticated user with a valid session is authorized.\n * You can override this behavior by providing a custom `authorizeUser` function\n * in the constructor options.\n *\n * @param user - The authenticated user and session\n * @returns True if the user is authorized, false otherwise\n */\n async authorizeUser(user: BetterAuthUser): Promise<boolean> {\n // By default, any authenticated user with a valid session is authorized\n return !!user?.session?.id && !!user?.user?.id;\n }\n\n // ============================================\n // ICredentialsProvider implementation (EE capability)\n // License check happens in buildCapabilities()\n // ============================================\n\n /**\n * Sign in with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param request - Incoming HTTP request\n * @returns Result with user and session cookies\n * @throws Error if credentials are invalid\n */\n async signIn(email: string, password: string, request: Request): Promise<CredentialsResult<EEUser>> {\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signInEmail({\n body: { email, password },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Invalid email or password');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Invalid email or password');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Sign up with email and password.\n * Implements ICredentialsProvider for EE credentials auth.\n *\n * @param email - User email\n * @param password - User password\n * @param name - Optional display name\n * @param request - Incoming HTTP request\n * @returns Result with new user and session cookies\n * @throws Error if sign up fails\n */\n async signUp(\n email: string,\n password: string,\n name: string | undefined,\n request: Request,\n ): Promise<CredentialsResult<EEUser>> {\n const displayName = name ?? email.split('@')[0] ?? 'User';\n const headers = request?.headers ?? new Headers();\n\n // Use asResponse: true to get the full response with Set-Cookie headers\n const response = await this.auth.api.signUpEmail({\n body: { email, password, name: displayName },\n headers,\n asResponse: true,\n });\n\n if (!response.ok) {\n const errorData = (await response.json().catch(() => ({}))) as { message?: string };\n throw new Error(errorData.message || 'Failed to create account');\n }\n\n const result = (await response.json()) as { user?: User; token?: string | null };\n\n if (!result?.user) {\n throw new Error('Failed to create account');\n }\n\n // Extract Set-Cookie headers from Better Auth response\n const cookies: string[] = [];\n const setCookieHeader = response.headers.get('set-cookie');\n if (setCookieHeader) {\n // Split multiple cookies (they may be comma-separated or in multiple headers)\n cookies.push(...setCookieHeader.split(/,(?=\\s*\\w+=)/));\n }\n\n return {\n user: mapBetterAuthUserToEEUser(result.user),\n token: result.token ?? undefined,\n cookies,\n };\n }\n\n /**\n * Get the underlying Better Auth instance.\n * Useful for accessing Better Auth APIs directly.\n */\n getAuth(): Auth {\n return this.auth;\n }\n\n /**\n * Get headers to clear the session cookies on logout.\n * Partial ISessionProvider implementation for logout support.\n *\n * Clears Better Auth's default session cookies.\n */\n getClearSessionHeaders(): Record<string, string> {\n // Cross-site deploys set the session cookie with SameSite=None; Secure —\n // the clearing cookie must match those attributes to overwrite it.\n const sameSite = this.#crossSite ? 'None; Secure' : 'Lax';\n // Clear both the session token and its signature cookie\n const cookies = [\n `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0`,\n ];\n return {\n 'Set-Cookie': cookies.join(', '),\n };\n }\n}\n"],"mappings":";;;;;;AACA,SAAS,sBAAsB,SAAS,MAAM;CAC7C,MAAM,iBAAiB,KAAK,YAAY;CACxC,MAAM,cAAc,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,MAAM,cAAc;CAC3F,MAAM,QAAQ,gBAAgB,KAAK,IAAI,KAAK,IAAI,QAAQ;CACxD,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,MAAM,OAAO,SAAS;AAC3D;;;;;AAKA,SAAS,iBAAiB,SAAS,MAAM;CACxC,IAAI,mBAAmB,SAAS,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAC/D,IAAI,QAAQ,eAAe,SAAS,OAAO,QAAQ,IAAI,QAAQ,IAAI,IAAI;CACvE,MAAM,UAAU,QAAQ;CACxB,IAAI,mBAAmB,SAAS,OAAO,QAAQ,IAAI,IAAI;CACvD,IAAI,OAAO,QAAQ,WAAW,YAAY,OAAO,QAAQ,OAAO,IAAI,KAAK;CACzE,IAAI,WAAW,OAAO,YAAY,UAAU,OAAO,sBAAsB,SAAS,IAAI;CACtF,OAAO;AACR;;;;;;;;ACTA,SAAS,uBAAuB,KAAK,OAAO,UAAU;CACrD,IAAI,CAAC,KAAK,QAAQ,QAAQ;CAC1B,IAAI;EACH,MAAM,cAAc;EACpB,IAAI,WAAW,CAAC,EAAE,MAAM,MAAM,SAAS;GACtC,GAAG,YAAY,OAAO,KAAK,IAAI,EAAE,SAAS,YAAY,GAAG,IAAI,CAAC;GAC9D,GAAG,YAAY,WAAW,KAAK,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;GACrE,GAAG,YAAY,aAAa,KAAK,IAAI,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;GAC3E,GAAG,YAAY,YAAY,KAAK,IAAI,EAAE,SAAS,YAAY,QAAQ,IAAI,CAAC;GACxE,GAAG,MAAM,iBAAiB,QAAQ,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,CAAC;GACpE,GAAG;EACJ,CAAC;CACF,QAAQ,CAAC;AACV;;;;;;;AAOA,SAAS,mBAAmB,MAAM;CACjC,MAAM,aAAa,KAAK,MAAM,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,MAAM;CAC/H,MAAM,WAAW,KAAK,MAAM,QAAQ,eAAe,KAAK;CACxD,MAAM,YAAY,KAAK,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,QAAQ;CAC7E,IAAI,CAAC,cAAc,CAAC,YAAY,UAAU,WAAW,GAAG,OAAO,KAAK;CACpE,OAAO;EACN,GAAG,cAAc,CAAC;EAClB,GAAG,WAAW,EAAE,OAAO;GACtB,MAAM,SAAS;GACf,SAAS,SAAS;GAClB,OAAO,SAAS;EACjB,EAAE,IAAI,CAAC;EACP,GAAG,UAAU,SAAS,IAAI,EAAE,MAAM,UAAU,IAAI,CAAC;CAClD;AACD;AAGA,MAAM,mBAAmB;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACT,SAAS;CACT,UAAU;CACV,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,cAAc;CACd,QAAQ;CACR,WAAW;CACX,SAAS;AACV;AACA,MAAM,WAAW;CAChB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,MAAM;AACP;AAiCA,IAAI,eAAe,MAAM;CACxB;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,QAAQ,QAAQ,SAAS,SAAS;EACvC,KAAK,aAAa,IAAI,IAAI,OAAO,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAAC;CACnE;CACA,gBAAgB;EACf,OAAO,KAAK;CACb;CACA,eAAe,QAAQ,WAAW,CAAC;CACnC,MAAM,SAAS,aAAa,QAAQ;EACnC,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,GAAG,OAAO;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,WAAW,MAAM,KAAK;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,EAAE,aAAa,OAAO,UAAU,QAAQ,UAAU,SAAS,MAAM,WAAW;EACjG,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,OAAO,OAAO;GACvE,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,kBAAkB;GACzD;GACA;GACA;GACA;GACA;GACA;GACA;EACD,CAAC,KAAK;GACL,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;CACD;AACD;AACA,IAAI,gBAAgB,MAAM,sBAAsB,aAAa;CAC5D;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,MAAM,OAAO;EACb,KAAK,YAAY,QAAQ;EACzB,KAAK,SAAS,QAAQ;CACvB;;;;;;CAMA,sBAAsB,KAAK;EAC1B,KAAK,kBAAkB;CACxB;CACA,MAAM,qBAAqB;EAC1B,MAAM,YAAY,OAAO,wBAAwB,WAAW,sBAAsB,qBAAqB,aAAa,KAAK;EACzH,MAAM,QAAQ,IAAI,cAAc;GAC/B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ;GACA,QAAQ,KAAK;EACd,CAAC;EACD,IAAI,KAAK,iBAAiB,MAAM,sBAAsB,KAAK,eAAe;EAC1E,OAAO;CACR;;;;;CAKA,WAAW,MAAM;EAChB,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,QAAQ,aAAa,OAAO;EACtC,IAAI;GACH,MAAM,SAAS,IAAI,mBAAmB;GACtC,OAAO,SAAS,CAAC,GAAG,MAAM,MAAM,IAAI;EACrC,QAAQ;GACP,OAAO;EACR;CACD;;;;;;CAMA,QAAQ,OAAO,SAAS,MAAM;EAC7B,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,QAAQ,QAAQ;EAC1B,IAAI;GACH,IAAI,WAAW,CAAC,GAAG,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;EAC5D,QAAQ,CAAC;CACV;CACA,UAAU,OAAO,SAAS,MAAM;EAC/B,IAAI,CAAC,KAAK,QAAQ,OAAO;EACzB,IAAI;GACH,OAAO,KAAK,OAAO;IAClB,WAAW,KAAK;IAChB;IACA;IACA;GACD,CAAC;EACF,SAAS,GAAG;GACX,QAAQ,MAAM,uCAAuC,KAAK,UAAU,SAAS,MAAM,IAAI,CAAC;GACxF,OAAO;EACR;CACD;CACA,SAAS;EACR,OAAO,KAAK,YAAY,IAAI,KAAK,UAAU,MAAM;CAClD;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,IAAI,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACvJ,KAAK,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACxL,KAAK,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EACxN,KAAK,QAAQ,QAAQ,SAAS,IAAI;CACnC;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,KAAK,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,KAAK,WAAW,IAAI,CAAC;EAC3P,KAAK,QAAQ,SAAS,SAAS,IAAI;CACpC;CACA,eAAe,OAAO,UAAU;EAC/B,uBAAuB,KAAK,iBAAiB,OAAO,QAAQ;CAC7D;CACA,MAAM,SAAS,cAAc,SAAS;EACrC,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,SAAS,QAAQ;GACvB,SAAS,SAAS,WAAW;GAC7B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,OAAO;EAC5B,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,MAAM,QAAQ;GACpB,SAAS,MAAM,WAAW;GAC1B,SAAS;EACV;CACD;AACD;;;AC5QA,IAAI,aAAa,MAAM;CACtB,YAAY,iBAAiB;CAC7B;CACA;CACA;CACA,YAAY,EAAE,WAAW,MAAM,aAAa;EAC3C,KAAK,YAAY,aAAa,iBAAiB;EAC/C,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC;CAC7E;;;;;CAKA,cAAc;EACb,OAAO,KAAK;CACb;;;;;CAKA,eAAe,WAAW;EACzB,KAAK,aAAa;CACnB;;;;;CAKA,YAAY,QAAQ;EACnB,KAAK,SAAS,WAAW,UAAU,OAAO,OAAO,UAAU,aAAa,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI;CACvH;AACD;;;AC/BA,IAAI,qBAAqB,cAAc,WAAW;CACjD;CACA;CACA,YAAY,SAAS;EACpB,MAAM;GACL,WAAW;GACX,MAAM,SAAS;EAChB,CAAC;EACD,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ,cAAc,KAAK,IAAI;EAChF,KAAK,YAAY,SAAS;EAC1B,KAAK,SAAS,SAAS;EACvB,KAAK,sBAAsB,SAAS;CACrC;CACA,gBAAgB,MAAM;EACrB,IAAI,MAAM,eAAe,KAAK,gBAAgB,KAAK,cAAc,KAAK,IAAI;EAC1E,IAAI,MAAM,qBAAqB,KAAK,sBAAsB,KAAK;EAC/D,IAAI,MAAM,WAAW,KAAK,YAAY,KAAK;EAC3C,IAAI,MAAM,QAAQ,KAAK,SAAS,KAAK;CACtC;AACD;;;ACEA,SAAS,UAAU,OAAuB;CACxC,IAAI;EACF,OAAO,mBAAmB,KAAK;CACjC,QAAQ;EACN,OAAO;CACT;AACF;;;;AAoBA,SAAS,0BAA0B,MAAoB;CACrD,OAAO;EACL,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,WAAW,KAAK,SAAS,KAAA;EACzB,UAAU;GACR,eAAe,KAAK;GACpB,WAAW,KAAK;GAChB,WAAW,KAAK;EAClB;CACF;AACF;;;;;;;AAiCA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DzB,IAAa,uBAAb,cACU,mBAEV;CACE;CACA;;CAEA,gBAAgB;;CAEhB;;;;;;;;;CASA,4BAAY,IAAI,IAAkD;CAElE,aAAa,QAAoC;EAC/C,MAAM,QAAQ,KAAK,UAAU,IAAI,MAAM;EACvC,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,IAAI,KAAK,IAAI,KAAK,MAAM,WAAW;GACjC,KAAK,UAAU,OAAO,MAAM;GAC5B;EACF;EACA,OAAO,MAAM;CACf;;;;;;;;CASA,YAAY,QAAgB,OAAqB;EAC/C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,CAAC,KAAK,UAAU,KAAK,WAAW;GACzC,IAAI,MAAM,MAAM,WAAW;GAC3B,KAAK,UAAU,OAAO,GAAG;EAC3B;EACA,KAAK,UAAU,OAAO,MAAM;EAC5B,KAAK,UAAU,IAAI,QAAQ;GAAE;GAAO,WAAW,MAAM;EAAiB,CAAC;CACzE;;CAGA,IAAI,eAAuB;EACzB,OAAO,KAAK,UAAU;CACxB;;CAEA,aAAa;CACb;CAEA,YAAY,SAAsC;EAChD,MAAM,EAAE,MAAM,SAAS,QAAQ,cAAc,CAAC;EAE9C,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,MACR,iOAEF;EAGF,KAAK,QAAQ,QAAQ;EACrB,KAAK,UAAU,QAAQ;EACvB,KAAK,sBAAsB,QAAQ,iBAAiB;EAEpD,KAAK,gBAAgB,OAAO;CAC9B;;;;;CAMA,IAAc,OAAa;EACzB,IAAI,CAAC,KAAK,OACR,MAAM,IAAI,MACR,yGACF;EAEF,OAAO,KAAK;CACd;;;;;;CAOA,IAAI,oBAA4B;EAC9B,MAAM,UAAW,KAAK,OAClB;EACJ,MAAM,WAAW,SAAS;EAO1B,MAAM,SAAS,UAAU,gBAAgB;EACzC,MAAM,SAAS,UAAU,oBAAoB,SAAS,SAAS,WAAW,UAAU,KAAK;EACzF,MAAM,WAAW,UAAU,SAAS,eAAe,QAAQ,GAAG,OAAO;EACrE,OAAO,GAAG,SAAS,cAAc,KAAK;CACxC;;;;;;;;;;CAeA,MAAM,KAAK,KAAqC;EAC9C,KAAK,cAAc,IAAI,gBAAgB,UAAU,KAAK;EACtD,IAAI,KAAK,OAAO;EAEhB,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,QACH,MAAM,IAAI,MACR,0MAEF;EAKF,MAAM,WACJ,OAAO,YAAY,aACd,OAAO,OACR,OAAO,YAAY,WACjB;GACE,SAAS,IAAI,cAAc,EAAE,QAAQ,OAAO,OAAO,CAAmD;GACtG,MAAM;EACR,IACC,OAAO;EAChB,MAAM,iBAAiB,IAAI,kBAAkB,CAAC;EAI9C,MAAM,UAA6B;GACjC;GACA,QAAQ,KAAK;GAGb,UAAU;GACV,GAAI,IAAI,YAAY,EAAE,SAAS,IAAI,UAAU,IAAI,CAAC;GAIlD,GAAI,eAAe,SAAS,EAAE,gBAAgB,eAAe,IAAI,CAAC;GAClE,kBAAkB;IAAE,SAAS;IAAM,eAAe,CAAC,KAAK;GAAoB;GAC5E,SAAS,CAAC,aAAa,CAAC;GAGxB,GAAI,KAAK,aAAa,EAAE,UAAU,EAAE,yBAAyB;IAAE,UAAU;IAAQ,QAAQ;GAAK,EAAE,EAAE,IAAI,CAAC;EACzG;EACA,KAAK,QAAQ,WAAW,OAAO;EAC/B,KAAK,gBAAgB;CACvB;;;;;CAMA,MAAM,iBAAgC;EACpC,IAAI,CAAC,KAAK,eAAe;EACzB,KAAK,eAAe,YAAY;GAC9B,MAAM,EAAE,kBAAkB,MAAM,cAAc,KAAK,KAAK,OAA4B;GACpF,MAAM,cAAc;EACtB,EAAA,CAAG;EACH,IAAI;GACF,MAAM,KAAK;EACb,SAAS,OAAO;GACd,KAAK,YAAY,KAAA;GACjB,QAAQ,KAAK,gGAAgG;GAC7G,MAAM;EACR;CACF;;;;;CAUA,MAAM,kBAAkB,SAAqC;EAC3D,IAAI;GACF,MAAM,KAAK,eAAe;EAC5B,QAAQ;GACN,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,mBAAmB,CAAC,GAAG;IACjE,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;GAChD,CAAC;EACH;EACA,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;;;;;;CAWA,MAAM,qBAAqB,KAAwB,QAA6C;EAM9F,MAAM,SAAQ,MALa,IAAI,QAAQ,SAAS;GAC9C,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAU,OAAO;GAAO,CAAC;GAC1C,QAAQ;IAAE,OAAO;IAAa,WAAW;GAAM;EACjD,CAAC,EAAA,CACyB,MAAK,MAAK,EAAE,cAAc,CAAC,EAAE;EACvD,IAAI,OAAO,KAAK,YAAY,QAAQ,KAAK;EACzC,OAAO;CACT;;;;;;;;;;;CAYA,MAAM,6BAA6B,QAA6C;EAC9E,MAAM,SAAS,KAAK,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EACnB,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GACjB,OAAO,MAAM,KAAK,qBAAqB,KAAK,MAAM;EACpD,QAAQ;GACN;EACF;CACF;;;;;;;;;;;;;;;;CAiBA,MAAM,mBAAmB,QAA6C;EACpE,MAAM,SAAS,KAAK,aAAa,MAAM;EACvC,IAAI,QAAQ,OAAO;EAEnB,IAAI;GACF,MAAM,KAAK,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO,KAAA;GAEjB,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,KAAK,MAAM;GACjE,IAAI,eAAe,OAAO;GAG1B,MAAM,aAAa,MAAM,IAAI,gBAAgB,aAAa,MAAM,CAAC,CAAC,YAAY,IAAI;GAElF,MAAM,UAAU,GADF,YAAY,SAAS,YAAY,QAAQ,OAC9B;GACzB,MAAM,iBAAiB;IACrB,MAAM;IACN,2BAAW,IAAI,KAAK;IACpB,UAAU,KAAK,UAAU,EAAE,mBAAmB,OAAO,CAAC;GACxD;GAKA,MAAM,OAAO,YAAY;GACzB,IAAI;GACJ,IAAI;IAKF,kBAAiB,MAJM,IAAI,QAAQ,OAAO;KACxC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG;KAAK;IAC7B,CAAC,EAAA,CACwB;GAC3B,SAAS,OAAO;IACd,MAAM,WAAY,MAAM,IAAI,QAAQ,QAAQ;KAC1C,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAQ,OAAO;KAAK,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,UAAU,MAAM;IASrB,KADsB,MAJS,IAAI,QAAQ,SAAS;KAClD,OAAO;KACP,OAAO,CAAC;MAAE,OAAO;MAAkB,OAAO,SAAS;KAAG,CAAC;IACzD,CAAC,EAAA,CACqC,MAAK,MAAK,EAAE,WAAW,MAC7C,GAKd,kBAAiB,MAJO,IAAI,QAAQ,OAAO;KACzC,OAAO;KACP,MAAM;MAAE,GAAG,QAAQ;MAAG,MAAM,YAAY,OAAO,GAAG,OAAO,WAAW;KAAI;IAC1E,CAAC,EAAA,CACyB;SAE1B,iBAAiB,SAAS;GAE9B;GAIA,IAAI;IACF,MAAM,IAAI,QAAQ,OAAO;KACvB,OAAO;KACP,MAAM;MAAE;MAAgB;MAAQ,MAAM;MAAS,2BAAW,IAAI,KAAK;KAAE;IACvE,CAAC;GACH,SAAS,OAAO;IAQd,IAAI,CAAC,MAPgB,IAAI,QAAQ,QAAQ;KACvC,OAAO;KACP,OAAO,CACL;MAAE,OAAO;MAAkB,OAAO;KAAe,GACjD;MAAE,OAAO;MAAU,OAAO;KAAO,CACnC;IACF,CAAC,GACY,MAAM;GACrB;GAEA,KAAK,YAAY,QAAQ,cAAc;GACvC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,KACN,mEAAmE,OAAO,iEAE1E,KACF;GACA;EACF;CACF;;;;;CAMA,MAAM,oBAAoB,gBAAwB,QAAkC;EAClF,IAAI;GACF,MAAM,KAAK,eAAe;GAC1B,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GACjB,MAAM,aAAc,MAAM,IAAI,QAAQ,QAAQ;IAC5C,OAAO;IACP,OAAO,CACL;KAAE,OAAO;KAAkB,OAAO;IAAe,GACjD;KAAE,OAAO;KAAU,OAAO;IAAO,CACnC;GACF,CAAC;GACD,OAAO,YAAY,SAAS,WAAW,YAAY,SAAS;EAC9D,QAAQ;GACN,OAAO;EACT;CACF;;;;;CAMA,kBAA2B;EACzB,OAAO,KAAK;CACd;;;;;;;;;;;CAiBA,MAAM,eAAe,SAA0C;EAC7D,IAAI;GACF,MAAM,KAAK,eAAe;GAC1B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;GAI3C,MAAM,aAAa,QAAQ,IAAI,eAAe;GAC9C,MAAM,cACJ,cAAc,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,MAAM,YAAY,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,KAAA;GAClG,MAAM,KAAK,oBAAoB,SAAS,WAAW;GAEnD,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,QAAQ,MAAM,OAAO;GAC1B,OAAO,0BAA0B,OAAO,IAAI;EAC9C,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,QAAQ,QAAwC;EACpD,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,eAAe;GACtC,IAAI,CAAC,KAAK,OAAO;GAEjB,MAAM,OAAO,MAAM,IAAI,gBAAgB,aAAa,MAAM;GAC1D,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,0BAA0B,IAAI;EACvC,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;CASA,MAAM,SAAS,SAAkD;EAC/D,OAAO,QAAQ,IAAI,QAAQ,KAAI,WAAU,KAAK,QAAQ,MAAM,CAAC,CAAC;CAChE;;;;;CAMA,kBAAkB,MAAsB;EACtC,OAAO,YAAY,KAAK;CAC1B;;;;;CAMA,MAAc,iBAAoD;EAChE,IAAI;GACF,OAAQ,MAAM,QAAQ,QAAQ,KAAK,KAAK,QAAQ,KAAM;EACxD,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;CAWA,MAAc,oBAAoB,SAAkB,OAA0C;EAC5F,IAAI,CAAC,OAAO;EAEZ,MAAM,MAAM,MAAM,KAAK,eAAe;EACtC,MAAM,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK;EAC9D,MAAM,SAAS,KAAK;EAEpB,MAAM,eAAe,QAAQ,IAAI,QAAQ;EAKzC,IAAI,CAJsB,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,MAAK,SAAQ;GAC/D,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG;GACnC,OAAO,KAAK,KAAK,MAAM;EACzB,CAAC,GACqB;EAGtB,IAAI,cAAc,MAAM,SAAS,GAAG,IAAK,MAAM,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI,QAAS;EAC3F,IAAI,CAAC,MAAM,SAAS,GAAG,KAAK,QAC1B,cAAc,GAAG,MAAM,GAAG,MAAM,cAAc,OAAO,MAAM;EAG7D,MAAM,kBAAkB,eAAe,GAAG,aAAa,MAAM;EAC7D,QAAQ,IAAI,UAAU,GAAG,kBAAkB,WAAW,GAAG,mBAAmB,WAAW,GAAG;CAC5F;;;;;;;;;;;;;CAcA,MAAM,kBAAkB,OAAe,SAA4D;EACjG,IAAI;GACF,MAAM,KAAK,eAAe;GAG1B,MAAM,UAAU,IAAI,QAAQ;GAE5B,MAAM,eAAe,iBAAiB,SAAS,QAAQ;GACvD,IAAI,cACF,QAAQ,IAAI,UAAU,YAAY;GAKpC,MAAM,KAAK,oBAAoB,SAAS,KAAK;GAE7C,MAAM,SAAS,MAAM,KAAK,KAAK,IAAI,WAAW,EAC5C,QACF,CAAC;GAED,IAAI,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,OAAO,MACxC,OAAO;GAQT,IAAI,UAAqC,OAAO;GAChD,IAAI,CAAC,QAAQ,sBAAsB;IACjC,MAAM,iBAAiB,MAAM,KAAK,6BAA6B,OAAO,KAAK,EAAE;IAC7E,IAAI,gBAAgB,UAAU;KAAE,GAAG;KAAS,sBAAsB;IAAe;GACnF;GAEA,OAAO;IACL;IACA,MAAM,OAAO;GACf;EACF,QAAQ;GACN,OAAO;EACT;CACF;;;;;;;;;;;CAYA,MAAM,cAAc,MAAwC;EAE1D,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM;CAC9C;;;;;;;;;;;CAiBA,MAAM,OAAO,OAAe,UAAkB,SAAsD;EAClG,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;GAAS;GACxB;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,2BAA2B;EAClE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,2BAA2B;EAI7C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;;;;;;;;CAaA,MAAM,OACJ,OACA,UACA,MACA,SACoC;EACpC,MAAM,cAAc,QAAQ,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;EACnD,MAAM,UAAU,SAAS,WAAW,IAAI,QAAQ;EAGhD,MAAM,WAAW,MAAM,KAAK,KAAK,IAAI,YAAY;GAC/C,MAAM;IAAE;IAAO;IAAU,MAAM;GAAY;GAC3C;GACA,YAAY;EACd,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAa,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;GACzD,MAAM,IAAI,MAAM,UAAU,WAAW,0BAA0B;EACjE;EAEA,MAAM,SAAU,MAAM,SAAS,KAAK;EAEpC,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,MAAM,0BAA0B;EAI5C,MAAM,UAAoB,CAAC;EAC3B,MAAM,kBAAkB,SAAS,QAAQ,IAAI,YAAY;EACzD,IAAI,iBAEF,QAAQ,KAAK,GAAG,gBAAgB,MAAM,cAAc,CAAC;EAGvD,OAAO;GACL,MAAM,0BAA0B,OAAO,IAAI;GAC3C,OAAO,OAAO,SAAS,KAAA;GACvB;EACF;CACF;;;;;CAMA,UAAgB;EACd,OAAO,KAAK;CACd;;;;;;;CAQA,yBAAiD;EAG/C,MAAM,WAAW,KAAK,aAAa,iBAAiB;EAMpD,OAAO,EACL,cAAc,CAJd,GAAG,KAAK,kBAAkB,gCAAgC,SAAS,cACnE,GAAG,KAAK,kBAAkB,oCAAoC,SAAS,YAGnD,CAAC,CAAC,KAAK,IAAI,EACjC;CACF;AACF"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mastra/auth-better-auth",
3
- "version": "1.1.8-alpha.0",
3
+ "version": "1.1.8",
4
4
  "description": "Mastra Better Auth integration - self-hosted authentication",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -30,13 +30,12 @@
30
30
  "@types/node": "22.20.1",
31
31
  "@vitest/coverage-v8": "4.1.11",
32
32
  "@vitest/ui": "4.1.11",
33
- "eslint": "^10.7.0",
34
33
  "tsdown": "0.22.9",
35
34
  "typescript": "^7.0.2",
36
35
  "vitest": "4.1.11",
37
- "@internal/auth": "0.0.34",
38
- "@internal/types-builder": "0.0.119",
39
- "@internal/lint": "0.0.144"
36
+ "@internal/lint": "0.0.145",
37
+ "@internal/types-builder": "0.0.120",
38
+ "@internal/auth": "0.0.34"
40
39
  },
41
40
  "files": [
42
41
  "dist"
@@ -57,7 +56,7 @@
57
56
  "build": "tsdown --silent --config tsdown.config.ts",
58
57
  "build:watch": "tsdown --watch --silent --config tsdown.config.ts",
59
58
  "test": "vitest run",
60
- "lint": "oxlint . && eslint .",
61
- "lint:fix": "oxlint --fix . && eslint --fix ."
59
+ "lint": "oxlint --type-aware .",
60
+ "lint:fix": "oxlint --type-aware --fix ."
62
61
  }
63
62
  }