@mastra/auth-cloud 1.2.0 → 1.2.1-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @mastra/auth-cloud
 
+## 1.2.1-alpha.0
+
+### Patch Changes
+
+- Improved auth package builds by removing the direct core dependency from auth providers while preserving the existing public auth APIs. ([#17142](https://github.com/mastra-ai/mastra/pull/17142))
+
+- Updated dependencies [[`5c0df77`](https://github.com/mastra-ai/mastra/commit/5c0df776c40efa420f8c07a2f3ee66010296618e)]:
+  - @mastra/auth@1.1.1-alpha.0
+
 ## 1.2.0
 
 ### Minor Changes

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/base/index.d.ts

@@ -0,0 +1,31 @@
+import { RegisteredLogger, IMastraLogger } from '../logger/index.js';
+import 'node:stream';
+
+declare class MastraBase {
+    #private;
+    component: RegisteredLogger;
+    protected logger: IMastraLogger;
+    name?: string;
+    constructor({ component, name, rawConfig, }: {
+        component?: RegisteredLogger;
+        name?: string;
+        rawConfig?: Record<string, unknown>;
+    });
+    /**
+     * Returns the raw storage configuration this primitive was created from,
+     * or undefined if it was created from code.
+     */
+    toRawConfig(): Record<string, unknown> | undefined;
+    /**
+     * Sets the raw storage configuration for this primitive.
+     * @internal
+     */
+    __setRawConfig(rawConfig: Record<string, unknown>): void;
+    /**
+     * Set the logger for the agent
+     * @param logger
+     */
+    __setLogger(logger: IMastraLogger): void;
+}
+
+export { MastraBase };

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/logger/index.d.ts

@@ -0,0 +1,217 @@
+import { Transform } from 'node:stream';
+
+declare const RegisteredLogger: {
+    readonly AGENT: "AGENT";
+    readonly OBSERVABILITY: "OBSERVABILITY";
+    readonly AUTH: "AUTH";
+    readonly BROWSER: "BROWSER";
+    readonly NETWORK: "NETWORK";
+    readonly WORKFLOW: "WORKFLOW";
+    readonly LLM: "LLM";
+    readonly TTS: "TTS";
+    readonly VOICE: "VOICE";
+    readonly VECTOR: "VECTOR";
+    readonly BUNDLER: "BUNDLER";
+    readonly DEPLOYER: "DEPLOYER";
+    readonly MEMORY: "MEMORY";
+    readonly STORAGE: "STORAGE";
+    readonly EMBEDDINGS: "EMBEDDINGS";
+    readonly MCP_SERVER: "MCP_SERVER";
+    readonly SERVER_CACHE: "SERVER_CACHE";
+    readonly SERVER: "SERVER";
+    readonly WORKSPACE: "WORKSPACE";
+    readonly CHANNEL: "CHANNEL";
+};
+type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];
+declare const LogLevel: {
+    readonly DEBUG: "debug";
+    readonly INFO: "info";
+    readonly WARN: "warn";
+    readonly ERROR: "error";
+    readonly NONE: "silent";
+};
+type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];
+interface BaseLogMessage {
+    runId?: string;
+    msg: string;
+    level: LogLevel;
+    time: Date;
+    pid: number;
+    hostname: string;
+    name: string;
+}
+declare abstract class LoggerTransport extends Transform {
+    constructor(opts?: any);
+    listLogsByRunId(_args: {
+        runId: string;
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: BaseLogMessage[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+    listLogs(_args?: {
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        returnPaginationResults?: boolean;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: BaseLogMessage[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+}
+declare const createCustomTransport: (stream: Transform, listLogs?: LoggerTransport["listLogs"], listLogsByRunId?: LoggerTransport["listLogsByRunId"]) => LoggerTransport;
+interface IMastraLogger {
+    debug(message: string, ...args: any[]): void;
+    info(message: string, ...args: any[]): void;
+    warn(message: string, ...args: any[]): void;
+    error(message: string, ...args: any[]): void;
+    trackException(error: Error, metadata?: Record<string, unknown>): void;
+    getTransports(): Map<string, LoggerTransport>;
+    listLogs(_transportId: string, _params?: {
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: BaseLogMessage[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+    listLogsByRunId(_args: {
+        transportId: string;
+        runId: string;
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: BaseLogMessage[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+}
+declare abstract class MastraLogger implements IMastraLogger {
+    protected name: string;
+    protected level: LogLevel;
+    protected transports: Map<string, LoggerTransport>;
+    constructor(options?: {
+        name?: string;
+        level?: LogLevel;
+        transports?: Record<string, LoggerTransport>;
+    });
+    abstract debug(message: string, ...args: any[]): void;
+    abstract info(message: string, ...args: any[]): void;
+    abstract warn(message: string, ...args: any[]): void;
+    abstract error(message: string, ...args: any[]): void;
+    getTransports(): Map<string, LoggerTransport>;
+    trackException(_error: Error, _metadata?: Record<string, unknown>): void;
+    listLogs(transportId: string, params?: {
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: BaseLogMessage[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+    listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage, }: {
+        transportId: string;
+        runId: string;
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: BaseLogMessage[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+}
+type LogFilterContext = {
+    component?: RegisteredLogger;
+    level: LogLevel;
+    message: string;
+    args: unknown[];
+};
+type LogFilter = (ctx: LogFilterContext) => boolean;
+interface ConsoleLoggerOptions {
+    name?: string;
+    level?: LogLevel;
+    component?: RegisteredLogger;
+    filter?: LogFilter;
+}
+declare class ConsoleLogger extends MastraLogger {
+    protected component?: RegisteredLogger;
+    protected filter?: LogFilter;
+    constructor(options?: ConsoleLoggerOptions);
+    child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger;
+    private shouldLog;
+    private prefix;
+    debug(message: string, ...args: any[]): void;
+    info(message: string, ...args: any[]): void;
+    warn(message: string, ...args: any[]): void;
+    error(message: string, ...args: any[]): void;
+    listLogs(_transportId: string, _params?: {
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: never[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+    listLogsByRunId(_args: {
+        transportId: string;
+        runId: string;
+        fromDate?: Date;
+        toDate?: Date;
+        logLevel?: LogLevel;
+        filters?: Record<string, any>;
+        page?: number;
+        perPage?: number;
+    }): Promise<{
+        logs: never[];
+        total: number;
+        page: number;
+        perPage: number;
+        hasMore: boolean;
+    }>;
+}
+
+export { type BaseLogMessage, ConsoleLogger, type ConsoleLoggerOptions, type IMastraLogger, type LogFilter, type LogFilterContext, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, createCustomTransport };

package/dist/_types/@internal_auth/dist/ee/capabilities.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Capabilities detection and response building for EE authentication.
+ */
+import type { MastraAuthProvider } from '../provider/index.js';
+import type { IFGAProvider } from './interfaces/fga.js';
+import type { IRBACProvider } from './interfaces/rbac.js';
+import type { EEUser } from './interfaces/user.js';
+/**
+ * Public capabilities response (no authentication required).
+ * Contains just enough info to render the login page.
+ */
+export interface PublicAuthCapabilities {
+    /** Whether auth is enabled */
+    enabled: boolean;
+    /** Login configuration (null if no auth or no SSO) */
+    login: {
+        /** Type of login available */
+        type: 'sso' | 'credentials' | 'both';
+        /** Whether sign-up is enabled (defaults to true) */
+        signUpEnabled?: boolean;
+        /** Optional description explaining the auth requirement and what credentials to use */
+        description?: string;
+        /** SSO configuration */
+        sso?: {
+            /** Provider name */
+            provider: string;
+            /** Button text */
+            text: string;
+            /** Icon URL */
+            icon?: string;
+            /** Description of the auth requirement */
+            description?: string;
+            /** Login URL */
+            url: string;
+        };
+    } | null;
+}
+/**
+ * User info for authenticated response.
+ */
+export interface AuthenticatedUser {
+    /** User ID */
+    id: string;
+    /** User email */
+    email?: string;
+    /** Display name */
+    name?: string;
+    /** Avatar URL */
+    avatarUrl?: string;
+}
+/**
+ * Capability flags indicating which EE features are available.
+ */
+export interface CapabilityFlags {
+    /** IUserProvider is implemented and licensed */
+    user: boolean;
+    /** ISessionProvider is implemented and licensed */
+    session: boolean;
+    /** ISSOProvider is implemented and licensed */
+    sso: boolean;
+    /** IRBACProvider is implemented and licensed */
+    rbac: boolean;
+    /** IACLProvider is implemented and licensed */
+    acl: boolean;
+    /** IFGAProvider is implemented and licensed */
+    fga: boolean;
+}
+/**
+ * User's access (roles and permissions).
+ */
+export interface UserAccess {
+    /** User's roles */
+    roles: string[];
+    /** User's resolved permissions */
+    permissions: string[];
+}
+/**
+ * Authenticated capabilities response.
+ * Extends public capabilities with user context and feature flags.
+ */
+export interface AuthenticatedCapabilities extends PublicAuthCapabilities {
+    /** Current authenticated user */
+    user: AuthenticatedUser;
+    /** Available EE capabilities */
+    capabilities: CapabilityFlags;
+    /** User's access (if RBAC available) */
+    access: UserAccess | null;
+    /** Available roles in the system (only present for admin users) */
+    availableRoles?: {
+        id: string;
+        name: string;
+    }[];
+}
+/**
+ * Type guard to check if response is authenticated.
+ */
+export declare function isAuthenticated(caps: PublicAuthCapabilities | AuthenticatedCapabilities): caps is AuthenticatedCapabilities;
+/**
+ * Options for building capabilities.
+ */
+export interface BuildCapabilitiesOptions {
+    /**
+     * RBAC provider for role-based access control (EE feature).
+     * Separate from the auth provider to allow mixing different providers.
+     *
+     * @example
+     * ```typescript
+     * const rbac = new StaticRBACProvider({
+     *   roles: DEFAULT_ROLES,
+     *   getUserRoles: (user) => [user.role],
+     * });
+     *
+     * buildCapabilities(auth, request, { rbac });
+     * ```
+     */
+    rbac?: IRBACProvider<EEUser>;
+    /**
+     * FGA provider for fine-grained authorization (EE feature).
+     * Separate from the auth provider to allow mixing different providers.
+     */
+    fga?: IFGAProvider<EEUser>;
+    /**
+     * API route prefix used to construct SSO login URLs.
+     * Defaults to `/api` when not provided.
+     *
+     * @example `/mastra` results in SSO URL `/mastra/auth/sso/login`
+     */
+    apiPrefix?: string;
+}
+/**
+ * Build capabilities response based on auth configuration and request state.
+ *
+ * This function determines what capabilities are available and, if the user
+ * is authenticated, includes their user info and access permissions.
+ *
+ * @param auth - Auth provider (or null if no auth configured)
+ * @param request - Incoming HTTP request
+ * @param options - Optional configuration (roleMapping, etc.)
+ * @returns Capabilities response (public or authenticated)
+ */
+export declare function buildCapabilities(auth: MastraAuthProvider | null, request: Request, options?: BuildCapabilitiesOptions): Promise<PublicAuthCapabilities | AuthenticatedCapabilities>;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/_types/@internal_auth/dist/ee/defaults/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Default implementations for EE authentication.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ */
+export { DEFAULT_ROLES, type Permission, type PermissionPattern, type RoleMapping, getDefaultRole, resolvePermissions, resolvePermissionsFromMapping, matchesPermission, hasPermission, } from './roles.js';
+export { StaticRBACProvider, type StaticRBACProviderOptions } from './rbac/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/ee/defaults/rbac/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * RBAC provider implementations.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ */
+export { StaticRBACProvider, type StaticRBACProviderOptions } from './static.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/ee/defaults/rbac/static.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Static RBAC provider with config-based roles.
+ */
+import type { RoleDefinition, RoleMapping, IRBACProvider } from '../../interfaces/index.js';
+/**
+ * Options for StaticRBACProvider.
+ *
+ * Use ONE of the following approaches:
+ * - `roles`: Define role structures with permissions (Mastra's native role system)
+ * - `roleMapping`: Map provider roles directly to permissions (simpler for external providers)
+ */
+export type StaticRBACProviderOptions<TUser = unknown> = {
+    /** Role definitions (Mastra's native role system) */
+    roles: RoleDefinition[];
+    /** Function to get user's role IDs */
+    getUserRoles: (user: TUser) => string[] | Promise<string[]>;
+    roleMapping?: never;
+} | {
+    /**
+     * Role mapping for translating provider roles to permissions.
+     * Use this when your identity provider has roles that need to be
+     * mapped to Mastra permissions.
+     */
+    roleMapping: RoleMapping;
+    /** Function to get user's role IDs from the provider */
+    getUserRoles: (user: TUser) => string[] | Promise<string[]>;
+    roles?: never;
+};
+/**
+ * Static RBAC provider.
+ *
+ * Supports two modes:
+ * 1. **Role definitions**: Use Mastra's native role system with structured roles
+ * 2. **Role mapping**: Directly map provider roles to permissions
+ *
+ * @example Using role definitions (Mastra's native system)
+ * ```typescript
+ * const rbac = new StaticRBACProvider({
+ *   roles: DEFAULT_ROLES,
+ *   getUserRoles: (user) => [user.role],
+ * });
+ * ```
+ *
+ * @example Using role mapping (for external providers)
+ * ```typescript
+ * const rbac = new StaticRBACProvider({
+ *   roleMapping: {
+ *     "Engineering": ["agents:*", "workflows:*"],
+ *     "Product": ["agents:read", "workflows:read"],
+ *     "_default": [],
+ *   },
+ *   getUserRoles: (user) => user.providerRoles,
+ * });
+ * ```
+ *
+ * @example Async role lookup
+ * ```typescript
+ * const rbac = new StaticRBACProvider({
+ *   roles: DEFAULT_ROLES,
+ *   getUserRoles: async (user) => {
+ *     return db.getUserRoles(user.id);
+ *   },
+ * });
+ * ```
+ */
+export declare class StaticRBACProvider<TUser = unknown> implements IRBACProvider<TUser> {
+    private roles?;
+    private _roleMapping?;
+    private getUserRolesFn;
+    private permissionCache;
+    /** Expose roleMapping for middleware access */
+    get roleMapping(): RoleMapping | undefined;
+    constructor(options: StaticRBACProviderOptions<TUser>);
+    getRoles(user: TUser): Promise<string[]>;
+    hasRole(user: TUser, role: string): Promise<boolean>;
+    getPermissions(user: TUser): Promise<string[]>;
+    hasPermission(user: TUser, permission: string): Promise<boolean>;
+    hasAllPermissions(user: TUser, permissions: string[]): Promise<boolean>;
+    hasAnyPermission(user: TUser, permissions: string[]): Promise<boolean>;
+    /**
+     * Clear the permission cache.
+     */
+    clearCache(): void;
+    /**
+     * Get all role definitions.
+     * Only available when using role definitions mode (not role mapping).
+     */
+    getRoleDefinitions(): RoleDefinition[];
+    /**
+     * Get a specific role definition.
+     * Only available when using role definitions mode (not role mapping).
+     */
+    getRoleDefinition(roleId: string): RoleDefinition | undefined;
+    /**
+     * Get all available roles in the system.
+     */
+    getAvailableRoles(): Promise<{
+        id: string;
+        name: string;
+    }[]>;
+    /**
+     * Get the resolved permissions for a specific role.
+     */
+    getPermissionsForRole(roleId: string): Promise<string[]>;
+}
+//# sourceMappingURL=static.d.ts.map

package/dist/_types/@internal_auth/dist/ee/defaults/roles.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Default roles and permissions for Mastra Studio.
+ */
+import type { RoleDefinition, RoleMapping } from '../interfaces/index.js';
+export type { RoleMapping };
+/**
+ * Default role definitions for Studio.
+ *
+ * These roles provide a sensible starting point for most applications:
+ * - **owner**: Full access to everything
+ * - **admin**: Manage agents, workflows, and users
+ * - **member**: Execute agents and workflows, read-only settings
+ * - **viewer**: Read-only access
+ *
+ * Permission patterns:
+ * - `*` - Full access to everything
+ * - `resource:*` - All actions on a specific resource
+ * - `*:action` - An action across all resources (e.g., `*:read` for read-only)
+ */
+export declare const DEFAULT_ROLES: RoleDefinition[];
+export type { Permission, PermissionPattern } from '../interfaces/permissions.generated.js';
+/**
+ * Get role by ID from default roles.
+ *
+ * @param roleId - Role ID to find
+ * @returns Role definition or undefined
+ */
+export declare function getDefaultRole(roleId: string): RoleDefinition | undefined;
+/**
+ * Resolve all permissions for a set of role IDs.
+ *
+ * Handles role inheritance and deduplication.
+ *
+ * @param roleIds - Role IDs to resolve
+ * @param roles - Role definitions (defaults to DEFAULT_ROLES)
+ * @returns Array of resolved permissions
+ */
+export declare function resolvePermissions(roleIds: string[], roles?: RoleDefinition[]): string[];
+/**
+ * Check if a permission matches (including wildcard support).
+ *
+ * Permission format: `{resource}:{action}[:{resource-id}]`
+ *
+ * Examples:
+ * - `*` matches everything
+ * - `agents:*` matches `agents:read`, `agents:read:my-agent`
+ * - `*:read` matches `agents:read`, `workflows:read` (action across all resources)
+ * - `agents:read` matches `agents:read`, `agents:read:my-agent`
+ * - `agents:read:my-agent` matches only `agents:read:my-agent`
+ * - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`
+ *
+ * @param userPermission - Permission the user has
+ * @param requiredPermission - Permission being checked
+ * @returns True if permission matches
+ */
+export declare function matchesPermission(userPermission: string, requiredPermission: string): boolean;
+/**
+ * Check if a user has a specific permission.
+ *
+ * @param userPermissions - Permissions the user has
+ * @param requiredPermission - Permission being checked
+ * @returns True if user has the permission
+ */
+export declare function hasPermission(userPermissions: string[], requiredPermission: string): boolean;
+/**
+ * Resolve permissions from user roles using a role mapping.
+ *
+ * This function translates provider-defined roles (from WorkOS, Okta, etc.)
+ * to Mastra permissions using a configurable mapping.
+ *
+ * @example
+ * ```typescript
+ * const roleMapping = {
+ *   "Engineering": ["agents:*", "workflows:*"],
+ *   "Product": ["agents:read"],
+ *   "_default": [],
+ * };
+ *
+ * // User has "Engineering" and "QA" roles
+ * const permissions = resolvePermissionsFromMapping(
+ *   ["Engineering", "QA"],
+ *   roleMapping
+ * );
+ * // Result: ["agents:*", "workflows:*"] (QA is unmapped, gets _default)
+ * ```
+ *
+ * @param roles - User's roles from the identity provider
+ * @param mapping - Role to permission mapping
+ * @returns Array of resolved permissions
+ */
+export declare function resolvePermissionsFromMapping(roles: string[], mapping: RoleMapping): string[];
+//# sourceMappingURL=roles.d.ts.map

package/dist/_types/@internal_auth/dist/ee/fga-check.d.ts

@@ -0,0 +1,62 @@
+/**
+ * FGA enforcement utility for checking fine-grained authorization.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ */
+import type { FGACheckContext, IFGAProvider } from './interfaces/fga.js';
+import type { MastraFGAPermissionInput } from './interfaces/permissions.generated.js';
+export type ActorSignal = true | {
+    actorKind: 'system';
+    sourceWorkflow?: string;
+};
+export interface CheckFGAOptions {
+    fgaProvider: IFGAProvider | undefined;
+    user: any;
+    resource: {
+        type: string;
+        id: string;
+    };
+    permission: MastraFGAPermissionInput | MastraFGAPermissionInput[];
+    context?: FGACheckContext;
+    requestContext?: FGACheckContext['requestContext'];
+    actor?: ActorSignal;
+}
+export interface RequireFGAOptions extends CheckFGAOptions {
+    metadata?: Record<string, unknown>;
+}
+export declare function getAgentFGAResourceId(agentId: string): string;
+export declare function getWorkflowFGAResourceId(workflowId: string): string;
+export declare function getStandaloneToolFGAResourceId(toolName: string): string;
+export declare function getAgentToolFGAResourceId(agentId: string, toolName: string): string;
+export declare function getMCPToolFGAResourceId(serverName: string, toolName: string): string;
+/**
+ * Check fine-grained authorization for a resource.
+ *
+ * No-op if no FGA provider is configured (backward compatibility).
+ * Delegates to fgaProvider.require() which throws FGADeniedError if denied.
+ */
+export declare function checkFGA(options: CheckFGAOptions): Promise<void>;
+/**
+ * Require fine-grained authorization for a resource.
+ *
+ * No-op if no FGA provider is configured. When FGA is configured, a missing
+ * user fails closed.
+ */
+export declare function requireFGA(options: RequireFGAOptions): Promise<void>;
+/**
+ * Error thrown when an FGA authorization check is denied.
+ */
+export declare class FGADeniedError extends Error {
+    readonly user: any;
+    readonly resource: {
+        type: string;
+        id: string;
+    };
+    readonly permission: MastraFGAPermissionInput | MastraFGAPermissionInput[];
+    readonly status: number;
+    constructor(user: any, resource: {
+        type: string;
+        id: string;
+    }, permission: MastraFGAPermissionInput | MastraFGAPermissionInput[], reason?: string);
+}
+//# sourceMappingURL=fga-check.d.ts.map