@mastra/auth-cloud 1.2.1-alpha.0 → 1.2.2-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @mastra/auth-cloud
 
+## 1.2.2-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [[`705ff39`](https://github.com/mastra-ai/mastra/commit/705ff3969e57214ff2fdaf3815d751dd558886ed)]:
+  - @mastra/auth@1.1.2-alpha.0
+
+## 1.2.1
+
+### Patch Changes
+
+- Improved auth package builds by removing the direct core dependency from auth providers while preserving the existing public auth APIs. ([#17142](https://github.com/mastra-ai/mastra/pull/17142))
+
+- Updated dependencies [[`5c0df77`](https://github.com/mastra-ai/mastra/commit/5c0df776c40efa420f8c07a2f3ee66010296618e)]:
+  - @mastra/auth@1.1.1
+
 ## 1.2.1-alpha.0
 
 ### Patch Changes

package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts

@@ -10,7 +10,7 @@
  * All known API resources.
  * Derived from SERVER_ROUTES paths in @mastra/server.
  */
-export declare const RESOURCES: readonly ["a2a", "agent-builder", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "harness", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
+export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "heartbeats", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
 /**
  * Resource type union.
  */
@@ -54,6 +54,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'a2a:*': "a2a:*";
     /** Full access to agent builder */
     readonly 'agent-builder:*': "agent-builder:*";
+    /** Full access to agent controller sessions */
+    readonly 'agent-controller:*': "agent-controller:*";
     /** Full access to agents */
     readonly 'agents:*': "agents:*";
     /** Full access to auth */
@@ -68,8 +70,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'embedders:*': "embedders:*";
     /** Full access to experiments */
     readonly 'experiments:*': "experiments:*";
-    /** Full access to harness sessions */
-    readonly 'harness:*': "harness:*";
+    /** Full access to heartbeats */
+    readonly 'heartbeats:*': "heartbeats:*";
     /** Full access to infrastructure */
     readonly 'infrastructure:*': "infrastructure:*";
     /** Full access to logs */
@@ -124,6 +126,10 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'agent-builder:read': "agent-builder:read";
     /** Create and modify agent builder */
     readonly 'agent-builder:write': "agent-builder:write";
+    /** Execute agent controller sessions */
+    readonly 'agent-controller:execute': "agent-controller:execute";
+    /** View agent controller sessions */
+    readonly 'agent-controller:read': "agent-controller:read";
     /** Create agents */
     readonly 'agents:create': "agents:create";
     /** Delete agents */
@@ -154,10 +160,14 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'embedders:read': "embedders:read";
     /** View experiments */
     readonly 'experiments:read': "experiments:read";
-    /** Execute harness sessions */
-    readonly 'harness:execute': "harness:execute";
-    /** View harness sessions */
-    readonly 'harness:read': "harness:read";
+    /** Delete heartbeats */
+    readonly 'heartbeats:delete': "heartbeats:delete";
+    /** Execute heartbeats */
+    readonly 'heartbeats:execute': "heartbeats:execute";
+    /** View heartbeats */
+    readonly 'heartbeats:read': "heartbeats:read";
+    /** Create and modify heartbeats */
+    readonly 'heartbeats:write': "heartbeats:write";
     /** View infrastructure */
     readonly 'infrastructure:read': "infrastructure:read";
     /** View logs */
@@ -303,7 +313,7 @@ export type PermissionPattern = keyof typeof PERMISSION_PATTERNS;
 /**
  * All valid resource:action permission combinations (excludes wildcards).
  */
-export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "harness:execute", "harness:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
+export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "heartbeats:delete", "heartbeats:execute", "heartbeats:read", "heartbeats:write", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
 /**
  * Specific permission type (e.g., 'agents:read', 'workflows:execute').
  */
@@ -325,6 +335,10 @@ export declare const MastraFGAPermissions: {
     readonly AGENT_BUILDER_READ: "agent-builder:read";
     /** Create and modify agent builder */
     readonly AGENT_BUILDER_WRITE: "agent-builder:write";
+    /** Execute agent controller sessions */
+    readonly AGENT_CONTROLLER_EXECUTE: "agent-controller:execute";
+    /** View agent controller sessions */
+    readonly AGENT_CONTROLLER_READ: "agent-controller:read";
     /** Create agents */
     readonly AGENTS_CREATE: "agents:create";
     /** Delete agents */
@@ -355,10 +369,14 @@ export declare const MastraFGAPermissions: {
     readonly EMBEDDERS_READ: "embedders:read";
     /** View experiments */
     readonly EXPERIMENTS_READ: "experiments:read";
-    /** Execute harness sessions */
-    readonly HARNESS_EXECUTE: "harness:execute";
-    /** View harness sessions */
-    readonly HARNESS_READ: "harness:read";
+    /** Delete heartbeats */
+    readonly HEARTBEATS_DELETE: "heartbeats:delete";
+    /** Execute heartbeats */
+    readonly HEARTBEATS_EXECUTE: "heartbeats:execute";
+    /** View heartbeats */
+    readonly HEARTBEATS_READ: "heartbeats:read";
+    /** Create and modify heartbeats */
+    readonly HEARTBEATS_WRITE: "heartbeats:write";
     /** View infrastructure */
     readonly INFRASTRUCTURE_READ: "infrastructure:read";
     /** View logs */

package/dist/_types/@internal_auth/dist/provider/index.d.ts

@@ -14,7 +14,44 @@ export interface MastraAuthProviderOptions<TUser = unknown> {
      */
     public?: MastraAuthConfig['public'];
 }
-export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {
+/**
+ * Structural description of the public surface of a `MastraAuthProvider`.
+ *
+ * Auth provider packages bundle their own copy of the `MastraAuthProvider`
+ * declaration, so provider class types cannot be compared nominally across
+ * package boundaries — `#private`/`protected` members would make otherwise
+ * identical copies mutually unassignable. Positions that accept user-supplied
+ * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface
+ * instead of the class.
+ *
+ * Note: methods intentionally use method syntax (not property syntax) so they
+ * are checked bivariantly — providers with a narrower `TUser` must remain
+ * assignable to `IMastraAuthProvider<unknown>`.
+ */
+export interface IMastraAuthProvider<TUser = unknown> {
+    name?: string;
+    /**
+     * Protected paths for the auth provider
+     */
+    protected?: MastraAuthConfig['protected'];
+    /**
+     * Public paths for the auth provider
+     */
+    public?: MastraAuthConfig['public'];
+    /**
+     * Authenticate a token and return the payload
+     */
+    authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;
+    /**
+     * Authorize a user for a path and method
+     */
+    authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;
+    /**
+     * Map an authenticated user to a memory resource id
+     */
+    mapUserToResourceId?(user: TUser): string | undefined | null;
+}
+export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {
     protected?: MastraAuthConfig['protected'];
     public?: MastraAuthConfig['public'];
     mapUserToResourceId?(user: TUser): string | undefined | null;
@@ -39,7 +76,7 @@ export declare class CompositeAuth extends MastraAuthProvider implements ISSOPro
     private providers;
     private authenticatedProviderByObject;
     private authenticatedProviderByPrimitive;
-    constructor(providers: MastraAuthProvider[]);
+    constructor(providers: IMastraAuthProvider[]);
     private findProvider;
     private rememberAuthenticatedProvider;
     private takeAuthenticatedProvider;

package/dist/index.cjs

@@ -617,7 +617,7 @@ var MastraBase = class {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-XG6GH2VJ.js
+// ../../packages/_internals/auth/dist/chunk-7GLKLOU3.js
 var MastraAuthProvider = class extends MastraBase {
   protected;
   public;
@@ -936,7 +936,7 @@ var MastraCloudAuthProvider = class extends MastraAuthProvider {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-JCX4XB6F.js
+// ../../packages/_internals/auth/dist/chunk-GVS7OL46.js
 var RESOURCE_EXPANSIONS = {
   stored: [
     "stored-agents",