@mastra/auth-cloud 1.2.1 → 1.2.2-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @mastra/auth-cloud
 
+## 1.2.2-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [[`705ff39`](https://github.com/mastra-ai/mastra/commit/705ff3969e57214ff2fdaf3815d751dd558886ed)]:
+  - @mastra/auth@1.1.2-alpha.0
+
 ## 1.2.1
 
 ### Patch Changes

package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts

@@ -10,7 +10,7 @@
  * All known API resources.
  * Derived from SERVER_ROUTES paths in @mastra/server.
  */
-export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
+export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "heartbeats", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
 /**
  * Resource type union.
  */
@@ -70,6 +70,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'embedders:*': "embedders:*";
     /** Full access to experiments */
     readonly 'experiments:*': "experiments:*";
+    /** Full access to heartbeats */
+    readonly 'heartbeats:*': "heartbeats:*";
     /** Full access to infrastructure */
     readonly 'infrastructure:*': "infrastructure:*";
     /** Full access to logs */
@@ -158,6 +160,14 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'embedders:read': "embedders:read";
     /** View experiments */
     readonly 'experiments:read': "experiments:read";
+    /** Delete heartbeats */
+    readonly 'heartbeats:delete': "heartbeats:delete";
+    /** Execute heartbeats */
+    readonly 'heartbeats:execute': "heartbeats:execute";
+    /** View heartbeats */
+    readonly 'heartbeats:read': "heartbeats:read";
+    /** Create and modify heartbeats */
+    readonly 'heartbeats:write': "heartbeats:write";
     /** View infrastructure */
     readonly 'infrastructure:read': "infrastructure:read";
     /** View logs */
@@ -303,7 +313,7 @@ export type PermissionPattern = keyof typeof PERMISSION_PATTERNS;
 /**
  * All valid resource:action permission combinations (excludes wildcards).
  */
-export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
+export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "heartbeats:delete", "heartbeats:execute", "heartbeats:read", "heartbeats:write", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
 /**
  * Specific permission type (e.g., 'agents:read', 'workflows:execute').
  */
@@ -359,6 +369,14 @@ export declare const MastraFGAPermissions: {
     readonly EMBEDDERS_READ: "embedders:read";
     /** View experiments */
     readonly EXPERIMENTS_READ: "experiments:read";
+    /** Delete heartbeats */
+    readonly HEARTBEATS_DELETE: "heartbeats:delete";
+    /** Execute heartbeats */
+    readonly HEARTBEATS_EXECUTE: "heartbeats:execute";
+    /** View heartbeats */
+    readonly HEARTBEATS_READ: "heartbeats:read";
+    /** Create and modify heartbeats */
+    readonly HEARTBEATS_WRITE: "heartbeats:write";
     /** View infrastructure */
     readonly INFRASTRUCTURE_READ: "infrastructure:read";
     /** View logs */

package/dist/_types/@internal_auth/dist/provider/index.d.ts

@@ -14,7 +14,44 @@ export interface MastraAuthProviderOptions<TUser = unknown> {
      */
     public?: MastraAuthConfig['public'];
 }
-export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {
+/**
+ * Structural description of the public surface of a `MastraAuthProvider`.
+ *
+ * Auth provider packages bundle their own copy of the `MastraAuthProvider`
+ * declaration, so provider class types cannot be compared nominally across
+ * package boundaries — `#private`/`protected` members would make otherwise
+ * identical copies mutually unassignable. Positions that accept user-supplied
+ * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface
+ * instead of the class.
+ *
+ * Note: methods intentionally use method syntax (not property syntax) so they
+ * are checked bivariantly — providers with a narrower `TUser` must remain
+ * assignable to `IMastraAuthProvider<unknown>`.
+ */
+export interface IMastraAuthProvider<TUser = unknown> {
+    name?: string;
+    /**
+     * Protected paths for the auth provider
+     */
+    protected?: MastraAuthConfig['protected'];
+    /**
+     * Public paths for the auth provider
+     */
+    public?: MastraAuthConfig['public'];
+    /**
+     * Authenticate a token and return the payload
+     */
+    authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;
+    /**
+     * Authorize a user for a path and method
+     */
+    authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;
+    /**
+     * Map an authenticated user to a memory resource id
+     */
+    mapUserToResourceId?(user: TUser): string | undefined | null;
+}
+export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {
     protected?: MastraAuthConfig['protected'];
     public?: MastraAuthConfig['public'];
     mapUserToResourceId?(user: TUser): string | undefined | null;
@@ -39,7 +76,7 @@ export declare class CompositeAuth extends MastraAuthProvider implements ISSOPro
     private providers;
     private authenticatedProviderByObject;
     private authenticatedProviderByPrimitive;
-    constructor(providers: MastraAuthProvider[]);
+    constructor(providers: IMastraAuthProvider[]);
     private findProvider;
     private rememberAuthenticatedProvider;
     private takeAuthenticatedProvider;

package/dist/index.cjs

@@ -617,7 +617,7 @@ var MastraBase = class {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-XG6GH2VJ.js
+// ../../packages/_internals/auth/dist/chunk-7GLKLOU3.js
 var MastraAuthProvider = class extends MastraBase {
   protected;
   public;
@@ -936,7 +936,7 @@ var MastraCloudAuthProvider = class extends MastraAuthProvider {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-7SVOHBXQ.js
+// ../../packages/_internals/auth/dist/chunk-GVS7OL46.js
 var RESOURCE_EXPANSIONS = {
   stored: [
     "stored-agents",