@mastra/auth-cloud 1.2.1 → 1.2.2-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +7 -0
  2. package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts +20 -2
  3. package/dist/_types/@internal_auth/dist/provider/index.d.ts +39 -2
  4. package/dist/index.cjs +2 -2
  5. package/dist/index.cjs.map +1 -1
  6. package/dist/index.js +2 -2
  7. package/dist/index.js.map +1 -1
  8. package/package.json +5 -5
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/error.ts","../src/oauth/state.ts","../src/oauth/network.ts","../src/pkce/error.ts","../src/pkce/cookie.ts","../src/pkce/pkce.ts","../src/oauth/oauth.ts","../src/session/cookie.ts","../src/session/session.ts","../src/client.ts","../../../packages/_internal-core/src/logger/index.ts","../../../packages/_internal-core/src/base/MastraBase.ts","../../../packages/_internals/auth/src/provider/index.ts","../src/auth-provider.ts","../../../packages/_internals/auth/src/ee/defaults/roles.ts","../src/rbac/rbac-provider.ts"],"names":["getRequestHeader"],"mappings":";;;AAiCO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EACS,KAAA;AAAA,EACT,SAAA;AAAA,EACA,YAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAAqB,OAAA,EAAiB,OAAA,EAA4B;AAC5E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,QAAQ,OAAA,EAAS,KAAA;AACtB,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,eAAe,OAAA,EAAS,YAAA;AAE7B,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,YAAA,GAA0B;AAC/B,IAAA,OAAO,IAAI,UAAA,CAAU,eAAA,EAAiB,gDAAgD,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,GAA2B;AAChC,IAAA,OAAO,IAAI,UAAA,CAAU,gBAAA,EAAkB,6DAA6D,CAAA;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,WAAA,GAAyB;AAC9B,IAAA,OAAO,IAAI,UAAA,CAAU,cAAA,EAAgB,oDAAoD,CAAA;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,oBAAoB,OAAA,EAAuC;AAChE,IAAA,OAAO,IAAI,UAAA,CAAU,uBAAA,EAAyB,mDAAA,EAAqD,OAAO,CAAA;AAAA,EAC5G;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,kBAAA,GAAgC;AACrC,IAAA,OAAO,IAAI,UAAA,CAAU,qBAAA,EAAuB,4BAA4B,CAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,cAAA,GAA4B;AACjC,IAAA,OAAO,IAAI,UAAA,CAAU,iBAAA,EAAmB,yCAAyC,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,cAAA,GAA4B;AACjC,IAAA,OAAO,IAAI,UAAA,CAAU,iBAAA,EAAmB,2CAA2C,CAAA;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAa,KAAA,EAA0B;AAC5C,IAAA,OAAO,IAAI,UAAA,CAAU,eAAA,EAAiB,4DAAA,EAA8D,EAAE,OAAO,CAAA;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,cAAc,OAAA,EAAuC;AAC1D,IAAA,MAAM,OAAA,GAAU,SAAS,YAAA,IAAgB,8BAAA;AACzC,IAAA,OAAO,IAAI,UAAA,CAAU,iBAAA,EAAmB,OAAA,EAAS,OAAO,CAAA;AAAA,EAC1D;AACF;;;ACpFO,SAAS,WAAA,CAAY,MAAc,QAAA,EAA0B;AAClE,EAAA,MAAM,IAAA,GAAkB,EAAE,IAAA,EAAM,QAAA,EAAS;AACzC,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAChC,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,WAAW,CAAA;AAC/C;AASO,SAAS,YAAY,KAAA,EAA0B;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,WAAW,EAAE,QAAA,EAAS;AACtD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAG5B,IAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,aAAa,QAAA,EAAU;AACtE,MAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,IAC3C;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,UAAU,YAAA,EAAa;AAAA,EAC/B;AACF;AAaO,SAAS,gBAAA,CAAiB,UAA8B,aAAA,EAA+B;AAE5F,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO,GAAA;AAAA,EACT;AAGA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAG,CAAA,IAAK,CAAC,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC1D,IAAA,OAAO,QAAA;AAAA,EACT;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAQ,CAAA;AAC/B,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,aAAa,CAAA;AAGpC,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ;AACnC,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,OAAO,GAAA;AACT;;;AC1EA,eAAsB,cAAA,CAAe,KAAa,OAAA,EAAyC;AACzF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,EAAK,OAAO,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AAEN,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,GAAA,EAAK,OAAO,CAAA;AAAA,IACjC,SAAS,UAAA,EAAY;AAEnB,MAAA,MAAM,SAAA,CAAU,YAAA,CAAa,UAAA,YAAsB,KAAA,GAAQ,aAAa,MAAS,CAAA;AAAA,IACnF;AAAA,EACF;AACF;;;AClBO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EACS,KAAA;AAAA,EAElB,WAAA,CAAY,IAAA,EAAqB,OAAA,EAAiB,KAAA,EAAe;AAC/D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAEb,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,eAAA,GAA6B;AAClC,IAAA,OAAO,IAAI,UAAA;AAAA,MACT,kBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OAAA,GAAqB;AAC1B,IAAA,OAAO,IAAI,UAAA,CAAU,SAAA,EAAW,mEAAmE,CAAA;AAAA,EACrG;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,QAAQ,KAAA,EAA0B;AACvC,IAAA,OAAO,IAAI,UAAA,CAAU,SAAA,EAAW,+CAAA,EAAiD,KAAK,CAAA;AAAA,EACxF;AACF,CAAA;;;ACvCO,IAAM,gBAAA,GAAmB,sBAAA;AAmBzB,SAAS,aAAA,CAAc,QAAA,EAAkB,KAAA,EAAe,YAAA,EAA+B;AAC5F,EAAA,MAAM,aAAa,CAAA,GAAI,EAAA;AACvB,EAAA,MAAM,IAAA,GAAuB;AAAA,IAC3B,QAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,UAAA,GAAa;AAAA,GACvC;AAEA,EAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAEvD,EAAA,IAAI,SAAS,CAAA,EAAG,gBAAgB,CAAA,CAAA,EAAI,OAAO,6CAA6C,UAAU,CAAA,CAAA;AAElG,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAA,IAAU,UAAA;AAAA,EACZ;AAEA,EAAA,OAAO,MAAA;AACT;AASO,SAAS,gBAAgB,YAAA,EAA6C;AAC3E,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,MAAM,UAAU,eAAA,EAAgB;AAAA,EAClC;AAEA,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAA,CAAM,IAAI,OAAO,CAAA,EAAG,gBAAgB,UAAU,CAAC,CAAA;AAE1E,EAAA,IAAI,CAAC,KAAA,GAAQ,CAAC,CAAA,EAAG;AACf,IAAA,MAAM,UAAU,eAAA,EAAgB;AAAA,EAClC;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,KAAK,KAAA,CAAM,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA;AAAA,EAChD,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,SAAA,CAAU,OAAA,CAAQ,CAAA,YAAa,KAAA,GAAQ,IAAI,MAAS,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AAC/B,IAAA,MAAM,UAAU,OAAA,EAAQ;AAAA,EAC1B;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAO,GAAG,gBAAgB,CAAA,4CAAA,CAAA;AAC5B;AC1EO,SAAS,oBAAA,GAA+B;AAE7C,EAAA,OAAO,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC7C;AAQO,SAAS,qBAAqB,QAAA,EAA0B;AAC7D,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AACjE;AAMO,SAAS,aAAA,GAAwB;AAEtC,EAAA,OAAO,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC7C;;;ACwBO,SAAS,YAAY,OAAA,EAA0C;AACpE,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,aAAa,QAAA,EAAU,aAAA,EAAe,cAAa,GAAI,OAAA;AAGxF,EAAA,MAAM,WAAW,oBAAA,EAAqB;AACtC,EAAA,MAAM,SAAA,GAAY,qBAAqB,QAAQ,CAAA;AAG/C,EAAA,MAAM,OAAO,aAAA,EAAc;AAG3B,EAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,QAAA,EAAU,aAAa,CAAA;AAGlE,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,IAAA,EAAM,iBAAiB,CAAA;AAGjD,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AAC7C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,YAAA,EAAc,SAAS,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,SAAS,CAAA;AAChD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,uBAAA,EAAyB,MAAM,CAAA;AACpD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,WAAW,CAAA;AAChD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AAGnC,EAAA,MAAM,eAAA,GAAkB,YAAA,IAAgB,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AACjE,EAAA,MAAM,UAAA,GAAa,aAAA,CAAc,QAAA,EAAU,IAAA,EAAM,eAAe,CAAA;AAEhE,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,IAAI,QAAA,EAAS;AAAA,IAClB,OAAA,EAAS,CAAC,UAAU;AAAA,GACtB;AACF;AAeA,eAAsB,eAAe,OAAA,EAAmD;AACtF,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,aAAa,IAAA,EAAM,KAAA,EAAO,cAAa,GAAI,OAAA;AAG5E,EAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAG7C,EAAA,MAAM,SAAA,GAAY,YAAY,KAAK,CAAA;AAGnC,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,QAAA,CAAS,KAAA,EAAO;AACrC,IAAA,MAAM,UAAU,aAAA,EAAc;AAAA,EAChC;AAGA,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,cAAA,CAAA,EAAkB;AAAA,IACrE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,kBAAA;AAAA,MAChB,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACnB,IAAA;AAAA,MACA,YAAA,EAAc,WAAA;AAAA,MACd,eAAe,QAAA,CAAS;AAAA,KACzB;AAAA,GACF,CAAA;AAGD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,YAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,EAAK;AACvC,MAAA,SAAA,GAAY,SAAA,CAAU,IAAA;AACtB,MAAA,YAAA,GAAe,SAAA,CAAU,OAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,SAAA,CAAU,mBAAA,CAAoB,EAAE,SAAA,EAAW,cAAc,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAOlC,EAAA,MAAM,cAAA,GAAiB,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,IACzE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAA;AAAA,MAC1C,cAAA,EAAgB;AAAA;AAClB,GACD,CAAA;AAED,EAAA,IAAI,CAAC,eAAe,EAAA,EAAI;AACtB,IAAA,MAAM,UAAU,kBAAA,EAAmB;AAAA,EACrC;AAGA,EAAA,MAAM,UAAA,GAAc,MAAM,cAAA,CAAe,IAAA,EAAK;AAS9C,EAAA,MAAM,cAAc,eAAA,EAAgB;AAEpC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,UAAA,CAAW,GAAA;AAAA,MACf,OAAO,UAAA,CAAW,KAAA;AAAA,MAClB,MAAM,UAAA,CAAW,IAAA;AAAA,MACjB,QAAQ,UAAA,CAAW,UAAA;AAAA,MACnB,MAAM,UAAA,CAAW;AAAA,KACnB;AAAA,IACA,aAAa,IAAA,CAAK,YAAA;AAAA,IAClB,UAAU,SAAA,CAAU,QAAA;AAAA,IACpB,OAAA,EAAS,CAAC,WAAW;AAAA,GACvB;AACF;;;AC1LO,IAAM,mBAAA,GAAsB,sBAAA;AAS5B,SAAS,gBAAA,CAAiB,OAAe,YAAA,EAA+B;AAC7E,EAAA,MAAM,UAAA,GAAa,KAAK,EAAA,GAAK,EAAA;AAE7B,EAAA,IAAI,SAAS,CAAA,EAAG,mBAAmB,CAAA,CAAA,EAAI,KAAK,6CAA6C,UAAU,CAAA,CAAA;AAEnG,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAA,IAAU,UAAA;AAAA,EACZ;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,mBAAmB,YAAA,EAA4C;AAC7E,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAA,CAAM,IAAI,OAAO,CAAA,EAAG,mBAAmB,UAAU,CAAC,CAAA;AAC7E,EAAA,OAAO,KAAA,GAAQ,CAAC,CAAA,IAAK,IAAA;AACvB;AAOO,SAAS,kBAAA,GAA6B;AAC3C,EAAA,OAAO,GAAG,mBAAmB,CAAA,4CAAA,CAAA;AAC/B;;;AChBA,eAAsB,YAAY,OAAA,EAAsD;AACtF,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,KAAA,EAAM,GAAI,OAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA;AAAA,MAC9B,cAAA,EAAgB;AAAA;AAClB,GACD,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAU,kBAAA,EAAmB;AAAA,EACrC;AAKA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAalC,EAAA,IAAI,IAAA,CAAK,eAAe,mBAAA,EAAqB;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM;AAAA,QACJ,EAAA,EAAI,WAAA;AAAA,QACJ,KAAA,EAAO,MAAA;AAAA,QACP,IAAA,EAAM,MAAA;AAAA,QACN,MAAA,EAAQ;AAAA,OACV;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,IAAA,CAAK,GAAA;AAAA,MACT,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAQ,IAAA,CAAK;AAAA,KACf;AAAA,IACA,MAAM,IAAA,CAAK;AAAA,GACb;AACF;AAQA,eAAsB,gBAAgB,OAAA,EAAuD;AAC3F,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,YAAA,EAAa,GAAI,OAAA;AAElD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,sBAAA,CAAA,EAA0B;AAAA,MAC7E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,YAAY,CAAA,CAAA;AAAA,QACrC,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAsB,eAAe,OAAA,EAAwC;AAC3E,EAAA,MAAM,EAAE,YAAA,EAAc,YAAA,EAAa,GAAI,OAAA;AAEvC,EAAA,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,qBAAA,CAAA,EAAyB;AAAA,IAC3D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,YAAY,CAAA;AAAA;AACvC,GACD,CAAA;AAGH;AAUO,SAAS,YAAA,CAAa,YAAA,EAAsB,qBAAA,EAA+B,WAAA,EAA6B;AAC7G,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,cAAA,EAAgB,YAAY,CAAA;AAChD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,0BAAA,EAA4B,qBAAqB,CAAA;AACtE,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,WAAW,CAAA;AACjD,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;;;ACnGO,IAAM,kBAAN,MAAsB;AAAA,EACV,MAAA;AAAA,EAEjB,YAAY,MAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,OAAA,EAAuE;AACjF,IAAA,OAAO,WAAA,CAAY;AAAA,MACjB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA,MAC1B,WAAA,EAAa,KAAK,MAAA,CAAO,WAAA;AAAA,MACzB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,OAAA,EAAgG;AAC7G,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA,MAC1B,WAAA,EAAa,KAAK,MAAA,CAAO,WAAA;AAAA,MACzB,GAAG;AAAA,KACJ,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,KAAA,EAAwC;AAClD,IAAA,OAAO,WAAA,CAAY,EAAE,SAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,KAAA,EAAO,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,YAAA,EAAoD;AAClE,IAAA,OAAO,eAAA,CAAgB,EAAE,SAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,CAAA;AAAA,EACnH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,YAAA,EAAqC;AAClD,IAAA,OAAO,cAAA,CAAe,EAAoC,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,CAAA;AAAA,EAClH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAA,CAAa,uBAA+B,WAAA,EAA6B;AACvE,IAAA,OAAO,YAAA,CAAa,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,uBAAuB,WAAW,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,iBAAiB,KAAA,EAAuB;AACtC,IAAA,OAAO,gBAAA,CAAiB,OAAO,IAAA,CAAK,MAAA,CAAO,gBAAgB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAA,GAA6B;AAC3B,IAAA,OAAO,kBAAA,EAAmB;AAAA,EAC5B;AACF;;;ACtJO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACtBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAW;AACpE,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;;;AC1CA,SAASA,iBAAAA,CAAiB,SAA4B,IAAA,EAA6B;AACjF,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AACjG;AAsCO,IAAM,uBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACU,MAAA;AAAA;AAAA,EAGC,iBAAA,GAAoB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrB,yBAAA,GAA2C,IAAA;AAAA,EAEnD,YAAY,OAAA,EAAyC;AACnD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,SAAS,CAAA;AAExC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAChC,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,cAAc,OAAA,CAAQ;AAAA,KACvB,CAAA;AAED,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,wBAAwB,YAAA,EAAmC;AACzD,IAAA,IAAA,CAAK,yBAAA,GAA4B,YAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAuD;AAC5F,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAeA,iBAAAA,CAAiB,OAAA,EAAS,QAAQ,CAAA;AAGvD,MAAA,MAAM,YAAA,GAAe,mBAAmB,YAAY,CAAA;AAEpD,MAAA,IAAI,YAAA,EAAc;AAEhB,QAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,YAAY,CAAA;AACjE,QAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAK;AAAA,MACzB;AAGA,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,KAAK,CAAA;AAC1D,QAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAK;AAAA,MACzB;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,cAAc,IAAA,EAA0B;AACtC,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,EAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,gBAAA,GAA8D,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStE,WAAA,CAAY,aAAqB,KAAA,EAAuB;AAEtD,IAAA,IAAI,iBAAA,GAAoB,GAAA;AACxB,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAChC,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChC,MAAA,MAAM,eAAA,GAAkB,MAAM,CAAC,CAAA;AAC/B,MAAA,IAAI,eAAA,EAAiB;AACnB,QAAA,IAAI;AACF,UAAA,iBAAA,GAAoB,mBAAmB,eAAe,CAAA;AAAA,QACxD,CAAA,CAAA,MAAQ;AACN,UAAA,iBAAA,GAAoB,GAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,WAAW,CAAA;AACvC,IAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAG3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY;AAAA,MACrC,QAAA,EAAU,iBAAA;AAAA,MACV,aAAA,EAAe;AAAA,KAChB,CAAA;AAGD,IAAA,IAAA,CAAK,gBAAA,GAAmB,MAAA;AAExB,IAAA,OAAO,MAAA,CAAO,GAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAA,GAAwC;AACtC,IAAA,MAAM,OAAA,GAAU,KAAK,gBAAA,EAAkB,OAAA;AACvC,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAA,CAAe,IAAA,EAAc,KAAA,EAAmD;AAEpF,IAAA,MAAM,eAAe,IAAA,CAAK,yBAAA;AAC1B,IAAA,IAAA,CAAK,yBAAA,GAA4B,IAAA;AAGjC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,cAAA,CAAe;AAAA,MAC9C,IAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB,OAAO,WAAW,CAAA;AAErE,IAAA,OAAO;AAAA,MACL,MAAM,MAAA,CAAO,IAAA;AAAA;AAAA,MACb,MAAA,EAAQ;AAAA,QACN,aAAa,MAAA,CAAO;AAAA,OACtB;AAAA,MACA,OAAA,EAAS,CAAC,GAAG,MAAA,CAAO,SAAS,aAAa;AAAA,KAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAA,GAAuC;AACrC,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,QAAA;AAAA,MACV,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,YAAA,CAAa,aAAqB,OAAA,EAAkC;AAElE,IAAA,MAAM,YAAA,GAAe,OAAA,GAAU,IAAA,CAAK,uBAAA,CAAwB,OAAO,CAAA,GAAI,IAAA;AACvE,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,WAAA,EAAa,YAAY,CAAA;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,aAAA,CAAc,MAAA,EAAgB,QAAA,EAAsD;AACxF,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAE9D,IAAA,OAAO;AAAA,MACL,EAAA,EAAK,QAAA,EAAU,WAAA,IAA0B,MAAA,CAAO,UAAA,EAAW;AAAA,MAC3D,MAAA;AAAA,MACA,SAAA,EAAW,GAAA;AAAA,MACX,SAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,gBAAgB,SAAA,EAA4C;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAgB,SAAS,CAAA;AAC3D,IAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA;AAAA,MACrC,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,SAAS;AAAA,KACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,SAAA,EAAkC;AACrD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,cAAA,CAAe,SAAS,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAA,EAA4C;AAC/D,IAAA,OAAO,IAAA,CAAK,gBAAgB,SAAS,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,wBAAwB,OAAA,EAAiC;AACvD,IAAA,OAAO,kBAAA,CAAmB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAkB,OAAA,EAA0C;AAC1D,IAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,OAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,CAAA,EAAE;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAA,GAAiD;AAC/C,IAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,oBAAmB,EAAE;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAe,OAAA,EAA6C;AAChE,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,uBAAA,CAAwB,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,YAAY,CAAA;AACjE,MAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,QAAQ,OAAA,EAA4C;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AC3SA,IAAM,mBAAA,GAAyD;EAC7D,MAAA,EAAQ;AACN,IAAA,eAAA;AACA,IAAA,oBAAA;AACA,IAAA,sBAAA;AACA,IAAA,gBAAA;AACA,IAAA,eAAA;AACA,IAAA;AAAA;AAEJ,CAAA;AAmBO,SAAS,iBAAA,CAAkB,gBAAwB,kBAAA,EAAqC;AAE7F,EAAA,IAAI,mBAAmB,GAAA,EAAK;AAC1B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AAC7C,EAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,KAAA,CAAM,GAAG,CAAA;AAIlD,EAAA,MAAM,gBAAA,GAAmB,mBAAA,CAAoB,YAAA,CAAa,CAAC,KAAK,EAAE,CAAA;AAClE,EAAA,IAAI,oBAAoB,gBAAA,CAAiB,QAAA,CAAS,cAAc,CAAC,CAAA,IAAK,EAAE,CAAA,EAAG;AACzE,IAAA,MAAM,OAAA,GAAU,CAAC,aAAA,CAAc,CAAC,CAAA,EAAG,GAAG,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACrE,IAAA,OAAO,iBAAA,CAAkB,SAAS,kBAAkB,CAAA;AACtD,EAAA;AAGA,EAAA,IAAI,YAAA,CAAa,MAAA,GAAS,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,cAAA,KAAmB,kBAAA;AAC5B,EAAA;AAEA,EAAA,MAAM,CAAC,eAAA,EAAiB,aAAA,EAAe,SAAS,CAAA,GAAI,YAAA;AACpD,EAAA,MAAM,CAAC,gBAAA,EAAkB,cAAA,EAAgB,UAAU,CAAA,GAAI,aAAA;AAGvD,EAAA,IAAI,oBAAoB,GAAA,EAAK;AAE3B,IAAA,IAAI,kBAAkB,GAAA,EAAK;AACzB,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,OAAO,IAAA;AACT,MAAA;AACA,MAAA,OAAO,SAAA,KAAc,UAAA;AACvB,IAAA;AAEA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,SAAA,KAAc,UAAA;AACvB,EAAA;AAGA,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACxC,IAAA,OAAO,KAAA;AACT,EAAA;AAGA,EAAA,IAAI,kBAAkB,GAAA,EAAK;AAGzB,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,SAAA,KAAc,UAAA;AACvB,EAAA;AAGA,EAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,IAAA,OAAO,KAAA;AACT,EAAA;AAIA,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,OAAO,IAAA;AACT,EAAA;AAGA,EAAA,OAAO,SAAA,KAAc,UAAA;AACvB;AAuCO,SAAS,6BAAA,CAA8B,OAAiB,OAAA,EAAgC;AAC7F,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAA;AACxB,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,UAAU,CAAA,IAAK,EAAA;AAE5C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,SAAA,GAAY,QAAQ,IAAI,CAAA;AAC9B,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AACtB,MAAA;IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AACtB,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,WAAW,CAAA;AAC/B;;;AC5NO,IAAM,kBAAN,MAA0D;AAAA,EACvD,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,IAAI,WAAA,GAA2B;AAC7B,IAAA,OAAO,KAAK,OAAA,CAAQ,WAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,SAAS,IAAA,EAAoC;AAEjD,IAAA,OAAO,KAAK,IAAA,GAAO,CAAC,IAAA,CAAK,IAAI,IAAI,EAAC;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,CAAQ,IAAA,EAAiB,IAAA,EAAgC;AAC7D,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AACtC,IAAA,OAAO,KAAA,CAAM,SAAS,IAAI,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,eAAe,IAAA,EAAoC;AACvD,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AAEtC,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,UAAU,KAAK,EAAC;AAAA,IAClD;AAEA,IAAA,OAAO,6BAAA,CAA8B,KAAA,EAAO,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CAAc,IAAA,EAAiB,UAAA,EAAsC;AACzE,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AAClD,IAAA,OAAO,YAAY,IAAA,CAAK,CAAA,CAAA,KAAK,iBAAA,CAAkB,CAAA,EAAG,UAAU,CAAC,CAAA;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAA,CAAkB,IAAA,EAAiB,WAAA,EAAyC;AAChF,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AACtD,IAAA,OAAO,WAAA,CAAY,KAAA,CAAM,CAAA,QAAA,KAAY,eAAA,CAAgB,IAAA,CAAK,OAAK,iBAAA,CAAkB,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,gBAAA,CAAiB,IAAA,EAAiB,WAAA,EAAyC;AAC/E,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AACtD,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,CAAA,QAAA,KAAY,eAAA,CAAgB,IAAA,CAAK,OAAK,iBAAA,CAAkB,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA;AAAA,EAC/F;AACF","file":"index.js","sourcesContent":["/**\n * Auth error types and error class.\n *\n * Provides typed error handling for OAuth flow and session management.\n */\n\n/**\n * Error codes for authentication-related failures.\n */\nexport type AuthErrorCode =\n | 'invalid_state'\n | 'state_mismatch'\n | 'missing_code'\n | 'token_exchange_failed'\n | 'verification_failed'\n | 'session_invalid'\n | 'session_expired'\n | 'network_error'\n | 'cloud_api_error';\n\n/**\n * Options for AuthError constructor.\n */\nexport interface AuthErrorOptions {\n cause?: Error;\n cloudCode?: string;\n cloudMessage?: string;\n}\n\n/**\n * Error class for authentication-related failures.\n * Uses a code discriminator for programmatic error handling.\n */\nexport class AuthError extends Error {\n readonly code: AuthErrorCode;\n override readonly cause?: Error;\n readonly cloudCode?: string;\n readonly cloudMessage?: string;\n\n constructor(code: AuthErrorCode, message: string, options?: AuthErrorOptions) {\n super(message);\n this.name = 'AuthError';\n this.code = code;\n this.cause = options?.cause;\n this.cloudCode = options?.cloudCode;\n this.cloudMessage = options?.cloudMessage;\n // Required for instanceof checks in TypeScript\n Object.setPrototypeOf(this, new.target.prototype);\n }\n\n /**\n * Factory: OAuth state parameter is invalid or malformed.\n */\n static invalidState(): AuthError {\n return new AuthError('invalid_state', 'OAuth state parameter is invalid or malformed.');\n }\n\n /**\n * Factory: OAuth state parameter does not match expected value.\n */\n static stateMismatch(): AuthError {\n return new AuthError('state_mismatch', 'OAuth state parameter does not match. Possible CSRF attack.');\n }\n\n /**\n * Factory: Authorization code is missing from callback.\n */\n static missingCode(): AuthError {\n return new AuthError('missing_code', 'Authorization code is missing from OAuth callback.');\n }\n\n /**\n * Factory: Token exchange with Cloud API failed.\n */\n static tokenExchangeFailed(options?: AuthErrorOptions): AuthError {\n return new AuthError('token_exchange_failed', 'Failed to exchange authorization code for tokens.', options);\n }\n\n /**\n * Factory: Token verification failed.\n */\n static verificationFailed(): AuthError {\n return new AuthError('verification_failed', 'Token verification failed.');\n }\n\n /**\n * Factory: Session is invalid.\n */\n static sessionInvalid(): AuthError {\n return new AuthError('session_invalid', 'Session is invalid or has been revoked.');\n }\n\n /**\n * Factory: Session has expired.\n */\n static sessionExpired(): AuthError {\n return new AuthError('session_expired', 'Session has expired. Please log in again.');\n }\n\n /**\n * Factory: Network error during API call.\n */\n static networkError(cause?: Error): AuthError {\n return new AuthError('network_error', 'Network error occurred while communicating with Cloud API.', { cause });\n }\n\n /**\n * Factory: Cloud API returned an error.\n */\n static cloudApiError(options?: AuthErrorOptions): AuthError {\n const message = options?.cloudMessage ?? 'Cloud API returned an error.';\n return new AuthError('cloud_api_error', message, options);\n }\n}\n","/**\n * OAuth state parameter encoding/decoding.\n *\n * The state parameter carries:\n * - csrf: CSRF token for validation\n * - returnTo: URL to redirect after successful login\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\n\n/**\n * Data encoded in the OAuth state parameter.\n */\nexport interface StateData {\n /** CSRF token for state validation */\n csrf: string;\n /** URL to redirect to after login */\n returnTo: string;\n}\n\n/**\n * Encode state data into a base64url string for OAuth state parameter.\n *\n * @param csrf - CSRF token to include\n * @param returnTo - URL to redirect to after login\n * @returns Base64url encoded state string\n */\nexport function encodeState(csrf: string, returnTo: string): string {\n const data: StateData = { csrf, returnTo };\n const json = JSON.stringify(data);\n return Buffer.from(json).toString('base64url');\n}\n\n/**\n * Decode state parameter back to StateData.\n *\n * @param state - Base64url encoded state string\n * @returns Decoded state data\n * @throws AuthError with code 'invalid_state' if decoding fails\n */\nexport function decodeState(state: string): StateData {\n try {\n const json = Buffer.from(state, 'base64url').toString();\n const data = JSON.parse(json) as StateData;\n\n // Validate required fields exist\n if (typeof data.csrf !== 'string' || typeof data.returnTo !== 'string') {\n throw new Error('Missing required fields');\n }\n\n return data;\n } catch {\n throw AuthError.invalidState();\n }\n}\n\n/**\n * Validate and sanitize returnTo URL to prevent open redirect attacks.\n *\n * Safe values:\n * - Relative paths starting with '/' (but not '//')\n * - Absolute URLs with same origin as request\n *\n * @param returnTo - URL from user input (may be undefined)\n * @param requestOrigin - Origin of the current request (e.g., 'https://example.com')\n * @returns Safe redirect URL, defaults to '/' if invalid\n */\nexport function validateReturnTo(returnTo: string | undefined, requestOrigin: string): string {\n // Default to root for empty/undefined values\n if (!returnTo) {\n return '/';\n }\n\n // Relative paths starting with '/' are safe (but not protocol-relative '//')\n if (returnTo.startsWith('/') && !returnTo.startsWith('//')) {\n return returnTo;\n }\n\n // For absolute URLs, validate same origin\n try {\n const parsed = new URL(returnTo);\n const origin = new URL(requestOrigin);\n\n // Same origin check: protocol + host must match\n if (parsed.origin === origin.origin) {\n return returnTo;\n }\n } catch {\n // Invalid URL, fall through to default\n }\n\n // Default to root for invalid or cross-origin URLs\n return '/';\n}\n","/**\n * Network utilities for OAuth flow.\n *\n * Provides fetch wrapper with single retry for transient network errors.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\n\n/**\n * Fetch with single retry on network errors.\n *\n * Retries ONLY on network failures (fetch throws), not HTTP error responses.\n * Caller is responsible for handling HTTP status codes.\n *\n * @param url - URL to fetch\n * @param options - Fetch options\n * @returns Response (may have error status code)\n * @throws AuthError with code 'network_error' if both attempts fail\n */\nexport async function fetchWithRetry(url: string, options: RequestInit): Promise<Response> {\n try {\n return await fetch(url, options);\n } catch {\n // Network error - retry once\n try {\n return await fetch(url, options);\n } catch (retryError) {\n // Both attempts failed\n throw AuthError.networkError(retryError instanceof Error ? retryError : undefined);\n }\n }\n}\n","/**\n * PKCE error types and error class.\n *\n * @internal This module is not exported from the main package.\n */\n\n/**\n * Error codes for PKCE-related failures.\n */\nexport type PKCEErrorCode = 'MISSING_VERIFIER' | 'EXPIRED' | 'INVALID';\n\n/**\n * Error class for PKCE-related failures.\n * Uses a code discriminator for programmatic error handling.\n */\nexport class PKCEError extends Error {\n readonly code: PKCEErrorCode;\n override readonly cause?: Error;\n\n constructor(code: PKCEErrorCode, message: string, cause?: Error) {\n super(message);\n this.name = 'PKCEError';\n this.code = code;\n this.cause = cause;\n // Required for instanceof checks in TypeScript\n Object.setPrototypeOf(this, new.target.prototype);\n }\n\n /**\n * Factory: PKCE verifier cookie not found.\n */\n static missingVerifier(): PKCEError {\n return new PKCEError(\n 'MISSING_VERIFIER',\n 'PKCE verifier cookie not found. Authorization flow may have expired or was not initiated properly.',\n );\n }\n\n /**\n * Factory: PKCE verifier has expired.\n */\n static expired(): PKCEError {\n return new PKCEError('EXPIRED', 'PKCE verifier has expired. Please restart the authorization flow.');\n }\n\n /**\n * Factory: PKCE verifier cookie is malformed.\n */\n static invalid(cause?: Error): PKCEError {\n return new PKCEError('INVALID', 'PKCE verifier cookie is malformed or invalid.', cause);\n }\n}\n","/**\n * PKCE cookie storage utilities.\n * Handles serialization, parsing, and clearing of PKCE verifier cookies.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { PKCEError } from './error';\n\n/**\n * Cookie name for PKCE verifier storage.\n */\nexport const PKCE_COOKIE_NAME = 'mastra_pkce_verifier';\n\n/**\n * Data stored in the PKCE cookie.\n */\nexport interface PKCECookieData {\n verifier: string;\n state: string;\n expiresAt: number; // Unix timestamp in milliseconds\n}\n\n/**\n * Create a Set-Cookie header value for storing PKCE verifier and state.\n *\n * @param verifier - The code verifier for PKCE\n * @param state - The state parameter for CSRF protection\n * @param isProduction - Whether to add Secure flag (required for HTTPS)\n * @returns Set-Cookie header value\n */\nexport function setPKCECookie(verifier: string, state: string, isProduction: boolean): string {\n const ttlSeconds = 5 * 60; // 5 minutes\n const data: PKCECookieData = {\n verifier,\n state,\n expiresAt: Date.now() + ttlSeconds * 1000,\n };\n\n const encoded = encodeURIComponent(JSON.stringify(data));\n\n let cookie = `${PKCE_COOKIE_NAME}=${encoded}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${ttlSeconds}`;\n\n if (isProduction) {\n cookie += '; Secure';\n }\n\n return cookie;\n}\n\n/**\n * Parse the PKCE cookie from a Cookie header.\n *\n * @param cookieHeader - The Cookie header value (may be null)\n * @returns Parsed cookie data\n * @throws PKCEError if cookie is missing, expired, or malformed\n */\nexport function parsePKCECookie(cookieHeader: string | null): PKCECookieData {\n if (!cookieHeader) {\n throw PKCEError.missingVerifier();\n }\n\n const match = cookieHeader.match(new RegExp(`${PKCE_COOKIE_NAME}=([^;]+)`));\n\n if (!match?.[1]) {\n throw PKCEError.missingVerifier();\n }\n\n let data: PKCECookieData;\n try {\n data = JSON.parse(decodeURIComponent(match[1])) as PKCECookieData;\n } catch (e) {\n throw PKCEError.invalid(e instanceof Error ? e : undefined);\n }\n\n if (data.expiresAt < Date.now()) {\n throw PKCEError.expired();\n }\n\n return data;\n}\n\n/**\n * Create a Set-Cookie header value to clear the PKCE cookie.\n *\n * @returns Set-Cookie header value that expires the cookie\n */\nexport function clearPKCECookie(): string {\n return `${PKCE_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;\n}\n","/**\n * PKCE (Proof Key for Code Exchange) cryptographic utilities.\n * Implements RFC 7636 S256 challenge method.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { randomBytes, createHash } from 'node:crypto';\n\n/**\n * Generate a code verifier for PKCE.\n * Uses 32 random bytes encoded as base64url (43 characters).\n *\n * Per RFC 7636: code_verifier must be 43-128 characters using unreserved characters.\n */\nexport function generateCodeVerifier(): string {\n // 32 bytes -> 43 chars base64url\n return randomBytes(32).toString('base64url');\n}\n\n/**\n * Compute the S256 code challenge from a verifier.\n * challenge = BASE64URL(SHA256(verifier))\n *\n * Per RFC 7636: S256 method uses SHA-256 hash of the verifier.\n */\nexport function computeCodeChallenge(verifier: string): string {\n return createHash('sha256').update(verifier).digest('base64url');\n}\n\n/**\n * Generate a state parameter for CSRF protection.\n * Uses 16 random bytes encoded as base64url (22 characters).\n */\nexport function generateState(): string {\n // 16 bytes -> 22 chars base64url\n return randomBytes(16).toString('base64url');\n}\n","/**\n * OAuth authorization flow functions.\n *\n * Implements login URL generation and callback handling for\n * Mastra Cloud authentication with PKCE.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\nimport { setPKCECookie, parsePKCECookie, clearPKCECookie } from '../pkce/cookie';\nimport { generateCodeVerifier, computeCodeChallenge, generateState } from '../pkce/pkce';\nimport type { LoginUrlResult, CallbackResult } from '../types';\nimport { fetchWithRetry } from './network';\nimport { encodeState, decodeState, validateReturnTo } from './state';\n\n/**\n * Options for generating login URL.\n */\nexport interface LoginUrlOptions {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of Mastra Cloud API (e.g., 'https://cloud.mastra.ai') */\n cloudBaseUrl: string;\n /** OAuth callback URL (e.g., 'https://myapp.com/auth/callback') */\n callbackUrl: string;\n /** URL to redirect to after successful login */\n returnTo?: string;\n /** Origin of the current request (e.g., 'https://myapp.com') */\n requestOrigin: string;\n /** Whether running in production (affects cookie Secure flag) */\n isProduction?: boolean;\n}\n\n/**\n * Options for handling OAuth callback.\n */\nexport interface CallbackOptions {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of Mastra Cloud API */\n cloudBaseUrl: string;\n /** OAuth callback URL (must match what was sent to /auth/oss) */\n redirectUri: string;\n /** Authorization code from OAuth callback */\n code: string;\n /** State parameter from OAuth callback */\n state: string;\n /** Cookie header from request (may be null) */\n cookieHeader: string | null;\n}\n\n/**\n * Generate a login URL for Mastra Cloud OAuth flow.\n *\n * Creates a URL with PKCE challenge and state parameter for CSRF protection.\n * Returns a PKCE cookie that must be set on the response.\n *\n * @param options - Login URL options\n * @returns URL to redirect to and cookies to set\n */\nexport function getLoginUrl(options: LoginUrlOptions): LoginUrlResult {\n const { projectId, cloudBaseUrl, callbackUrl, returnTo, requestOrigin, isProduction } = options;\n\n // Generate PKCE verifier and challenge\n const verifier = generateCodeVerifier();\n const challenge = computeCodeChallenge(verifier);\n\n // Generate CSRF token for state\n const csrf = generateState();\n\n // Validate returnTo to prevent open redirect attacks\n const validatedReturnTo = validateReturnTo(returnTo, requestOrigin);\n\n // Encode state with CSRF and returnTo\n const state = encodeState(csrf, validatedReturnTo);\n\n // Build authorization URL\n const url = new URL('/auth/oss', cloudBaseUrl);\n url.searchParams.set('project_id', projectId);\n url.searchParams.set('code_challenge', challenge);\n url.searchParams.set('code_challenge_method', 'S256');\n url.searchParams.set('redirect_uri', callbackUrl);\n url.searchParams.set('state', state);\n\n // Create PKCE cookie (stores verifier and CSRF token)\n const isProductionEnv = isProduction ?? process.env.NODE_ENV === 'production';\n const pkceCookie = setPKCECookie(verifier, csrf, isProductionEnv);\n\n return {\n url: url.toString(),\n cookies: [pkceCookie],\n };\n}\n\n/**\n * Handle OAuth callback from Mastra Cloud.\n *\n * Validates state for CSRF, exchanges code for tokens, and returns user info.\n * Returns a cookie to clear the PKCE state.\n *\n * Note: Session cookie is NOT set here - caller (session module) handles that.\n *\n * @param options - Callback options\n * @returns User info, access token, and redirect URL\n * @throws PKCEError if PKCE cookie is missing or expired\n * @throws AuthError if state validation fails or token exchange fails\n */\nexport async function handleCallback(options: CallbackOptions): Promise<CallbackResult> {\n const { projectId, cloudBaseUrl, redirectUri, code, state, cookieHeader } = options;\n\n // Parse PKCE cookie (throws PKCEError if missing/expired)\n const pkceData = parsePKCECookie(cookieHeader);\n\n // Decode state parameter (throws AuthError if malformed)\n const stateData = decodeState(state);\n\n // Validate CSRF token matches\n if (stateData.csrf !== pkceData.state) {\n throw AuthError.stateMismatch();\n }\n\n // Exchange code for tokens\n const response = await fetchWithRetry(`${cloudBaseUrl}/auth/callback`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'X-Project-ID': projectId,\n },\n body: JSON.stringify({\n code,\n redirect_uri: redirectUri,\n code_verifier: pkceData.verifier,\n }),\n });\n\n // Handle error responses\n if (!response.ok) {\n let cloudCode: string | undefined;\n let cloudMessage: string | undefined;\n\n try {\n const errorBody = (await response.json()) as { code?: string; message?: string };\n cloudCode = errorBody.code;\n cloudMessage = errorBody.message;\n } catch {\n // Could not parse error body\n }\n\n throw AuthError.tokenExchangeFailed({ cloudCode, cloudMessage });\n }\n\n // Parse successful response - Cloud returns token only, no user\n const body = (await response.json()) as {\n access_token: string;\n token_type: string;\n expires_in: number;\n };\n\n // Get user info from /auth/verify endpoint\n const verifyResponse = await fetchWithRetry(`${cloudBaseUrl}/auth/verify`, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${body.access_token}`,\n 'X-Project-ID': projectId,\n },\n });\n\n if (!verifyResponse.ok) {\n throw AuthError.verificationFailed();\n }\n\n // Cloud returns: { sub, email, name?, avatar_url?, role }\n const verifyBody = (await verifyResponse.json()) as {\n sub: string;\n email: string;\n name?: string;\n avatar_url?: string;\n role: string;\n };\n\n // Clear PKCE cookie (no longer needed)\n const clearCookie = clearPKCECookie();\n\n return {\n user: {\n id: verifyBody.sub,\n email: verifyBody.email,\n name: verifyBody.name,\n avatar: verifyBody.avatar_url,\n role: verifyBody.role,\n },\n accessToken: body.access_token,\n returnTo: stateData.returnTo,\n cookies: [clearCookie],\n };\n}\n","/**\n * Session cookie utilities.\n * Handles setting, parsing, and clearing of session cookies.\n *\n * @internal This module is not exported from the main package.\n */\n\n/**\n * Cookie name for session token storage.\n */\nexport const SESSION_COOKIE_NAME = 'mastra_cloud_session';\n\n/**\n * Create a Set-Cookie header value for storing session token.\n *\n * @param token - The session token\n * @param isProduction - Whether to add Secure flag (required for HTTPS)\n * @returns Set-Cookie header value\n */\nexport function setSessionCookie(token: string, isProduction: boolean): string {\n const ttlSeconds = 24 * 60 * 60; // 24 hours\n\n let cookie = `${SESSION_COOKIE_NAME}=${token}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${ttlSeconds}`;\n\n if (isProduction) {\n cookie += '; Secure';\n }\n\n return cookie;\n}\n\n/**\n * Parse the session token from a Cookie header.\n *\n * @param cookieHeader - The Cookie header value (may be null)\n * @returns Session token or null if not present\n */\nexport function parseSessionCookie(cookieHeader: string | null): string | null {\n if (!cookieHeader) {\n return null;\n }\n\n const match = cookieHeader.match(new RegExp(`${SESSION_COOKIE_NAME}=([^;]+)`));\n return match?.[1] ?? null;\n}\n\n/**\n * Create a Set-Cookie header value to clear the session cookie.\n *\n * @returns Set-Cookie header value that expires the cookie\n */\nexport function clearSessionCookie(): string {\n return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;\n}\n","/**\n * Session lifecycle functions.\n * Handles token verification, session validation, and logout.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\nimport { fetchWithRetry } from '../oauth/network';\nimport type { CloudSession, VerifyResponse } from '../types';\n\n/**\n * Options for verifyToken.\n */\nexport interface VerifyTokenOptions {\n projectId: string;\n cloudBaseUrl: string;\n token: string;\n}\n\n/**\n * Options for validateSession and destroySession.\n */\nexport interface SessionOptions {\n projectId: string;\n cloudBaseUrl: string;\n sessionToken: string;\n}\n\n/**\n * Verify an access token with Cloud API.\n *\n * @param options - Verification options\n * @returns User and role information\n * @throws AuthError with code 'verification_failed' if verification fails\n * @throws AuthError with code 'network_error' if network request fails\n */\nexport async function verifyToken(options: VerifyTokenOptions): Promise<VerifyResponse> {\n const { projectId, cloudBaseUrl, token } = options;\n\n const response = await fetchWithRetry(`${cloudBaseUrl}/auth/verify`, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${token}`,\n 'X-Project-ID': projectId,\n },\n });\n\n if (!response.ok) {\n throw AuthError.verificationFailed();\n }\n\n // Cloud returns different shapes for user tokens vs project API tokens:\n // User token: { sub, email, name?, avatar_url?, role }\n // Project API token: { valid: true, role: \"api\", token_type: \"project_api_token\" }\n const body = (await response.json()) as {\n // User token fields\n sub?: string;\n email?: string;\n name?: string;\n avatar_url?: string;\n role: string;\n // Project API token fields\n valid?: boolean;\n token_type?: string;\n };\n\n // Project API token - no user info, just role\n if (body.token_type === 'project_api_token') {\n return {\n user: {\n id: 'api-token',\n email: undefined,\n name: undefined,\n avatar: undefined,\n },\n role: body.role,\n };\n }\n\n // User token - full user info\n return {\n user: {\n id: body.sub!,\n email: body.email!,\n name: body.name,\n avatar: body.avatar_url,\n },\n role: body.role,\n };\n}\n\n/**\n * Validate an existing session with Cloud API.\n *\n * @param options - Session options\n * @returns Session data if valid, null otherwise\n */\nexport async function validateSession(options: SessionOptions): Promise<CloudSession | null> {\n const { projectId, cloudBaseUrl, sessionToken } = options;\n\n try {\n const response = await fetchWithRetry(`${cloudBaseUrl}/auth/session/validate`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${sessionToken}`,\n 'X-Project-ID': projectId,\n },\n });\n\n if (!response.ok) {\n return null;\n }\n\n return (await response.json()) as CloudSession;\n } catch {\n // Any error (network, parsing) returns null\n return null;\n }\n}\n\n/**\n * Destroy a session with Cloud API.\n * Note: X-Project-ID not required for this endpoint.\n *\n * @param options - Session options\n */\nexport async function destroySession(options: SessionOptions): Promise<void> {\n const { cloudBaseUrl, sessionToken } = options;\n\n await fetchWithRetry(`${cloudBaseUrl}/auth/session/destroy`, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${sessionToken}`,\n },\n });\n\n // Ignore response - void return per spec\n}\n\n/**\n * Get the logout URL for redirecting users.\n *\n * @param cloudBaseUrl - Cloud API base URL\n * @param postLogoutRedirectUri - URL to redirect to after logout (required)\n * @param idTokenHint - The access token (required by Cloud)\n * @returns Full logout URL with redirect and token parameters\n */\nexport function getLogoutUrl(cloudBaseUrl: string, postLogoutRedirectUri: string, idTokenHint: string): string {\n const url = new URL('/auth/logout', cloudBaseUrl);\n url.searchParams.set('post_logout_redirect_uri', postLogoutRedirectUri);\n url.searchParams.set('id_token_hint', idTokenHint);\n return url.toString();\n}\n","/**\n * MastraCloudAuth client class.\n * Facade composing OAuth and session modules into unified API.\n */\n\nimport { getLoginUrl, handleCallback } from './oauth';\nimport {\n verifyToken,\n validateSession,\n destroySession,\n getLogoutUrl,\n setSessionCookie,\n clearSessionCookie,\n} from './session';\nimport type { LoginUrlResult, CallbackResult, VerifyResponse, CloudSession } from './types';\n\n/**\n * Configuration for MastraCloudAuth client.\n */\nexport interface MastraCloudAuthConfig {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of the Cloud API (e.g., https://cloud.mastra.ai) */\n cloudBaseUrl: string;\n /** OAuth callback URL for your application */\n callbackUrl: string;\n /** Whether running in production (adds Secure flag to cookies) */\n isProduction?: boolean;\n}\n\n/**\n * Mastra Cloud authentication client.\n *\n * Provides unified API for OAuth flow and session management.\n *\n * @example\n * ```typescript\n * const auth = new MastraCloudAuth({\n * cloudBaseUrl: 'https://cloud.mastra.ai',\n * callbackUrl: 'https://myapp.com/auth/callback',\n * });\n *\n * // Start login flow\n * const { url, cookies } = auth.getLoginUrl({\n * requestOrigin: 'https://myapp.com',\n * });\n *\n * // After callback\n * const result = await auth.handleCallback({\n * code: 'auth_code',\n * state: 'state_param',\n * cookieHeader: request.headers.get('cookie'),\n * });\n * ```\n */\nexport class MastraCloudAuth {\n private readonly config: MastraCloudAuthConfig;\n\n constructor(config: MastraCloudAuthConfig) {\n this.config = config;\n }\n\n /**\n * Generate login URL for OAuth authorization.\n *\n * @param options - Login options\n * @returns URL to redirect to and cookies to set\n */\n getLoginUrl(options: { returnTo?: string; requestOrigin: string }): LoginUrlResult {\n return getLoginUrl({\n projectId: this.config.projectId,\n cloudBaseUrl: this.config.cloudBaseUrl,\n callbackUrl: this.config.callbackUrl,\n returnTo: options.returnTo,\n requestOrigin: options.requestOrigin,\n isProduction: this.config.isProduction,\n });\n }\n\n /**\n * Handle OAuth callback after authorization.\n *\n * @param options - Callback parameters\n * @returns User info, tokens, and redirect URL\n */\n handleCallback(options: { code: string; state: string; cookieHeader: string | null }): Promise<CallbackResult> {\n return handleCallback({\n projectId: this.config.projectId,\n cloudBaseUrl: this.config.cloudBaseUrl,\n redirectUri: this.config.callbackUrl,\n ...options,\n });\n }\n\n /**\n * Verify an access token.\n *\n * @param token - Access token to verify\n * @returns User and role information\n */\n verifyToken(token: string): Promise<VerifyResponse> {\n return verifyToken({ projectId: this.config.projectId, cloudBaseUrl: this.config.cloudBaseUrl, token });\n }\n\n /**\n * Validate an existing session.\n *\n * @param sessionToken - Session token to validate\n * @returns Session data if valid, null otherwise\n */\n validateSession(sessionToken: string): Promise<CloudSession | null> {\n return validateSession({ projectId: this.config.projectId, cloudBaseUrl: this.config.cloudBaseUrl, sessionToken });\n }\n\n /**\n * Destroy a session (server-side logout).\n *\n * @param sessionToken - Session token to destroy\n */\n destroySession(sessionToken: string): Promise<void> {\n return destroySession({ projectId: this.config.projectId, cloudBaseUrl: this.config.cloudBaseUrl, sessionToken });\n }\n\n /**\n * Get the logout URL for client-side redirect.\n *\n * @param postLogoutRedirectUri - URL to redirect to after logout\n * @param idTokenHint - The access token\n * @returns Full logout URL with redirect and token parameters\n */\n getLogoutUrl(postLogoutRedirectUri: string, idTokenHint: string): string {\n return getLogoutUrl(this.config.cloudBaseUrl, postLogoutRedirectUri, idTokenHint);\n }\n\n /**\n * Create Set-Cookie header value for session token.\n *\n * @param token - Session token to store\n * @returns Set-Cookie header value\n */\n setSessionCookie(token: string): string {\n return setSessionCookie(token, this.config.isProduction ?? process.env.NODE_ENV === 'production');\n }\n\n /**\n * Create Set-Cookie header value to clear session cookie.\n *\n * @returns Set-Cookie header value\n */\n clearSessionCookie(): string {\n return clearSessionCookie();\n }\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n AGENT: 'AGENT',\n OBSERVABILITY: 'OBSERVABILITY',\n AUTH: 'AUTH',\n BROWSER: 'BROWSER',\n NETWORK: 'NETWORK',\n WORKFLOW: 'WORKFLOW',\n LLM: 'LLM',\n TTS: 'TTS',\n VOICE: 'VOICE',\n VECTOR: 'VECTOR',\n BUNDLER: 'BUNDLER',\n DEPLOYER: 'DEPLOYER',\n MEMORY: 'MEMORY',\n STORAGE: 'STORAGE',\n EMBEDDINGS: 'EMBEDDINGS',\n MCP_SERVER: 'MCP_SERVER',\n SERVER_CACHE: 'SERVER_CACHE',\n SERVER: 'SERVER',\n WORKSPACE: 'WORKSPACE',\n CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n DEBUG: 'debug',\n INFO: 'info',\n WARN: 'warn',\n ERROR: 'error',\n NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n runId?: string;\n msg: string;\n level: LogLevel;\n time: Date;\n pid: number;\n hostname: string;\n name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n constructor(opts: any = {}) {\n super({ ...opts, objectMode: true });\n }\n\n async listLogsByRunId(_args: {\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n\n async listLogs(_args?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n returnPaginationResults?: boolean;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n}\n\nexport const createCustomTransport = (\n stream: Transform,\n listLogs?: LoggerTransport['listLogs'],\n listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n let transport = stream as LoggerTransport;\n if (listLogs) {\n transport.listLogs = listLogs;\n }\n if (listLogsByRunId) {\n transport.listLogsByRunId = listLogsByRunId;\n }\n return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n debug(message: string, ...args: any[]): void;\n info(message: string, ...args: any[]): void;\n warn(message: string, ...args: any[]): void;\n error(message: string, ...args: any[]): void;\n trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n getTransports(): Map<string, LoggerTransport>;\n listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n protected name: string;\n protected level: LogLevel;\n protected transports: Map<string, LoggerTransport>;\n\n constructor(\n options: {\n name?: string;\n level?: LogLevel;\n transports?: Record<string, LoggerTransport>;\n } = {},\n ) {\n this.name = options.name || 'Mastra';\n this.level = options.level || LogLevel.ERROR;\n this.transports = new Map(Object.entries(options.transports || {}));\n }\n\n abstract debug(message: string, ...args: any[]): void;\n abstract info(message: string, ...args: any[]): void;\n abstract warn(message: string, ...args: any[]): void;\n abstract error(message: string, ...args: any[]): void;\n\n getTransports() {\n return this.transports;\n }\n\n trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n async listLogs(\n transportId: string,\n params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n if (!transportId || !this.transports.has(transportId)) {\n return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports.get(transportId)!.listLogs?.(params) ?? {\n logs: [],\n total: 0,\n page: params?.page ?? 1,\n perPage: params?.perPage ?? 100,\n hasMore: false,\n }\n );\n }\n\n async listLogsByRunId({\n transportId,\n runId,\n fromDate,\n toDate,\n logLevel,\n filters,\n page,\n perPage,\n }: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n if (!transportId || !this.transports.has(transportId) || !runId) {\n return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports\n .get(transportId)!\n .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n logs: [],\n total: 0,\n page: page ?? 1,\n perPage: perPage ?? 100,\n hasMore: false,\n }\n );\n }\n}\n\nexport type LogFilterContext = {\n component?: RegisteredLogger;\n level: LogLevel;\n message: string;\n args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n name?: string;\n level?: LogLevel;\n component?: RegisteredLogger;\n filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n protected component?: RegisteredLogger;\n protected filter?: LogFilter;\n\n constructor(options: ConsoleLoggerOptions = {}) {\n super(options);\n this.component = options.component;\n this.filter = options.filter;\n }\n\n child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n const component =\n typeof componentOrBindings === 'string'\n ? componentOrBindings\n : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n return new ConsoleLogger({\n name: this.name,\n level: this.level,\n component,\n filter: this.filter,\n });\n }\n\n private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n if (!this.filter) return true;\n try {\n return this.filter({ component: this.component, level, message, args });\n } catch (e) {\n console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n return true;\n }\n }\n\n private prefix(): string {\n return this.component ? `[${this.component}] ` : '';\n }\n\n debug(message: string, ...args: any[]): void {\n if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n info(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.INFO, message, args)\n ) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n warn(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.WARN, message, args)\n ) {\n console.warn(`${this.prefix()}${message}`, ...args);\n }\n }\n\n error(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.ERROR ||\n this.level === LogLevel.WARN ||\n this.level === LogLevel.INFO ||\n this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.ERROR, message, args)\n ) {\n console.error(`${this.prefix()}${message}`, ...args);\n }\n }\n\n async listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n }\n\n async listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n component: RegisteredLogger = RegisteredLogger.LLM;\n protected logger: IMastraLogger;\n name?: string;\n #rawConfig?: Record<string, unknown>;\n\n constructor({\n component,\n name,\n rawConfig,\n }: {\n component?: RegisteredLogger;\n name?: string;\n rawConfig?: Record<string, unknown>;\n }) {\n this.component = component || RegisteredLogger.LLM;\n this.name = name;\n this.#rawConfig = rawConfig;\n this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n }\n\n /**\n * Returns the raw storage configuration this primitive was created from,\n * or undefined if it was created from code.\n */\n toRawConfig(): Record<string, unknown> | undefined {\n return this.#rawConfig;\n }\n\n /**\n * Sets the raw storage configuration for this primitive.\n * @internal\n */\n __setRawConfig(rawConfig: Record<string, unknown>): void {\n this.#rawConfig = rawConfig;\n }\n\n /**\n * Set the logger for the agent\n * @param logger\n */\n __setLogger(logger: IMastraLogger) {\n this.logger =\n 'child' in logger && typeof (logger as any).child === 'function'\n ? (logger as any).child({ component: this.component })\n : logger;\n }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n CredentialsResult,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n name?: string;\n authorizeUser?: AuthorizeUserFn<TUser>;\n mapUserToResourceId?(user: TUser): string | undefined | null;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {\n public protected?: MastraAuthConfig['protected'];\n public public?: MastraAuthConfig['public'];\n public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n constructor(options?: MastraAuthProviderOptions<TUser>) {\n super({ component: 'AUTH', name: options?.name });\n\n if (options?.authorizeUser) {\n this.authorizeUser = options.authorizeUser.bind(this);\n }\n\n this.protected = options?.protected;\n this.public = options?.public;\n this.mapUserToResourceId = options?.mapUserToResourceId;\n }\n\n /**\n * Authenticate a token and return the payload\n * @param token - The token to authenticate\n * @param request - The request\n * @returns The payload\n */\n abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n /**\n * Authorize a user for a path and method\n * @param user - The user to authorize\n * @param request - The request\n * @returns The authorization result\n */\n abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n if (opts?.authorizeUser) {\n this.authorizeUser = opts.authorizeUser.bind(this);\n }\n if (opts?.mapUserToResourceId) {\n this.mapUserToResourceId = opts.mapUserToResourceId;\n }\n if (opts?.protected) {\n this.protected = opts.protected;\n }\n if (opts?.public) {\n this.public = opts.public;\n }\n }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).getLoginUrl === 'function' &&\n typeof (p as any).handleCallback === 'function'\n );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).validateSession === 'function' &&\n typeof (p as any).createSession === 'function'\n );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n extends MastraAuthProvider\n implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n private providers: MastraAuthProvider[];\n private authenticatedProviderByObject = new WeakMap<object, MastraAuthProvider>();\n private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, MastraAuthProvider>();\n\n constructor(providers: MastraAuthProvider[]) {\n const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n super({\n public: combinedPublic,\n protected: combinedProtected,\n });\n\n this.providers = providers;\n if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n }\n\n // Null out interface methods when no inner provider supports them.\n // This ensures duck-typing checks (typeof auth.method === 'function')\n // accurately reflect the composite's actual capabilities — preventing\n // Studio from showing login options that no provider can handle.\n if (!providers.some(isSSOProvider)) {\n this.getLoginUrl = undefined as any;\n this.handleCallback = undefined as any;\n this.getLoginButtonConfig = undefined as any;\n }\n if (!providers.some(isSessionProvider)) {\n this.createSession = undefined as any;\n this.validateSession = undefined as any;\n this.getSessionIdFromRequest = undefined as any;\n }\n if (!providers.some(isUserProvider)) {\n this.getCurrentUser = undefined as any;\n this.getUser = undefined as any;\n this.getUsers = undefined as any;\n }\n // Proxy credentials provider methods if any inner provider supports them.\n const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is MastraAuthProvider) as any;\n if (credProvider) {\n (this as any).signIn = credProvider.signIn.bind(credProvider);\n if (typeof credProvider.signUp === 'function') {\n (this as any).signUp = credProvider.signUp.bind(credProvider);\n }\n if (typeof credProvider.requestPasswordReset === 'function') {\n (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n }\n if (typeof credProvider.resetPassword === 'function') {\n (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n }\n (this as any).isSignUpEnabled =\n typeof credProvider.isSignUpEnabled === 'function'\n ? credProvider.isSignUpEnabled.bind(credProvider)\n : () => true;\n } else {\n (this as any).signIn = undefined;\n (this as any).signUp = undefined;\n (this as any).requestPasswordReset = undefined;\n (this as any).resetPassword = undefined;\n (this as any).isSignUpEnabled = undefined;\n }\n }\n\n // Find first provider implementing an interface\n private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n return this.providers.find(check) as T | undefined;\n }\n\n private rememberAuthenticatedProvider(user: unknown, provider: MastraAuthProvider): void {\n if (isObjectLike(user)) {\n this.authenticatedProviderByObject.set(user, provider);\n return;\n }\n\n this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n }\n\n private takeAuthenticatedProvider(user: unknown): MastraAuthProvider | undefined {\n if (isObjectLike(user)) {\n const provider = this.authenticatedProviderByObject.get(user);\n this.authenticatedProviderByObject.delete(user);\n return provider;\n }\n\n const primitiveUser = user as PrimitiveAuthUser;\n const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n this.authenticatedProviderByPrimitive.delete(primitiveUser);\n return provider;\n }\n\n private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n const provider = this.takeAuthenticatedProvider(user);\n return provider?.mapUserToResourceId?.(user);\n }\n\n // ============================================================================\n // License Exemption Markers\n // Expose these if any underlying provider has them\n // ============================================================================\n\n /**\n * True if any provider is MastraCloudAuth (exempt from license requirement).\n */\n get isMastraCloudAuth(): boolean {\n return this.providers.some(\n p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n );\n }\n\n /**\n * True if any provider is SimpleAuth (exempt from license requirement).\n */\n get isSimpleAuth(): boolean {\n return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n for (const provider of this.providers) {\n try {\n const user = await provider.authenticateToken(token, request);\n if (user) {\n this.rememberAuthenticatedProvider(user, provider);\n return user;\n }\n } catch {\n // ignore error, try next provider\n }\n }\n return null;\n }\n\n async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n for (const provider of this.providers) {\n const authorized = await provider.authorizeUser(user, request);\n if (authorized) {\n return true;\n }\n }\n return false;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /**\n * Forward cookie header to SSO provider for PKCE validation.\n * Called by auth handler before handleCallback().\n */\n setCallbackCookieHeader(cookieHeader: string | null): void {\n const sso = this.findProvider(isSSOProvider);\n if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n (sso as any).setCallbackCookieHeader(cookieHeader);\n }\n }\n\n getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.getLoginUrl(redirectUri, state);\n }\n\n getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n const sso = this.findProvider(isSSOProvider);\n return sso?.getLoginCookies?.(redirectUri, state);\n }\n\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) return { provider: 'unknown', text: 'Sign in' };\n return sso.getLoginButtonConfig();\n }\n\n async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n // Try each SSO provider until one returns a logout URL\n for (const provider of this.providers) {\n if (isSSOProvider(provider) && provider.getLogoutUrl) {\n try {\n const url = await provider.getLogoutUrl(redirectUri, request);\n if (url) return url;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const session = this.findProvider(isSessionProvider);\n if (!session) throw new Error('No session provider configured in CompositeAuth');\n return session.createSession(userId, metadata);\n }\n\n async validateSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one validates\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.validateSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async destroySession(sessionId: string): Promise<void> {\n // Destroy session on ALL providers (user may have sessions in multiple stores)\n const destroyPromises: Promise<void>[] = [];\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n destroyPromises.push(\n provider.destroySession(sessionId).catch(() => {\n // Ignore errors, session may not exist in this provider\n }),\n );\n }\n }\n await Promise.all(destroyPromises);\n }\n\n async refreshSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one refreshes\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.refreshSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionIdFromRequest(request: Request): string | null {\n // Try each session provider until one finds a session ID\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const sessionId = provider.getSessionIdFromRequest(request);\n if (sessionId) return sessionId;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n // Intentionally uses only the first session provider: a session is created by one\n // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n // no stale cookies remain.\n const sessionProvider = this.findProvider(isSessionProvider);\n return sessionProvider?.getSessionHeaders(session) ?? {};\n }\n\n getClearSessionHeaders(): Record<string, string> {\n // Merge clear headers from ALL providers to ensure no stale session cookies remain\n const headers: Record<string, string> = {};\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const providerHeaders = provider.getClearSessionHeaders();\n Object.assign(headers, providerHeaders);\n } catch {\n // Ignore errors\n }\n }\n }\n return headers;\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // Try each provider until one returns a user (like authenticateToken)\n // ============================================================================\n\n async getCurrentUser(request: Request): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getCurrentUser(request);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUser(userId: string): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getUser(userId);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<User | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n /**\n * Valid tokens to authenticate against\n */\n tokens: TokenToUser<TUser>;\n /**\n * Headers to check for authentication\n * @default ['Authorization', 'X-Playground-Access']\n */\n headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n /**\n * Marker to exempt SimpleAuth from EE license requirement.\n * SimpleAuth is for development/testing and should work without a license.\n */\n readonly isSimpleAuth = true;\n\n private tokens: TokenToUser<TUser>;\n private headers: string[];\n private users: TUser[];\n private userById: Map<string, TUser>;\n\n constructor(options: SimpleAuthOptions<TUser>) {\n super(options);\n this.tokens = options.tokens;\n this.users = Object.values(this.tokens);\n this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n }\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n const requestTokens = this.getTokensFromHeaders(token, request);\n\n for (const requestToken of requestTokens) {\n const tokenToUser = this.tokens[requestToken];\n if (tokenToUser) {\n return tokenToUser;\n }\n }\n\n return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n }\n\n async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n return this.users.includes(user);\n }\n\n /** Get current user from request headers or cookie. */\n async getCurrentUser(request: Request): Promise<TUser | null> {\n // Check headers first\n for (const headerName of this.headers) {\n const headerValue = request.headers.get(headerName);\n if (headerValue) {\n const token = this.stripBearerPrefix(headerValue);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n\n return this.getUserFromCookie(request.headers.get('Cookie'));\n }\n\n private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n if (!cookieHeader) return null;\n\n const cookies = cookieHeader.split(';').map(c => c.trim());\n for (const cookie of cookies) {\n if (cookie.startsWith('mastra-token=')) {\n const token = cookie.slice('mastra-token='.length);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n return null;\n }\n\n /** Get user by ID. */\n async getUser(userId: string): Promise<TUser | null> {\n return this.userById.get(userId) ?? null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n return userIds.map(userId => this.userById.get(userId) ?? null);\n }\n\n /**\n * Sign in with token (passed as password field).\n * The email field is ignored - only the token matters.\n */\n async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n const token = password;\n const user = this.tokens[token];\n\n if (!user) {\n throw new Error('Invalid token');\n }\n\n // Set cookie so the token persists across requests\n const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n return {\n user,\n token,\n cookies: [cookie],\n };\n }\n\n async signUp(): Promise<CredentialsResult<TUser>> {\n throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n }\n\n isSignUpEnabled(): boolean {\n return false;\n }\n\n /**\n * Get headers to clear the session cookie on logout.\n * Partial ISessionProvider implementation for logout support.\n */\n getClearSessionHeaders(): Record<string, string> {\n return {\n 'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n };\n }\n\n private stripBearerPrefix(token: string): string {\n return token.startsWith('Bearer ') ? token.slice(7) : token;\n }\n\n private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n const tokens = [token];\n for (const headerName of this.headers) {\n const headerValue = getRequestHeader(request, headerName);\n if (headerValue) {\n tokens.push(this.stripBearerPrefix(headerValue));\n }\n }\n return tokens;\n }\n}\n","/**\n * MastraCloudAuthProvider - Server integration for Mastra Cloud authentication.\n *\n * Extends MastraAuthProvider and implements ISSOProvider, ISessionProvider,\n * and IUserProvider interfaces to integrate with Mastra server middleware.\n *\n * @packageDocumentation\n */\n\nimport type {\n IUserProvider,\n ISSOProvider,\n ISessionProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n} from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\n\nimport { MastraCloudAuth } from './client';\nimport { parseSessionCookie } from './session/cookie';\nimport type { CloudUser } from './types';\n\ntype HonoRequestLike = {\n raw?: Request;\n headers?: Headers;\n header(name: string): string | undefined;\n};\n\ntype MastraAuthRequest = Request | HonoRequestLike;\n\nfunction getRequestHeader(request: MastraAuthRequest, name: string): string | null {\n if (request instanceof Request) {\n return request.headers.get(name);\n }\n\n return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;\n}\n\n/**\n * Configuration options for MastraCloudAuthProvider.\n */\nexport interface MastraCloudAuthProviderOptions extends MastraAuthProviderOptions<CloudUser> {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of Mastra Cloud API (e.g., https://cloud.mastra.ai) */\n cloudBaseUrl: string;\n /** OAuth callback URL for your application */\n callbackUrl: string;\n /** Whether running in production (adds Secure flag to cookies) */\n isProduction?: boolean;\n}\n\n/**\n * Mastra Cloud authentication provider for server integration.\n *\n * Wraps the MastraCloudAuth client and implements the required interfaces\n * for Mastra server middleware. Provides SSO login, session management,\n * and user awareness.\n *\n * @example\n * ```typescript\n * import { MastraCloudAuthProvider } from '@mastra/auth-cloud';\n *\n * const auth = new MastraCloudAuthProvider({\n * cloudBaseUrl: 'https://cloud.mastra.ai',\n * callbackUrl: 'https://myapp.com/auth/callback',\n * });\n *\n * const mastra = new Mastra({\n * auth,\n * // ...\n * });\n * ```\n */\nexport class MastraCloudAuthProvider\n extends MastraAuthProvider<CloudUser>\n implements IUserProvider<EEUser>, ISSOProvider<EEUser>, ISessionProvider<Session>\n{\n private client: MastraCloudAuth;\n\n /** Marker for EE license exemption - MastraCloudAuth is exempt */\n readonly isMastraCloudAuth = true;\n\n /**\n * Cookie header for handleCallback PKCE validation.\n * Set via setCallbackCookieHeader() before handleCallback() is called.\n * @internal\n */\n private _lastCallbackCookieHeader: string | null = null;\n\n constructor(options: MastraCloudAuthProviderOptions) {\n super({ name: options?.name ?? 'cloud' });\n\n this.client = new MastraCloudAuth({\n projectId: options.projectId,\n cloudBaseUrl: options.cloudBaseUrl,\n callbackUrl: options.callbackUrl,\n isProduction: options.isProduction,\n });\n\n this.registerOptions(options);\n }\n\n /**\n * Set cookie header for handleCallback PKCE validation.\n * Must be called before handleCallback() to pass cookie header.\n *\n * @param cookieHeader - Cookie header from original request\n */\n setCallbackCookieHeader(cookieHeader: string | null): void {\n this._lastCallbackCookieHeader = cookieHeader;\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n /**\n * Authenticate a bearer token or session cookie.\n *\n * Checks session cookie first, falls back to bearer token for API clients.\n *\n * @param token - Bearer token (from Authorization header)\n * @param request - Request used for cookie access\n * @returns Authenticated user with role, or null if invalid\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<CloudUser | null> {\n try {\n const cookieHeader = getRequestHeader(request, 'cookie');\n\n // Parse session token from cookie\n const sessionToken = parseSessionCookie(cookieHeader);\n\n if (sessionToken) {\n // Verify session token with Cloud API\n const { user, role } = await this.client.verifyToken(sessionToken);\n return { ...user, role };\n }\n\n // Fall back to bearer token if no cookie\n if (token) {\n const { user, role } = await this.client.verifyToken(token);\n return { ...user, role };\n }\n\n return null;\n } catch {\n // Per Phase 10 decision: return null on any error\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * Simple validation - detailed permission checking happens in server\n * middleware via checkRoutePermission(), not authorizeUser().\n *\n * @param user - Authenticated user\n * @returns True if user has valid id\n */\n authorizeUser(user: CloudUser): boolean {\n return !!user?.id;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /**\n * Cached login result for getLoginCookies() to retrieve cookies.\n * @internal\n */\n private _lastLoginResult: { url: string; cookies: string[] } | null = null;\n\n /**\n * Get URL to redirect user to for SSO login.\n *\n * @param redirectUri - Callback URL after authentication\n * @param state - State parameter (format: uuid|encodedPostLoginRedirect)\n * @returns Full authorization URL\n */\n getLoginUrl(redirectUri: string, state: string): string {\n // Extract postLoginRedirect from state (format: uuid|encodedPostLoginRedirect)\n let postLoginRedirect = '/';\n if (state && state.includes('|')) {\n const parts = state.split('|', 2);\n const encodedRedirect = parts[1];\n if (encodedRedirect) {\n try {\n postLoginRedirect = decodeURIComponent(encodedRedirect);\n } catch {\n postLoginRedirect = '/';\n }\n }\n }\n\n // Parse origin from redirectUri for PKCE cookie origin validation\n const redirectUrl = new URL(redirectUri);\n const origin = redirectUrl.origin;\n\n // Generate login URL with PKCE\n const result = this.client.getLoginUrl({\n returnTo: postLoginRedirect,\n requestOrigin: origin,\n });\n\n // Cache result for getLoginCookies() to retrieve\n this._lastLoginResult = result;\n\n return result.url;\n }\n\n /**\n * Get cookies to set during login redirect (PKCE verifier).\n * Must be called after getLoginUrl() in same request.\n *\n * @returns Array of Set-Cookie header values\n */\n getLoginCookies(): string[] | undefined {\n const cookies = this._lastLoginResult?.cookies;\n this._lastLoginResult = null; // Clear after retrieval\n return cookies;\n }\n\n /**\n * Handle OAuth callback, exchange code for tokens and user.\n *\n * @param code - Authorization code from callback\n * @param state - State parameter for CSRF validation\n * @returns User, tokens, and session cookies\n */\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<EEUser>> {\n // Get cookie header for PKCE validation, then clear\n const cookieHeader = this._lastCallbackCookieHeader;\n this._lastCallbackCookieHeader = null;\n\n // Exchange code for tokens and get user (includes /auth/verify call)\n const result = await this.client.handleCallback({\n code,\n state,\n cookieHeader,\n });\n\n // Build session cookie\n const sessionCookie = this.client.setSessionCookie(result.accessToken);\n\n return {\n user: result.user, // Already has role from handleCallback\n tokens: {\n accessToken: result.accessToken,\n },\n cookies: [...result.cookies, sessionCookie],\n };\n }\n\n /**\n * Get configuration for rendering login button in UI.\n *\n * @returns Login button configuration\n */\n getLoginButtonConfig(): SSOLoginConfig {\n return {\n provider: 'mastra',\n text: 'Sign in with Mastra Cloud',\n };\n }\n\n /**\n * Get logout URL for client-side redirect.\n * Requires the request to extract the session token for id_token_hint.\n *\n * @param redirectUri - URL to redirect to after logout\n * @param request - Request to extract session token from\n * @returns Logout URL with redirect and token parameters, or null if no session\n */\n getLogoutUrl(redirectUri: string, request?: Request): string | null {\n // Get session token from request cookies for id_token_hint\n const sessionToken = request ? this.getSessionIdFromRequest(request) : null;\n if (!sessionToken) {\n return null; // No active session, nothing to logout\n }\n return this.client.getLogoutUrl(redirectUri, sessionToken);\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n /**\n * Create a new session for a user.\n *\n * For Cloud auth, sessions are created via handleCallback.\n * This method builds a Session object for interface compatibility.\n *\n * @param userId - User to create session for\n * @param metadata - Optional metadata (accessToken can be passed here)\n * @returns Session object\n */\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const now = new Date();\n const expiresAt = new Date(now.getTime() + 24 * 60 * 60 * 1000); // 24 hours\n\n return {\n id: (metadata?.accessToken as string) ?? crypto.randomUUID(),\n userId,\n createdAt: now,\n expiresAt,\n metadata,\n };\n }\n\n /**\n * Validate a session and return it if valid.\n *\n * @param sessionId - Session token to validate\n * @returns Session object or null if invalid/expired\n */\n async validateSession(sessionId: string): Promise<Session | null> {\n const session = await this.client.validateSession(sessionId);\n if (!session) return null;\n\n return {\n id: sessionId,\n userId: session.userId,\n createdAt: new Date(session.createdAt),\n expiresAt: new Date(session.expiresAt),\n };\n }\n\n /**\n * Destroy a session (logout).\n *\n * @param sessionId - Session token to destroy\n */\n async destroySession(sessionId: string): Promise<void> {\n await this.client.destroySession(sessionId);\n }\n\n /**\n * Refresh a session, extending its expiry.\n * Cloud handles refresh internally, so just validate.\n *\n * @param sessionId - Session token to refresh\n * @returns Session object or null if invalid\n */\n async refreshSession(sessionId: string): Promise<Session | null> {\n return this.validateSession(sessionId);\n }\n\n /**\n * Extract session ID from an incoming request.\n *\n * @param request - Incoming HTTP request\n * @returns Session token or null if not present\n */\n getSessionIdFromRequest(request: Request): string | null {\n return parseSessionCookie(request.headers.get('cookie'));\n }\n\n /**\n * Create response headers to set session cookie.\n *\n * @param session - Session to encode (id is the access token)\n * @returns Headers object with Set-Cookie\n */\n getSessionHeaders(session: Session): Record<string, string> {\n return { 'Set-Cookie': this.client.setSessionCookie(session.id) };\n }\n\n /**\n * Create response headers to clear session (for logout).\n *\n * @returns Headers object to clear session cookie\n */\n getClearSessionHeaders(): Record<string, string> {\n return { 'Set-Cookie': this.client.clearSessionCookie() };\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // ============================================================================\n\n /**\n * Get current user from request (session cookie).\n *\n * @param request - Incoming HTTP request\n * @returns User with role or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<CloudUser | null> {\n const sessionToken = this.getSessionIdFromRequest(request);\n if (!sessionToken) return null;\n\n try {\n const { user, role } = await this.client.verifyToken(sessionToken);\n return { ...user, role };\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Cloud API doesn't have a /users/:id endpoint.\n *\n * @returns Always null (not supported)\n */\n async getUser(_userId: string): Promise<CloudUser | null> {\n return null;\n }\n}\n","/**\n * Default roles and permissions for Mastra Studio.\n */\n\nimport type { RoleDefinition, RoleMapping } from '../interfaces';\n\n// Re-export RoleMapping for backward compatibility\nexport type { RoleMapping };\n\n/**\n * Default role definitions for Studio.\n *\n * These roles provide a sensible starting point for most applications:\n * - **owner**: Full access to everything\n * - **admin**: Manage agents, workflows, and users\n * - **member**: Execute agents and workflows, read-only settings\n * - **viewer**: Read-only access\n *\n * Permission patterns:\n * - `*` - Full access to everything\n * - `resource:*` - All actions on a specific resource\n * - `*:action` - An action across all resources (e.g., `*:read` for read-only)\n */\nexport const DEFAULT_ROLES: RoleDefinition[] = [\n {\n id: 'owner',\n name: 'Owner',\n description: 'Full access to all features and settings',\n permissions: ['*'],\n },\n {\n id: 'admin',\n name: 'Admin',\n description: 'Manage agents, workflows, and team members',\n permissions: [\n '*:read',\n '*:write',\n '*:execute',\n '*:publish',\n '*:share',\n // Note: admins cannot delete resources\n ],\n },\n {\n id: 'member',\n name: 'Member',\n description: 'Execute agents and workflows',\n permissions: ['*:read', '*:execute'],\n },\n {\n id: 'viewer',\n name: 'Viewer',\n description: 'Read-only access',\n permissions: ['*:read'],\n },\n];\n\n// Re-export Permission types from generated file\nexport type { Permission, PermissionPattern } from '../interfaces/permissions.generated';\n\n/**\n * Get role by ID from default roles.\n *\n * @param roleId - Role ID to find\n * @returns Role definition or undefined\n */\nexport function getDefaultRole(roleId: string): RoleDefinition | undefined {\n return DEFAULT_ROLES.find(role => role.id === roleId);\n}\n\n/**\n * Resolve all permissions for a set of role IDs.\n *\n * Handles role inheritance and deduplication.\n *\n * @param roleIds - Role IDs to resolve\n * @param roles - Role definitions (defaults to DEFAULT_ROLES)\n * @returns Array of resolved permissions\n */\nexport function resolvePermissions(roleIds: string[], roles: RoleDefinition[] = DEFAULT_ROLES): string[] {\n const permissions = new Set<string>();\n const visited = new Set<string>();\n\n function resolveRole(roleId: string) {\n if (visited.has(roleId)) return;\n visited.add(roleId);\n\n const role = roles.find(r => r.id === roleId);\n if (!role) return;\n\n for (const permission of role.permissions) {\n permissions.add(permission);\n }\n\n // Resolve inherited roles\n if (role.inherits) {\n for (const inheritedRoleId of role.inherits) {\n resolveRole(inheritedRoleId);\n }\n }\n }\n\n for (const roleId of roleIds) {\n resolveRole(roleId);\n }\n\n return Array.from(permissions);\n}\n\n/**\n * Compound resource keys that expand to a set of per-family resources.\n * A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`\n * (and `stored:*` matches any `stored-<family>:*`).\n */\nconst RESOURCE_EXPANSIONS: Record<string, readonly string[]> = {\n stored: [\n 'stored-agents',\n 'stored-mcp-clients',\n 'stored-prompt-blocks',\n 'stored-scorers',\n 'stored-skills',\n 'stored-workspaces',\n ],\n};\n\n/**\n * Check if a permission matches (including wildcard support).\n *\n * Permission format: `{resource}:{action}[:{resource-id}]`\n *\n * Examples:\n * - `*` matches everything\n * - `agents:*` matches `agents:read`, `agents:read:my-agent`\n * - `*:read` matches `agents:read`, `workflows:read` (action across all resources)\n * - `agents:read` matches `agents:read`, `agents:read:my-agent`\n * - `agents:read:my-agent` matches only `agents:read:my-agent`\n * - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`\n *\n * @param userPermission - Permission the user has\n * @param requiredPermission - Permission being checked\n * @returns True if permission matches\n */\nexport function matchesPermission(userPermission: string, requiredPermission: string): boolean {\n // Wildcard matches everything\n if (userPermission === '*') {\n return true;\n }\n\n const grantedParts = userPermission.split(':');\n const requiredParts = requiredPermission.split(':');\n\n // Compound resource alias: expand granted `stored:<action>` into its per-family equivalents.\n // Only applies when the required permission targets one of the expanded families.\n const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ''];\n if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? '')) {\n const aliased = [requiredParts[0], ...grantedParts.slice(1)].join(':');\n return matchesPermission(aliased, requiredPermission);\n }\n\n // Must have at least resource:action\n if (grantedParts.length < 2 || requiredParts.length < 2) {\n return userPermission === requiredPermission;\n }\n\n const [grantedResource, grantedAction, grantedId] = grantedParts;\n const [requiredResource, requiredAction, requiredId] = requiredParts;\n\n // Resource wildcard: \"*:*\" matches everything, \"*:read\" matches any resource with that action\n if (grantedResource === '*') {\n // \"*:*\" is a full wildcard - matches everything\n if (grantedAction === '*') {\n if (grantedId === undefined) {\n return true;\n }\n return grantedId === requiredId;\n }\n // Action must match for resource wildcards with specific action\n if (grantedAction !== requiredAction) {\n return false;\n }\n // If no granted ID, matches all instances\n if (grantedId === undefined) {\n return true;\n }\n // *:read:my-id would match agents:read:my-id (unusual but consistent)\n return grantedId === requiredId;\n }\n\n // Resource must match (for non-wildcard resources)\n if (grantedResource !== requiredResource) {\n return false;\n }\n\n // Action wildcard: \"agents:*\" matches any action\n if (grantedAction === '*') {\n // If no granted ID, matches all resources\n // If granted ID specified (agents:*:my-agent), must match required ID\n if (grantedId === undefined) {\n return true;\n }\n // agents:*:my-agent matches agents:read:my-agent but not agents:read:other\n return grantedId === requiredId;\n }\n\n // Action must match\n if (grantedAction !== requiredAction) {\n return false;\n }\n\n // No resource ID in granted permission = access to all resources of this type\n // \"agents:read\" matches \"agents:read\" and \"agents:read:specific-id\"\n if (grantedId === undefined) {\n return true;\n }\n\n // Both have resource IDs - must match exactly\n return grantedId === requiredId;\n}\n\n/**\n * Check if a user has a specific permission.\n *\n * @param userPermissions - Permissions the user has\n * @param requiredPermission - Permission being checked\n * @returns True if user has the permission\n */\nexport function hasPermission(userPermissions: string[], requiredPermission: string): boolean {\n return userPermissions.some(p => matchesPermission(p, requiredPermission));\n}\n\n/**\n * Resolve permissions from user roles using a role mapping.\n *\n * This function translates provider-defined roles (from WorkOS, Okta, etc.)\n * to Mastra permissions using a configurable mapping.\n *\n * @example\n * ```typescript\n * const roleMapping = {\n * \"Engineering\": [\"agents:*\", \"workflows:*\"],\n * \"Product\": [\"agents:read\"],\n * \"_default\": [],\n * };\n *\n * // User has \"Engineering\" and \"QA\" roles\n * const permissions = resolvePermissionsFromMapping(\n * [\"Engineering\", \"QA\"],\n * roleMapping\n * );\n * // Result: [\"agents:*\", \"workflows:*\"] (QA is unmapped, gets _default)\n * ```\n *\n * @param roles - User's roles from the identity provider\n * @param mapping - Role to permission mapping\n * @returns Array of resolved permissions\n */\nexport function resolvePermissionsFromMapping(roles: string[], mapping: RoleMapping): string[] {\n const permissions = new Set<string>();\n const defaultPerms = mapping['_default'] ?? [];\n\n for (const role of roles) {\n const rolePerms = mapping[role];\n if (rolePerms) {\n for (const perm of rolePerms) {\n permissions.add(perm);\n }\n } else {\n // Apply default permissions for unmapped roles\n for (const perm of defaultPerms) {\n permissions.add(perm);\n }\n }\n }\n\n return Array.from(permissions);\n}\n","/**\n * Mastra Cloud RBAC provider.\n *\n * Provides role-based permission checking for Cloud-authenticated users\n * using configurable role-to-permission mappings.\n */\n\nimport type { IRBACProvider, RoleMapping } from '@internal/auth/ee';\nimport { resolvePermissionsFromMapping, matchesPermission } from '@internal/auth/ee';\n\nimport type { CloudUser } from '../types';\n\n/**\n * Configuration options for MastraRBACCloud.\n */\nexport interface MastraRBACCloudOptions {\n /**\n * Mapping from role names to permission arrays.\n *\n * @example\n * ```typescript\n * {\n * admin: ['*'],\n * member: ['agents:read', 'workflows:*'],\n * viewer: ['agents:read', 'workflows:read'],\n * _default: [],\n * }\n * ```\n */\n roleMapping: RoleMapping;\n}\n\n/**\n * RBAC provider for Mastra Cloud authentication.\n *\n * Maps user roles (from /verify endpoint) to Mastra permissions\n * using a configurable role mapping. This is a simpler implementation\n * than WorkOS RBAC since Cloud uses a single-role model.\n *\n * @example Basic usage\n * ```typescript\n * import { MastraRBACCloud } from '@mastra/auth-cloud';\n *\n * const rbac = new MastraRBACCloud({\n * roleMapping: {\n * admin: ['*'],\n * member: ['agents:read', 'workflows:*'],\n * viewer: ['agents:read', 'workflows:read'],\n * _default: [],\n * },\n * });\n *\n * const hasAccess = await rbac.hasPermission(user, 'agents:read');\n * ```\n */\nexport class MastraRBACCloud implements IRBACProvider<CloudUser> {\n private options: MastraRBACCloudOptions;\n\n /**\n * Expose roleMapping for middleware access.\n * This allows the authorization middleware to resolve permissions\n * without needing to call the async methods.\n */\n get roleMapping(): RoleMapping {\n return this.options.roleMapping;\n }\n\n /**\n * Create a new Mastra Cloud RBAC provider.\n *\n * @param options - RBAC configuration options\n */\n constructor(options: MastraRBACCloudOptions) {\n this.options = options;\n }\n\n /**\n * Get all roles for a user.\n *\n * Returns the user's role as a single-element array, or empty array if no role.\n * Cloud uses a single-role model (role is attached via verifyToken()).\n *\n * @param user - Cloud user to get roles for\n * @returns Array containing user's role, or empty array\n */\n async getRoles(user: CloudUser): Promise<string[]> {\n // Role attached to user from verifyToken() call\n return user.role ? [user.role] : [];\n }\n\n /**\n * Check if a user has a specific role.\n *\n * @param user - Cloud user to check\n * @param role - Role name to check for\n * @returns True if user has the role\n */\n async hasRole(user: CloudUser, role: string): Promise<boolean> {\n const roles = await this.getRoles(user);\n return roles.includes(role);\n }\n\n /**\n * Get all permissions for a user by mapping their role.\n *\n * Uses the configured roleMapping to translate the user's role\n * into Mastra permission strings.\n *\n * If the user has no role, the _default permissions from the\n * role mapping are applied.\n *\n * @param user - Cloud user to get permissions for\n * @returns Array of permission strings\n */\n async getPermissions(user: CloudUser): Promise<string[]> {\n const roles = await this.getRoles(user);\n\n if (roles.length === 0) {\n return this.options.roleMapping['_default'] ?? [];\n }\n\n return resolvePermissionsFromMapping(roles, this.options.roleMapping);\n }\n\n /**\n * Check if a user has a specific permission.\n *\n * Uses wildcard matching to check if the user's permissions\n * grant access to the required permission.\n *\n * @param user - Cloud user to check\n * @param permission - Permission to check for (e.g., 'agents:read')\n * @returns True if user has the permission\n */\n async hasPermission(user: CloudUser, permission: string): Promise<boolean> {\n const permissions = await this.getPermissions(user);\n return permissions.some(p => matchesPermission(p, permission));\n }\n\n /**\n * Check if a user has ALL of the specified permissions.\n *\n * @param user - Cloud user to check\n * @param permissions - Array of permissions to check for\n * @returns True if user has all permissions\n */\n async hasAllPermissions(user: CloudUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.every(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n\n /**\n * Check if a user has ANY of the specified permissions.\n *\n * @param user - Cloud user to check\n * @param permissions - Array of permissions to check for\n * @returns True if user has at least one permission\n */\n async hasAnyPermission(user: CloudUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.some(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n}\n"]}
1
+ {"version":3,"sources":["../src/error.ts","../src/oauth/state.ts","../src/oauth/network.ts","../src/pkce/error.ts","../src/pkce/cookie.ts","../src/pkce/pkce.ts","../src/oauth/oauth.ts","../src/session/cookie.ts","../src/session/session.ts","../src/client.ts","../../../packages/_internal-core/src/logger/index.ts","../../../packages/_internal-core/src/base/MastraBase.ts","../../../packages/_internals/auth/src/provider/index.ts","../src/auth-provider.ts","../../../packages/_internals/auth/src/ee/defaults/roles.ts","../src/rbac/rbac-provider.ts"],"names":["getRequestHeader"],"mappings":";;;AAiCO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EACS,KAAA;AAAA,EACT,SAAA;AAAA,EACA,YAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAAqB,OAAA,EAAiB,OAAA,EAA4B;AAC5E,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,QAAQ,OAAA,EAAS,KAAA;AACtB,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,eAAe,OAAA,EAAS,YAAA;AAE7B,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,YAAA,GAA0B;AAC/B,IAAA,OAAO,IAAI,UAAA,CAAU,eAAA,EAAiB,gDAAgD,CAAA;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,GAA2B;AAChC,IAAA,OAAO,IAAI,UAAA,CAAU,gBAAA,EAAkB,6DAA6D,CAAA;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,WAAA,GAAyB;AAC9B,IAAA,OAAO,IAAI,UAAA,CAAU,cAAA,EAAgB,oDAAoD,CAAA;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,oBAAoB,OAAA,EAAuC;AAChE,IAAA,OAAO,IAAI,UAAA,CAAU,uBAAA,EAAyB,mDAAA,EAAqD,OAAO,CAAA;AAAA,EAC5G;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,kBAAA,GAAgC;AACrC,IAAA,OAAO,IAAI,UAAA,CAAU,qBAAA,EAAuB,4BAA4B,CAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,cAAA,GAA4B;AACjC,IAAA,OAAO,IAAI,UAAA,CAAU,iBAAA,EAAmB,yCAAyC,CAAA;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,cAAA,GAA4B;AACjC,IAAA,OAAO,IAAI,UAAA,CAAU,iBAAA,EAAmB,2CAA2C,CAAA;AAAA,EACrF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAa,KAAA,EAA0B;AAC5C,IAAA,OAAO,IAAI,UAAA,CAAU,eAAA,EAAiB,4DAAA,EAA8D,EAAE,OAAO,CAAA;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,cAAc,OAAA,EAAuC;AAC1D,IAAA,MAAM,OAAA,GAAU,SAAS,YAAA,IAAgB,8BAAA;AACzC,IAAA,OAAO,IAAI,UAAA,CAAU,iBAAA,EAAmB,OAAA,EAAS,OAAO,CAAA;AAAA,EAC1D;AACF;;;ACpFO,SAAS,WAAA,CAAY,MAAc,QAAA,EAA0B;AAClE,EAAA,MAAM,IAAA,GAAkB,EAAE,IAAA,EAAM,QAAA,EAAS;AACzC,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAChC,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,WAAW,CAAA;AAC/C;AASO,SAAS,YAAY,KAAA,EAA0B;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,WAAW,EAAE,QAAA,EAAS;AACtD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAG5B,IAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,aAAa,QAAA,EAAU;AACtE,MAAA,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAAA,IAC3C;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,UAAU,YAAA,EAAa;AAAA,EAC/B;AACF;AAaO,SAAS,gBAAA,CAAiB,UAA8B,aAAA,EAA+B;AAE5F,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO,GAAA;AAAA,EACT;AAGA,EAAA,IAAI,QAAA,CAAS,WAAW,GAAG,CAAA,IAAK,CAAC,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC1D,IAAA,OAAO,QAAA;AAAA,EACT;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAQ,CAAA;AAC/B,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,aAAa,CAAA;AAGpC,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ;AACnC,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,OAAO,GAAA;AACT;;;AC1EA,eAAsB,cAAA,CAAe,KAAa,OAAA,EAAyC;AACzF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,EAAK,OAAO,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AAEN,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,GAAA,EAAK,OAAO,CAAA;AAAA,IACjC,SAAS,UAAA,EAAY;AAEnB,MAAA,MAAM,SAAA,CAAU,YAAA,CAAa,UAAA,YAAsB,KAAA,GAAQ,aAAa,MAAS,CAAA;AAAA,IACnF;AAAA,EACF;AACF;;;AClBO,IAAM,SAAA,GAAN,MAAM,UAAA,SAAkB,KAAA,CAAM;AAAA,EAC1B,IAAA;AAAA,EACS,KAAA;AAAA,EAElB,WAAA,CAAY,IAAA,EAAqB,OAAA,EAAiB,KAAA,EAAe;AAC/D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAEb,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,eAAA,GAA6B;AAClC,IAAA,OAAO,IAAI,UAAA;AAAA,MACT,kBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,OAAA,GAAqB;AAC1B,IAAA,OAAO,IAAI,UAAA,CAAU,SAAA,EAAW,mEAAmE,CAAA;AAAA,EACrG;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,QAAQ,KAAA,EAA0B;AACvC,IAAA,OAAO,IAAI,UAAA,CAAU,SAAA,EAAW,+CAAA,EAAiD,KAAK,CAAA;AAAA,EACxF;AACF,CAAA;;;ACvCO,IAAM,gBAAA,GAAmB,sBAAA;AAmBzB,SAAS,aAAA,CAAc,QAAA,EAAkB,KAAA,EAAe,YAAA,EAA+B;AAC5F,EAAA,MAAM,aAAa,CAAA,GAAI,EAAA;AACvB,EAAA,MAAM,IAAA,GAAuB;AAAA,IAC3B,QAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,UAAA,GAAa;AAAA,GACvC;AAEA,EAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAEvD,EAAA,IAAI,SAAS,CAAA,EAAG,gBAAgB,CAAA,CAAA,EAAI,OAAO,6CAA6C,UAAU,CAAA,CAAA;AAElG,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAA,IAAU,UAAA;AAAA,EACZ;AAEA,EAAA,OAAO,MAAA;AACT;AASO,SAAS,gBAAgB,YAAA,EAA6C;AAC3E,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,MAAM,UAAU,eAAA,EAAgB;AAAA,EAClC;AAEA,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAA,CAAM,IAAI,OAAO,CAAA,EAAG,gBAAgB,UAAU,CAAC,CAAA;AAE1E,EAAA,IAAI,CAAC,KAAA,GAAQ,CAAC,CAAA,EAAG;AACf,IAAA,MAAM,UAAU,eAAA,EAAgB;AAAA,EAClC;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,KAAK,KAAA,CAAM,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA;AAAA,EAChD,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,SAAA,CAAU,OAAA,CAAQ,CAAA,YAAa,KAAA,GAAQ,IAAI,MAAS,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AAC/B,IAAA,MAAM,UAAU,OAAA,EAAQ;AAAA,EAC1B;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAO,GAAG,gBAAgB,CAAA,4CAAA,CAAA;AAC5B;AC1EO,SAAS,oBAAA,GAA+B;AAE7C,EAAA,OAAO,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC7C;AAQO,SAAS,qBAAqB,QAAA,EAA0B;AAC7D,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AACjE;AAMO,SAAS,aAAA,GAAwB;AAEtC,EAAA,OAAO,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC7C;;;ACwBO,SAAS,YAAY,OAAA,EAA0C;AACpE,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,aAAa,QAAA,EAAU,aAAA,EAAe,cAAa,GAAI,OAAA;AAGxF,EAAA,MAAM,WAAW,oBAAA,EAAqB;AACtC,EAAA,MAAM,SAAA,GAAY,qBAAqB,QAAQ,CAAA;AAG/C,EAAA,MAAM,OAAO,aAAA,EAAc;AAG3B,EAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,QAAA,EAAU,aAAa,CAAA;AAGlE,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,IAAA,EAAM,iBAAiB,CAAA;AAGjD,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AAC7C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,YAAA,EAAc,SAAS,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,SAAS,CAAA;AAChD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,uBAAA,EAAyB,MAAM,CAAA;AACpD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,WAAW,CAAA;AAChD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AAGnC,EAAA,MAAM,eAAA,GAAkB,YAAA,IAAgB,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AACjE,EAAA,MAAM,UAAA,GAAa,aAAA,CAAc,QAAA,EAAU,IAAA,EAAM,eAAe,CAAA;AAEhE,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,IAAI,QAAA,EAAS;AAAA,IAClB,OAAA,EAAS,CAAC,UAAU;AAAA,GACtB;AACF;AAeA,eAAsB,eAAe,OAAA,EAAmD;AACtF,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,aAAa,IAAA,EAAM,KAAA,EAAO,cAAa,GAAI,OAAA;AAG5E,EAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAG7C,EAAA,MAAM,SAAA,GAAY,YAAY,KAAK,CAAA;AAGnC,EAAA,IAAI,SAAA,CAAU,IAAA,KAAS,QAAA,CAAS,KAAA,EAAO;AACrC,IAAA,MAAM,UAAU,aAAA,EAAc;AAAA,EAChC;AAGA,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,cAAA,CAAA,EAAkB;AAAA,IACrE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,kBAAA;AAAA,MAChB,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACnB,IAAA;AAAA,MACA,YAAA,EAAc,WAAA;AAAA,MACd,eAAe,QAAA,CAAS;AAAA,KACzB;AAAA,GACF,CAAA;AAGD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,YAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAa,MAAM,QAAA,CAAS,IAAA,EAAK;AACvC,MAAA,SAAA,GAAY,SAAA,CAAU,IAAA;AACtB,MAAA,YAAA,GAAe,SAAA,CAAU,OAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,SAAA,CAAU,mBAAA,CAAoB,EAAE,SAAA,EAAW,cAAc,CAAA;AAAA,EACjE;AAGA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAOlC,EAAA,MAAM,cAAA,GAAiB,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,IACzE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAA;AAAA,MAC1C,cAAA,EAAgB;AAAA;AAClB,GACD,CAAA;AAED,EAAA,IAAI,CAAC,eAAe,EAAA,EAAI;AACtB,IAAA,MAAM,UAAU,kBAAA,EAAmB;AAAA,EACrC;AAGA,EAAA,MAAM,UAAA,GAAc,MAAM,cAAA,CAAe,IAAA,EAAK;AAS9C,EAAA,MAAM,cAAc,eAAA,EAAgB;AAEpC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,UAAA,CAAW,GAAA;AAAA,MACf,OAAO,UAAA,CAAW,KAAA;AAAA,MAClB,MAAM,UAAA,CAAW,IAAA;AAAA,MACjB,QAAQ,UAAA,CAAW,UAAA;AAAA,MACnB,MAAM,UAAA,CAAW;AAAA,KACnB;AAAA,IACA,aAAa,IAAA,CAAK,YAAA;AAAA,IAClB,UAAU,SAAA,CAAU,QAAA;AAAA,IACpB,OAAA,EAAS,CAAC,WAAW;AAAA,GACvB;AACF;;;AC1LO,IAAM,mBAAA,GAAsB,sBAAA;AAS5B,SAAS,gBAAA,CAAiB,OAAe,YAAA,EAA+B;AAC7E,EAAA,MAAM,UAAA,GAAa,KAAK,EAAA,GAAK,EAAA;AAE7B,EAAA,IAAI,SAAS,CAAA,EAAG,mBAAmB,CAAA,CAAA,EAAI,KAAK,6CAA6C,UAAU,CAAA,CAAA;AAEnG,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAA,IAAU,UAAA;AAAA,EACZ;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,mBAAmB,YAAA,EAA4C;AAC7E,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAA,CAAM,IAAI,OAAO,CAAA,EAAG,mBAAmB,UAAU,CAAC,CAAA;AAC7E,EAAA,OAAO,KAAA,GAAQ,CAAC,CAAA,IAAK,IAAA;AACvB;AAOO,SAAS,kBAAA,GAA6B;AAC3C,EAAA,OAAO,GAAG,mBAAmB,CAAA,4CAAA,CAAA;AAC/B;;;AChBA,eAAsB,YAAY,OAAA,EAAsD;AACtF,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,KAAA,EAAM,GAAI,OAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,KAAK,CAAA,CAAA;AAAA,MAC9B,cAAA,EAAgB;AAAA;AAClB,GACD,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAU,kBAAA,EAAmB;AAAA,EACrC;AAKA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAalC,EAAA,IAAI,IAAA,CAAK,eAAe,mBAAA,EAAqB;AAC3C,IAAA,OAAO;AAAA,MACL,IAAA,EAAM;AAAA,QACJ,EAAA,EAAI,WAAA;AAAA,QACJ,KAAA,EAAO,MAAA;AAAA,QACP,IAAA,EAAM,MAAA;AAAA,QACN,MAAA,EAAQ;AAAA,OACV;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,IAAA,CAAK,GAAA;AAAA,MACT,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAQ,IAAA,CAAK;AAAA,KACf;AAAA,IACA,MAAM,IAAA,CAAK;AAAA,GACb;AACF;AAQA,eAAsB,gBAAgB,OAAA,EAAuD;AAC3F,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,YAAA,EAAa,GAAI,OAAA;AAElD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,sBAAA,CAAA,EAA0B;AAAA,MAC7E,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB,kBAAA;AAAA,QAChB,aAAA,EAAe,UAAU,YAAY,CAAA,CAAA;AAAA,QACrC,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAsB,eAAe,OAAA,EAAwC;AAC3E,EAAA,MAAM,EAAE,YAAA,EAAc,YAAA,EAAa,GAAI,OAAA;AAEvC,EAAA,MAAM,cAAA,CAAe,CAAA,EAAG,YAAY,CAAA,qBAAA,CAAA,EAAyB;AAAA,IAC3D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,YAAY,CAAA;AAAA;AACvC,GACD,CAAA;AAGH;AAUO,SAAS,YAAA,CAAa,YAAA,EAAsB,qBAAA,EAA+B,WAAA,EAA6B;AAC7G,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,cAAA,EAAgB,YAAY,CAAA;AAChD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,0BAAA,EAA4B,qBAAqB,CAAA;AACtE,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,WAAW,CAAA;AACjD,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;;;ACnGO,IAAM,kBAAN,MAAsB;AAAA,EACV,MAAA;AAAA,EAEjB,YAAY,MAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,OAAA,EAAuE;AACjF,IAAA,OAAO,WAAA,CAAY;AAAA,MACjB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA,MAC1B,WAAA,EAAa,KAAK,MAAA,CAAO,WAAA;AAAA,MACzB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,OAAA,EAAgG;AAC7G,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,YAAA,EAAc,KAAK,MAAA,CAAO,YAAA;AAAA,MAC1B,WAAA,EAAa,KAAK,MAAA,CAAO,WAAA;AAAA,MACzB,GAAG;AAAA,KACJ,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,YAAY,KAAA,EAAwC;AAClD,IAAA,OAAO,WAAA,CAAY,EAAE,SAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,KAAA,EAAO,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,YAAA,EAAoD;AAClE,IAAA,OAAO,eAAA,CAAgB,EAAE,SAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAA,EAAW,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,CAAA;AAAA,EACnH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,YAAA,EAAqC;AAClD,IAAA,OAAO,cAAA,CAAe,EAAoC,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,CAAA;AAAA,EAClH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAA,CAAa,uBAA+B,WAAA,EAA6B;AACvE,IAAA,OAAO,YAAA,CAAa,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc,uBAAuB,WAAW,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,iBAAiB,KAAA,EAAuB;AACtC,IAAA,OAAO,gBAAA,CAAiB,OAAO,IAAA,CAAK,MAAA,CAAO,gBAAgB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAY,CAAA;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAA,GAA6B;AAC3B,IAAA,OAAO,kBAAA,EAAmB;AAAA,EAC5B;AACF;;;ACtJO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACgBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAiD;AAC1G,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;;;AChFA,SAASA,iBAAAA,CAAiB,SAA4B,IAAA,EAA6B;AACjF,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AACjG;AAsCO,IAAM,uBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACU,MAAA;AAAA;AAAA,EAGC,iBAAA,GAAoB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrB,yBAAA,GAA2C,IAAA;AAAA,EAEnD,YAAY,OAAA,EAAyC;AACnD,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,SAAS,CAAA;AAExC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAChC,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,cAAc,OAAA,CAAQ;AAAA,KACvB,CAAA;AAED,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,wBAAwB,YAAA,EAAmC;AACzD,IAAA,IAAA,CAAK,yBAAA,GAA4B,YAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAuD;AAC5F,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAeA,iBAAAA,CAAiB,OAAA,EAAS,QAAQ,CAAA;AAGvD,MAAA,MAAM,YAAA,GAAe,mBAAmB,YAAY,CAAA;AAEpD,MAAA,IAAI,YAAA,EAAc;AAEhB,QAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,YAAY,CAAA;AACjE,QAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAK;AAAA,MACzB;AAGA,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,KAAK,CAAA;AAC1D,QAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAK;AAAA,MACzB;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,cAAc,IAAA,EAA0B;AACtC,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,EAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,gBAAA,GAA8D,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAStE,WAAA,CAAY,aAAqB,KAAA,EAAuB;AAEtD,IAAA,IAAI,iBAAA,GAAoB,GAAA;AACxB,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAChC,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA;AAChC,MAAA,MAAM,eAAA,GAAkB,MAAM,CAAC,CAAA;AAC/B,MAAA,IAAI,eAAA,EAAiB;AACnB,QAAA,IAAI;AACF,UAAA,iBAAA,GAAoB,mBAAmB,eAAe,CAAA;AAAA,QACxD,CAAA,CAAA,MAAQ;AACN,UAAA,iBAAA,GAAoB,GAAA;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,WAAW,CAAA;AACvC,IAAA,MAAM,SAAS,WAAA,CAAY,MAAA;AAG3B,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,WAAA,CAAY;AAAA,MACrC,QAAA,EAAU,iBAAA;AAAA,MACV,aAAA,EAAe;AAAA,KAChB,CAAA;AAGD,IAAA,IAAA,CAAK,gBAAA,GAAmB,MAAA;AAExB,IAAA,OAAO,MAAA,CAAO,GAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAA,GAAwC;AACtC,IAAA,MAAM,OAAA,GAAU,KAAK,gBAAA,EAAkB,OAAA;AACvC,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAA,CAAe,IAAA,EAAc,KAAA,EAAmD;AAEpF,IAAA,MAAM,eAAe,IAAA,CAAK,yBAAA;AAC1B,IAAA,IAAA,CAAK,yBAAA,GAA4B,IAAA;AAGjC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,MAAA,CAAO,cAAA,CAAe;AAAA,MAC9C,IAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAGD,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB,OAAO,WAAW,CAAA;AAErE,IAAA,OAAO;AAAA,MACL,MAAM,MAAA,CAAO,IAAA;AAAA;AAAA,MACb,MAAA,EAAQ;AAAA,QACN,aAAa,MAAA,CAAO;AAAA,OACtB;AAAA,MACA,OAAA,EAAS,CAAC,GAAG,MAAA,CAAO,SAAS,aAAa;AAAA,KAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAA,GAAuC;AACrC,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,QAAA;AAAA,MACV,IAAA,EAAM;AAAA,KACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,YAAA,CAAa,aAAqB,OAAA,EAAkC;AAElE,IAAA,MAAM,YAAA,GAAe,OAAA,GAAU,IAAA,CAAK,uBAAA,CAAwB,OAAO,CAAA,GAAI,IAAA;AACvE,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,WAAA,EAAa,YAAY,CAAA;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,aAAA,CAAc,MAAA,EAAgB,QAAA,EAAsD;AACxF,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAE9D,IAAA,OAAO;AAAA,MACL,EAAA,EAAK,QAAA,EAAU,WAAA,IAA0B,MAAA,CAAO,UAAA,EAAW;AAAA,MAC3D,MAAA;AAAA,MACA,SAAA,EAAW,GAAA;AAAA,MACX,SAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,gBAAgB,SAAA,EAA4C;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAgB,SAAS,CAAA;AAC3D,IAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,SAAS,CAAA;AAAA,MACrC,SAAA,EAAW,IAAI,IAAA,CAAK,OAAA,CAAQ,SAAS;AAAA,KACvC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,SAAA,EAAkC;AACrD,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,cAAA,CAAe,SAAS,CAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAA,EAA4C;AAC/D,IAAA,OAAO,IAAA,CAAK,gBAAgB,SAAS,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,wBAAwB,OAAA,EAAiC;AACvD,IAAA,OAAO,kBAAA,CAAmB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAkB,OAAA,EAA0C;AAC1D,IAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,OAAO,gBAAA,CAAiB,OAAA,CAAQ,EAAE,CAAA,EAAE;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAA,GAAiD;AAC/C,IAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,oBAAmB,EAAE;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,eAAe,OAAA,EAA6C;AAChE,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,uBAAA,CAAwB,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,MAAM,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,YAAY,CAAA;AACjE,MAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,QAAQ,OAAA,EAA4C;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AC3SA,IAAM,mBAAA,GAAyD;EAC7D,MAAA,EAAQ;AACN,IAAA,eAAA;AACA,IAAA,oBAAA;AACA,IAAA,sBAAA;AACA,IAAA,gBAAA;AACA,IAAA,eAAA;AACA,IAAA;AAAA;AAEJ,CAAA;AAmBO,SAAS,iBAAA,CAAkB,gBAAwB,kBAAA,EAAqC;AAE7F,EAAA,IAAI,mBAAmB,GAAA,EAAK;AAC1B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AAC7C,EAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,KAAA,CAAM,GAAG,CAAA;AAIlD,EAAA,MAAM,gBAAA,GAAmB,mBAAA,CAAoB,YAAA,CAAa,CAAC,KAAK,EAAE,CAAA;AAClE,EAAA,IAAI,oBAAoB,gBAAA,CAAiB,QAAA,CAAS,cAAc,CAAC,CAAA,IAAK,EAAE,CAAA,EAAG;AACzE,IAAA,MAAM,OAAA,GAAU,CAAC,aAAA,CAAc,CAAC,CAAA,EAAG,GAAG,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACrE,IAAA,OAAO,iBAAA,CAAkB,SAAS,kBAAkB,CAAA;AACtD,EAAA;AAGA,EAAA,IAAI,YAAA,CAAa,MAAA,GAAS,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,cAAA,KAAmB,kBAAA;AAC5B,EAAA;AAEA,EAAA,MAAM,CAAC,eAAA,EAAiB,aAAA,EAAe,SAAS,CAAA,GAAI,YAAA;AACpD,EAAA,MAAM,CAAC,gBAAA,EAAkB,cAAA,EAAgB,UAAU,CAAA,GAAI,aAAA;AAGvD,EAAA,IAAI,oBAAoB,GAAA,EAAK;AAE3B,IAAA,IAAI,kBAAkB,GAAA,EAAK;AACzB,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,OAAO,IAAA;AACT,MAAA;AACA,MAAA,OAAO,SAAA,KAAc,UAAA;AACvB,IAAA;AAEA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,SAAA,KAAc,UAAA;AACvB,EAAA;AAGA,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACxC,IAAA,OAAO,KAAA;AACT,EAAA;AAGA,EAAA,IAAI,kBAAkB,GAAA,EAAK;AAGzB,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,SAAA,KAAc,UAAA;AACvB,EAAA;AAGA,EAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,IAAA,OAAO,KAAA;AACT,EAAA;AAIA,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,OAAO,IAAA;AACT,EAAA;AAGA,EAAA,OAAO,SAAA,KAAc,UAAA;AACvB;AAuCO,SAAS,6BAAA,CAA8B,OAAiB,OAAA,EAAgC;AAC7F,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAA;AACxB,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,UAAU,CAAA,IAAK,EAAA;AAE5C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,SAAA,GAAY,QAAQ,IAAI,CAAA;AAC9B,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AACtB,MAAA;IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AACtB,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,WAAW,CAAA;AAC/B;;;AC5NO,IAAM,kBAAN,MAA0D;AAAA,EACvD,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,IAAI,WAAA,GAA2B;AAC7B,IAAA,OAAO,KAAK,OAAA,CAAQ,WAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,OAAA,EAAiC;AAC3C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,SAAS,IAAA,EAAoC;AAEjD,IAAA,OAAO,KAAK,IAAA,GAAO,CAAC,IAAA,CAAK,IAAI,IAAI,EAAC;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,CAAQ,IAAA,EAAiB,IAAA,EAAgC;AAC7D,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AACtC,IAAA,OAAO,KAAA,CAAM,SAAS,IAAI,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,eAAe,IAAA,EAAoC;AACvD,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AAEtC,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,UAAU,KAAK,EAAC;AAAA,IAClD;AAEA,IAAA,OAAO,6BAAA,CAA8B,KAAA,EAAO,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,aAAA,CAAc,IAAA,EAAiB,UAAA,EAAsC;AACzE,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AAClD,IAAA,OAAO,YAAY,IAAA,CAAK,CAAA,CAAA,KAAK,iBAAA,CAAkB,CAAA,EAAG,UAAU,CAAC,CAAA;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,iBAAA,CAAkB,IAAA,EAAiB,WAAA,EAAyC;AAChF,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AACtD,IAAA,OAAO,WAAA,CAAY,KAAA,CAAM,CAAA,QAAA,KAAY,eAAA,CAAgB,IAAA,CAAK,OAAK,iBAAA,CAAkB,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA;AAAA,EAChG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,gBAAA,CAAiB,IAAA,EAAiB,WAAA,EAAyC;AAC/E,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AACtD,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,CAAA,QAAA,KAAY,eAAA,CAAgB,IAAA,CAAK,OAAK,iBAAA,CAAkB,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA;AAAA,EAC/F;AACF","file":"index.js","sourcesContent":["/**\n * Auth error types and error class.\n *\n * Provides typed error handling for OAuth flow and session management.\n */\n\n/**\n * Error codes for authentication-related failures.\n */\nexport type AuthErrorCode =\n | 'invalid_state'\n | 'state_mismatch'\n | 'missing_code'\n | 'token_exchange_failed'\n | 'verification_failed'\n | 'session_invalid'\n | 'session_expired'\n | 'network_error'\n | 'cloud_api_error';\n\n/**\n * Options for AuthError constructor.\n */\nexport interface AuthErrorOptions {\n cause?: Error;\n cloudCode?: string;\n cloudMessage?: string;\n}\n\n/**\n * Error class for authentication-related failures.\n * Uses a code discriminator for programmatic error handling.\n */\nexport class AuthError extends Error {\n readonly code: AuthErrorCode;\n override readonly cause?: Error;\n readonly cloudCode?: string;\n readonly cloudMessage?: string;\n\n constructor(code: AuthErrorCode, message: string, options?: AuthErrorOptions) {\n super(message);\n this.name = 'AuthError';\n this.code = code;\n this.cause = options?.cause;\n this.cloudCode = options?.cloudCode;\n this.cloudMessage = options?.cloudMessage;\n // Required for instanceof checks in TypeScript\n Object.setPrototypeOf(this, new.target.prototype);\n }\n\n /**\n * Factory: OAuth state parameter is invalid or malformed.\n */\n static invalidState(): AuthError {\n return new AuthError('invalid_state', 'OAuth state parameter is invalid or malformed.');\n }\n\n /**\n * Factory: OAuth state parameter does not match expected value.\n */\n static stateMismatch(): AuthError {\n return new AuthError('state_mismatch', 'OAuth state parameter does not match. Possible CSRF attack.');\n }\n\n /**\n * Factory: Authorization code is missing from callback.\n */\n static missingCode(): AuthError {\n return new AuthError('missing_code', 'Authorization code is missing from OAuth callback.');\n }\n\n /**\n * Factory: Token exchange with Cloud API failed.\n */\n static tokenExchangeFailed(options?: AuthErrorOptions): AuthError {\n return new AuthError('token_exchange_failed', 'Failed to exchange authorization code for tokens.', options);\n }\n\n /**\n * Factory: Token verification failed.\n */\n static verificationFailed(): AuthError {\n return new AuthError('verification_failed', 'Token verification failed.');\n }\n\n /**\n * Factory: Session is invalid.\n */\n static sessionInvalid(): AuthError {\n return new AuthError('session_invalid', 'Session is invalid or has been revoked.');\n }\n\n /**\n * Factory: Session has expired.\n */\n static sessionExpired(): AuthError {\n return new AuthError('session_expired', 'Session has expired. Please log in again.');\n }\n\n /**\n * Factory: Network error during API call.\n */\n static networkError(cause?: Error): AuthError {\n return new AuthError('network_error', 'Network error occurred while communicating with Cloud API.', { cause });\n }\n\n /**\n * Factory: Cloud API returned an error.\n */\n static cloudApiError(options?: AuthErrorOptions): AuthError {\n const message = options?.cloudMessage ?? 'Cloud API returned an error.';\n return new AuthError('cloud_api_error', message, options);\n }\n}\n","/**\n * OAuth state parameter encoding/decoding.\n *\n * The state parameter carries:\n * - csrf: CSRF token for validation\n * - returnTo: URL to redirect after successful login\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\n\n/**\n * Data encoded in the OAuth state parameter.\n */\nexport interface StateData {\n /** CSRF token for state validation */\n csrf: string;\n /** URL to redirect to after login */\n returnTo: string;\n}\n\n/**\n * Encode state data into a base64url string for OAuth state parameter.\n *\n * @param csrf - CSRF token to include\n * @param returnTo - URL to redirect to after login\n * @returns Base64url encoded state string\n */\nexport function encodeState(csrf: string, returnTo: string): string {\n const data: StateData = { csrf, returnTo };\n const json = JSON.stringify(data);\n return Buffer.from(json).toString('base64url');\n}\n\n/**\n * Decode state parameter back to StateData.\n *\n * @param state - Base64url encoded state string\n * @returns Decoded state data\n * @throws AuthError with code 'invalid_state' if decoding fails\n */\nexport function decodeState(state: string): StateData {\n try {\n const json = Buffer.from(state, 'base64url').toString();\n const data = JSON.parse(json) as StateData;\n\n // Validate required fields exist\n if (typeof data.csrf !== 'string' || typeof data.returnTo !== 'string') {\n throw new Error('Missing required fields');\n }\n\n return data;\n } catch {\n throw AuthError.invalidState();\n }\n}\n\n/**\n * Validate and sanitize returnTo URL to prevent open redirect attacks.\n *\n * Safe values:\n * - Relative paths starting with '/' (but not '//')\n * - Absolute URLs with same origin as request\n *\n * @param returnTo - URL from user input (may be undefined)\n * @param requestOrigin - Origin of the current request (e.g., 'https://example.com')\n * @returns Safe redirect URL, defaults to '/' if invalid\n */\nexport function validateReturnTo(returnTo: string | undefined, requestOrigin: string): string {\n // Default to root for empty/undefined values\n if (!returnTo) {\n return '/';\n }\n\n // Relative paths starting with '/' are safe (but not protocol-relative '//')\n if (returnTo.startsWith('/') && !returnTo.startsWith('//')) {\n return returnTo;\n }\n\n // For absolute URLs, validate same origin\n try {\n const parsed = new URL(returnTo);\n const origin = new URL(requestOrigin);\n\n // Same origin check: protocol + host must match\n if (parsed.origin === origin.origin) {\n return returnTo;\n }\n } catch {\n // Invalid URL, fall through to default\n }\n\n // Default to root for invalid or cross-origin URLs\n return '/';\n}\n","/**\n * Network utilities for OAuth flow.\n *\n * Provides fetch wrapper with single retry for transient network errors.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\n\n/**\n * Fetch with single retry on network errors.\n *\n * Retries ONLY on network failures (fetch throws), not HTTP error responses.\n * Caller is responsible for handling HTTP status codes.\n *\n * @param url - URL to fetch\n * @param options - Fetch options\n * @returns Response (may have error status code)\n * @throws AuthError with code 'network_error' if both attempts fail\n */\nexport async function fetchWithRetry(url: string, options: RequestInit): Promise<Response> {\n try {\n return await fetch(url, options);\n } catch {\n // Network error - retry once\n try {\n return await fetch(url, options);\n } catch (retryError) {\n // Both attempts failed\n throw AuthError.networkError(retryError instanceof Error ? retryError : undefined);\n }\n }\n}\n","/**\n * PKCE error types and error class.\n *\n * @internal This module is not exported from the main package.\n */\n\n/**\n * Error codes for PKCE-related failures.\n */\nexport type PKCEErrorCode = 'MISSING_VERIFIER' | 'EXPIRED' | 'INVALID';\n\n/**\n * Error class for PKCE-related failures.\n * Uses a code discriminator for programmatic error handling.\n */\nexport class PKCEError extends Error {\n readonly code: PKCEErrorCode;\n override readonly cause?: Error;\n\n constructor(code: PKCEErrorCode, message: string, cause?: Error) {\n super(message);\n this.name = 'PKCEError';\n this.code = code;\n this.cause = cause;\n // Required for instanceof checks in TypeScript\n Object.setPrototypeOf(this, new.target.prototype);\n }\n\n /**\n * Factory: PKCE verifier cookie not found.\n */\n static missingVerifier(): PKCEError {\n return new PKCEError(\n 'MISSING_VERIFIER',\n 'PKCE verifier cookie not found. Authorization flow may have expired or was not initiated properly.',\n );\n }\n\n /**\n * Factory: PKCE verifier has expired.\n */\n static expired(): PKCEError {\n return new PKCEError('EXPIRED', 'PKCE verifier has expired. Please restart the authorization flow.');\n }\n\n /**\n * Factory: PKCE verifier cookie is malformed.\n */\n static invalid(cause?: Error): PKCEError {\n return new PKCEError('INVALID', 'PKCE verifier cookie is malformed or invalid.', cause);\n }\n}\n","/**\n * PKCE cookie storage utilities.\n * Handles serialization, parsing, and clearing of PKCE verifier cookies.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { PKCEError } from './error';\n\n/**\n * Cookie name for PKCE verifier storage.\n */\nexport const PKCE_COOKIE_NAME = 'mastra_pkce_verifier';\n\n/**\n * Data stored in the PKCE cookie.\n */\nexport interface PKCECookieData {\n verifier: string;\n state: string;\n expiresAt: number; // Unix timestamp in milliseconds\n}\n\n/**\n * Create a Set-Cookie header value for storing PKCE verifier and state.\n *\n * @param verifier - The code verifier for PKCE\n * @param state - The state parameter for CSRF protection\n * @param isProduction - Whether to add Secure flag (required for HTTPS)\n * @returns Set-Cookie header value\n */\nexport function setPKCECookie(verifier: string, state: string, isProduction: boolean): string {\n const ttlSeconds = 5 * 60; // 5 minutes\n const data: PKCECookieData = {\n verifier,\n state,\n expiresAt: Date.now() + ttlSeconds * 1000,\n };\n\n const encoded = encodeURIComponent(JSON.stringify(data));\n\n let cookie = `${PKCE_COOKIE_NAME}=${encoded}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${ttlSeconds}`;\n\n if (isProduction) {\n cookie += '; Secure';\n }\n\n return cookie;\n}\n\n/**\n * Parse the PKCE cookie from a Cookie header.\n *\n * @param cookieHeader - The Cookie header value (may be null)\n * @returns Parsed cookie data\n * @throws PKCEError if cookie is missing, expired, or malformed\n */\nexport function parsePKCECookie(cookieHeader: string | null): PKCECookieData {\n if (!cookieHeader) {\n throw PKCEError.missingVerifier();\n }\n\n const match = cookieHeader.match(new RegExp(`${PKCE_COOKIE_NAME}=([^;]+)`));\n\n if (!match?.[1]) {\n throw PKCEError.missingVerifier();\n }\n\n let data: PKCECookieData;\n try {\n data = JSON.parse(decodeURIComponent(match[1])) as PKCECookieData;\n } catch (e) {\n throw PKCEError.invalid(e instanceof Error ? e : undefined);\n }\n\n if (data.expiresAt < Date.now()) {\n throw PKCEError.expired();\n }\n\n return data;\n}\n\n/**\n * Create a Set-Cookie header value to clear the PKCE cookie.\n *\n * @returns Set-Cookie header value that expires the cookie\n */\nexport function clearPKCECookie(): string {\n return `${PKCE_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;\n}\n","/**\n * PKCE (Proof Key for Code Exchange) cryptographic utilities.\n * Implements RFC 7636 S256 challenge method.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { randomBytes, createHash } from 'node:crypto';\n\n/**\n * Generate a code verifier for PKCE.\n * Uses 32 random bytes encoded as base64url (43 characters).\n *\n * Per RFC 7636: code_verifier must be 43-128 characters using unreserved characters.\n */\nexport function generateCodeVerifier(): string {\n // 32 bytes -> 43 chars base64url\n return randomBytes(32).toString('base64url');\n}\n\n/**\n * Compute the S256 code challenge from a verifier.\n * challenge = BASE64URL(SHA256(verifier))\n *\n * Per RFC 7636: S256 method uses SHA-256 hash of the verifier.\n */\nexport function computeCodeChallenge(verifier: string): string {\n return createHash('sha256').update(verifier).digest('base64url');\n}\n\n/**\n * Generate a state parameter for CSRF protection.\n * Uses 16 random bytes encoded as base64url (22 characters).\n */\nexport function generateState(): string {\n // 16 bytes -> 22 chars base64url\n return randomBytes(16).toString('base64url');\n}\n","/**\n * OAuth authorization flow functions.\n *\n * Implements login URL generation and callback handling for\n * Mastra Cloud authentication with PKCE.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\nimport { setPKCECookie, parsePKCECookie, clearPKCECookie } from '../pkce/cookie';\nimport { generateCodeVerifier, computeCodeChallenge, generateState } from '../pkce/pkce';\nimport type { LoginUrlResult, CallbackResult } from '../types';\nimport { fetchWithRetry } from './network';\nimport { encodeState, decodeState, validateReturnTo } from './state';\n\n/**\n * Options for generating login URL.\n */\nexport interface LoginUrlOptions {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of Mastra Cloud API (e.g., 'https://cloud.mastra.ai') */\n cloudBaseUrl: string;\n /** OAuth callback URL (e.g., 'https://myapp.com/auth/callback') */\n callbackUrl: string;\n /** URL to redirect to after successful login */\n returnTo?: string;\n /** Origin of the current request (e.g., 'https://myapp.com') */\n requestOrigin: string;\n /** Whether running in production (affects cookie Secure flag) */\n isProduction?: boolean;\n}\n\n/**\n * Options for handling OAuth callback.\n */\nexport interface CallbackOptions {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of Mastra Cloud API */\n cloudBaseUrl: string;\n /** OAuth callback URL (must match what was sent to /auth/oss) */\n redirectUri: string;\n /** Authorization code from OAuth callback */\n code: string;\n /** State parameter from OAuth callback */\n state: string;\n /** Cookie header from request (may be null) */\n cookieHeader: string | null;\n}\n\n/**\n * Generate a login URL for Mastra Cloud OAuth flow.\n *\n * Creates a URL with PKCE challenge and state parameter for CSRF protection.\n * Returns a PKCE cookie that must be set on the response.\n *\n * @param options - Login URL options\n * @returns URL to redirect to and cookies to set\n */\nexport function getLoginUrl(options: LoginUrlOptions): LoginUrlResult {\n const { projectId, cloudBaseUrl, callbackUrl, returnTo, requestOrigin, isProduction } = options;\n\n // Generate PKCE verifier and challenge\n const verifier = generateCodeVerifier();\n const challenge = computeCodeChallenge(verifier);\n\n // Generate CSRF token for state\n const csrf = generateState();\n\n // Validate returnTo to prevent open redirect attacks\n const validatedReturnTo = validateReturnTo(returnTo, requestOrigin);\n\n // Encode state with CSRF and returnTo\n const state = encodeState(csrf, validatedReturnTo);\n\n // Build authorization URL\n const url = new URL('/auth/oss', cloudBaseUrl);\n url.searchParams.set('project_id', projectId);\n url.searchParams.set('code_challenge', challenge);\n url.searchParams.set('code_challenge_method', 'S256');\n url.searchParams.set('redirect_uri', callbackUrl);\n url.searchParams.set('state', state);\n\n // Create PKCE cookie (stores verifier and CSRF token)\n const isProductionEnv = isProduction ?? process.env.NODE_ENV === 'production';\n const pkceCookie = setPKCECookie(verifier, csrf, isProductionEnv);\n\n return {\n url: url.toString(),\n cookies: [pkceCookie],\n };\n}\n\n/**\n * Handle OAuth callback from Mastra Cloud.\n *\n * Validates state for CSRF, exchanges code for tokens, and returns user info.\n * Returns a cookie to clear the PKCE state.\n *\n * Note: Session cookie is NOT set here - caller (session module) handles that.\n *\n * @param options - Callback options\n * @returns User info, access token, and redirect URL\n * @throws PKCEError if PKCE cookie is missing or expired\n * @throws AuthError if state validation fails or token exchange fails\n */\nexport async function handleCallback(options: CallbackOptions): Promise<CallbackResult> {\n const { projectId, cloudBaseUrl, redirectUri, code, state, cookieHeader } = options;\n\n // Parse PKCE cookie (throws PKCEError if missing/expired)\n const pkceData = parsePKCECookie(cookieHeader);\n\n // Decode state parameter (throws AuthError if malformed)\n const stateData = decodeState(state);\n\n // Validate CSRF token matches\n if (stateData.csrf !== pkceData.state) {\n throw AuthError.stateMismatch();\n }\n\n // Exchange code for tokens\n const response = await fetchWithRetry(`${cloudBaseUrl}/auth/callback`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'X-Project-ID': projectId,\n },\n body: JSON.stringify({\n code,\n redirect_uri: redirectUri,\n code_verifier: pkceData.verifier,\n }),\n });\n\n // Handle error responses\n if (!response.ok) {\n let cloudCode: string | undefined;\n let cloudMessage: string | undefined;\n\n try {\n const errorBody = (await response.json()) as { code?: string; message?: string };\n cloudCode = errorBody.code;\n cloudMessage = errorBody.message;\n } catch {\n // Could not parse error body\n }\n\n throw AuthError.tokenExchangeFailed({ cloudCode, cloudMessage });\n }\n\n // Parse successful response - Cloud returns token only, no user\n const body = (await response.json()) as {\n access_token: string;\n token_type: string;\n expires_in: number;\n };\n\n // Get user info from /auth/verify endpoint\n const verifyResponse = await fetchWithRetry(`${cloudBaseUrl}/auth/verify`, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${body.access_token}`,\n 'X-Project-ID': projectId,\n },\n });\n\n if (!verifyResponse.ok) {\n throw AuthError.verificationFailed();\n }\n\n // Cloud returns: { sub, email, name?, avatar_url?, role }\n const verifyBody = (await verifyResponse.json()) as {\n sub: string;\n email: string;\n name?: string;\n avatar_url?: string;\n role: string;\n };\n\n // Clear PKCE cookie (no longer needed)\n const clearCookie = clearPKCECookie();\n\n return {\n user: {\n id: verifyBody.sub,\n email: verifyBody.email,\n name: verifyBody.name,\n avatar: verifyBody.avatar_url,\n role: verifyBody.role,\n },\n accessToken: body.access_token,\n returnTo: stateData.returnTo,\n cookies: [clearCookie],\n };\n}\n","/**\n * Session cookie utilities.\n * Handles setting, parsing, and clearing of session cookies.\n *\n * @internal This module is not exported from the main package.\n */\n\n/**\n * Cookie name for session token storage.\n */\nexport const SESSION_COOKIE_NAME = 'mastra_cloud_session';\n\n/**\n * Create a Set-Cookie header value for storing session token.\n *\n * @param token - The session token\n * @param isProduction - Whether to add Secure flag (required for HTTPS)\n * @returns Set-Cookie header value\n */\nexport function setSessionCookie(token: string, isProduction: boolean): string {\n const ttlSeconds = 24 * 60 * 60; // 24 hours\n\n let cookie = `${SESSION_COOKIE_NAME}=${token}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${ttlSeconds}`;\n\n if (isProduction) {\n cookie += '; Secure';\n }\n\n return cookie;\n}\n\n/**\n * Parse the session token from a Cookie header.\n *\n * @param cookieHeader - The Cookie header value (may be null)\n * @returns Session token or null if not present\n */\nexport function parseSessionCookie(cookieHeader: string | null): string | null {\n if (!cookieHeader) {\n return null;\n }\n\n const match = cookieHeader.match(new RegExp(`${SESSION_COOKIE_NAME}=([^;]+)`));\n return match?.[1] ?? null;\n}\n\n/**\n * Create a Set-Cookie header value to clear the session cookie.\n *\n * @returns Set-Cookie header value that expires the cookie\n */\nexport function clearSessionCookie(): string {\n return `${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;\n}\n","/**\n * Session lifecycle functions.\n * Handles token verification, session validation, and logout.\n *\n * @internal This module is not exported from the main package.\n */\n\nimport { AuthError } from '../error';\nimport { fetchWithRetry } from '../oauth/network';\nimport type { CloudSession, VerifyResponse } from '../types';\n\n/**\n * Options for verifyToken.\n */\nexport interface VerifyTokenOptions {\n projectId: string;\n cloudBaseUrl: string;\n token: string;\n}\n\n/**\n * Options for validateSession and destroySession.\n */\nexport interface SessionOptions {\n projectId: string;\n cloudBaseUrl: string;\n sessionToken: string;\n}\n\n/**\n * Verify an access token with Cloud API.\n *\n * @param options - Verification options\n * @returns User and role information\n * @throws AuthError with code 'verification_failed' if verification fails\n * @throws AuthError with code 'network_error' if network request fails\n */\nexport async function verifyToken(options: VerifyTokenOptions): Promise<VerifyResponse> {\n const { projectId, cloudBaseUrl, token } = options;\n\n const response = await fetchWithRetry(`${cloudBaseUrl}/auth/verify`, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${token}`,\n 'X-Project-ID': projectId,\n },\n });\n\n if (!response.ok) {\n throw AuthError.verificationFailed();\n }\n\n // Cloud returns different shapes for user tokens vs project API tokens:\n // User token: { sub, email, name?, avatar_url?, role }\n // Project API token: { valid: true, role: \"api\", token_type: \"project_api_token\" }\n const body = (await response.json()) as {\n // User token fields\n sub?: string;\n email?: string;\n name?: string;\n avatar_url?: string;\n role: string;\n // Project API token fields\n valid?: boolean;\n token_type?: string;\n };\n\n // Project API token - no user info, just role\n if (body.token_type === 'project_api_token') {\n return {\n user: {\n id: 'api-token',\n email: undefined,\n name: undefined,\n avatar: undefined,\n },\n role: body.role,\n };\n }\n\n // User token - full user info\n return {\n user: {\n id: body.sub!,\n email: body.email!,\n name: body.name,\n avatar: body.avatar_url,\n },\n role: body.role,\n };\n}\n\n/**\n * Validate an existing session with Cloud API.\n *\n * @param options - Session options\n * @returns Session data if valid, null otherwise\n */\nexport async function validateSession(options: SessionOptions): Promise<CloudSession | null> {\n const { projectId, cloudBaseUrl, sessionToken } = options;\n\n try {\n const response = await fetchWithRetry(`${cloudBaseUrl}/auth/session/validate`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${sessionToken}`,\n 'X-Project-ID': projectId,\n },\n });\n\n if (!response.ok) {\n return null;\n }\n\n return (await response.json()) as CloudSession;\n } catch {\n // Any error (network, parsing) returns null\n return null;\n }\n}\n\n/**\n * Destroy a session with Cloud API.\n * Note: X-Project-ID not required for this endpoint.\n *\n * @param options - Session options\n */\nexport async function destroySession(options: SessionOptions): Promise<void> {\n const { cloudBaseUrl, sessionToken } = options;\n\n await fetchWithRetry(`${cloudBaseUrl}/auth/session/destroy`, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${sessionToken}`,\n },\n });\n\n // Ignore response - void return per spec\n}\n\n/**\n * Get the logout URL for redirecting users.\n *\n * @param cloudBaseUrl - Cloud API base URL\n * @param postLogoutRedirectUri - URL to redirect to after logout (required)\n * @param idTokenHint - The access token (required by Cloud)\n * @returns Full logout URL with redirect and token parameters\n */\nexport function getLogoutUrl(cloudBaseUrl: string, postLogoutRedirectUri: string, idTokenHint: string): string {\n const url = new URL('/auth/logout', cloudBaseUrl);\n url.searchParams.set('post_logout_redirect_uri', postLogoutRedirectUri);\n url.searchParams.set('id_token_hint', idTokenHint);\n return url.toString();\n}\n","/**\n * MastraCloudAuth client class.\n * Facade composing OAuth and session modules into unified API.\n */\n\nimport { getLoginUrl, handleCallback } from './oauth';\nimport {\n verifyToken,\n validateSession,\n destroySession,\n getLogoutUrl,\n setSessionCookie,\n clearSessionCookie,\n} from './session';\nimport type { LoginUrlResult, CallbackResult, VerifyResponse, CloudSession } from './types';\n\n/**\n * Configuration for MastraCloudAuth client.\n */\nexport interface MastraCloudAuthConfig {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of the Cloud API (e.g., https://cloud.mastra.ai) */\n cloudBaseUrl: string;\n /** OAuth callback URL for your application */\n callbackUrl: string;\n /** Whether running in production (adds Secure flag to cookies) */\n isProduction?: boolean;\n}\n\n/**\n * Mastra Cloud authentication client.\n *\n * Provides unified API for OAuth flow and session management.\n *\n * @example\n * ```typescript\n * const auth = new MastraCloudAuth({\n * cloudBaseUrl: 'https://cloud.mastra.ai',\n * callbackUrl: 'https://myapp.com/auth/callback',\n * });\n *\n * // Start login flow\n * const { url, cookies } = auth.getLoginUrl({\n * requestOrigin: 'https://myapp.com',\n * });\n *\n * // After callback\n * const result = await auth.handleCallback({\n * code: 'auth_code',\n * state: 'state_param',\n * cookieHeader: request.headers.get('cookie'),\n * });\n * ```\n */\nexport class MastraCloudAuth {\n private readonly config: MastraCloudAuthConfig;\n\n constructor(config: MastraCloudAuthConfig) {\n this.config = config;\n }\n\n /**\n * Generate login URL for OAuth authorization.\n *\n * @param options - Login options\n * @returns URL to redirect to and cookies to set\n */\n getLoginUrl(options: { returnTo?: string; requestOrigin: string }): LoginUrlResult {\n return getLoginUrl({\n projectId: this.config.projectId,\n cloudBaseUrl: this.config.cloudBaseUrl,\n callbackUrl: this.config.callbackUrl,\n returnTo: options.returnTo,\n requestOrigin: options.requestOrigin,\n isProduction: this.config.isProduction,\n });\n }\n\n /**\n * Handle OAuth callback after authorization.\n *\n * @param options - Callback parameters\n * @returns User info, tokens, and redirect URL\n */\n handleCallback(options: { code: string; state: string; cookieHeader: string | null }): Promise<CallbackResult> {\n return handleCallback({\n projectId: this.config.projectId,\n cloudBaseUrl: this.config.cloudBaseUrl,\n redirectUri: this.config.callbackUrl,\n ...options,\n });\n }\n\n /**\n * Verify an access token.\n *\n * @param token - Access token to verify\n * @returns User and role information\n */\n verifyToken(token: string): Promise<VerifyResponse> {\n return verifyToken({ projectId: this.config.projectId, cloudBaseUrl: this.config.cloudBaseUrl, token });\n }\n\n /**\n * Validate an existing session.\n *\n * @param sessionToken - Session token to validate\n * @returns Session data if valid, null otherwise\n */\n validateSession(sessionToken: string): Promise<CloudSession | null> {\n return validateSession({ projectId: this.config.projectId, cloudBaseUrl: this.config.cloudBaseUrl, sessionToken });\n }\n\n /**\n * Destroy a session (server-side logout).\n *\n * @param sessionToken - Session token to destroy\n */\n destroySession(sessionToken: string): Promise<void> {\n return destroySession({ projectId: this.config.projectId, cloudBaseUrl: this.config.cloudBaseUrl, sessionToken });\n }\n\n /**\n * Get the logout URL for client-side redirect.\n *\n * @param postLogoutRedirectUri - URL to redirect to after logout\n * @param idTokenHint - The access token\n * @returns Full logout URL with redirect and token parameters\n */\n getLogoutUrl(postLogoutRedirectUri: string, idTokenHint: string): string {\n return getLogoutUrl(this.config.cloudBaseUrl, postLogoutRedirectUri, idTokenHint);\n }\n\n /**\n * Create Set-Cookie header value for session token.\n *\n * @param token - Session token to store\n * @returns Set-Cookie header value\n */\n setSessionCookie(token: string): string {\n return setSessionCookie(token, this.config.isProduction ?? process.env.NODE_ENV === 'production');\n }\n\n /**\n * Create Set-Cookie header value to clear session cookie.\n *\n * @returns Set-Cookie header value\n */\n clearSessionCookie(): string {\n return clearSessionCookie();\n }\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n AGENT: 'AGENT',\n OBSERVABILITY: 'OBSERVABILITY',\n AUTH: 'AUTH',\n BROWSER: 'BROWSER',\n NETWORK: 'NETWORK',\n WORKFLOW: 'WORKFLOW',\n LLM: 'LLM',\n TTS: 'TTS',\n VOICE: 'VOICE',\n VECTOR: 'VECTOR',\n BUNDLER: 'BUNDLER',\n DEPLOYER: 'DEPLOYER',\n MEMORY: 'MEMORY',\n STORAGE: 'STORAGE',\n EMBEDDINGS: 'EMBEDDINGS',\n MCP_SERVER: 'MCP_SERVER',\n SERVER_CACHE: 'SERVER_CACHE',\n SERVER: 'SERVER',\n WORKSPACE: 'WORKSPACE',\n CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n DEBUG: 'debug',\n INFO: 'info',\n WARN: 'warn',\n ERROR: 'error',\n NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n runId?: string;\n msg: string;\n level: LogLevel;\n time: Date;\n pid: number;\n hostname: string;\n name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n constructor(opts: any = {}) {\n super({ ...opts, objectMode: true });\n }\n\n async listLogsByRunId(_args: {\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n\n async listLogs(_args?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n returnPaginationResults?: boolean;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n}\n\nexport const createCustomTransport = (\n stream: Transform,\n listLogs?: LoggerTransport['listLogs'],\n listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n let transport = stream as LoggerTransport;\n if (listLogs) {\n transport.listLogs = listLogs;\n }\n if (listLogsByRunId) {\n transport.listLogsByRunId = listLogsByRunId;\n }\n return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n debug(message: string, ...args: any[]): void;\n info(message: string, ...args: any[]): void;\n warn(message: string, ...args: any[]): void;\n error(message: string, ...args: any[]): void;\n trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n getTransports(): Map<string, LoggerTransport>;\n listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n protected name: string;\n protected level: LogLevel;\n protected transports: Map<string, LoggerTransport>;\n\n constructor(\n options: {\n name?: string;\n level?: LogLevel;\n transports?: Record<string, LoggerTransport>;\n } = {},\n ) {\n this.name = options.name || 'Mastra';\n this.level = options.level || LogLevel.ERROR;\n this.transports = new Map(Object.entries(options.transports || {}));\n }\n\n abstract debug(message: string, ...args: any[]): void;\n abstract info(message: string, ...args: any[]): void;\n abstract warn(message: string, ...args: any[]): void;\n abstract error(message: string, ...args: any[]): void;\n\n getTransports() {\n return this.transports;\n }\n\n trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n async listLogs(\n transportId: string,\n params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n if (!transportId || !this.transports.has(transportId)) {\n return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports.get(transportId)!.listLogs?.(params) ?? {\n logs: [],\n total: 0,\n page: params?.page ?? 1,\n perPage: params?.perPage ?? 100,\n hasMore: false,\n }\n );\n }\n\n async listLogsByRunId({\n transportId,\n runId,\n fromDate,\n toDate,\n logLevel,\n filters,\n page,\n perPage,\n }: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n if (!transportId || !this.transports.has(transportId) || !runId) {\n return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports\n .get(transportId)!\n .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n logs: [],\n total: 0,\n page: page ?? 1,\n perPage: perPage ?? 100,\n hasMore: false,\n }\n );\n }\n}\n\nexport type LogFilterContext = {\n component?: RegisteredLogger;\n level: LogLevel;\n message: string;\n args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n name?: string;\n level?: LogLevel;\n component?: RegisteredLogger;\n filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n protected component?: RegisteredLogger;\n protected filter?: LogFilter;\n\n constructor(options: ConsoleLoggerOptions = {}) {\n super(options);\n this.component = options.component;\n this.filter = options.filter;\n }\n\n child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n const component =\n typeof componentOrBindings === 'string'\n ? componentOrBindings\n : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n return new ConsoleLogger({\n name: this.name,\n level: this.level,\n component,\n filter: this.filter,\n });\n }\n\n private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n if (!this.filter) return true;\n try {\n return this.filter({ component: this.component, level, message, args });\n } catch (e) {\n console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n return true;\n }\n }\n\n private prefix(): string {\n return this.component ? `[${this.component}] ` : '';\n }\n\n debug(message: string, ...args: any[]): void {\n if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n info(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.INFO, message, args)\n ) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n warn(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.WARN, message, args)\n ) {\n console.warn(`${this.prefix()}${message}`, ...args);\n }\n }\n\n error(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.ERROR ||\n this.level === LogLevel.WARN ||\n this.level === LogLevel.INFO ||\n this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.ERROR, message, args)\n ) {\n console.error(`${this.prefix()}${message}`, ...args);\n }\n }\n\n async listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n }\n\n async listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n component: RegisteredLogger = RegisteredLogger.LLM;\n protected logger: IMastraLogger;\n name?: string;\n #rawConfig?: Record<string, unknown>;\n\n constructor({\n component,\n name,\n rawConfig,\n }: {\n component?: RegisteredLogger;\n name?: string;\n rawConfig?: Record<string, unknown>;\n }) {\n this.component = component || RegisteredLogger.LLM;\n this.name = name;\n this.#rawConfig = rawConfig;\n this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n }\n\n /**\n * Returns the raw storage configuration this primitive was created from,\n * or undefined if it was created from code.\n */\n toRawConfig(): Record<string, unknown> | undefined {\n return this.#rawConfig;\n }\n\n /**\n * Sets the raw storage configuration for this primitive.\n * @internal\n */\n __setRawConfig(rawConfig: Record<string, unknown>): void {\n this.#rawConfig = rawConfig;\n }\n\n /**\n * Set the logger for the agent\n * @param logger\n */\n __setLogger(logger: IMastraLogger) {\n this.logger =\n 'child' in logger && typeof (logger as any).child === 'function'\n ? (logger as any).child({ component: this.component })\n : logger;\n }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n CredentialsResult,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n name?: string;\n authorizeUser?: AuthorizeUserFn<TUser>;\n mapUserToResourceId?(user: TUser): string | undefined | null;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n}\n\n/**\n * Structural description of the public surface of a `MastraAuthProvider`.\n *\n * Auth provider packages bundle their own copy of the `MastraAuthProvider`\n * declaration, so provider class types cannot be compared nominally across\n * package boundaries — `#private`/`protected` members would make otherwise\n * identical copies mutually unassignable. Positions that accept user-supplied\n * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface\n * instead of the class.\n *\n * Note: methods intentionally use method syntax (not property syntax) so they\n * are checked bivariantly — providers with a narrower `TUser` must remain\n * assignable to `IMastraAuthProvider<unknown>`.\n */\nexport interface IMastraAuthProvider<TUser = unknown> {\n name?: string;\n /**\n * Protected paths for the auth provider\n */\n protected?: MastraAuthConfig['protected'];\n /**\n * Public paths for the auth provider\n */\n public?: MastraAuthConfig['public'];\n /**\n * Authenticate a token and return the payload\n */\n authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n /**\n * Authorize a user for a path and method\n */\n authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n /**\n * Map an authenticated user to a memory resource id\n */\n mapUserToResourceId?(user: TUser): string | undefined | null;\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {\n public protected?: MastraAuthConfig['protected'];\n public public?: MastraAuthConfig['public'];\n public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n constructor(options?: MastraAuthProviderOptions<TUser>) {\n super({ component: 'AUTH', name: options?.name });\n\n if (options?.authorizeUser) {\n this.authorizeUser = options.authorizeUser.bind(this);\n }\n\n this.protected = options?.protected;\n this.public = options?.public;\n this.mapUserToResourceId = options?.mapUserToResourceId;\n }\n\n /**\n * Authenticate a token and return the payload\n * @param token - The token to authenticate\n * @param request - The request\n * @returns The payload\n */\n abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n /**\n * Authorize a user for a path and method\n * @param user - The user to authorize\n * @param request - The request\n * @returns The authorization result\n */\n abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n if (opts?.authorizeUser) {\n this.authorizeUser = opts.authorizeUser.bind(this);\n }\n if (opts?.mapUserToResourceId) {\n this.mapUserToResourceId = opts.mapUserToResourceId;\n }\n if (opts?.protected) {\n this.protected = opts.protected;\n }\n if (opts?.public) {\n this.public = opts.public;\n }\n }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).getLoginUrl === 'function' &&\n typeof (p as any).handleCallback === 'function'\n );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).validateSession === 'function' &&\n typeof (p as any).createSession === 'function'\n );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n extends MastraAuthProvider\n implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n private providers: IMastraAuthProvider[];\n private authenticatedProviderByObject = new WeakMap<object, IMastraAuthProvider>();\n private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, IMastraAuthProvider>();\n\n constructor(providers: IMastraAuthProvider[]) {\n const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n super({\n public: combinedPublic,\n protected: combinedProtected,\n });\n\n this.providers = providers;\n if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n }\n\n // Null out interface methods when no inner provider supports them.\n // This ensures duck-typing checks (typeof auth.method === 'function')\n // accurately reflect the composite's actual capabilities — preventing\n // Studio from showing login options that no provider can handle.\n if (!providers.some(isSSOProvider)) {\n this.getLoginUrl = undefined as any;\n this.handleCallback = undefined as any;\n this.getLoginButtonConfig = undefined as any;\n }\n if (!providers.some(isSessionProvider)) {\n this.createSession = undefined as any;\n this.validateSession = undefined as any;\n this.getSessionIdFromRequest = undefined as any;\n }\n if (!providers.some(isUserProvider)) {\n this.getCurrentUser = undefined as any;\n this.getUser = undefined as any;\n this.getUsers = undefined as any;\n }\n // Proxy credentials provider methods if any inner provider supports them.\n const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is IMastraAuthProvider) as any;\n if (credProvider) {\n (this as any).signIn = credProvider.signIn.bind(credProvider);\n if (typeof credProvider.signUp === 'function') {\n (this as any).signUp = credProvider.signUp.bind(credProvider);\n }\n if (typeof credProvider.requestPasswordReset === 'function') {\n (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n }\n if (typeof credProvider.resetPassword === 'function') {\n (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n }\n (this as any).isSignUpEnabled =\n typeof credProvider.isSignUpEnabled === 'function'\n ? credProvider.isSignUpEnabled.bind(credProvider)\n : () => true;\n } else {\n (this as any).signIn = undefined;\n (this as any).signUp = undefined;\n (this as any).requestPasswordReset = undefined;\n (this as any).resetPassword = undefined;\n (this as any).isSignUpEnabled = undefined;\n }\n }\n\n // Find first provider implementing an interface\n private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n return this.providers.find(check) as T | undefined;\n }\n\n private rememberAuthenticatedProvider(user: unknown, provider: IMastraAuthProvider): void {\n if (isObjectLike(user)) {\n this.authenticatedProviderByObject.set(user, provider);\n return;\n }\n\n this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n }\n\n private takeAuthenticatedProvider(user: unknown): IMastraAuthProvider | undefined {\n if (isObjectLike(user)) {\n const provider = this.authenticatedProviderByObject.get(user);\n this.authenticatedProviderByObject.delete(user);\n return provider;\n }\n\n const primitiveUser = user as PrimitiveAuthUser;\n const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n this.authenticatedProviderByPrimitive.delete(primitiveUser);\n return provider;\n }\n\n private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n const provider = this.takeAuthenticatedProvider(user);\n return provider?.mapUserToResourceId?.(user);\n }\n\n // ============================================================================\n // License Exemption Markers\n // Expose these if any underlying provider has them\n // ============================================================================\n\n /**\n * True if any provider is MastraCloudAuth (exempt from license requirement).\n */\n get isMastraCloudAuth(): boolean {\n return this.providers.some(\n p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n );\n }\n\n /**\n * True if any provider is SimpleAuth (exempt from license requirement).\n */\n get isSimpleAuth(): boolean {\n return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n for (const provider of this.providers) {\n try {\n const user = await provider.authenticateToken(token, request);\n if (user) {\n this.rememberAuthenticatedProvider(user, provider);\n return user;\n }\n } catch {\n // ignore error, try next provider\n }\n }\n return null;\n }\n\n async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n for (const provider of this.providers) {\n const authorized = await provider.authorizeUser(user, request);\n if (authorized) {\n return true;\n }\n }\n return false;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /**\n * Forward cookie header to SSO provider for PKCE validation.\n * Called by auth handler before handleCallback().\n */\n setCallbackCookieHeader(cookieHeader: string | null): void {\n const sso = this.findProvider(isSSOProvider);\n if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n (sso as any).setCallbackCookieHeader(cookieHeader);\n }\n }\n\n getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.getLoginUrl(redirectUri, state);\n }\n\n getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n const sso = this.findProvider(isSSOProvider);\n return sso?.getLoginCookies?.(redirectUri, state);\n }\n\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) return { provider: 'unknown', text: 'Sign in' };\n return sso.getLoginButtonConfig();\n }\n\n async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n // Try each SSO provider until one returns a logout URL\n for (const provider of this.providers) {\n if (isSSOProvider(provider) && provider.getLogoutUrl) {\n try {\n const url = await provider.getLogoutUrl(redirectUri, request);\n if (url) return url;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const session = this.findProvider(isSessionProvider);\n if (!session) throw new Error('No session provider configured in CompositeAuth');\n return session.createSession(userId, metadata);\n }\n\n async validateSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one validates\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.validateSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async destroySession(sessionId: string): Promise<void> {\n // Destroy session on ALL providers (user may have sessions in multiple stores)\n const destroyPromises: Promise<void>[] = [];\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n destroyPromises.push(\n provider.destroySession(sessionId).catch(() => {\n // Ignore errors, session may not exist in this provider\n }),\n );\n }\n }\n await Promise.all(destroyPromises);\n }\n\n async refreshSession(sessionId: string): Promise<Session | null> {\n // Try each session provider until one refreshes\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.refreshSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionIdFromRequest(request: Request): string | null {\n // Try each session provider until one finds a session ID\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const sessionId = provider.getSessionIdFromRequest(request);\n if (sessionId) return sessionId;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n // Intentionally uses only the first session provider: a session is created by one\n // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n // no stale cookies remain.\n const sessionProvider = this.findProvider(isSessionProvider);\n return sessionProvider?.getSessionHeaders(session) ?? {};\n }\n\n getClearSessionHeaders(): Record<string, string> {\n // Merge clear headers from ALL providers to ensure no stale session cookies remain\n const headers: Record<string, string> = {};\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const providerHeaders = provider.getClearSessionHeaders();\n Object.assign(headers, providerHeaders);\n } catch {\n // Ignore errors\n }\n }\n }\n return headers;\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // Try each provider until one returns a user (like authenticateToken)\n // ============================================================================\n\n async getCurrentUser(request: Request): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getCurrentUser(request);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUser(userId: string): Promise<User | null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getUser(userId);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<User | null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n /**\n * Valid tokens to authenticate against\n */\n tokens: TokenToUser<TUser>;\n /**\n * Headers to check for authentication\n * @default ['Authorization', 'X-Playground-Access']\n */\n headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n /**\n * Marker to exempt SimpleAuth from EE license requirement.\n * SimpleAuth is for development/testing and should work without a license.\n */\n readonly isSimpleAuth = true;\n\n private tokens: TokenToUser<TUser>;\n private headers: string[];\n private users: TUser[];\n private userById: Map<string, TUser>;\n\n constructor(options: SimpleAuthOptions<TUser>) {\n super(options);\n this.tokens = options.tokens;\n this.users = Object.values(this.tokens);\n this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n }\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n const requestTokens = this.getTokensFromHeaders(token, request);\n\n for (const requestToken of requestTokens) {\n const tokenToUser = this.tokens[requestToken];\n if (tokenToUser) {\n return tokenToUser;\n }\n }\n\n return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n }\n\n async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n return this.users.includes(user);\n }\n\n /** Get current user from request headers or cookie. */\n async getCurrentUser(request: Request): Promise<TUser | null> {\n // Check headers first\n for (const headerName of this.headers) {\n const headerValue = request.headers.get(headerName);\n if (headerValue) {\n const token = this.stripBearerPrefix(headerValue);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n\n return this.getUserFromCookie(request.headers.get('Cookie'));\n }\n\n private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n if (!cookieHeader) return null;\n\n const cookies = cookieHeader.split(';').map(c => c.trim());\n for (const cookie of cookies) {\n if (cookie.startsWith('mastra-token=')) {\n const token = cookie.slice('mastra-token='.length);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n return null;\n }\n\n /** Get user by ID. */\n async getUser(userId: string): Promise<TUser | null> {\n return this.userById.get(userId) ?? null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n return userIds.map(userId => this.userById.get(userId) ?? null);\n }\n\n /**\n * Sign in with token (passed as password field).\n * The email field is ignored - only the token matters.\n */\n async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n const token = password;\n const user = this.tokens[token];\n\n if (!user) {\n throw new Error('Invalid token');\n }\n\n // Set cookie so the token persists across requests\n const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n return {\n user,\n token,\n cookies: [cookie],\n };\n }\n\n async signUp(): Promise<CredentialsResult<TUser>> {\n throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n }\n\n isSignUpEnabled(): boolean {\n return false;\n }\n\n /**\n * Get headers to clear the session cookie on logout.\n * Partial ISessionProvider implementation for logout support.\n */\n getClearSessionHeaders(): Record<string, string> {\n return {\n 'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n };\n }\n\n private stripBearerPrefix(token: string): string {\n return token.startsWith('Bearer ') ? token.slice(7) : token;\n }\n\n private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n const tokens = [token];\n for (const headerName of this.headers) {\n const headerValue = getRequestHeader(request, headerName);\n if (headerValue) {\n tokens.push(this.stripBearerPrefix(headerValue));\n }\n }\n return tokens;\n }\n}\n","/**\n * MastraCloudAuthProvider - Server integration for Mastra Cloud authentication.\n *\n * Extends MastraAuthProvider and implements ISSOProvider, ISessionProvider,\n * and IUserProvider interfaces to integrate with Mastra server middleware.\n *\n * @packageDocumentation\n */\n\nimport type {\n IUserProvider,\n ISSOProvider,\n ISessionProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n} from '@internal/auth';\nimport type { EEUser } from '@internal/auth/ee';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\nimport { MastraAuthProvider } from '@internal/auth/provider';\n\nimport { MastraCloudAuth } from './client';\nimport { parseSessionCookie } from './session/cookie';\nimport type { CloudUser } from './types';\n\ntype HonoRequestLike = {\n raw?: Request;\n headers?: Headers;\n header(name: string): string | undefined;\n};\n\ntype MastraAuthRequest = Request | HonoRequestLike;\n\nfunction getRequestHeader(request: MastraAuthRequest, name: string): string | null {\n if (request instanceof Request) {\n return request.headers.get(name);\n }\n\n return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;\n}\n\n/**\n * Configuration options for MastraCloudAuthProvider.\n */\nexport interface MastraCloudAuthProviderOptions extends MastraAuthProviderOptions<CloudUser> {\n /** Mastra Cloud project ID */\n projectId: string;\n /** Base URL of Mastra Cloud API (e.g., https://cloud.mastra.ai) */\n cloudBaseUrl: string;\n /** OAuth callback URL for your application */\n callbackUrl: string;\n /** Whether running in production (adds Secure flag to cookies) */\n isProduction?: boolean;\n}\n\n/**\n * Mastra Cloud authentication provider for server integration.\n *\n * Wraps the MastraCloudAuth client and implements the required interfaces\n * for Mastra server middleware. Provides SSO login, session management,\n * and user awareness.\n *\n * @example\n * ```typescript\n * import { MastraCloudAuthProvider } from '@mastra/auth-cloud';\n *\n * const auth = new MastraCloudAuthProvider({\n * cloudBaseUrl: 'https://cloud.mastra.ai',\n * callbackUrl: 'https://myapp.com/auth/callback',\n * });\n *\n * const mastra = new Mastra({\n * auth,\n * // ...\n * });\n * ```\n */\nexport class MastraCloudAuthProvider\n extends MastraAuthProvider<CloudUser>\n implements IUserProvider<EEUser>, ISSOProvider<EEUser>, ISessionProvider<Session>\n{\n private client: MastraCloudAuth;\n\n /** Marker for EE license exemption - MastraCloudAuth is exempt */\n readonly isMastraCloudAuth = true;\n\n /**\n * Cookie header for handleCallback PKCE validation.\n * Set via setCallbackCookieHeader() before handleCallback() is called.\n * @internal\n */\n private _lastCallbackCookieHeader: string | null = null;\n\n constructor(options: MastraCloudAuthProviderOptions) {\n super({ name: options?.name ?? 'cloud' });\n\n this.client = new MastraCloudAuth({\n projectId: options.projectId,\n cloudBaseUrl: options.cloudBaseUrl,\n callbackUrl: options.callbackUrl,\n isProduction: options.isProduction,\n });\n\n this.registerOptions(options);\n }\n\n /**\n * Set cookie header for handleCallback PKCE validation.\n * Must be called before handleCallback() to pass cookie header.\n *\n * @param cookieHeader - Cookie header from original request\n */\n setCallbackCookieHeader(cookieHeader: string | null): void {\n this._lastCallbackCookieHeader = cookieHeader;\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n /**\n * Authenticate a bearer token or session cookie.\n *\n * Checks session cookie first, falls back to bearer token for API clients.\n *\n * @param token - Bearer token (from Authorization header)\n * @param request - Request used for cookie access\n * @returns Authenticated user with role, or null if invalid\n */\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<CloudUser | null> {\n try {\n const cookieHeader = getRequestHeader(request, 'cookie');\n\n // Parse session token from cookie\n const sessionToken = parseSessionCookie(cookieHeader);\n\n if (sessionToken) {\n // Verify session token with Cloud API\n const { user, role } = await this.client.verifyToken(sessionToken);\n return { ...user, role };\n }\n\n // Fall back to bearer token if no cookie\n if (token) {\n const { user, role } = await this.client.verifyToken(token);\n return { ...user, role };\n }\n\n return null;\n } catch {\n // Per Phase 10 decision: return null on any error\n return null;\n }\n }\n\n /**\n * Authorize a user for access.\n *\n * Simple validation - detailed permission checking happens in server\n * middleware via checkRoutePermission(), not authorizeUser().\n *\n * @param user - Authenticated user\n * @returns True if user has valid id\n */\n authorizeUser(user: CloudUser): boolean {\n return !!user?.id;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /**\n * Cached login result for getLoginCookies() to retrieve cookies.\n * @internal\n */\n private _lastLoginResult: { url: string; cookies: string[] } | null = null;\n\n /**\n * Get URL to redirect user to for SSO login.\n *\n * @param redirectUri - Callback URL after authentication\n * @param state - State parameter (format: uuid|encodedPostLoginRedirect)\n * @returns Full authorization URL\n */\n getLoginUrl(redirectUri: string, state: string): string {\n // Extract postLoginRedirect from state (format: uuid|encodedPostLoginRedirect)\n let postLoginRedirect = '/';\n if (state && state.includes('|')) {\n const parts = state.split('|', 2);\n const encodedRedirect = parts[1];\n if (encodedRedirect) {\n try {\n postLoginRedirect = decodeURIComponent(encodedRedirect);\n } catch {\n postLoginRedirect = '/';\n }\n }\n }\n\n // Parse origin from redirectUri for PKCE cookie origin validation\n const redirectUrl = new URL(redirectUri);\n const origin = redirectUrl.origin;\n\n // Generate login URL with PKCE\n const result = this.client.getLoginUrl({\n returnTo: postLoginRedirect,\n requestOrigin: origin,\n });\n\n // Cache result for getLoginCookies() to retrieve\n this._lastLoginResult = result;\n\n return result.url;\n }\n\n /**\n * Get cookies to set during login redirect (PKCE verifier).\n * Must be called after getLoginUrl() in same request.\n *\n * @returns Array of Set-Cookie header values\n */\n getLoginCookies(): string[] | undefined {\n const cookies = this._lastLoginResult?.cookies;\n this._lastLoginResult = null; // Clear after retrieval\n return cookies;\n }\n\n /**\n * Handle OAuth callback, exchange code for tokens and user.\n *\n * @param code - Authorization code from callback\n * @param state - State parameter for CSRF validation\n * @returns User, tokens, and session cookies\n */\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<EEUser>> {\n // Get cookie header for PKCE validation, then clear\n const cookieHeader = this._lastCallbackCookieHeader;\n this._lastCallbackCookieHeader = null;\n\n // Exchange code for tokens and get user (includes /auth/verify call)\n const result = await this.client.handleCallback({\n code,\n state,\n cookieHeader,\n });\n\n // Build session cookie\n const sessionCookie = this.client.setSessionCookie(result.accessToken);\n\n return {\n user: result.user, // Already has role from handleCallback\n tokens: {\n accessToken: result.accessToken,\n },\n cookies: [...result.cookies, sessionCookie],\n };\n }\n\n /**\n * Get configuration for rendering login button in UI.\n *\n * @returns Login button configuration\n */\n getLoginButtonConfig(): SSOLoginConfig {\n return {\n provider: 'mastra',\n text: 'Sign in with Mastra Cloud',\n };\n }\n\n /**\n * Get logout URL for client-side redirect.\n * Requires the request to extract the session token for id_token_hint.\n *\n * @param redirectUri - URL to redirect to after logout\n * @param request - Request to extract session token from\n * @returns Logout URL with redirect and token parameters, or null if no session\n */\n getLogoutUrl(redirectUri: string, request?: Request): string | null {\n // Get session token from request cookies for id_token_hint\n const sessionToken = request ? this.getSessionIdFromRequest(request) : null;\n if (!sessionToken) {\n return null; // No active session, nothing to logout\n }\n return this.client.getLogoutUrl(redirectUri, sessionToken);\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n /**\n * Create a new session for a user.\n *\n * For Cloud auth, sessions are created via handleCallback.\n * This method builds a Session object for interface compatibility.\n *\n * @param userId - User to create session for\n * @param metadata - Optional metadata (accessToken can be passed here)\n * @returns Session object\n */\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const now = new Date();\n const expiresAt = new Date(now.getTime() + 24 * 60 * 60 * 1000); // 24 hours\n\n return {\n id: (metadata?.accessToken as string) ?? crypto.randomUUID(),\n userId,\n createdAt: now,\n expiresAt,\n metadata,\n };\n }\n\n /**\n * Validate a session and return it if valid.\n *\n * @param sessionId - Session token to validate\n * @returns Session object or null if invalid/expired\n */\n async validateSession(sessionId: string): Promise<Session | null> {\n const session = await this.client.validateSession(sessionId);\n if (!session) return null;\n\n return {\n id: sessionId,\n userId: session.userId,\n createdAt: new Date(session.createdAt),\n expiresAt: new Date(session.expiresAt),\n };\n }\n\n /**\n * Destroy a session (logout).\n *\n * @param sessionId - Session token to destroy\n */\n async destroySession(sessionId: string): Promise<void> {\n await this.client.destroySession(sessionId);\n }\n\n /**\n * Refresh a session, extending its expiry.\n * Cloud handles refresh internally, so just validate.\n *\n * @param sessionId - Session token to refresh\n * @returns Session object or null if invalid\n */\n async refreshSession(sessionId: string): Promise<Session | null> {\n return this.validateSession(sessionId);\n }\n\n /**\n * Extract session ID from an incoming request.\n *\n * @param request - Incoming HTTP request\n * @returns Session token or null if not present\n */\n getSessionIdFromRequest(request: Request): string | null {\n return parseSessionCookie(request.headers.get('cookie'));\n }\n\n /**\n * Create response headers to set session cookie.\n *\n * @param session - Session to encode (id is the access token)\n * @returns Headers object with Set-Cookie\n */\n getSessionHeaders(session: Session): Record<string, string> {\n return { 'Set-Cookie': this.client.setSessionCookie(session.id) };\n }\n\n /**\n * Create response headers to clear session (for logout).\n *\n * @returns Headers object to clear session cookie\n */\n getClearSessionHeaders(): Record<string, string> {\n return { 'Set-Cookie': this.client.clearSessionCookie() };\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // ============================================================================\n\n /**\n * Get current user from request (session cookie).\n *\n * @param request - Incoming HTTP request\n * @returns User with role or null if not authenticated\n */\n async getCurrentUser(request: Request): Promise<CloudUser | null> {\n const sessionToken = this.getSessionIdFromRequest(request);\n if (!sessionToken) return null;\n\n try {\n const { user, role } = await this.client.verifyToken(sessionToken);\n return { ...user, role };\n } catch {\n return null;\n }\n }\n\n /**\n * Get user by ID.\n * Cloud API doesn't have a /users/:id endpoint.\n *\n * @returns Always null (not supported)\n */\n async getUser(_userId: string): Promise<CloudUser | null> {\n return null;\n }\n}\n","/**\n * Default roles and permissions for Mastra Studio.\n */\n\nimport type { RoleDefinition, RoleMapping } from '../interfaces';\n\n// Re-export RoleMapping for backward compatibility\nexport type { RoleMapping };\n\n/**\n * Default role definitions for Studio.\n *\n * These roles provide a sensible starting point for most applications:\n * - **owner**: Full access to everything\n * - **admin**: Manage agents, workflows, and users\n * - **member**: Execute agents and workflows, read-only settings\n * - **viewer**: Read-only access\n *\n * Permission patterns:\n * - `*` - Full access to everything\n * - `resource:*` - All actions on a specific resource\n * - `*:action` - An action across all resources (e.g., `*:read` for read-only)\n */\nexport const DEFAULT_ROLES: RoleDefinition[] = [\n {\n id: 'owner',\n name: 'Owner',\n description: 'Full access to all features and settings',\n permissions: ['*'],\n },\n {\n id: 'admin',\n name: 'Admin',\n description: 'Manage agents, workflows, and team members',\n permissions: [\n '*:read',\n '*:write',\n '*:execute',\n '*:publish',\n '*:share',\n // Note: admins cannot delete resources\n ],\n },\n {\n id: 'member',\n name: 'Member',\n description: 'Execute agents and workflows',\n permissions: ['*:read', '*:execute'],\n },\n {\n id: 'viewer',\n name: 'Viewer',\n description: 'Read-only access',\n permissions: ['*:read'],\n },\n];\n\n// Re-export Permission types from generated file\nexport type { Permission, PermissionPattern } from '../interfaces/permissions.generated';\n\n/**\n * Get role by ID from default roles.\n *\n * @param roleId - Role ID to find\n * @returns Role definition or undefined\n */\nexport function getDefaultRole(roleId: string): RoleDefinition | undefined {\n return DEFAULT_ROLES.find(role => role.id === roleId);\n}\n\n/**\n * Resolve all permissions for a set of role IDs.\n *\n * Handles role inheritance and deduplication.\n *\n * @param roleIds - Role IDs to resolve\n * @param roles - Role definitions (defaults to DEFAULT_ROLES)\n * @returns Array of resolved permissions\n */\nexport function resolvePermissions(roleIds: string[], roles: RoleDefinition[] = DEFAULT_ROLES): string[] {\n const permissions = new Set<string>();\n const visited = new Set<string>();\n\n function resolveRole(roleId: string) {\n if (visited.has(roleId)) return;\n visited.add(roleId);\n\n const role = roles.find(r => r.id === roleId);\n if (!role) return;\n\n for (const permission of role.permissions) {\n permissions.add(permission);\n }\n\n // Resolve inherited roles\n if (role.inherits) {\n for (const inheritedRoleId of role.inherits) {\n resolveRole(inheritedRoleId);\n }\n }\n }\n\n for (const roleId of roleIds) {\n resolveRole(roleId);\n }\n\n return Array.from(permissions);\n}\n\n/**\n * Compound resource keys that expand to a set of per-family resources.\n * A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`\n * (and `stored:*` matches any `stored-<family>:*`).\n */\nconst RESOURCE_EXPANSIONS: Record<string, readonly string[]> = {\n stored: [\n 'stored-agents',\n 'stored-mcp-clients',\n 'stored-prompt-blocks',\n 'stored-scorers',\n 'stored-skills',\n 'stored-workspaces',\n ],\n};\n\n/**\n * Check if a permission matches (including wildcard support).\n *\n * Permission format: `{resource}:{action}[:{resource-id}]`\n *\n * Examples:\n * - `*` matches everything\n * - `agents:*` matches `agents:read`, `agents:read:my-agent`\n * - `*:read` matches `agents:read`, `workflows:read` (action across all resources)\n * - `agents:read` matches `agents:read`, `agents:read:my-agent`\n * - `agents:read:my-agent` matches only `agents:read:my-agent`\n * - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`\n *\n * @param userPermission - Permission the user has\n * @param requiredPermission - Permission being checked\n * @returns True if permission matches\n */\nexport function matchesPermission(userPermission: string, requiredPermission: string): boolean {\n // Wildcard matches everything\n if (userPermission === '*') {\n return true;\n }\n\n const grantedParts = userPermission.split(':');\n const requiredParts = requiredPermission.split(':');\n\n // Compound resource alias: expand granted `stored:<action>` into its per-family equivalents.\n // Only applies when the required permission targets one of the expanded families.\n const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ''];\n if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? '')) {\n const aliased = [requiredParts[0], ...grantedParts.slice(1)].join(':');\n return matchesPermission(aliased, requiredPermission);\n }\n\n // Must have at least resource:action\n if (grantedParts.length < 2 || requiredParts.length < 2) {\n return userPermission === requiredPermission;\n }\n\n const [grantedResource, grantedAction, grantedId] = grantedParts;\n const [requiredResource, requiredAction, requiredId] = requiredParts;\n\n // Resource wildcard: \"*:*\" matches everything, \"*:read\" matches any resource with that action\n if (grantedResource === '*') {\n // \"*:*\" is a full wildcard - matches everything\n if (grantedAction === '*') {\n if (grantedId === undefined) {\n return true;\n }\n return grantedId === requiredId;\n }\n // Action must match for resource wildcards with specific action\n if (grantedAction !== requiredAction) {\n return false;\n }\n // If no granted ID, matches all instances\n if (grantedId === undefined) {\n return true;\n }\n // *:read:my-id would match agents:read:my-id (unusual but consistent)\n return grantedId === requiredId;\n }\n\n // Resource must match (for non-wildcard resources)\n if (grantedResource !== requiredResource) {\n return false;\n }\n\n // Action wildcard: \"agents:*\" matches any action\n if (grantedAction === '*') {\n // If no granted ID, matches all resources\n // If granted ID specified (agents:*:my-agent), must match required ID\n if (grantedId === undefined) {\n return true;\n }\n // agents:*:my-agent matches agents:read:my-agent but not agents:read:other\n return grantedId === requiredId;\n }\n\n // Action must match\n if (grantedAction !== requiredAction) {\n return false;\n }\n\n // No resource ID in granted permission = access to all resources of this type\n // \"agents:read\" matches \"agents:read\" and \"agents:read:specific-id\"\n if (grantedId === undefined) {\n return true;\n }\n\n // Both have resource IDs - must match exactly\n return grantedId === requiredId;\n}\n\n/**\n * Check if a user has a specific permission.\n *\n * @param userPermissions - Permissions the user has\n * @param requiredPermission - Permission being checked\n * @returns True if user has the permission\n */\nexport function hasPermission(userPermissions: string[], requiredPermission: string): boolean {\n return userPermissions.some(p => matchesPermission(p, requiredPermission));\n}\n\n/**\n * Resolve permissions from user roles using a role mapping.\n *\n * This function translates provider-defined roles (from WorkOS, Okta, etc.)\n * to Mastra permissions using a configurable mapping.\n *\n * @example\n * ```typescript\n * const roleMapping = {\n * \"Engineering\": [\"agents:*\", \"workflows:*\"],\n * \"Product\": [\"agents:read\"],\n * \"_default\": [],\n * };\n *\n * // User has \"Engineering\" and \"QA\" roles\n * const permissions = resolvePermissionsFromMapping(\n * [\"Engineering\", \"QA\"],\n * roleMapping\n * );\n * // Result: [\"agents:*\", \"workflows:*\"] (QA is unmapped, gets _default)\n * ```\n *\n * @param roles - User's roles from the identity provider\n * @param mapping - Role to permission mapping\n * @returns Array of resolved permissions\n */\nexport function resolvePermissionsFromMapping(roles: string[], mapping: RoleMapping): string[] {\n const permissions = new Set<string>();\n const defaultPerms = mapping['_default'] ?? [];\n\n for (const role of roles) {\n const rolePerms = mapping[role];\n if (rolePerms) {\n for (const perm of rolePerms) {\n permissions.add(perm);\n }\n } else {\n // Apply default permissions for unmapped roles\n for (const perm of defaultPerms) {\n permissions.add(perm);\n }\n }\n }\n\n return Array.from(permissions);\n}\n","/**\n * Mastra Cloud RBAC provider.\n *\n * Provides role-based permission checking for Cloud-authenticated users\n * using configurable role-to-permission mappings.\n */\n\nimport type { IRBACProvider, RoleMapping } from '@internal/auth/ee';\nimport { resolvePermissionsFromMapping, matchesPermission } from '@internal/auth/ee';\n\nimport type { CloudUser } from '../types';\n\n/**\n * Configuration options for MastraRBACCloud.\n */\nexport interface MastraRBACCloudOptions {\n /**\n * Mapping from role names to permission arrays.\n *\n * @example\n * ```typescript\n * {\n * admin: ['*'],\n * member: ['agents:read', 'workflows:*'],\n * viewer: ['agents:read', 'workflows:read'],\n * _default: [],\n * }\n * ```\n */\n roleMapping: RoleMapping;\n}\n\n/**\n * RBAC provider for Mastra Cloud authentication.\n *\n * Maps user roles (from /verify endpoint) to Mastra permissions\n * using a configurable role mapping. This is a simpler implementation\n * than WorkOS RBAC since Cloud uses a single-role model.\n *\n * @example Basic usage\n * ```typescript\n * import { MastraRBACCloud } from '@mastra/auth-cloud';\n *\n * const rbac = new MastraRBACCloud({\n * roleMapping: {\n * admin: ['*'],\n * member: ['agents:read', 'workflows:*'],\n * viewer: ['agents:read', 'workflows:read'],\n * _default: [],\n * },\n * });\n *\n * const hasAccess = await rbac.hasPermission(user, 'agents:read');\n * ```\n */\nexport class MastraRBACCloud implements IRBACProvider<CloudUser> {\n private options: MastraRBACCloudOptions;\n\n /**\n * Expose roleMapping for middleware access.\n * This allows the authorization middleware to resolve permissions\n * without needing to call the async methods.\n */\n get roleMapping(): RoleMapping {\n return this.options.roleMapping;\n }\n\n /**\n * Create a new Mastra Cloud RBAC provider.\n *\n * @param options - RBAC configuration options\n */\n constructor(options: MastraRBACCloudOptions) {\n this.options = options;\n }\n\n /**\n * Get all roles for a user.\n *\n * Returns the user's role as a single-element array, or empty array if no role.\n * Cloud uses a single-role model (role is attached via verifyToken()).\n *\n * @param user - Cloud user to get roles for\n * @returns Array containing user's role, or empty array\n */\n async getRoles(user: CloudUser): Promise<string[]> {\n // Role attached to user from verifyToken() call\n return user.role ? [user.role] : [];\n }\n\n /**\n * Check if a user has a specific role.\n *\n * @param user - Cloud user to check\n * @param role - Role name to check for\n * @returns True if user has the role\n */\n async hasRole(user: CloudUser, role: string): Promise<boolean> {\n const roles = await this.getRoles(user);\n return roles.includes(role);\n }\n\n /**\n * Get all permissions for a user by mapping their role.\n *\n * Uses the configured roleMapping to translate the user's role\n * into Mastra permission strings.\n *\n * If the user has no role, the _default permissions from the\n * role mapping are applied.\n *\n * @param user - Cloud user to get permissions for\n * @returns Array of permission strings\n */\n async getPermissions(user: CloudUser): Promise<string[]> {\n const roles = await this.getRoles(user);\n\n if (roles.length === 0) {\n return this.options.roleMapping['_default'] ?? [];\n }\n\n return resolvePermissionsFromMapping(roles, this.options.roleMapping);\n }\n\n /**\n * Check if a user has a specific permission.\n *\n * Uses wildcard matching to check if the user's permissions\n * grant access to the required permission.\n *\n * @param user - Cloud user to check\n * @param permission - Permission to check for (e.g., 'agents:read')\n * @returns True if user has the permission\n */\n async hasPermission(user: CloudUser, permission: string): Promise<boolean> {\n const permissions = await this.getPermissions(user);\n return permissions.some(p => matchesPermission(p, permission));\n }\n\n /**\n * Check if a user has ALL of the specified permissions.\n *\n * @param user - Cloud user to check\n * @param permissions - Array of permissions to check for\n * @returns True if user has all permissions\n */\n async hasAllPermissions(user: CloudUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.every(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n\n /**\n * Check if a user has ANY of the specified permissions.\n *\n * @param user - Cloud user to check\n * @param permissions - Array of permissions to check for\n * @returns True if user has at least one permission\n */\n async hasAnyPermission(user: CloudUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.some(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mastra/auth-cloud",
3
- "version": "1.2.1",
3
+ "version": "1.2.2-alpha.0",
4
4
  "description": "Mastra Cloud authentication with PKCE OAuth",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -20,7 +20,7 @@
20
20
  },
21
21
  "license": "Apache-2.0",
22
22
  "dependencies": {
23
- "@mastra/auth": "1.1.1"
23
+ "@mastra/auth": "1.1.2-alpha.0"
24
24
  },
25
25
  "peerDependencies": {
26
26
  "hono": "^4.0.0"
@@ -33,9 +33,9 @@
33
33
  "tsup": "^8.5.1",
34
34
  "typescript": "^6.0.3",
35
35
  "vitest": "4.1.8",
36
- "@internal/auth": "0.0.1",
37
- "@internal/lint": "0.0.109",
38
- "@internal/types-builder": "0.0.84"
36
+ "@internal/auth": "0.0.2",
37
+ "@internal/types-builder": "0.0.85",
38
+ "@internal/lint": "0.0.110"
39
39
  },
40
40
  "files": [
41
41
  "dist",