npm - @mastra/auth-studio - Versions diffs - 1.3.2 → 1.3.3 - Mend

@mastra/auth-studio 1.3.2 → 1.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/CHANGELOG.md +22 -0
package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/base/index.d.ts +27 -27
package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/index-S1lgaKO7.d.ts +218 -0
package/dist/index.cjs +855 -790
package/dist/index.cjs.map +1 -1
package/dist/index.d.ts +13 -0
package/dist/index.d.ts.map +1 -1
package/dist/index.js +854 -788
package/dist/index.js.map +1 -1
package/package.json +9 -8
package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/logger/index.d.ts +0 -217

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../packages/_internals/auth/src/ee/defaults/roles.ts","../../../packages/_internal-core/src/logger/index.ts","../../../packages/_internal-core/src/base/MastraBase.ts","../../../packages/_internals/auth/src/provider/index.ts","../src/index.ts"],"names":["getRequestHeader"],"mappings":";;;AAkHA,IAAM,mBAAA,GAAyD;EAC7D,MAAA,EAAQ;AACN,IAAA,eAAA;AACA,IAAA,oBAAA;AACA,IAAA,sBAAA;AACA,IAAA,gBAAA;AACA,IAAA,eAAA;AACA,IAAA;AAAA;AAEJ,CAAA;AAmBO,SAAS,iBAAA,CAAkB,gBAAwB,kBAAA,EAAqC;AAE7F,EAAA,IAAI,mBAAmB,GAAA,EAAK;AAC1B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM,YAAA,GAAe,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AAC7C,EAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,KAAA,CAAM,GAAG,CAAA;AAIlD,EAAA,MAAM,gBAAA,GAAmB,mBAAA,CAAoB,YAAA,CAAa,CAAC,KAAK,EAAE,CAAA;AAClE,EAAA,IAAI,oBAAoB,gBAAA,CAAiB,QAAA,CAAS,cAAc,CAAC,CAAA,IAAK,EAAE,CAAA,EAAG;AACzE,IAAA,MAAM,OAAA,GAAU,CAAC,aAAA,CAAc,CAAC,CAAA,EAAG,GAAG,YAAA,CAAa,KAAA,CAAM,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACrE,IAAA,OAAO,iBAAA,CAAkB,SAAS,kBAAkB,CAAA;AACtD,EAAA;AAGA,EAAA,IAAI,YAAA,CAAa,MAAA,GAAS,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,cAAA,KAAmB,kBAAA;AAC5B,EAAA;AAEA,EAAA,MAAM,CAAC,eAAA,EAAiB,aAAA,EAAe,SAAS,CAAA,GAAI,YAAA;AACpD,EAAA,MAAM,CAAC,gBAAA,EAAkB,cAAA,EAAgB,UAAU,CAAA,GAAI,aAAA;AAGvD,EAAA,IAAI,oBAAoB,GAAA,EAAK;AAE3B,IAAA,IAAI,kBAAkB,GAAA,EAAK;AACzB,MAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,QAAA,OAAO,IAAA;AACT,MAAA;AACA,MAAA,OAAO,SAAA,KAAc,UAAA;AACvB,IAAA;AAEA,IAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,MAAA,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,SAAA,KAAc,UAAA;AACvB,EAAA;AAGA,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACxC,IAAA,OAAO,KAAA;AACT,EAAA;AAGA,EAAA,IAAI,kBAAkB,GAAA,EAAK;AAGzB,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,SAAA,KAAc,UAAA;AACvB,EAAA;AAGA,EAAA,IAAI,kBAAkB,cAAA,EAAgB;AACpC,IAAA,OAAO,KAAA;AACT,EAAA;AAIA,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,OAAO,IAAA;AACT,EAAA;AAGA,EAAA,OAAO,SAAA,KAAc,UAAA;AACvB;AAuCO,SAAS,6BAAA,CAA8B,OAAiB,OAAA,EAAgC;AAC7F,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAA;AACxB,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,UAAU,CAAA,IAAK,EAAA;AAE5C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,SAAA,GAAY,QAAQ,IAAI,CAAA;AAC9B,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC5B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AACtB,MAAA;IACF,CAAA,MAAO;AAEL,MAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,QAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AACtB,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,WAAW,CAAA;AAC/B;;;ACjRO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACoBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAiD;AAC1G,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;;;AC/FA,SAASA,iBAAAA,CAAiB,SAA4B,IAAA,EAA6B;AACjF,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,IAAI,CAAA,IAAK,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AACjG;AA4BA,IAAM,WAAA,GAAc,aAAA;AAab,IAAM,gBAAA,GAAN,cACG,kBAAA,CAEV;AAAA,EACW,iBAAA,GAAoB,IAAA;AAAA,EAErB,YAAA;AAAA,EACA,cAAA;AAAA,EACA,oBAAA;AAAA,EACA,YAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAA,uBAAyB,GAAA,EAAoB;AAAA,EACpC,iBAAA,GAAoB,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS7B,6BAAA,uBAAoC,GAAA,EAAyC;AAAA,EAErF,YAAY,OAAA,EAAmC;AAC7C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,eAAA,EAAiB,GAAG,SAAS,CAAA;AAC3C,IAAA,MAAM,oBAAA,GAAuB,OAAA,EAAS,YAAA,IAAgB,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAClE,IAAA,IAAA,CAAK,eAAe,oBAAA,IAAwB,+BAAA;AAC5C,IAAA,IAAA,CAAK,cAAA,GAAiB,OAAA,EAAS,cAAA,IAAkB,OAAA,CAAQ,GAAA,CAAI,sBAAA;AAG7D,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,QAAA,CAAS,GAAG,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,CAAa,KAAA,CAAM,GAAG,EAAE,CAAA;AAAA,IACnD;AAGA,IAAA,IAAA,CAAK,YAAA,GAAe,OAAA,EAAS,YAAA,IAAgB,OAAA,CAAQ,GAAA,CAAI,oBAAA;AASzD,IAAA,IAAI,kBAAA,GAAqB,KAAA;AACzB,IAAA,IAAI,oBAAA,EAAsB;AACxB,MAAA,IAAI;AACF,QAAA,MAAM,WAAW,IAAI,GAAA,CAAI,KAAK,YAAY,CAAA,CAAE,SAAS,WAAA,EAAY;AACjE,QAAA,kBAAA,GAAqB,QAAA,KAAa,WAAA,IAAe,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA;AAAA,MACjF,CAAA,CAAA,MAAQ;AACN,QAAA,kBAAA,GAAqB,KAAA;AAAA,MACvB;AAAA,IACF;AACA,IAAA,IAAA,CAAK,oBAAA,GAAuB,CAAC,CAAC,IAAA,CAAK,YAAA,IAAgB,kBAAA;AAGnD,IAAA,IAAI,CAAC,IAAA,CAAK,YAAA,IAAgB,kBAAA,EAAoB;AAC5C,MAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AAAA,IACtB;AAEA,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,iBAAA,CAAkB,KAAA,EAAe,OAAA,EAAwD;AAC7F,IAAA,IAAI,IAAA,GAA0B,IAAA;AAG9B,IAAA,MAAM,YAAA,GAAeA,iBAAAA,CAAiB,OAAA,EAAS,QAAQ,CAAA;AACvD,IAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,YAAA,EAAc,WAAW,CAAA;AAE3D,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,mBAAA,CAAoB,aAAa,CAAA;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAAA,IAC3C;AAEA,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAIlB,IAAA,IAAI,IAAA,CAAK,kBAAkB,CAAC,IAAA,CAAK,cAAc,QAAA,CAAS,IAAA,CAAK,cAAc,CAAA,EAAG;AAC5E,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,cAAc,IAAA,EAA2B;AACvC,IAAA,OAAO,CAAC,CAAC,IAAA,EAAM,EAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAMA,WAAA,CAAY,aAAqB,KAAA,EAAuB;AAEtD,IAAA,IAAI,iBAAA,GAAoB,GAAA;AACxB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AACnC,MAAA,IAAI,cAAc,EAAA,EAAI;AACpB,QAAA,IAAI;AACF,UAAA,iBAAA,GAAoB,kBAAA,CAAmB,KAAA,CAAM,KAAA,CAAM,SAAA,GAAY,CAAC,CAAC,CAAA;AAAA,QACnE,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MACjC,OAAA,EAAS,QAAA;AAAA,MACT,YAAA,EAAc,WAAA;AAAA,MACd,mBAAA,EAAqB,iBAAA;AAAA;AAAA,MAErB,MAAA,EAAQ,OAAA;AAAA,MACR,GAAI,KAAK,cAAA,GAAiB,EAAE,iBAAiB,IAAA,CAAK,cAAA,KAAmB;AAAC,KACvE,CAAA;AAED,IAAA,OAAO,GAAG,IAAA,CAAK,YAAY,CAAA,YAAA,EAAe,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,EAC7D;AAAA,EAEA,MAAM,cAAA,CAAe,IAAA,EAAc,MAAA,EAAwD;AAIzF,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,wDAAA,EAA0D;AAAA,MAC1E,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,YAAY,IAAA,EAAM;AAAA,KACnB,CAAA;AACD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,mBAAA,CAAoB,IAAI,CAAA;AAChD,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,kFAAA,EAA+E;AAAA,QAC/F,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,YAAY,IAAA,EAAM;AAAA,OACnB,CAAA;AACD,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAKA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,EACF;AAAA,EAEA,wBAAwB,aAAA,EAAoC;AAAA,EAE5D;AAAA,EAEA,eAAA,GAAwC;AAEtC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,oBAAA,GAAuC;AACrC,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,eAAA;AAAA,MACV,IAAA,EAAM,qBAAA;AAAA,MACN,WAAA,EACE;AAAA,KACJ;AAAA,EACF;AAAA,EAEA,MAAM,YAAA,CAAa,YAAA,EAAsB,OAAA,EAA2C;AAClF,IAAA,MAAM,YAAA,GAAe,OAAA,EAAS,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAClD,IAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,YAAA,EAAc,WAAW,CAAA;AAE3D,IAAA,IAAI,CAAC,eAAe,OAAO,IAAA;AAE3B,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,QAC1D,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,aAAa,CAAA;AAAA;AACzC,OACD,CAAA;AAED,MAAA,IAAI,IAAI,EAAA,EAAI;AACV,QAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,QAAA,OAAO,KAAK,SAAA,IAAa,IAAA;AAAA,MAC3B;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAA,CAAc,MAAA,EAAgB,QAAA,EAAsD;AACxF,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,OAAO;AAAA,MACL,EAAA,EAAK,QAAA,EAAU,WAAA,IAA0B,MAAA,CAAO,UAAA,EAAW;AAAA,MAC3D,MAAA;AAAA,MACA,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAAA;AAAA,MACvD,SAAA,EAAW,GAAA;AAAA,MACX;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAA,EAA4C;AAChE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,mBAAA,CAAoB,SAAS,CAAA;AACrD,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAAA,MACvD,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAA,EAAkC;AACrD,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,QAC9C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA;AAAA;AACrC,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAA,EAA4C;AAC/D,IAAA,IAAI;AAEF,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,aAAA,CAAA,EAAiB;AAAA,QAC3D,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA;AAAA;AACrC,OACD,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,2DAAA,EAA6D;AAAA,UAC5E,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,aAAA;AAAA,SAC1B,CAAA;AAED,QAAA,OAAO,IAAA,CAAK,gBAAgB,SAAS,CAAA;AAAA,MACvC;AAGA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAC9C,MAAA,MAAM,YAAA,GAAe,SAAA,GAAY,qBAAA,CAAsB,SAAA,EAAW,WAAW,CAAA,GAAI,IAAA;AAEjF,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAE3E,QAAA,OAAO,IAAA,CAAK,gBAAgB,SAAS,CAAA;AAAA,MACvC;AAGA,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,mBAAA,CAAoB,YAAY,CAAA;AACxD,MAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,MAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,YAAA;AAAA,QACJ,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAAA,QACvD,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,4CAAA,EAA8C;AAAA,QAC9D,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,aAAA,CAAA;AAAA,QACzB,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,GAAI,MAAA,CAAO,KAAK;AAAA,OAC9F,CAAA;AAED,MAAA,OAAO,IAAA,CAAK,gBAAgB,SAAS,CAAA;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,wBAAwB,OAAA,EAAiC;AACvD,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACjD,IAAA,OAAO,WAAA,CAAY,cAAc,WAAW,CAAA;AAAA,EAC9C;AAAA,EAEA,kBAAkB,OAAA,EAA0C;AAC1D,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,OAAA,CAAQ,EAAE,CAAA,CAAA,EAAI,UAAA,EAAY,cAAA,EAAgB,QAAA,EAAU,eAAe,CAAA;AACpG,IAAA,IAAI,IAAA,CAAK,oBAAA,IAAwB,IAAA,CAAK,YAAA,EAAc;AAClD,MAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AACnB,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAE,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,EAAE,YAAA,EAAc,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC1C;AAAA,EAEA,sBAAA,GAAiD;AAC/C,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,WAAW,KAAK,UAAA,EAAY,cAAA,EAAgB,UAAU,WAAW,CAAA;AACnF,IAAA,IAAI,IAAA,CAAK,oBAAA,IAAwB,IAAA,CAAK,YAAA,EAAc;AAClD,MAAA,KAAA,CAAM,KAAK,QAAQ,CAAA;AACnB,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,OAAA,EAAU,IAAA,CAAK,YAAY,CAAA,CAAE,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,EAAE,YAAA,EAAc,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,OAAA,EAA8C;AACjE,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AACjD,IAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,YAAA,EAAc,WAAW,CAAA;AAE3D,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,OAAO,IAAA,CAAK,oBAAoB,aAAa,CAAA;AAAA,IAC/C;AAGA,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,IAAI,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACrC,MAAA,OAAO,IAAA,CAAK,iBAAA,CAAkB,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,OAAA,EAA6C;AAEzD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,mBAAmB,MAAA,EAA6C;AAIpE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,6BAAA,CAA8B,GAAA,CAAI,MAAM,CAAA;AAC9D,IAAA,IAAI,UAAU,OAAO,QAAA;AAErB,IAAA,MAAM,YAAY,IAAA,CAAK,oBAAA,CAAqB,MAAM,CAAA,CAAE,QAAQ,MAAM;AAChE,MAAA,IAAA,CAAK,6BAAA,CAA8B,OAAO,MAAM,CAAA;AAAA,IAClD,CAAC,CAAA;AACD,IAAA,IAAA,CAAK,6BAAA,CAA8B,GAAA,CAAI,MAAA,EAAQ,SAAS,CAAA;AACxD,IAAA,OAAO,SAAA;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,MAAA,EAA6C;AAC9E,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA;AACxD,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,2EAAA,EAA6E,EAAE,QAAQ,CAAA;AACzG,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI;AAIF,MAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAC3C,MAAA,IAAI,EAAA,EAAI,cAAA,EAAgB,OAAO,EAAA,CAAG,cAAA;AAClC,MAAA,IAAI,EAAA,EAAI,gBAAgB,EAAA,CAAG,YAAA,CAAa,SAAS,CAAA,EAAG,OAAO,EAAA,CAAG,YAAA,CAAa,CAAC,CAAA;AAM5E,MAAA,MAAM,OAAA,GAAU,EAAA,EAAI,IAAA,EAAM,KAAA,GAAQ,CAAA,EAAG,GAAG,IAAA,CAAK,KAAK,CAAA,MAAA,CAAA,GAAW,CAAA,UAAA,EAAa,MAAM,CAAA,CAAA,CAAA;AAChF,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,UAAA,CAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,aAAa,CAAA;AAAA,SACzC;AAAA,QACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,SAAS;AAAA,OACvC,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,gEAAA,EAAkE;AAAA,UACjF,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ;AAAA,SACD,CAAA;AACD,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,OAAO,KAAK,YAAA,EAAc,EAAA;AAAA,IAC5B,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,gDAAA,EAAkD;AAAA,QAClE,MAAA;AAAA,QACA,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,GAAI,MAAA,CAAO,KAAK;AAAA,OAC9F,CAAA;AACD,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,mBAAA,CAAoB,cAAA,EAAwB,MAAA,EAAkC;AAClF,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA;AACxD,IAAA,IAAI,CAAC,eAAe,OAAO,KAAA;AAE3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAC3C,MAAA,IAAI,EAAA,EAAI,mBAAmB,cAAA,EAAgB;AACzC,QAAA,OAAO,WAAA,CAAY,GAAG,IAAI,CAAA;AAAA,MAC5B;AAGA,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,UAAA,CAAA,EAAc;AAAA,QACxD,SAAS,EAAE,MAAA,EAAQ,GAAG,WAAW,CAAA,CAAA,EAAI,aAAa,CAAA,CAAA;AAAG,OACtD,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,KAAA;AAEpB,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAG7B,MAAA,MAAM,aAAa,IAAA,CAAK,aAAA,EAAe,KAAK,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,cAAc,CAAA;AACxE,MAAA,OAAO,WAAA,CAAY,UAAA,EAAY,IAAA,IAAQ,MAAS,CAAA;AAAA,IAClD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,mBAAA,CAAoB,QAAgB,aAAA,EAA6B;AAEvE,IAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,MAAM,CAAA;AACrC,IAAA,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,MAAA,EAAQ,aAAa,CAAA;AACjD,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,IAAA,GAAO,IAAA,CAAK,iBAAA,EAAmB;AACzD,MAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACrD,MAAA,IAAI,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAAA,IACjE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,QAAQ,aAAA,EAKZ;AACR,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,QAAA,CAAA,EAAY;AAAA,QACtD,SAAS,EAAE,MAAA,EAAQ,GAAG,WAAW,CAAA,CAAA,EAAI,aAAa,CAAA,CAAA;AAAG,OACtD,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,IAAA;AACpB,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IAMzB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAoB,aAAA,EAAmD;AACnF,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,QAAA,CAAA,EAAY;AAAA,QACtD,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,aAAa,CAAA;AAAA;AACzC,OACD,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,wDAAA,EAA0D;AAAA,UACzE,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,YAAY,GAAA,CAAI,UAAA;AAAA,UAChB,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,QAAA;AAAA,SAC1B,CAAA;AACD,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAgB7B,MAAA,IAAA,CAAK,mBAAA,CAAoB,IAAA,CAAK,IAAA,CAAK,EAAA,EAAI,aAAa,CAAA;AAEpD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAK,IAAA,CAAK,EAAA;AAAA,QACd,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,IAAA,EAAM,CAAC,IAAA,CAAK,IAAA,CAAK,WAAW,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAAA,QAC7E,SAAA,EAAW,KAAK,IAAA,CAAK,iBAAA;AAAA,QACrB,gBAAgB,IAAA,CAAK,cAAA;AAAA,QACrB,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,cAAc,IAAA,CAAK;AAAA,OACrB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,iDAAA,EAAmD;AAAA,QACnE,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,QAAA,CAAA;AAAA,QACzB,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,GAAI,MAAA,CAAO,KAAK;AAAA,OAC9F,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,kBAAkB,KAAA,EAA2C;AACzE,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,YAAA,CAAA,EAAgB;AAAA,QAC1D,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,UAAU,KAAK,CAAA;AAAA;AAChC,OACD,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,sDAAA,EAAwD;AAAA,UACvE,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,YAAA;AAAA,SAC1B,CAAA;AACD,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAY7B,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAK,IAAA,CAAK,EAAA;AAAA,QACd,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,IAAA,EAAM,CAAC,IAAA,CAAK,IAAA,CAAK,WAAW,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,IAAK,MAAA;AAAA,QAC7E,gBAAgB,IAAA,CAAK,cAAA;AAAA,QACrB,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,cAAc,IAAA,CAAK;AAAA,OACrB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,+CAAA,EAAiD;AAAA,QACjE,GAAA,EAAK,CAAA,EAAG,IAAA,CAAK,YAAY,CAAA,YAAA,CAAA;AAAA,QACzB,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,GAAI,MAAA,CAAO,KAAK;AAAA,OAC9F,CAAA;AACD,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;AAMA,SAAS,WAAA,CAAY,cAAyC,IAAA,EAA6B;AACzF,EAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAC1B,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAA,CAAM,IAAI,OAAO,CAAA,EAAG,IAAI,UAAU,CAAC,CAAA;AAC9D,EAAA,OAAO,KAAA,GAAQ,CAAC,CAAA,IAAK,IAAA;AACvB;AAOA,SAAS,YAAY,IAAA,EAAmC;AACtD,EAAA,OAAO,IAAA,KAAS,WAAW,IAAA,KAAS,OAAA;AACtC;AAMA,SAAS,qBAAA,CAAsB,iBAAyB,IAAA,EAA6B;AAEnF,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACvC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE/B,EAAA,MAAM,CAAC,YAAY,GAAG,UAAU,IAAI,KAAA,CAAM,CAAC,CAAA,CAAG,KAAA,CAAM,GAAG,CAAA;AACvD,EAAA,IAAI,UAAA,EAAY,IAAA,EAAK,KAAM,IAAA,EAAM,OAAO,IAAA;AAGxC,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA,IAAK,IAAA;AACjC;AA6BO,IAAM,mBAAN,MAA4D;AAAA,EACzD,OAAA;AAAA,EAER,IAAI,WAAA,GAA2B;AAC7B,IAAA,OAAO,KAAK,OAAA,CAAQ,WAAA;AAAA,EACtB;AAAA,EAEA,YAAY,OAAA,EAAkC;AAC5C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,MAAM,SAAS,IAAA,EAAqC;AAClD,IAAA,OAAO,KAAK,IAAA,GAAO,CAAC,IAAA,CAAK,IAAI,IAAI,EAAC;AAAA,EACpC;AAAA,EAEA,MAAM,OAAA,CAAQ,IAAA,EAAkB,IAAA,EAAgC;AAC9D,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AACtC,IAAA,OAAO,KAAA,CAAM,SAAS,IAAI,CAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,eAAe,IAAA,EAAqC;AACxD,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA;AACtC,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,UAAU,KAAK,EAAC;AAAA,IAClD;AACA,IAAA,OAAO,6BAAA,CAA8B,KAAA,EAAO,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA;AAAA,EACtE;AAAA,EAEA,MAAM,aAAA,CAAc,IAAA,EAAkB,UAAA,EAAsC;AAC1E,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AAClD,IAAA,OAAO,YAAY,IAAA,CAAK,CAAA,CAAA,KAAK,iBAAA,CAAkB,CAAA,EAAG,UAAU,CAAC,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAM,iBAAA,CAAkB,IAAA,EAAkB,WAAA,EAAyC;AACjF,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AACtD,IAAA,OAAO,WAAA,CAAY,KAAA,CAAM,CAAA,QAAA,KAAY,eAAA,CAAgB,IAAA,CAAK,OAAK,iBAAA,CAAkB,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA;AAAA,EAChG;AAAA,EAEA,MAAM,gBAAA,CAAiB,IAAA,EAAkB,WAAA,EAAyC;AAChF,IAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AACtD,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,CAAA,QAAA,KAAY,eAAA,CAAgB,IAAA,CAAK,OAAK,iBAAA,CAAkB,CAAA,EAAG,QAAQ,CAAC,CAAC,CAAA;AAAA,EAC/F;AACF","file":"index.cjs","sourcesContent":["/*\n Default roles and permissions for Mastra Studio.\n /\n\nimport type { RoleDefinition, RoleMapping } from '../interfaces';\n\n// Re-export RoleMapping for backward compatibility\nexport type { RoleMapping };\n\n/\n Default role definitions for Studio.\n \n These roles provide a sensible starting point for most applications:\n * - owner: Full access to everything\n * - admin: Manage agents, workflows, and users\n * - member: Execute agents and workflows, read-only settings\n * - viewer: Read-only access\n \n Permission patterns:\n * - `` - Full access to everything\n - `resource:` - All actions on a specific resource\n - `:action` - An action across all resources (e.g., `:read` for read-only)\n /\nexport const DEFAULT_ROLES: RoleDefinition[] = [\n {\n id: 'owner',\n name: 'Owner',\n description: 'Full access to all features and settings',\n permissions: [''],\n },\n {\n id: 'admin',\n name: 'Admin',\n description: 'Manage agents, workflows, and team members',\n permissions: [\n ':read',\n ':write',\n ':execute',\n ':publish',\n ':share',\n // Note: admins cannot delete resources\n ],\n },\n {\n id: 'member',\n name: 'Member',\n description: 'Execute agents and workflows',\n permissions: [':read', ':execute'],\n },\n {\n id: 'viewer',\n name: 'Viewer',\n description: 'Read-only access',\n permissions: [':read'],\n },\n];\n\n// Re-export Permission types from generated file\nexport type { Permission, PermissionPattern } from '../interfaces/permissions.generated';\n\n/*\n Get role by ID from default roles.\n \n @param roleId - Role ID to find\n * @returns Role definition or undefined\n /\nexport function getDefaultRole(roleId: string): RoleDefinition \| undefined {\n return DEFAULT_ROLES.find(role => role.id === roleId);\n}\n\n/\n Resolve all permissions for a set of role IDs.\n \n Handles role inheritance and deduplication.\n \n @param roleIds - Role IDs to resolve\n * @param roles - Role definitions (defaults to DEFAULT_ROLES)\n * @returns Array of resolved permissions\n /\nexport function resolvePermissions(roleIds: string[], roles: RoleDefinition[] = DEFAULT_ROLES): string[] {\n const permissions = new Set<string>();\n const visited = new Set<string>();\n\n function resolveRole(roleId: string) {\n if (visited.has(roleId)) return;\n visited.add(roleId);\n\n const role = roles.find(r => r.id === roleId);\n if (!role) return;\n\n for (const permission of role.permissions) {\n permissions.add(permission);\n }\n\n // Resolve inherited roles\n if (role.inherits) {\n for (const inheritedRoleId of role.inherits) {\n resolveRole(inheritedRoleId);\n }\n }\n }\n\n for (const roleId of roleIds) {\n resolveRole(roleId);\n }\n\n return Array.from(permissions);\n}\n\n/\n Compound resource keys that expand to a set of per-family resources.\n * A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`\n * (and `stored:` matches any `stored-<family>:`).\n /\nconst RESOURCE_EXPANSIONS: Record<string, readonly string[]> = {\n stored: [\n 'stored-agents',\n 'stored-mcp-clients',\n 'stored-prompt-blocks',\n 'stored-scorers',\n 'stored-skills',\n 'stored-workspaces',\n ],\n};\n\n/\n Check if a permission matches (including wildcard support).\n \n Permission format: `{resource}:{action}[:{resource-id}]`\n \n Examples:\n * - `` matches everything\n - `agents:` matches `agents:read`, `agents:read:my-agent`\n - `:read` matches `agents:read`, `workflows:read` (action across all resources)\n - `agents:read` matches `agents:read`, `agents:read:my-agent`\n * - `agents:read:my-agent` matches only `agents:read:my-agent`\n * - `agents::my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`\n \n * @param userPermission - Permission the user has\n * @param requiredPermission - Permission being checked\n * @returns True if permission matches\n /\nexport function matchesPermission(userPermission: string, requiredPermission: string): boolean {\n // Wildcard matches everything\n if (userPermission === '') {\n return true;\n }\n\n const grantedParts = userPermission.split(':');\n const requiredParts = requiredPermission.split(':');\n\n // Compound resource alias: expand granted `stored:<action>` into its per-family equivalents.\n // Only applies when the required permission targets one of the expanded families.\n const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ''];\n if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? '')) {\n const aliased = [requiredParts[0], ...grantedParts.slice(1)].join(':');\n return matchesPermission(aliased, requiredPermission);\n }\n\n // Must have at least resource:action\n if (grantedParts.length < 2 \|\| requiredParts.length < 2) {\n return userPermission === requiredPermission;\n }\n\n const [grantedResource, grantedAction, grantedId] = grantedParts;\n const [requiredResource, requiredAction, requiredId] = requiredParts;\n\n // Resource wildcard: \":\" matches everything, \":read\" matches any resource with that action\n if (grantedResource === '') {\n // \":\" is a full wildcard - matches everything\n if (grantedAction === '') {\n if (grantedId === undefined) {\n return true;\n }\n return grantedId === requiredId;\n }\n // Action must match for resource wildcards with specific action\n if (grantedAction !== requiredAction) {\n return false;\n }\n // If no granted ID, matches all instances\n if (grantedId === undefined) {\n return true;\n }\n // :read:my-id would match agents:read:my-id (unusual but consistent)\n return grantedId === requiredId;\n }\n\n // Resource must match (for non-wildcard resources)\n if (grantedResource !== requiredResource) {\n return false;\n }\n\n // Action wildcard: \"agents:\" matches any action\n if (grantedAction === '') {\n // If no granted ID, matches all resources\n // If granted ID specified (agents::my-agent), must match required ID\n if (grantedId === undefined) {\n return true;\n }\n // agents::my-agent matches agents:read:my-agent but not agents:read:other\n return grantedId === requiredId;\n }\n\n // Action must match\n if (grantedAction !== requiredAction) {\n return false;\n }\n\n // No resource ID in granted permission = access to all resources of this type\n // \"agents:read\" matches \"agents:read\" and \"agents:read:specific-id\"\n if (grantedId === undefined) {\n return true;\n }\n\n // Both have resource IDs - must match exactly\n return grantedId === requiredId;\n}\n\n/*\n Check if a user has a specific permission.\n \n @param userPermissions - Permissions the user has\n * @param requiredPermission - Permission being checked\n * @returns True if user has the permission\n /\nexport function hasPermission(userPermissions: string[], requiredPermission: string): boolean {\n return userPermissions.some(p => matchesPermission(p, requiredPermission));\n}\n\n/\n Resolve permissions from user roles using a role mapping.\n \n This function translates provider-defined roles (from WorkOS, Okta, etc.)\n * to Mastra permissions using a configurable mapping.\n \n @example\n * ```typescript\n * const roleMapping = {\n * \"Engineering\": [\"agents:\", \"workflows:\"],\n * \"Product\": [\"agents:read\"],\n * \"_default\": [],\n * };\n \n // User has \"Engineering\" and \"QA\" roles\n * const permissions = resolvePermissionsFromMapping(\n * [\"Engineering\", \"QA\"],\n * roleMapping\n * );\n * // Result: [\"agents:\", \"workflows:\"] (QA is unmapped, gets _default)\n * ```\n \n @param roles - User's roles from the identity provider\n * @param mapping - Role to permission mapping\n * @returns Array of resolved permissions\n /\nexport function resolvePermissionsFromMapping(roles: string[], mapping: RoleMapping): string[] {\n const permissions = new Set<string>();\n const defaultPerms = mapping['_default'] ?? [];\n\n for (const role of roles) {\n const rolePerms = mapping[role];\n if (rolePerms) {\n for (const perm of rolePerms) {\n permissions.add(perm);\n }\n } else {\n // Apply default permissions for unmapped roles\n for (const perm of defaultPerms) {\n permissions.add(perm);\n }\n }\n }\n\n return Array.from(permissions);\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n AGENT: 'AGENT',\n OBSERVABILITY: 'OBSERVABILITY',\n AUTH: 'AUTH',\n BROWSER: 'BROWSER',\n NETWORK: 'NETWORK',\n WORKFLOW: 'WORKFLOW',\n LLM: 'LLM',\n TTS: 'TTS',\n VOICE: 'VOICE',\n VECTOR: 'VECTOR',\n BUNDLER: 'BUNDLER',\n DEPLOYER: 'DEPLOYER',\n MEMORY: 'MEMORY',\n STORAGE: 'STORAGE',\n EMBEDDINGS: 'EMBEDDINGS',\n MCP_SERVER: 'MCP_SERVER',\n SERVER_CACHE: 'SERVER_CACHE',\n SERVER: 'SERVER',\n WORKSPACE: 'WORKSPACE',\n CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n DEBUG: 'debug',\n INFO: 'info',\n WARN: 'warn',\n ERROR: 'error',\n NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n runId?: string;\n msg: string;\n level: LogLevel;\n time: Date;\n pid: number;\n hostname: string;\n name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n constructor(opts: any = {}) {\n super({ ...opts, objectMode: true });\n }\n\n async listLogsByRunId(_args: {\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n\n async listLogs(_args?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n returnPaginationResults?: boolean;\n page?: number;\n perPage?: number;\n }): Promise<{\n logs: BaseLogMessage[];\n total: number;\n page: number;\n perPage: number;\n hasMore: boolean;\n }> {\n return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n }\n}\n\nexport const createCustomTransport = (\n stream: Transform,\n listLogs?: LoggerTransport['listLogs'],\n listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n let transport = stream as LoggerTransport;\n if (listLogs) {\n transport.listLogs = listLogs;\n }\n if (listLogsByRunId) {\n transport.listLogsByRunId = listLogsByRunId;\n }\n return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n debug(message: string, ...args: any[]): void;\n info(message: string, ...args: any[]): void;\n warn(message: string, ...args: any[]): void;\n error(message: string, ...args: any[]): void;\n trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n getTransports(): Map<string, LoggerTransport>;\n listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n protected name: string;\n protected level: LogLevel;\n protected transports: Map<string, LoggerTransport>;\n\n constructor(\n options: {\n name?: string;\n level?: LogLevel;\n transports?: Record<string, LoggerTransport>;\n } = {},\n ) {\n this.name = options.name \|\| 'Mastra';\n this.level = options.level \|\| LogLevel.ERROR;\n this.transports = new Map(Object.entries(options.transports \|\| {}));\n }\n\n abstract debug(message: string, ...args: any[]): void;\n abstract info(message: string, ...args: any[]): void;\n abstract warn(message: string, ...args: any[]): void;\n abstract error(message: string, ...args: any[]): void;\n\n getTransports() {\n return this.transports;\n }\n\n trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n async listLogs(\n transportId: string,\n params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n if (!transportId \|\| !this.transports.has(transportId)) {\n return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports.get(transportId)!.listLogs?.(params) ?? {\n logs: [],\n total: 0,\n page: params?.page ?? 1,\n perPage: params?.perPage ?? 100,\n hasMore: false,\n }\n );\n }\n\n async listLogsByRunId({\n transportId,\n runId,\n fromDate,\n toDate,\n logLevel,\n filters,\n page,\n perPage,\n }: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n if (!transportId \|\| !this.transports.has(transportId) \|\| !runId) {\n return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n }\n\n return (\n this.transports\n .get(transportId)!\n .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n logs: [],\n total: 0,\n page: page ?? 1,\n perPage: perPage ?? 100,\n hasMore: false,\n }\n );\n }\n}\n\nexport type LogFilterContext = {\n component?: RegisteredLogger;\n level: LogLevel;\n message: string;\n args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n name?: string;\n level?: LogLevel;\n component?: RegisteredLogger;\n filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n protected component?: RegisteredLogger;\n protected filter?: LogFilter;\n\n constructor(options: ConsoleLoggerOptions = {}) {\n super(options);\n this.component = options.component;\n this.filter = options.filter;\n }\n\n child(componentOrBindings: RegisteredLogger \| Record<string, unknown>): ConsoleLogger {\n const component =\n typeof componentOrBindings === 'string'\n ? componentOrBindings\n : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n return new ConsoleLogger({\n name: this.name,\n level: this.level,\n component,\n filter: this.filter,\n });\n }\n\n private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n if (!this.filter) return true;\n try {\n return this.filter({ component: this.component, level, message, args });\n } catch (e) {\n console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n return true;\n }\n }\n\n private prefix(): string {\n return this.component ? `[${this.component}] ` : '';\n }\n\n debug(message: string, ...args: any[]): void {\n if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n info(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.INFO \|\| this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.INFO, message, args)\n ) {\n console.info(`${this.prefix()}${message}`, ...args);\n }\n }\n\n warn(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.WARN \|\| this.level === LogLevel.INFO \|\| this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.WARN, message, args)\n ) {\n console.warn(`${this.prefix()}${message}`, ...args);\n }\n }\n\n error(message: string, ...args: any[]): void {\n if (\n (this.level === LogLevel.ERROR \|\|\n this.level === LogLevel.WARN \|\|\n this.level === LogLevel.INFO \|\|\n this.level === LogLevel.DEBUG) &&\n this.shouldLog(LogLevel.ERROR, message, args)\n ) {\n console.error(`${this.prefix()}${message}`, ...args);\n }\n }\n\n async listLogs(\n _transportId: string,\n _params?: {\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n },\n ) {\n return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n }\n\n async listLogsByRunId(_args: {\n transportId: string;\n runId: string;\n fromDate?: Date;\n toDate?: Date;\n logLevel?: LogLevel;\n filters?: Record<string, any>;\n page?: number;\n perPage?: number;\n }) {\n return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n component: RegisteredLogger = RegisteredLogger.LLM;\n protected logger: IMastraLogger;\n name?: string;\n #rawConfig?: Record<string, unknown>;\n\n constructor({\n component,\n name,\n rawConfig,\n }: {\n component?: RegisteredLogger;\n name?: string;\n rawConfig?: Record<string, unknown>;\n }) {\n this.component = component \|\| RegisteredLogger.LLM;\n this.name = name;\n this.#rawConfig = rawConfig;\n this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n }\n\n /\n Returns the raw storage configuration this primitive was created from,\n * or undefined if it was created from code.\n /\n toRawConfig(): Record<string, unknown> \| undefined {\n return this.#rawConfig;\n }\n\n /\n Sets the raw storage configuration for this primitive.\n * @internal\n /\n __setRawConfig(rawConfig: Record<string, unknown>): void {\n this.#rawConfig = rawConfig;\n }\n\n /\n Set the logger for the agent\n * @param logger\n /\n __setLogger(logger: IMastraLogger) {\n this.logger =\n 'child' in logger && typeof (logger as any).child === 'function'\n ? (logger as any).child({ component: this.component })\n : logger;\n }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n CredentialsResult,\n IAuthHttpHandler,\n IAuthInit,\n ICredentialsProvider,\n IOrganizationsProvider,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n name?: string;\n authorizeUser?: AuthorizeUserFn<TUser>;\n mapUserToResourceId?(user: TUser): string \| undefined \| null;\n /\n Protected paths for the auth provider\n /\n protected?: MastraAuthConfig['protected'];\n /\n Public paths for the auth provider\n /\n public?: MastraAuthConfig['public'];\n}\n\n/\n Structural description of the public surface of a `MastraAuthProvider`.\n \n Auth provider packages bundle their own copy of the `MastraAuthProvider`\n * declaration, so provider class types cannot be compared nominally across\n * package boundaries — `#private`/`protected` members would make otherwise\n * identical copies mutually unassignable. Positions that accept user-supplied\n * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface\n * instead of the class.\n \n Note: methods intentionally use method syntax (not property syntax) so they\n * are checked bivariantly — providers with a narrower `TUser` must remain\n * assignable to `IMastraAuthProvider<unknown>`.\n /\nexport interface IMastraAuthProvider<TUser = unknown> {\n name?: string;\n /\n Protected paths for the auth provider\n /\n protected?: MastraAuthConfig['protected'];\n /\n Public paths for the auth provider\n /\n public?: MastraAuthConfig['public'];\n /\n Authenticate a token and return the payload\n /\n authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser \| null>;\n /\n Authorize a user for a path and method\n /\n authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> \| boolean;\n /\n Map an authenticated user to a memory resource id\n /\n mapUserToResourceId?(user: TUser): string \| undefined \| null;\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {\n public protected?: MastraAuthConfig['protected'];\n public public?: MastraAuthConfig['public'];\n public mapUserToResourceId?(user: TUser): string \| undefined \| null;\n\n constructor(options?: MastraAuthProviderOptions<TUser>) {\n super({ component: 'AUTH', name: options?.name });\n\n if (options?.authorizeUser) {\n this.authorizeUser = options.authorizeUser.bind(this);\n }\n\n this.protected = options?.protected;\n this.public = options?.public;\n this.mapUserToResourceId = options?.mapUserToResourceId;\n }\n\n /\n Authenticate a token and return the payload\n * @param token - The token to authenticate\n * @param request - The request\n * @returns The payload\n /\n abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser \| null>;\n\n /\n Authorize a user for a path and method\n * @param user - The user to authorize\n * @param request - The request\n * @returns The authorization result\n /\n abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> \| boolean;\n\n protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n if (opts?.authorizeUser) {\n this.authorizeUser = opts.authorizeUser.bind(this);\n }\n if (opts?.mapUserToResourceId) {\n this.mapUserToResourceId = opts.mapUserToResourceId;\n }\n if (opts?.protected) {\n this.protected = opts.protected;\n }\n if (opts?.public) {\n this.public = opts.public;\n }\n }\n}\n\ntype PrimitiveAuthUser = string \| number \| boolean \| bigint \| symbol \| null \| undefined;\n\n// Type guards for interface detection\nexport function isSSOProvider(p: unknown): p is ISSOProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).getLoginUrl === 'function' &&\n typeof (p as any).handleCallback === 'function'\n );\n}\n\nexport function isSessionProvider(p: unknown): p is ISessionProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).validateSession === 'function' &&\n typeof (p as any).createSession === 'function'\n );\n}\n\nexport function isUserProvider(p: unknown): p is IUserProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nexport function isCredentialsProvider(p: unknown): p is ICredentialsProvider {\n return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nexport function isOrganizationsProvider(p: unknown): p is IOrganizationsProvider {\n return (\n p !== null &&\n typeof p === 'object' &&\n typeof (p as any).ensureOrganization === 'function' &&\n typeof (p as any).isOrganizationAdmin === 'function'\n );\n}\n\nexport function isAuthHttpHandler(p: unknown): p is IAuthHttpHandler {\n return p !== null && typeof p === 'object' && typeof (p as any).handleAuthRequest === 'function';\n}\n\nexport function hasAuthInit(p: unknown): p is IAuthInit {\n return p !== null && typeof p === 'object' && typeof (p as any).init === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n return (typeof value === 'object' && value !== null) \|\| typeof value === 'function';\n}\n\nexport class CompositeAuth\n extends MastraAuthProvider\n implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n private providers: IMastraAuthProvider[];\n private authenticatedProviderByObject = new WeakMap<object, IMastraAuthProvider>();\n private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, IMastraAuthProvider>();\n\n constructor(providers: IMastraAuthProvider[]) {\n const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n super({\n public: combinedPublic,\n protected: combinedProtected,\n });\n\n this.providers = providers;\n if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n }\n\n // Null out interface methods when no inner provider supports them.\n // This ensures duck-typing checks (typeof auth.method === 'function')\n // accurately reflect the composite's actual capabilities — preventing\n // Studio from showing login options that no provider can handle.\n if (!providers.some(isSSOProvider)) {\n this.getLoginUrl = undefined as any;\n this.handleCallback = undefined as any;\n this.getLoginButtonConfig = undefined as any;\n }\n if (!providers.some(isSessionProvider)) {\n this.createSession = undefined as any;\n this.validateSession = undefined as any;\n this.getSessionIdFromRequest = undefined as any;\n }\n if (!providers.some(isUserProvider)) {\n this.getCurrentUser = undefined as any;\n this.getUser = undefined as any;\n this.getUsers = undefined as any;\n }\n // Proxy credentials provider methods if any inner provider supports them.\n const credProvider = providers.find(isCredentialsProvider) as any;\n if (credProvider) {\n (this as any).signIn = credProvider.signIn.bind(credProvider);\n if (typeof credProvider.signUp === 'function') {\n (this as any).signUp = credProvider.signUp.bind(credProvider);\n }\n if (typeof credProvider.requestPasswordReset === 'function') {\n (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n }\n if (typeof credProvider.resetPassword === 'function') {\n (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n }\n (this as any).isSignUpEnabled =\n typeof credProvider.isSignUpEnabled === 'function'\n ? credProvider.isSignUpEnabled.bind(credProvider)\n : () => true;\n } else {\n (this as any).signIn = undefined;\n (this as any).signUp = undefined;\n (this as any).requestPasswordReset = undefined;\n (this as any).resetPassword = undefined;\n (this as any).isSignUpEnabled = undefined;\n }\n }\n\n // Find first provider implementing an interface\n private findProvider<T>(check: (p: unknown) => p is T): T \| undefined {\n return this.providers.find(check) as T \| undefined;\n }\n\n private rememberAuthenticatedProvider(user: unknown, provider: IMastraAuthProvider): void {\n if (isObjectLike(user)) {\n this.authenticatedProviderByObject.set(user, provider);\n return;\n }\n\n this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n }\n\n private takeAuthenticatedProvider(user: unknown): IMastraAuthProvider \| undefined {\n if (isObjectLike(user)) {\n const provider = this.authenticatedProviderByObject.get(user);\n this.authenticatedProviderByObject.delete(user);\n return provider;\n }\n\n const primitiveUser = user as PrimitiveAuthUser;\n const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n this.authenticatedProviderByPrimitive.delete(primitiveUser);\n return provider;\n }\n\n private mapAuthenticatedUserToResourceId(user: unknown): string \| undefined \| null {\n const provider = this.takeAuthenticatedProvider(user);\n return provider?.mapUserToResourceId?.(user);\n }\n\n // ============================================================================\n // License Exemption Markers\n // Expose these if any underlying provider has them\n // ============================================================================\n\n /\n True if any provider is MastraCloudAuth (exempt from license requirement).\n /\n get isMastraCloudAuth(): boolean {\n return this.providers.some(\n p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n );\n }\n\n /\n True if any provider is SimpleAuth (exempt from license requirement).\n /\n get isSimpleAuth(): boolean {\n return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n }\n\n // ============================================================================\n // MastraAuthProvider Implementation\n // ============================================================================\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown \| null> {\n for (const provider of this.providers) {\n try {\n const user = await provider.authenticateToken(token, request);\n if (user) {\n this.rememberAuthenticatedProvider(user, provider);\n return user;\n }\n } catch {\n // ignore error, try next provider\n }\n }\n return null;\n }\n\n async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n for (const provider of this.providers) {\n const authorized = await provider.authorizeUser(user, request);\n if (authorized) {\n return true;\n }\n }\n return false;\n }\n\n // ============================================================================\n // ISSOProvider Implementation\n // ============================================================================\n\n /\n Forward cookie header to SSO provider for PKCE validation.\n * Called by auth handler before handleCallback().\n /\n setCallbackCookieHeader(cookieHeader: string \| null): void {\n const sso = this.findProvider(isSSOProvider);\n if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n (sso as any).setCallbackCookieHeader(cookieHeader);\n }\n }\n\n getLoginUrl(redirectUri: string, state: string): string \| Promise<string> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.getLoginUrl(redirectUri, state);\n }\n\n getLoginCookies(redirectUri: string, state: string): string[] \| undefined {\n const sso = this.findProvider(isSSOProvider);\n return sso?.getLoginCookies?.(redirectUri, state);\n }\n\n async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n const sso = this.findProvider(isSSOProvider);\n if (!sso) return { provider: 'unknown', text: 'Sign in' };\n return sso.getLoginButtonConfig();\n }\n\n async getLogoutUrl(redirectUri: string, request?: Request): Promise<string \| null> {\n // Try each SSO provider until one returns a logout URL\n for (const provider of this.providers) {\n if (isSSOProvider(provider) && provider.getLogoutUrl) {\n try {\n const url = await provider.getLogoutUrl(redirectUri, request);\n if (url) return url;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n // ============================================================================\n // ISessionProvider Implementation\n // ============================================================================\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const session = this.findProvider(isSessionProvider);\n if (!session) throw new Error('No session provider configured in CompositeAuth');\n return session.createSession(userId, metadata);\n }\n\n async validateSession(sessionId: string): Promise<Session \| null> {\n // Try each session provider until one validates\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.validateSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async destroySession(sessionId: string): Promise<void> {\n // Destroy session on ALL providers (user may have sessions in multiple stores)\n const destroyPromises: Promise<void>[] = [];\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n destroyPromises.push(\n provider.destroySession(sessionId).catch(() => {\n // Ignore errors, session may not exist in this provider\n }),\n );\n }\n }\n await Promise.all(destroyPromises);\n }\n\n async refreshSession(sessionId: string): Promise<Session \| null> {\n // Try each session provider until one refreshes\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const session = await provider.refreshSession(sessionId);\n if (session) return session;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionIdFromRequest(request: Request): string \| null {\n // Try each session provider until one finds a session ID\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const sessionId = provider.getSessionIdFromRequest(request);\n if (sessionId) return sessionId;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n // Intentionally uses only the first session provider: a session is created by one\n // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n // no stale cookies remain.\n const sessionProvider = this.findProvider(isSessionProvider);\n return sessionProvider?.getSessionHeaders(session) ?? {};\n }\n\n getClearSessionHeaders(): Record<string, string> {\n // Merge clear headers from ALL providers to ensure no stale session cookies remain\n const headers: Record<string, string> = {};\n for (const provider of this.providers) {\n if (isSessionProvider(provider)) {\n try {\n const providerHeaders = provider.getClearSessionHeaders();\n Object.assign(headers, providerHeaders);\n } catch {\n // Ignore errors\n }\n }\n }\n return headers;\n }\n\n // ============================================================================\n // IUserProvider Implementation\n // Try each provider until one returns a user (like authenticateToken)\n // ============================================================================\n\n async getCurrentUser(request: Request): Promise<User \| null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getCurrentUser(request);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUser(userId: string): Promise<User \| null> {\n for (const provider of this.providers) {\n if (isUserProvider(provider)) {\n try {\n const user = await provider.getUser(userId);\n if (user) return user;\n } catch {\n // Try next provider\n }\n }\n }\n return null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<User \| null>> {\n return Promise.all(userIds.map(userId => this.getUser(userId)));\n }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n /\n Valid tokens to authenticate against\n /\n tokens: TokenToUser<TUser>;\n /\n Headers to check for authentication\n * @default ['Authorization', 'X-Playground-Access']\n /\n headers?: string \| string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n /\n Marker to exempt SimpleAuth from EE license requirement.\n * SimpleAuth is for development/testing and should work without a license.\n /\n readonly isSimpleAuth = true;\n\n private tokens: TokenToUser<TUser>;\n private headers: string[];\n private users: TUser[];\n private userById: Map<string, TUser>;\n\n constructor(options: SimpleAuthOptions<TUser>) {\n super(options);\n this.tokens = options.tokens;\n this.users = Object.values(this.tokens);\n this.headers = [...DEFAULT_HEADERS].concat(options.headers \|\| []);\n this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n }\n\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser \| null> {\n const requestTokens = this.getTokensFromHeaders(token, request);\n\n for (const requestToken of requestTokens) {\n const tokenToUser = this.tokens[requestToken];\n if (tokenToUser) {\n return tokenToUser;\n }\n }\n\n return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n }\n\n async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n return this.users.includes(user);\n }\n\n /* Get current user from request headers or cookie. /\n async getCurrentUser(request: Request): Promise<TUser \| null> {\n // Check headers first\n for (const headerName of this.headers) {\n const headerValue = request.headers.get(headerName);\n if (headerValue) {\n const token = this.stripBearerPrefix(headerValue);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n\n return this.getUserFromCookie(request.headers.get('Cookie'));\n }\n\n private getUserFromCookie(cookieHeader: string \| null \| undefined): TUser \| null {\n if (!cookieHeader) return null;\n\n const cookies = cookieHeader.split(';').map(c => c.trim());\n for (const cookie of cookies) {\n if (cookie.startsWith('mastra-token=')) {\n const token = cookie.slice('mastra-token='.length);\n const user = this.tokens[token];\n if (user) {\n return user;\n }\n }\n }\n return null;\n }\n\n /* Get user by ID. /\n async getUser(userId: string): Promise<TUser \| null> {\n return this.userById.get(userId) ?? null;\n }\n\n async getUsers(userIds: string[]): Promise<Array<TUser \| null>> {\n return userIds.map(userId => this.userById.get(userId) ?? null);\n }\n\n /\n Sign in with token (passed as password field).\n * The email field is ignored - only the token matters.\n /\n async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n const token = password;\n const user = this.tokens[token];\n\n if (!user) {\n throw new Error('Invalid token');\n }\n\n // Set cookie so the token persists across requests\n const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n return {\n user,\n token,\n cookies: [cookie],\n };\n }\n\n async signUp(): Promise<CredentialsResult<TUser>> {\n throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n }\n\n isSignUpEnabled(): boolean {\n return false;\n }\n\n /\n Get headers to clear the session cookie on logout.\n * Partial ISessionProvider implementation for logout support.\n /\n getClearSessionHeaders(): Record<string, string> {\n return {\n 'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n };\n }\n\n private stripBearerPrefix(token: string): string {\n return token.startsWith('Bearer ') ? token.slice(7) : token;\n }\n\n private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n const tokens = [token];\n for (const headerName of this.headers) {\n const headerValue = getRequestHeader(request, headerName);\n if (headerValue) {\n tokens.push(this.stripBearerPrefix(headerValue));\n }\n }\n return tokens;\n }\n}\n","import type {\n IOrganizationsProvider,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n} from '@internal/auth';\nimport type { EEUser, IRBACProvider, RoleMapping } from '@internal/auth/ee';\nimport { resolvePermissionsFromMapping, matchesPermission } from '@internal/auth/ee';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\n\ntype HonoRequestLike = {\n raw?: Request;\n headers?: Headers;\n header(name: string): string \| undefined;\n};\n\ntype MastraAuthRequest = Request \| HonoRequestLike;\n\nfunction getRequestHeader(request: MastraAuthRequest, name: string): string \| null {\n if (request instanceof Request) {\n return request.headers.get(name);\n }\n\n return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;\n}\n\nexport interface StudioUser extends EEUser {\n id: string;\n email?: string;\n name?: string;\n avatarUrl?: string;\n organizationId?: string;\n role?: string;\n permissions?: string[];\n /* All organization IDs the user is a member of (for cross-org access checks) /\n memberOrgIds?: string[];\n}\n\nexport interface MastraAuthStudioOptions extends MastraAuthProviderOptions<StudioUser> {\n /* Base URL of the Mastra shared API (e.g., https://api.mastra.ai/v1) /\n sharedApiUrl?: string;\n /* Organization ID that owns this deployed instance. Users not in this org are rejected. /\n organizationId?: string;\n /\n Cookie domain for session cookies (e.g., '.example.com').\n * When set, cookies will include Secure and Domain attributes.\n * Defaults to auto-detecting from sharedApiUrl (uses '.mastra.ai' when sharedApiUrl contains '.mastra.ai').\n * Can also be set via MASTRA_COOKIE_DOMAIN environment variable.\n /\n cookieDomain?: string;\n}\n\nconst COOKIE_NAME = 'wos-session';\n\n/\n Auth provider for Mastra Studio deployed instances.\n \n Proxies all authentication through the shared API, keeping the\n * WorkOS API key safely in the shared API. Deployed instances only\n * need the shared API URL — no secrets required.\n \n The shared API's sealed session cookie (`wos-session`) is set with\n * `Domain=.mastra.ai` in production, so it's included in requests\n * to deployed instances and can be forwarded for validation.\n /\nexport class MastraAuthStudio\n extends MastraAuthProvider<StudioUser>\n implements ISSOProvider<StudioUser>, ISessionProvider<Session>, IUserProvider<StudioUser>, IOrganizationsProvider\n{\n readonly isMastraCloudAuth = true;\n\n private sharedApiUrl: string;\n private organizationId: string \| undefined;\n private useProductionCookies: boolean;\n private cookieDomain: string \| undefined;\n /\n `userId → sealed session cookie` cache. The `IOrganizationsProvider`\n * interface only hands us a `userId`, but the shared API's org endpoints are\n * cookie-authenticated — so we remember the cookie last seen for a user\n * inside `verifySessionCookie` and reuse it here. Kept small: bounded to\n * the last 1000 users, LRU-evicted on insert.\n /\n private userSessionCookies = new Map<string, string>();\n private readonly maxCachedSessions = 1000;\n\n /\n In-flight `ensureOrganization` promises keyed by userId. Concurrent calls\n * for the same brand-new user (multiple tabs, parallel requests) would\n * otherwise all see \"no org\" from `GET /auth/me` and each fire\n * `POST /auth/orgs`, creating duplicate personal organizations. The first\n * caller's promise is reused by every follower until it settles.\n /\n private organizationBootstrapInFlight = new Map<string, Promise<string \| undefined>>();\n\n constructor(options?: MastraAuthStudioOptions) {\n super({ name: 'mastra-studio', ...options });\n const explicitSharedApiUrl = options?.sharedApiUrl \|\| process.env.MASTRA_SHARED_API_URL;\n this.sharedApiUrl = explicitSharedApiUrl \|\| 'https://platform.mastra.ai/v1';\n this.organizationId = options?.organizationId \|\| process.env.MASTRA_ORGANIZATION_ID;\n\n // Strip trailing slash\n if (this.sharedApiUrl.endsWith('/')) {\n this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);\n }\n\n // Cookie domain can be explicitly configured, read from env, or auto-detected from sharedApiUrl\n this.cookieDomain = options?.cookieDomain \|\| process.env.MASTRA_COOKIE_DOMAIN;\n\n // Use production cookie settings (Secure + Domain) when:\n // 1. An explicit cookieDomain is configured, OR\n // 2. The shared API is explicitly* configured on .mastra.ai (auto-detect\n // default domain). The built-in platform.mastra.ai fallback doesn't\n // count — a localhost studio using the default would otherwise mint\n // Domain=.mastra.ai cookies the browser rejects.\n // Use hostname-based detection to avoid false positives (e.g., api.mastra.ai.evil.com)\n let autoDetectMastraAi = false;\n if (explicitSharedApiUrl) {\n try {\n const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();\n autoDetectMastraAi = hostname === 'mastra.ai' \|\| hostname.endsWith('.mastra.ai');\n } catch {\n autoDetectMastraAi = false;\n }\n }\n this.useProductionCookies = !!this.cookieDomain \|\| autoDetectMastraAi;\n\n // If no explicit domain but we're on .mastra.ai, use the default domain\n if (!this.cookieDomain && autoDetectMastraAi) {\n this.cookieDomain = '.mastra.ai';\n }\n\n if (options) {\n this.registerOptions(options);\n }\n }\n\n // ---------------------------------------------------------------------------\n // MastraAuthProvider abstract methods\n // ---------------------------------------------------------------------------\n\n /*\n Authenticate an incoming request by forwarding the sealed session cookie\n * to the shared API's /auth/me endpoint, or a Bearer token to /auth/verify.\n /\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<StudioUser \| null> {\n let user: StudioUser \| null = null;\n\n // Try sealed session cookie first (browser flow)\n const cookieHeader = getRequestHeader(request, 'Cookie');\n const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);\n\n if (sessionCookie) {\n user = await this.verifySessionCookie(sessionCookie);\n }\n\n // Fall back to Bearer token (CLI / API token flow)\n if (!user && token) {\n user = await this.verifyBearerToken(token);\n }\n\n if (!user) return null;\n\n // Org-scoping: if this instance belongs to a specific org, reject users not a member of that org\n // Check memberOrgIds (all orgs user belongs to) rather than organizationId (current org)\n if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) {\n return null;\n }\n\n return user;\n }\n\n authorizeUser(user: StudioUser): boolean {\n return !!user?.id;\n }\n\n // ---------------------------------------------------------------------------\n // ISSOProvider\n // ---------------------------------------------------------------------------\n\n getLoginUrl(redirectUri: string, state: string): string {\n // Extract the post-login redirect from state (format: uuid\|encodedPostLoginRedirect)\n let postLoginRedirect = '/';\n if (state) {\n const pipeIndex = state.indexOf('\|');\n if (pipeIndex !== -1) {\n try {\n postLoginRedirect = decodeURIComponent(state.slice(pipeIndex + 1));\n } catch {\n // ignore decode errors\n }\n }\n }\n\n const params = new URLSearchParams({\n product: 'deploy',\n redirect_uri: redirectUri,\n post_login_redirect: postLoginRedirect,\n // Force re-authentication so AuthKit always shows the account picker\n prompt: 'login',\n ...(this.organizationId ? { organization_id: this.organizationId } : {}),\n });\n\n return `${this.sharedApiUrl}/auth/login?${params.toString()}`;\n }\n\n async handleCallback(code: string, _state: string): Promise<SSOCallbackResult<StudioUser>> {\n // The shared API already consumed the OAuth code and passes the sealed\n // session directly as the `code` parameter in the redirect to this callback.\n // Validate it to get user info.\n this.logger.debug('SSO callback: validating sealed session via shared API', {\n sharedApiUrl: this.sharedApiUrl,\n codeLength: code?.length,\n });\n const user = await this.verifySessionCookie(code);\n if (!user) {\n this.logger.error('SSO callback: session validation failed — verifySessionCookie returned null', {\n sharedApiUrl: this.sharedApiUrl,\n codeLength: code?.length,\n });\n throw new Error('Session validation failed');\n }\n\n // Omit `cookies` so the Mastra server fallback path calls\n // createSession() + getSessionHeaders() to build a cookie scoped to\n // the deployed instance's domain.\n return {\n user,\n tokens: {\n accessToken: code,\n },\n };\n }\n\n setCallbackCookieHeader(_cookieHeader: string \| null): void {\n // No-op: we don't use PKCE cookies — the shared API handles the full OAuth flow\n }\n\n getLoginCookies(): string[] \| undefined {\n // No PKCE cookies needed — shared API manages the OAuth state\n return undefined;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n return {\n provider: 'mastra-studio',\n text: 'Sign in with Mastra',\n description:\n 'Your deployed Studio is secured by your Mastra account. Sign in with the same email you used to sign up on mastra.ai.',\n };\n }\n\n async getLogoutUrl(_redirectUri: string, request?: Request): Promise<string \| null> {\n const cookieHeader = request?.headers.get('Cookie');\n const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);\n\n if (!sessionCookie) return null;\n\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/logout`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Cookie: `${COOKIE_NAME}=${sessionCookie}`,\n },\n });\n\n if (res.ok) {\n const data = (await res.json()) as { ok: boolean; logoutUrl?: string };\n return data.logoutUrl ?? null;\n }\n } catch {\n // Failed to get logout URL — return null\n }\n\n return null;\n }\n\n // ---------------------------------------------------------------------------\n // ISessionProvider\n // ---------------------------------------------------------------------------\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const now = new Date();\n return {\n id: (metadata?.accessToken as string) \|\| crypto.randomUUID(),\n userId,\n expiresAt: new Date(now.getTime() + 24 60 * 60 * 1000), // 24 hours\n createdAt: now,\n metadata,\n };\n }\n\n async validateSession(sessionId: string): Promise<Session \| null> {\n const user = await this.verifySessionCookie(sessionId);\n if (!user) return null;\n\n const now = new Date();\n return {\n id: sessionId,\n userId: user.id,\n expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1000),\n createdAt: now,\n };\n }\n\n async destroySession(sessionId: string): Promise<void> {\n try {\n await fetch(`${this.sharedApiUrl}/auth/logout`, {\n method: 'POST',\n headers: {\n Cookie: `${COOKIE_NAME}=${sessionId}`,\n },\n });\n } catch {\n // Best effort\n }\n }\n\n async refreshSession(sessionId: string): Promise<Session \| null> {\n try {\n // Call the shared API's /auth/refresh endpoint to get a fresh access token\n const res = await fetch(`${this.sharedApiUrl}/auth/refresh`, {\n method: 'GET',\n headers: {\n Cookie: `${COOKIE_NAME}=${sessionId}`,\n },\n });\n\n if (!res.ok) {\n this.logger.warn('refreshSession: shared API refresh returned non-OK status', {\n status: res.status,\n url: `${this.sharedApiUrl}/auth/refresh`,\n });\n // Refresh failed, fall back to validation (will likely also fail)\n return this.validateSession(sessionId);\n }\n\n // Parse the new sealed session from Set-Cookie header\n const setCookie = res.headers.get('Set-Cookie');\n const newSessionId = setCookie ? parseCookieFromHeader(setCookie, COOKIE_NAME) : null;\n\n if (!newSessionId) {\n this.logger.warn('refreshSession: no Set-Cookie header in refresh response');\n // No new cookie returned, fall back to validation with original\n return this.validateSession(sessionId);\n }\n\n // Verify the new session works and return it\n const user = await this.verifySessionCookie(newSessionId);\n if (!user) return null;\n\n const now = new Date();\n return {\n id: newSessionId,\n userId: user.id,\n expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1000),\n createdAt: now,\n };\n } catch (error) {\n this.logger.error('refreshSession: fetch to shared API failed', {\n url: `${this.sharedApiUrl}/auth/refresh`,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n // On error, fall back to validation\n return this.validateSession(sessionId);\n }\n }\n\n getSessionIdFromRequest(request: Request): string \| null {\n const cookieHeader = request.headers.get('Cookie');\n return parseCookie(cookieHeader, COOKIE_NAME);\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n const parts = [`${COOKIE_NAME}=${session.id}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', 'Max-Age=86400'];\n if (this.useProductionCookies && this.cookieDomain) {\n parts.push('Secure');\n parts.push(`Domain=${this.cookieDomain}`);\n }\n return { 'Set-Cookie': parts.join('; ') };\n }\n\n getClearSessionHeaders(): Record<string, string> {\n const parts = [`${COOKIE_NAME}=`, 'HttpOnly', 'SameSite=Lax', 'Path=/', 'Max-Age=0'];\n if (this.useProductionCookies && this.cookieDomain) {\n parts.push('Secure');\n parts.push(`Domain=${this.cookieDomain}`);\n }\n return { 'Set-Cookie': parts.join('; ') };\n }\n\n // ---------------------------------------------------------------------------\n // IUserProvider\n // ---------------------------------------------------------------------------\n\n async getCurrentUser(request: Request): Promise<StudioUser \| null> {\n const cookieHeader = request.headers.get('Cookie');\n const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);\n\n if (sessionCookie) {\n return this.verifySessionCookie(sessionCookie);\n }\n\n // Try bearer token\n const authHeader = request.headers.get('Authorization');\n if (authHeader?.startsWith('Bearer ')) {\n return this.verifyBearerToken(authHeader.slice(7));\n }\n\n return null;\n }\n\n async getUser(_userId: string): Promise<StudioUser \| null> {\n // Cannot look up users by ID — only validate sessions\n return null;\n }\n\n // ---------------------------------------------------------------------------\n // IOrganizationsProvider\n // ---------------------------------------------------------------------------\n\n /*\n Ensure the user belongs to an organization, bootstrapping a personal org\n * on first use when they have none.\n \n Because the shared API's org endpoints are cookie-authenticated but this\n * method only receives a userId, we look up the user's sealed session cookie\n * from the {@link userSessionCookies} cache populated by\n * {@link verifySessionCookie}. If we have never seen a cookie for this user\n * (e.g. bearer-token flow, or the cache was evicted), we skip bootstrap and\n * return `undefined` — the caller keeps the user in their current no-org\n * state and the next authenticated request retries.\n \n Best-effort: any shared-API failure returns `undefined` rather than\n * throwing, mirroring `MastraAuthWorkos.ensureOrganization`.\n /\n async ensureOrganization(userId: string): Promise<string \| undefined> {\n // Dedupe concurrent bootstraps for the same user — otherwise parallel tabs\n // for a brand-new user each POST /auth/orgs and create duplicate personal\n // organizations.\n const inFlight = this.organizationBootstrapInFlight.get(userId);\n if (inFlight) return inFlight;\n\n const bootstrap = this.doEnsureOrganization(userId).finally(() => {\n this.organizationBootstrapInFlight.delete(userId);\n });\n this.organizationBootstrapInFlight.set(userId, bootstrap);\n return bootstrap;\n }\n\n private async doEnsureOrganization(userId: string): Promise<string \| undefined> {\n const sessionCookie = this.userSessionCookies.get(userId);\n if (!sessionCookie) {\n this.logger.debug('ensureOrganization: no cached session cookie for user; skipping bootstrap', { userId });\n return undefined;\n }\n\n try {\n // Check /auth/me first — the session may already carry an organizationId\n // (existing user) or memberOrgIds we can pick from (multi-org user with\n // no active selection).\n const me = await this.fetchMe(sessionCookie);\n if (me?.organizationId) return me.organizationId;\n if (me?.memberOrgIds && me.memberOrgIds.length > 0) return me.memberOrgIds[0];\n\n // No org anywhere → create a personal org. The shared API auto-switches\n // the session cookie to the new org, but the browser holds the sealed\n // cookie, not us, so we can't update it in-place. Next validated request\n // will observe the new org via /auth/me.\n const orgName = me?.user?.email ? `${me.user.email}'s org` : `Personal (${userId})`;\n const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Cookie: `${COOKIE_NAME}=${sessionCookie}`,\n },\n body: JSON.stringify({ name: orgName }),\n });\n\n if (!res.ok) {\n this.logger.warn('ensureOrganization: shared API POST /auth/orgs returned non-OK', {\n status: res.status,\n userId,\n });\n return undefined;\n }\n\n const data = (await res.json()) as { organization?: { id?: string } };\n return data.organization?.id;\n } catch (error) {\n this.logger.error('ensureOrganization: fetch to shared API failed', {\n userId,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n return undefined;\n }\n }\n\n /\n Whether the user holds an admin-equivalent role in the organization.\n \n Fast path: if the org matches the user's currently-active session org, we\n * read the role directly from `/auth/me`. Cross-org path: we call\n * `/auth/orgs` (which returns per-membership roles) and look up the target\n * org. Any shared-API failure resolves to `false`.\n /\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n const sessionCookie = this.userSessionCookies.get(userId);\n if (!sessionCookie) return false;\n\n try {\n const me = await this.fetchMe(sessionCookie);\n if (me?.organizationId === organizationId) {\n return isAdminRole(me.role);\n }\n\n // Not the active org — fall back to /auth/orgs for the per-org role.\n const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {\n headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },\n });\n if (!res.ok) return false;\n\n const data = (await res.json()) as {\n organizations?: Array<{ id: string; role?: string \| null }>;\n };\n const membership = data.organizations?.find(o => o.id === organizationId);\n return isAdminRole(membership?.role ?? undefined);\n } catch {\n return false;\n }\n }\n\n // ---------------------------------------------------------------------------\n // Internal helpers\n // ---------------------------------------------------------------------------\n\n /\n Record the sealed session cookie last seen for a user so\n * {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their\n * behalf. LRU-evicted at {@link maxCachedSessions} entries.\n /\n private rememberUserSession(userId: string, sessionCookie: string): void {\n // Refresh recency by re-inserting.\n this.userSessionCookies.delete(userId);\n this.userSessionCookies.set(userId, sessionCookie);\n if (this.userSessionCookies.size > this.maxCachedSessions) {\n const oldest = this.userSessionCookies.keys().next().value;\n if (oldest !== undefined) this.userSessionCookies.delete(oldest);\n }\n }\n\n /\n Fetch the shared API's `/auth/me` and return the raw response body, or\n * `null` on any non-OK / network error. Split out so `ensureOrganization`\n * and `isOrganizationAdmin` can reuse it without duplicating the shape.\n /\n private async fetchMe(sessionCookie: string): Promise<{\n user?: { id?: string; email?: string };\n organizationId?: string;\n role?: string;\n memberOrgIds?: string[];\n } \| null> {\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/me`, {\n headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },\n });\n if (!res.ok) return null;\n return (await res.json()) as {\n user?: { id?: string; email?: string };\n organizationId?: string;\n role?: string;\n memberOrgIds?: string[];\n };\n } catch {\n return null;\n }\n }\n\n /\n Forward a sealed session cookie to the shared API's /auth/me endpoint\n * to validate it and get user info.\n /\n private async verifySessionCookie(sessionCookie: string): Promise<StudioUser \| null> {\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/me`, {\n headers: {\n Cookie: `${COOKIE_NAME}=${sessionCookie}`,\n },\n });\n\n if (!res.ok) {\n this.logger.warn('verifySessionCookie: shared API returned non-OK status', {\n status: res.status,\n statusText: res.statusText,\n url: `${this.sharedApiUrl}/auth/me`,\n });\n return null;\n }\n\n const data = (await res.json()) as {\n user: {\n id: string;\n email: string;\n firstName: string;\n lastName: string;\n profilePictureUrl?: string;\n };\n organizationId: string;\n role?: string;\n permissions?: string[];\n memberOrgIds?: string[];\n };\n\n // Remember the sealed cookie for this user so IOrganizationsProvider\n // methods (invoked with only a userId) can act on the user's behalf.\n this.rememberUserSession(data.user.id, sessionCookie);\n\n return {\n id: data.user.id,\n email: data.user.email,\n name: [data.user.firstName, data.user.lastName].filter(Boolean).join(' ') \|\| undefined,\n avatarUrl: data.user.profilePictureUrl,\n organizationId: data.organizationId,\n role: data.role,\n permissions: data.permissions,\n memberOrgIds: data.memberOrgIds,\n };\n } catch (error) {\n this.logger.error('verifySessionCookie: fetch to shared API failed', {\n url: `${this.sharedApiUrl}/auth/me`,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n return null;\n }\n }\n\n /\n Forward a Bearer token to the shared API's /auth/verify endpoint\n * to validate it and get user info (used for CLI tokens).\n /\n private async verifyBearerToken(token: string): Promise<StudioUser \| null> {\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {\n headers: {\n Authorization: `Bearer ${token}`,\n },\n });\n\n if (!res.ok) {\n this.logger.warn('verifyBearerToken: shared API returned non-OK status', {\n status: res.status,\n url: `${this.sharedApiUrl}/auth/verify`,\n });\n return null;\n }\n\n const data = (await res.json()) as {\n user: {\n id: string;\n email: string;\n firstName: string;\n lastName: string;\n };\n organizationId: string;\n role?: string;\n memberOrgIds?: string[];\n };\n\n return {\n id: data.user.id,\n email: data.user.email,\n name: [data.user.firstName, data.user.lastName].filter(Boolean).join(' ') \|\| undefined,\n organizationId: data.organizationId,\n role: data.role,\n memberOrgIds: data.memberOrgIds,\n };\n } catch (error) {\n this.logger.error('verifyBearerToken: fetch to shared API failed', {\n url: `${this.sharedApiUrl}/auth/verify`,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n return null;\n }\n }\n}\n\n// ---------------------------------------------------------------------------\n// Cookie helpers\n// ---------------------------------------------------------------------------\n\nfunction parseCookie(cookieHeader: string \| null \| undefined, name: string): string \| null {\n if (!cookieHeader) return null;\n const match = cookieHeader.match(new RegExp(`${name}=([^;]+)`));\n return match?.[1] ?? null;\n}\n\n/\n WorkOS AuthKit conventionally uses `admin` / `owner` for admin-equivalent\n * roles; the shared API surfaces the WorkOS role slug directly on\n * `/auth/me` and `/auth/orgs`.\n /\nfunction isAdminRole(role: string \| undefined): boolean {\n return role === 'admin' \|\| role === 'owner';\n}\n\n/\n Parse a cookie value from a Set-Cookie header.\n * Set-Cookie format: \"name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400\"\n /\nfunction parseCookieFromHeader(setCookieHeader: string, name: string): string \| null {\n // Set-Cookie header starts with \"name=value\" followed by optional attributes\n const parts = setCookieHeader.split(';');\n if (parts.length === 0) return null;\n\n const [cookieName, ...valueParts] = parts[0]!.split('=');\n if (cookieName?.trim() !== name) return null;\n\n // Value could contain = characters, so rejoin\n return valueParts.join('=') \|\| null;\n}\n\n// ---------------------------------------------------------------------------\n// MastraRBACStudio — role-based permission provider for Studio auth\n// ---------------------------------------------------------------------------\n\nexport interface MastraRBACStudioOptions {\n /\n Mapping from role names to permission arrays.\n \n @example\n * ```typescript\n * {\n * admin: [''],\n member: ['agents:read', 'workflows:'],\n viewer: ['agents:read', 'workflows:read'],\n * _default: [],\n * }\n * ```\n /\n roleMapping: RoleMapping;\n}\n\n/\n RBAC provider for Mastra Studio authentication.\n \n Maps user roles (from the shared API's /auth/me endpoint) to Mastra permissions\n * using a configurable role mapping.\n */\nexport class MastraRBACStudio implements IRBACProvider<StudioUser> {\n private options: MastraRBACStudioOptions;\n\n get roleMapping(): RoleMapping {\n return this.options.roleMapping;\n }\n\n constructor(options: MastraRBACStudioOptions) {\n this.options = options;\n }\n\n async getRoles(user: StudioUser): Promise<string[]> {\n return user.role ? [user.role] : [];\n }\n\n async hasRole(user: StudioUser, role: string): Promise<boolean> {\n const roles = await this.getRoles(user);\n return roles.includes(role);\n }\n\n async getPermissions(user: StudioUser): Promise<string[]> {\n const roles = await this.getRoles(user);\n if (roles.length === 0) {\n return this.options.roleMapping['_default'] ?? [];\n }\n return resolvePermissionsFromMapping(roles, this.options.roleMapping);\n }\n\n async hasPermission(user: StudioUser, permission: string): Promise<boolean> {\n const permissions = await this.getPermissions(user);\n return permissions.some(p => matchesPermission(p, permission));\n }\n\n async hasAllPermissions(user: StudioUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.every(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n\n async hasAnyPermission(user: StudioUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.some(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n}\n"]}
1	+ {"version":3,"file":"index.cjs","names":["#rawConfig"],"sources":["../../../packages/_internals/auth/dist/ee-C8o0LZ3r.js","../../../packages/_internal-core/dist/logger/index.js","../../../packages/_internal-core/dist/base/index.js","../../../packages/_internals/auth/dist/provider/index.js","../src/index.ts"],"sourcesContent":["import { i as getSafeLicenseSummary, m as getEETelemetryFallbackDistinctId, p as captureEEEvent } from \"./capabilities-ZXD8uYsD.js\";\n//#region src/ee/interfaces/permissions.generated.ts\n/*\n AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY\n\n This file is generated by packages/server/scripts/generate-permissions.ts\n* Run `pnpm generate:permissions` from packages/server to regenerate.\n\n Source of truth: SERVER_ROUTES in @mastra/server\n/\n/\n All known API resources.\n* Derived from SERVER_ROUTES paths in @mastra/server.\n/\nconst RESOURCES = [\n\t\"a2a\",\n\t\"agent-builder\",\n\t\"agent-controller\",\n\t\"agents\",\n\t\"auth\",\n\t\"background-tasks\",\n\t\"channels\",\n\t\"datasets\",\n\t\"embedders\",\n\t\"experiments\",\n\t\"infrastructure\",\n\t\"logs\",\n\t\"mcp\",\n\t\"memory\",\n\t\"observability\",\n\t\"processor-providers\",\n\t\"processors\",\n\t\"schedules\",\n\t\"scores\",\n\t\"stored-agents\",\n\t\"stored-mcp-clients\",\n\t\"stored-prompt-blocks\",\n\t\"stored-scorers\",\n\t\"stored-skills\",\n\t\"stored-workspaces\",\n\t\"system\",\n\t\"tool-providers\",\n\t\"tools\",\n\t\"vector\",\n\t\"vectors\",\n\t\"workflows\",\n\t\"workspaces\"\n];\n/\n All permission actions.\n* Derived from HTTP methods and route overrides:\n* - GET → read\n* - POST → write or execute (context-dependent)\n* - PUT/PATCH → write\n* - DELETE → delete\n* - Additional actions from explicit requiresPermission overrides\n/\nconst ACTIONS = [\n\t\"create\",\n\t\"delete\",\n\t\"execute\",\n\t\"publish\",\n\t\"read\",\n\t\"share\",\n\t\"write\"\n];\n/\n All valid permission patterns.\n* Use `keyof typeof PERMISSION_PATTERNS` or the `PermissionPattern` type.\n/\nconst PERMISSION_PATTERNS = {\n\t/* Full access to all resources and actions /\n\t\"\": \"\",\n\t/* Create all resources /\n\t\":create\": \":create\",\n\t/* Delete all resources /\n\t\":delete\": \":delete\",\n\t/* Execute all resources /\n\t\":execute\": \":execute\",\n\t/* Publish, activate, or restore all resources /\n\t\":publish\": \":publish\",\n\t/* View all resources /\n\t\":read\": \":read\",\n\t/* Change visibility/audience all resources /\n\t\":share\": \":share\",\n\t/* Create and modify all resources /\n\t\":write\": \":write\",\n\t/* Full access to agent-to-agent communication /\n\t\"a2a:\": \"a2a:\",\n\t/* Full access to agent builder /\n\t\"agent-builder:\": \"agent-builder:\",\n\t/* Full access to agent controller sessions /\n\t\"agent-controller:\": \"agent-controller:\",\n\t/* Full access to agents /\n\t\"agents:\": \"agents:\",\n\t/* Full access to auth /\n\t\"auth:\": \"auth:\",\n\t/* Full access to background tasks /\n\t\"background-tasks:\": \"background-tasks:\",\n\t/* Full access to channels /\n\t\"channels:\": \"channels:\",\n\t/* Full access to datasets /\n\t\"datasets:\": \"datasets:\",\n\t/* Full access to embedders /\n\t\"embedders:\": \"embedders:\",\n\t/* Full access to experiments /\n\t\"experiments:\": \"experiments:\",\n\t/* Full access to infrastructure /\n\t\"infrastructure:\": \"infrastructure:\",\n\t/* Full access to logs /\n\t\"logs:\": \"logs:\",\n\t/* Full access to MCP servers /\n\t\"mcp:\": \"mcp:\",\n\t/* Full access to memory and threads /\n\t\"memory:\": \"memory:\",\n\t/* Full access to traces and spans /\n\t\"observability:\": \"observability:\",\n\t/* Full access to processor-providers /\n\t\"processor-providers:\": \"processor-providers:\",\n\t/* Full access to processors /\n\t\"processors:\": \"processors:\",\n\t/* Full access to schedules /\n\t\"schedules:\": \"schedules:\",\n\t/* Full access to evaluation scores /\n\t\"scores:\": \"scores:\",\n\t/* Full access to stored agents /\n\t\"stored-agents:\": \"stored-agents:\",\n\t/* Full access to stored MCP clients /\n\t\"stored-mcp-clients:\": \"stored-mcp-clients:\",\n\t/* Full access to stored prompt blocks /\n\t\"stored-prompt-blocks:\": \"stored-prompt-blocks:\",\n\t/* Full access to stored scorers /\n\t\"stored-scorers:\": \"stored-scorers:\",\n\t/* Full access to stored skills /\n\t\"stored-skills:\": \"stored-skills:\",\n\t/* Full access to stored workspaces /\n\t\"stored-workspaces:\": \"stored-workspaces:\",\n\t/* Full access to system info /\n\t\"system:\": \"system:\",\n\t/* Full access to tool-providers /\n\t\"tool-providers:\": \"tool-providers:\",\n\t/* Full access to tools /\n\t\"tools:\": \"tools:\",\n\t/* Full access to vector stores /\n\t\"vector:\": \"vector:\",\n\t/* Full access to vectors /\n\t\"vectors:\": \"vectors:\",\n\t/* Full access to workflows /\n\t\"workflows:\": \"workflows:\",\n\t/* Full access to workspaces /\n\t\"workspaces:\": \"workspaces:\",\n\t/* View agent-to-agent communication /\n\t\"a2a:read\": \"a2a:read\",\n\t/* Create and modify agent-to-agent communication /\n\t\"a2a:write\": \"a2a:write\",\n\t/* Execute agent builder /\n\t\"agent-builder:execute\": \"agent-builder:execute\",\n\t/* View agent builder /\n\t\"agent-builder:read\": \"agent-builder:read\",\n\t/* Create and modify agent builder /\n\t\"agent-builder:write\": \"agent-builder:write\",\n\t/* Execute agent controller sessions /\n\t\"agent-controller:execute\": \"agent-controller:execute\",\n\t/* View agent controller sessions /\n\t\"agent-controller:read\": \"agent-controller:read\",\n\t/* Create agents /\n\t\"agents:create\": \"agents:create\",\n\t/* Delete agents /\n\t\"agents:delete\": \"agents:delete\",\n\t/* Execute agents /\n\t\"agents:execute\": \"agents:execute\",\n\t/* View agents /\n\t\"agents:read\": \"agents:read\",\n\t/* Create and modify agents /\n\t\"agents:write\": \"agents:write\",\n\t/* View auth /\n\t\"auth:read\": \"auth:read\",\n\t/* View background tasks /\n\t\"background-tasks:read\": \"background-tasks:read\",\n\t/* View channels /\n\t\"channels:read\": \"channels:read\",\n\t/* Create and modify channels /\n\t\"channels:write\": \"channels:write\",\n\t/* Delete datasets /\n\t\"datasets:delete\": \"datasets:delete\",\n\t/* Execute datasets /\n\t\"datasets:execute\": \"datasets:execute\",\n\t/* View datasets /\n\t\"datasets:read\": \"datasets:read\",\n\t/* Create and modify datasets /\n\t\"datasets:write\": \"datasets:write\",\n\t/* View embedders /\n\t\"embedders:read\": \"embedders:read\",\n\t/* View experiments /\n\t\"experiments:read\": \"experiments:read\",\n\t/* View infrastructure /\n\t\"infrastructure:read\": \"infrastructure:read\",\n\t/* View logs /\n\t\"logs:read\": \"logs:read\",\n\t/* Execute MCP servers /\n\t\"mcp:execute\": \"mcp:execute\",\n\t/* View MCP servers /\n\t\"mcp:read\": \"mcp:read\",\n\t/* Create and modify MCP servers /\n\t\"mcp:write\": \"mcp:write\",\n\t/* Delete memory and threads /\n\t\"memory:delete\": \"memory:delete\",\n\t/* Execute memory and threads /\n\t\"memory:execute\": \"memory:execute\",\n\t/* View memory and threads /\n\t\"memory:read\": \"memory:read\",\n\t/* Create and modify memory and threads /\n\t\"memory:write\": \"memory:write\",\n\t/* View traces and spans /\n\t\"observability:read\": \"observability:read\",\n\t/* Create and modify traces and spans /\n\t\"observability:write\": \"observability:write\",\n\t/* View processor-providers /\n\t\"processor-providers:read\": \"processor-providers:read\",\n\t/* Execute processors /\n\t\"processors:execute\": \"processors:execute\",\n\t/* View processors /\n\t\"processors:read\": \"processors:read\",\n\t/* Delete schedules /\n\t\"schedules:delete\": \"schedules:delete\",\n\t/* Execute schedules /\n\t\"schedules:execute\": \"schedules:execute\",\n\t/* View schedules /\n\t\"schedules:read\": \"schedules:read\",\n\t/* Create and modify schedules /\n\t\"schedules:write\": \"schedules:write\",\n\t/* View evaluation scores /\n\t\"scores:read\": \"scores:read\",\n\t/* Create and modify evaluation scores /\n\t\"scores:write\": \"scores:write\",\n\t/* Delete stored agents /\n\t\"stored-agents:delete\": \"stored-agents:delete\",\n\t/* Publish, activate, or restore stored agents /\n\t\"stored-agents:publish\": \"stored-agents:publish\",\n\t/* View stored agents /\n\t\"stored-agents:read\": \"stored-agents:read\",\n\t/* Create and modify stored agents /\n\t\"stored-agents:write\": \"stored-agents:write\",\n\t/* Delete stored MCP clients /\n\t\"stored-mcp-clients:delete\": \"stored-mcp-clients:delete\",\n\t/* Publish, activate, or restore stored MCP clients /\n\t\"stored-mcp-clients:publish\": \"stored-mcp-clients:publish\",\n\t/* View stored MCP clients /\n\t\"stored-mcp-clients:read\": \"stored-mcp-clients:read\",\n\t/* Create and modify stored MCP clients /\n\t\"stored-mcp-clients:write\": \"stored-mcp-clients:write\",\n\t/* Delete stored prompt blocks /\n\t\"stored-prompt-blocks:delete\": \"stored-prompt-blocks:delete\",\n\t/* Publish, activate, or restore stored prompt blocks /\n\t\"stored-prompt-blocks:publish\": \"stored-prompt-blocks:publish\",\n\t/* View stored prompt blocks /\n\t\"stored-prompt-blocks:read\": \"stored-prompt-blocks:read\",\n\t/* Create and modify stored prompt blocks /\n\t\"stored-prompt-blocks:write\": \"stored-prompt-blocks:write\",\n\t/* Delete stored scorers /\n\t\"stored-scorers:delete\": \"stored-scorers:delete\",\n\t/* Publish, activate, or restore stored scorers /\n\t\"stored-scorers:publish\": \"stored-scorers:publish\",\n\t/* View stored scorers /\n\t\"stored-scorers:read\": \"stored-scorers:read\",\n\t/* Create and modify stored scorers /\n\t\"stored-scorers:write\": \"stored-scorers:write\",\n\t/* Delete stored skills /\n\t\"stored-skills:delete\": \"stored-skills:delete\",\n\t/* Publish, activate, or restore stored skills /\n\t\"stored-skills:publish\": \"stored-skills:publish\",\n\t/* View stored skills /\n\t\"stored-skills:read\": \"stored-skills:read\",\n\t/* Create and modify stored skills /\n\t\"stored-skills:write\": \"stored-skills:write\",\n\t/* Delete stored workspaces /\n\t\"stored-workspaces:delete\": \"stored-workspaces:delete\",\n\t/* View stored workspaces /\n\t\"stored-workspaces:read\": \"stored-workspaces:read\",\n\t/* Create and modify stored workspaces /\n\t\"stored-workspaces:write\": \"stored-workspaces:write\",\n\t/* View system info /\n\t\"system:read\": \"system:read\",\n\t/* Delete tool-providers /\n\t\"tool-providers:delete\": \"tool-providers:delete\",\n\t/* View tool-providers /\n\t\"tool-providers:read\": \"tool-providers:read\",\n\t/* Create and modify tool-providers /\n\t\"tool-providers:write\": \"tool-providers:write\",\n\t/* Execute tools /\n\t\"tools:execute\": \"tools:execute\",\n\t/* View tools /\n\t\"tools:read\": \"tools:read\",\n\t/* Delete vector stores /\n\t\"vector:delete\": \"vector:delete\",\n\t/* Execute vector stores /\n\t\"vector:execute\": \"vector:execute\",\n\t/* View vector stores /\n\t\"vector:read\": \"vector:read\",\n\t/* Create and modify vector stores /\n\t\"vector:write\": \"vector:write\",\n\t/* View vectors /\n\t\"vectors:read\": \"vectors:read\",\n\t/* Delete workflows /\n\t\"workflows:delete\": \"workflows:delete\",\n\t/* Execute workflows /\n\t\"workflows:execute\": \"workflows:execute\",\n\t/* View workflows /\n\t\"workflows:read\": \"workflows:read\",\n\t/* Create and modify workflows /\n\t\"workflows:write\": \"workflows:write\",\n\t/* Delete workspaces /\n\t\"workspaces:delete\": \"workspaces:delete\",\n\t/* View workspaces /\n\t\"workspaces:read\": \"workspaces:read\",\n\t/* Create and modify workspaces /\n\t\"workspaces:write\": \"workspaces:write\",\n\t/* Full access to all stored resource families /\n\t\"stored:\": \"stored:\",\n\t/* View all stored resource families /\n\t\"stored:read\": \"stored:read\",\n\t/* Create and modify all stored resource families /\n\t\"stored:write\": \"stored:write\",\n\t/* Delete all stored resource families /\n\t\"stored:delete\": \"stored:delete\",\n\t/* Change visibility/audience stored agents /\n\t\"stored-agents:share\": \"stored-agents:share\",\n\t/* Change visibility/audience stored skills /\n\t\"stored-skills:share\": \"stored-skills:share\"\n};\n/\n All valid resource:action permission combinations (excludes wildcards).\n/\nconst PERMISSIONS = [\n\t\"a2a:read\",\n\t\"a2a:write\",\n\t\"agent-builder:execute\",\n\t\"agent-builder:read\",\n\t\"agent-builder:write\",\n\t\"agent-controller:execute\",\n\t\"agent-controller:read\",\n\t\"agents:create\",\n\t\"agents:delete\",\n\t\"agents:execute\",\n\t\"agents:read\",\n\t\"agents:write\",\n\t\"auth:read\",\n\t\"background-tasks:read\",\n\t\"channels:read\",\n\t\"channels:write\",\n\t\"datasets:delete\",\n\t\"datasets:execute\",\n\t\"datasets:read\",\n\t\"datasets:write\",\n\t\"embedders:read\",\n\t\"experiments:read\",\n\t\"infrastructure:read\",\n\t\"logs:read\",\n\t\"mcp:execute\",\n\t\"mcp:read\",\n\t\"mcp:write\",\n\t\"memory:delete\",\n\t\"memory:execute\",\n\t\"memory:read\",\n\t\"memory:write\",\n\t\"observability:read\",\n\t\"observability:write\",\n\t\"processor-providers:read\",\n\t\"processors:execute\",\n\t\"processors:read\",\n\t\"schedules:delete\",\n\t\"schedules:execute\",\n\t\"schedules:read\",\n\t\"schedules:write\",\n\t\"scores:read\",\n\t\"scores:write\",\n\t\"stored-agents:delete\",\n\t\"stored-agents:publish\",\n\t\"stored-agents:read\",\n\t\"stored-agents:write\",\n\t\"stored-mcp-clients:delete\",\n\t\"stored-mcp-clients:publish\",\n\t\"stored-mcp-clients:read\",\n\t\"stored-mcp-clients:write\",\n\t\"stored-prompt-blocks:delete\",\n\t\"stored-prompt-blocks:publish\",\n\t\"stored-prompt-blocks:read\",\n\t\"stored-prompt-blocks:write\",\n\t\"stored-scorers:delete\",\n\t\"stored-scorers:publish\",\n\t\"stored-scorers:read\",\n\t\"stored-scorers:write\",\n\t\"stored-skills:delete\",\n\t\"stored-skills:publish\",\n\t\"stored-skills:read\",\n\t\"stored-skills:write\",\n\t\"stored-workspaces:delete\",\n\t\"stored-workspaces:read\",\n\t\"stored-workspaces:write\",\n\t\"system:read\",\n\t\"tool-providers:delete\",\n\t\"tool-providers:read\",\n\t\"tool-providers:write\",\n\t\"tools:execute\",\n\t\"tools:read\",\n\t\"vector:delete\",\n\t\"vector:execute\",\n\t\"vector:read\",\n\t\"vector:write\",\n\t\"vectors:read\",\n\t\"workflows:delete\",\n\t\"workflows:execute\",\n\t\"workflows:read\",\n\t\"workflows:write\",\n\t\"workspaces:delete\",\n\t\"workspaces:read\",\n\t\"workspaces:write\"\n];\n/\n Type-safe constants for Mastra-owned FGA permissions.\n\n These values are generated from server routes and can be used wherever\n* Mastra checks or maps FGA permissions.\n/\nconst MastraFGAPermissions = {\n\t/* View agent-to-agent communication /\n\tA2A_READ: \"a2a:read\",\n\t/* Create and modify agent-to-agent communication /\n\tA2A_WRITE: \"a2a:write\",\n\t/* Execute agent builder /\n\tAGENT_BUILDER_EXECUTE: \"agent-builder:execute\",\n\t/* View agent builder /\n\tAGENT_BUILDER_READ: \"agent-builder:read\",\n\t/* Create and modify agent builder /\n\tAGENT_BUILDER_WRITE: \"agent-builder:write\",\n\t/* Execute agent controller sessions /\n\tAGENT_CONTROLLER_EXECUTE: \"agent-controller:execute\",\n\t/* View agent controller sessions /\n\tAGENT_CONTROLLER_READ: \"agent-controller:read\",\n\t/* Create agents /\n\tAGENTS_CREATE: \"agents:create\",\n\t/* Delete agents /\n\tAGENTS_DELETE: \"agents:delete\",\n\t/* Execute agents /\n\tAGENTS_EXECUTE: \"agents:execute\",\n\t/* View agents /\n\tAGENTS_READ: \"agents:read\",\n\t/* Create and modify agents /\n\tAGENTS_WRITE: \"agents:write\",\n\t/* View auth /\n\tAUTH_READ: \"auth:read\",\n\t/* View background tasks /\n\tBACKGROUND_TASKS_READ: \"background-tasks:read\",\n\t/* View channels /\n\tCHANNELS_READ: \"channels:read\",\n\t/* Create and modify channels /\n\tCHANNELS_WRITE: \"channels:write\",\n\t/* Delete datasets /\n\tDATASETS_DELETE: \"datasets:delete\",\n\t/* Execute datasets /\n\tDATASETS_EXECUTE: \"datasets:execute\",\n\t/* View datasets /\n\tDATASETS_READ: \"datasets:read\",\n\t/* Create and modify datasets /\n\tDATASETS_WRITE: \"datasets:write\",\n\t/* View embedders /\n\tEMBEDDERS_READ: \"embedders:read\",\n\t/* View experiments /\n\tEXPERIMENTS_READ: \"experiments:read\",\n\t/* View infrastructure /\n\tINFRASTRUCTURE_READ: \"infrastructure:read\",\n\t/* View logs /\n\tLOGS_READ: \"logs:read\",\n\t/* Execute MCP servers /\n\tMCP_EXECUTE: \"mcp:execute\",\n\t/* View MCP servers /\n\tMCP_READ: \"mcp:read\",\n\t/* Create and modify MCP servers /\n\tMCP_WRITE: \"mcp:write\",\n\t/* Delete memory and threads /\n\tMEMORY_DELETE: \"memory:delete\",\n\t/* Execute memory and threads /\n\tMEMORY_EXECUTE: \"memory:execute\",\n\t/* View memory and threads /\n\tMEMORY_READ: \"memory:read\",\n\t/* Create and modify memory and threads /\n\tMEMORY_WRITE: \"memory:write\",\n\t/* View traces and spans /\n\tOBSERVABILITY_READ: \"observability:read\",\n\t/* Create and modify traces and spans /\n\tOBSERVABILITY_WRITE: \"observability:write\",\n\t/* View processor-providers /\n\tPROCESSOR_PROVIDERS_READ: \"processor-providers:read\",\n\t/* Execute processors /\n\tPROCESSORS_EXECUTE: \"processors:execute\",\n\t/* View processors /\n\tPROCESSORS_READ: \"processors:read\",\n\t/* Delete schedules /\n\tSCHEDULES_DELETE: \"schedules:delete\",\n\t/* Execute schedules /\n\tSCHEDULES_EXECUTE: \"schedules:execute\",\n\t/* View schedules /\n\tSCHEDULES_READ: \"schedules:read\",\n\t/* Create and modify schedules /\n\tSCHEDULES_WRITE: \"schedules:write\",\n\t/* View evaluation scores /\n\tSCORES_READ: \"scores:read\",\n\t/* Create and modify evaluation scores /\n\tSCORES_WRITE: \"scores:write\",\n\t/* Delete stored agents /\n\tSTORED_AGENTS_DELETE: \"stored-agents:delete\",\n\t/* Publish, activate, or restore stored agents /\n\tSTORED_AGENTS_PUBLISH: \"stored-agents:publish\",\n\t/* View stored agents /\n\tSTORED_AGENTS_READ: \"stored-agents:read\",\n\t/* Create and modify stored agents /\n\tSTORED_AGENTS_WRITE: \"stored-agents:write\",\n\t/* Delete stored MCP clients /\n\tSTORED_MCP_CLIENTS_DELETE: \"stored-mcp-clients:delete\",\n\t/* Publish, activate, or restore stored MCP clients /\n\tSTORED_MCP_CLIENTS_PUBLISH: \"stored-mcp-clients:publish\",\n\t/* View stored MCP clients /\n\tSTORED_MCP_CLIENTS_READ: \"stored-mcp-clients:read\",\n\t/* Create and modify stored MCP clients /\n\tSTORED_MCP_CLIENTS_WRITE: \"stored-mcp-clients:write\",\n\t/* Delete stored prompt blocks /\n\tSTORED_PROMPT_BLOCKS_DELETE: \"stored-prompt-blocks:delete\",\n\t/* Publish, activate, or restore stored prompt blocks /\n\tSTORED_PROMPT_BLOCKS_PUBLISH: \"stored-prompt-blocks:publish\",\n\t/* View stored prompt blocks /\n\tSTORED_PROMPT_BLOCKS_READ: \"stored-prompt-blocks:read\",\n\t/* Create and modify stored prompt blocks /\n\tSTORED_PROMPT_BLOCKS_WRITE: \"stored-prompt-blocks:write\",\n\t/* Delete stored scorers /\n\tSTORED_SCORERS_DELETE: \"stored-scorers:delete\",\n\t/* Publish, activate, or restore stored scorers /\n\tSTORED_SCORERS_PUBLISH: \"stored-scorers:publish\",\n\t/* View stored scorers /\n\tSTORED_SCORERS_READ: \"stored-scorers:read\",\n\t/* Create and modify stored scorers /\n\tSTORED_SCORERS_WRITE: \"stored-scorers:write\",\n\t/* Delete stored skills /\n\tSTORED_SKILLS_DELETE: \"stored-skills:delete\",\n\t/* Publish, activate, or restore stored skills /\n\tSTORED_SKILLS_PUBLISH: \"stored-skills:publish\",\n\t/* View stored skills /\n\tSTORED_SKILLS_READ: \"stored-skills:read\",\n\t/* Create and modify stored skills /\n\tSTORED_SKILLS_WRITE: \"stored-skills:write\",\n\t/* Delete stored workspaces /\n\tSTORED_WORKSPACES_DELETE: \"stored-workspaces:delete\",\n\t/* View stored workspaces /\n\tSTORED_WORKSPACES_READ: \"stored-workspaces:read\",\n\t/* Create and modify stored workspaces /\n\tSTORED_WORKSPACES_WRITE: \"stored-workspaces:write\",\n\t/* View system info /\n\tSYSTEM_READ: \"system:read\",\n\t/* Delete tool-providers /\n\tTOOL_PROVIDERS_DELETE: \"tool-providers:delete\",\n\t/* View tool-providers /\n\tTOOL_PROVIDERS_READ: \"tool-providers:read\",\n\t/* Create and modify tool-providers /\n\tTOOL_PROVIDERS_WRITE: \"tool-providers:write\",\n\t/* Execute tools /\n\tTOOLS_EXECUTE: \"tools:execute\",\n\t/* View tools /\n\tTOOLS_READ: \"tools:read\",\n\t/* Delete vector stores /\n\tVECTOR_DELETE: \"vector:delete\",\n\t/* Execute vector stores /\n\tVECTOR_EXECUTE: \"vector:execute\",\n\t/* View vector stores /\n\tVECTOR_READ: \"vector:read\",\n\t/* Create and modify vector stores /\n\tVECTOR_WRITE: \"vector:write\",\n\t/* View vectors /\n\tVECTORS_READ: \"vectors:read\",\n\t/* Delete workflows /\n\tWORKFLOWS_DELETE: \"workflows:delete\",\n\t/* Execute workflows /\n\tWORKFLOWS_EXECUTE: \"workflows:execute\",\n\t/* View workflows /\n\tWORKFLOWS_READ: \"workflows:read\",\n\t/* Create and modify workflows /\n\tWORKFLOWS_WRITE: \"workflows:write\",\n\t/* Delete workspaces /\n\tWORKSPACES_DELETE: \"workspaces:delete\",\n\t/* View workspaces /\n\tWORKSPACES_READ: \"workspaces:read\",\n\t/* Create and modify workspaces /\n\tWORKSPACES_WRITE: \"workspaces:write\"\n};\n/\n Validates that a string is a valid permission pattern.\n* Useful for runtime validation of permission strings.\n/\nfunction isValidPermissionPattern(pattern) {\n\treturn pattern in PERMISSION_PATTERNS;\n}\n/\n Validates that all permissions in an array are valid patterns.\n/\nfunction validatePermissions(permissions) {\n\treturn permissions.every(isValidPermissionPattern);\n}\n//#endregion\n//#region src/ee/fga-check.ts\n/\n FGA enforcement utility for checking fine-grained authorization.\n\n @license Mastra Enterprise License - see ee/LICENSE\n/\nfunction mergeFGAContext({ context, requestContext, metadata }) {\n\tconst mergedContext = { ...context };\n\tif (requestContext) mergedContext.requestContext = requestContext;\n\tif (metadata \|\| context?.metadata) mergedContext.metadata = {\n\t\t...context?.metadata ?? {},\n\t\t...metadata ?? {}\n\t};\n\treturn Object.keys(mergedContext).length > 0 ? mergedContext : void 0;\n}\nfunction isActorSignal(actor) {\n\tif (actor === true) return true;\n\tif (typeof actor !== \"object\" \|\| actor === null) return false;\n\tconst candidate = actor;\n\treturn candidate.actorKind === \"system\" && (candidate.sourceWorkflow === void 0 \|\| typeof candidate.sourceWorkflow === \"string\");\n}\nfunction getAgentFGAResourceId(agentId) {\n\treturn agentId;\n}\nfunction getWorkflowFGAResourceId(workflowId) {\n\treturn workflowId;\n}\nfunction getStandaloneToolFGAResourceId(toolName) {\n\treturn toolName;\n}\nfunction getAgentToolFGAResourceId(agentId, toolName) {\n\treturn `${agentId}:${toolName}`;\n}\nfunction getMCPToolFGAResourceId(serverName, toolName) {\n\treturn JSON.stringify([serverName, toolName]);\n}\n/\n Check fine-grained authorization for a resource.\n\n No-op if no FGA provider is configured (backward compatibility).\n* Delegates to fgaProvider.require() which throws FGADeniedError if denied.\n/\nasync function checkFGA(options) {\n\tawait requireFGA(options);\n}\n/\n Require fine-grained authorization for a resource.\n\n No-op if no FGA provider is configured. When FGA is configured, a missing\n* user fails closed.\n/\nasync function requireFGA(options) {\n\tconst { fgaProvider, user, resource, permission, context, requestContext, metadata, actor } = options;\n\tif (!fgaProvider) return;\n\tconst fgaContext = mergeFGAContext({\n\t\tcontext,\n\t\trequestContext,\n\t\tmetadata\n\t});\n\tconst license = getSafeLicenseSummary();\n\tif (isActorSignal(actor)) {\n\t\tconst tenantOrganizationId = fgaContext?.requestContext?.get(\"organizationId\");\n\t\tif (typeof tenantOrganizationId !== \"string\" \|\| tenantOrganizationId.length === 0) throw new FGADeniedError(user, resource, permission, \"trusted actor requires organizationId / tenant scope\");\n\t\tconst sourceWorkflow = (actor === true ? void 0 : actor.sourceWorkflow) ?? (typeof fgaContext?.metadata?.[\"sourceWorkflow\"] === \"string\" ? fgaContext.metadata[\"sourceWorkflow\"] : void 0);\n\t\tconst providerEnforced = typeof fgaProvider.requireActor === \"function\";\n\t\tif (providerEnforced) await fgaProvider.requireActor(actor, {\n\t\t\tresource,\n\t\t\tpermission,\n\t\t\t...fgaContext ? { context: fgaContext } : {}\n\t\t});\n\t\ttry {\n\t\t\tcaptureEEEvent(\"ee_feature_used\", license.anonymousId \|\| getEETelemetryFallbackDistinctId(), {\n\t\t\t\tfeature: \"fga\",\n\t\t\t\tactor_kind: \"system\",\n\t\t\t\tactor_authorized_by: providerEnforced ? \"provider\" : \"bypass\",\n\t\t\t\tresource_type: resource.type,\n\t\t\t\tresource_id: resource.id,\n\t\t\t\tpermission,\n\t\t\t\tuser_id: null,\n\t\t\t\torganization_membership_id: null,\n\t\t\t\tsource_workflow: sourceWorkflow,\n\t\t\t\tlicense_valid: license.valid,\n\t\t\t\tlicense_hash: license.licenseHash,\n\t\t\t\tis_dev_environment: license.isDevEnvironment\n\t\t\t});\n\t\t} catch {}\n\t\treturn;\n\t}\n\tif (!user) throw new FGADeniedError(user, resource, permission, \"authenticated user is required\");\n\tawait fgaProvider.require(user, fgaContext ? {\n\t\tresource,\n\t\tpermission,\n\t\tcontext: fgaContext\n\t} : {\n\t\tresource,\n\t\tpermission\n\t});\n\ttry {\n\t\tcaptureEEEvent(\"ee_feature_used\", user?.id \|\| license.anonymousId \|\| getEETelemetryFallbackDistinctId(), {\n\t\t\tfeature: \"fga\",\n\t\t\tactor_kind: \"user\",\n\t\t\tresource_type: resource.type,\n\t\t\tresource_id: resource.id,\n\t\t\tpermission,\n\t\t\tuser_id: user?.id ?? null,\n\t\t\torganization_membership_id: user?.organizationMembershipId ?? null,\n\t\t\tlicense_valid: license.valid,\n\t\t\tlicense_hash: license.licenseHash,\n\t\t\tis_dev_environment: license.isDevEnvironment\n\t\t});\n\t} catch {}\n}\n/\n Error thrown when an FGA authorization check is denied.\n/\nvar FGADeniedError = class extends Error {\n\tuser;\n\tresource;\n\tpermission;\n\tstatus;\n\tconstructor(user, resource, permission, reason) {\n\t\tconst userId = user?.id \|\| user?.workosId \|\| \"unknown\";\n\t\tconst permissionLabel = Array.isArray(permission) ? `any of [${permission.join(\", \")}]` : permission;\n\t\tsuper(reason ? `FGA authorization denied: ${reason}` : `FGA authorization denied: user ${userId} cannot ${permissionLabel} on ${resource.type}:${resource.id}`);\n\t\tthis.name = \"FGADeniedError\";\n\t\tthis.user = user;\n\t\tthis.resource = resource;\n\t\tthis.permission = permission;\n\t\tthis.status = 403;\n\t}\n};\n//#endregion\n//#region src/ee/defaults/roles.ts\n/\n Default role definitions for Studio.\n\n These roles provide a sensible starting point for most applications:\n* - owner: Full access to everything\n* - admin: Manage agents, workflows, and users\n* - member: Execute agents and workflows, read-only settings\n* - viewer: Read-only access\n\n Permission patterns:\n* - `` - Full access to everything\n - `resource:` - All actions on a specific resource\n - `:action` - An action across all resources (e.g., `:read` for read-only)\n/\nconst DEFAULT_ROLES = [\n\t{\n\t\tid: \"owner\",\n\t\tname: \"Owner\",\n\t\tdescription: \"Full access to all features and settings\",\n\t\tpermissions: [\"\"]\n\t},\n\t{\n\t\tid: \"admin\",\n\t\tname: \"Admin\",\n\t\tdescription: \"Manage agents, workflows, and team members\",\n\t\tpermissions: [\n\t\t\t\":read\",\n\t\t\t\":write\",\n\t\t\t\":execute\",\n\t\t\t\":publish\",\n\t\t\t\":share\"\n\t\t]\n\t},\n\t{\n\t\tid: \"member\",\n\t\tname: \"Member\",\n\t\tdescription: \"Execute agents and workflows\",\n\t\tpermissions: [\":read\", \":execute\"]\n\t},\n\t{\n\t\tid: \"viewer\",\n\t\tname: \"Viewer\",\n\t\tdescription: \"Read-only access\",\n\t\tpermissions: [\":read\"]\n\t}\n];\n/*\n Get role by ID from default roles.\n\n @param roleId - Role ID to find\n* @returns Role definition or undefined\n/\nfunction getDefaultRole(roleId) {\n\treturn DEFAULT_ROLES.find((role) => role.id === roleId);\n}\n/\n Resolve all permissions for a set of role IDs.\n\n Handles role inheritance and deduplication.\n\n @param roleIds - Role IDs to resolve\n* @param roles - Role definitions (defaults to DEFAULT_ROLES)\n* @returns Array of resolved permissions\n/\nfunction resolvePermissions(roleIds, roles = DEFAULT_ROLES) {\n\tconst permissions = / @__PURE__ / new Set();\n\tconst visited = / @__PURE__ / new Set();\n\tfunction resolveRole(roleId) {\n\t\tif (visited.has(roleId)) return;\n\t\tvisited.add(roleId);\n\t\tconst role = roles.find((r) => r.id === roleId);\n\t\tif (!role) return;\n\t\tfor (const permission of role.permissions) permissions.add(permission);\n\t\tif (role.inherits) for (const inheritedRoleId of role.inherits) resolveRole(inheritedRoleId);\n\t}\n\tfor (const roleId of roleIds) resolveRole(roleId);\n\treturn Array.from(permissions);\n}\n/\n Compound resource keys that expand to a set of per-family resources.\n* A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`\n* (and `stored:` matches any `stored-<family>:`).\n/\nconst RESOURCE_EXPANSIONS = { stored: [\n\t\"stored-agents\",\n\t\"stored-mcp-clients\",\n\t\"stored-prompt-blocks\",\n\t\"stored-scorers\",\n\t\"stored-skills\",\n\t\"stored-workspaces\"\n] };\n/\n Check if a permission matches (including wildcard support).\n\n Permission format: `{resource}:{action}[:{resource-id}]`\n\n Examples:\n* - `` matches everything\n - `agents:` matches `agents:read`, `agents:read:my-agent`\n - `:read` matches `agents:read`, `workflows:read` (action across all resources)\n - `agents:read` matches `agents:read`, `agents:read:my-agent`\n* - `agents:read:my-agent` matches only `agents:read:my-agent`\n* - `agents::my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`\n\n* @param userPermission - Permission the user has\n* @param requiredPermission - Permission being checked\n* @returns True if permission matches\n/\nfunction matchesPermission(userPermission, requiredPermission) {\n\tif (userPermission === \"\") return true;\n\tconst grantedParts = userPermission.split(\":\");\n\tconst requiredParts = requiredPermission.split(\":\");\n\tconst expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? \"\"];\n\tif (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? \"\")) return matchesPermission([requiredParts[0], ...grantedParts.slice(1)].join(\":\"), requiredPermission);\n\tif (grantedParts.length < 2 \|\| requiredParts.length < 2) return userPermission === requiredPermission;\n\tconst [grantedResource, grantedAction, grantedId] = grantedParts;\n\tconst [requiredResource, requiredAction, requiredId] = requiredParts;\n\tif (grantedResource === \"\") {\n\t\tif (grantedAction === \"\") {\n\t\t\tif (grantedId === void 0) return true;\n\t\t\treturn grantedId === requiredId;\n\t\t}\n\t\tif (grantedAction !== requiredAction) return false;\n\t\tif (grantedId === void 0) return true;\n\t\treturn grantedId === requiredId;\n\t}\n\tif (grantedResource !== requiredResource) return false;\n\tif (grantedAction === \"\") {\n\t\tif (grantedId === void 0) return true;\n\t\treturn grantedId === requiredId;\n\t}\n\tif (grantedAction !== requiredAction) return false;\n\tif (grantedId === void 0) return true;\n\treturn grantedId === requiredId;\n}\n/\n Check if a user has a specific permission.\n\n @param userPermissions - Permissions the user has\n* @param requiredPermission - Permission being checked\n* @returns True if user has the permission\n/\nfunction hasPermission(userPermissions, requiredPermission) {\n\treturn userPermissions.some((p) => matchesPermission(p, requiredPermission));\n}\n/\n Resolve permissions from user roles using a role mapping.\n\n This function translates provider-defined roles (from WorkOS, Okta, etc.)\n* to Mastra permissions using a configurable mapping.\n\n @example\n* ```typescript\n* const roleMapping = {\n* \"Engineering\": [\"agents:\", \"workflows:\"],\n* \"Product\": [\"agents:read\"],\n* \"_default\": [],\n* };\n\n // User has \"Engineering\" and \"QA\" roles\n* const permissions = resolvePermissionsFromMapping(\n* [\"Engineering\", \"QA\"],\n* roleMapping\n* );\n* // Result: [\"agents:\", \"workflows:\"] (QA is unmapped, gets _default)\n* ```\n\n @param roles - User's roles from the identity provider\n* @param mapping - Role to permission mapping\n* @returns Array of resolved permissions\n/\nfunction resolvePermissionsFromMapping(roles, mapping) {\n\tconst permissions = / @__PURE__ / new Set();\n\tconst defaultPerms = mapping[\"_default\"] ?? [];\n\tfor (const role of roles) {\n\t\tconst rolePerms = mapping[role];\n\t\tif (rolePerms) for (const perm of rolePerms) permissions.add(perm);\n\t\telse for (const perm of defaultPerms) permissions.add(perm);\n\t}\n\treturn Array.from(permissions);\n}\n//#endregion\n//#region src/ee/defaults/rbac/static.ts\n/\n Static RBAC provider.\n\n Supports two modes:\n* 1. Role definitions: Use Mastra's native role system with structured roles\n* 2. Role mapping: Directly map provider roles to permissions\n\n @example Using role definitions (Mastra's native system)\n* ```typescript\n* const rbac = new StaticRBACProvider({\n* roles: DEFAULT_ROLES,\n* getUserRoles: (user) => [user.role],\n* });\n* ```\n\n @example Using role mapping (for external providers)\n* ```typescript\n* const rbac = new StaticRBACProvider({\n* roleMapping: {\n* \"Engineering\": [\"agents:\", \"workflows:\"],\n* \"Product\": [\"agents:read\", \"workflows:read\"],\n* \"_default\": [],\n* },\n* getUserRoles: (user) => user.providerRoles,\n* });\n* ```\n\n @example Async role lookup\n* ```typescript\n* const rbac = new StaticRBACProvider({\n* roles: DEFAULT_ROLES,\n* getUserRoles: async (user) => {\n* return db.getUserRoles(user.id);\n* },\n* });\n* ```\n/\nvar StaticRBACProvider = class {\n\troles;\n\t_roleMapping;\n\tgetUserRolesFn;\n\tpermissionCache = / @__PURE__ / new Map();\n\t/* Expose roleMapping for middleware access /\n\tget roleMapping() {\n\t\treturn this._roleMapping;\n\t}\n\tconstructor(options) {\n\t\tif (\"roles\" in options && options.roles) this.roles = options.roles;\n\t\tif (\"roleMapping\" in options && options.roleMapping) this._roleMapping = options.roleMapping;\n\t\tthis.getUserRolesFn = options.getUserRoles;\n\t}\n\tasync getRoles(user) {\n\t\treturn await this.getUserRolesFn(user);\n\t}\n\tasync hasRole(user, role) {\n\t\treturn (await this.getRoles(user)).includes(role);\n\t}\n\tasync getPermissions(user) {\n\t\tconst roleIds = await this.getRoles(user);\n\t\tconst cacheKey = roleIds.sort().join(\",\");\n\t\tconst cached = this.permissionCache.get(cacheKey);\n\t\tif (cached) return cached;\n\t\tlet permissions;\n\t\tif (this._roleMapping) permissions = resolvePermissionsFromMapping(roleIds, this._roleMapping);\n\t\telse if (this.roles) permissions = resolvePermissions(roleIds, this.roles);\n\t\telse permissions = [];\n\t\tthis.permissionCache.set(cacheKey, permissions);\n\t\treturn permissions;\n\t}\n\tasync hasPermission(user, permission) {\n\t\treturn (await this.getPermissions(user)).some((p) => matchesPermission(p, permission));\n\t}\n\tasync hasAllPermissions(user, permissions) {\n\t\tconst userPermissions = await this.getPermissions(user);\n\t\treturn permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));\n\t}\n\tasync hasAnyPermission(user, permissions) {\n\t\tconst userPermissions = await this.getPermissions(user);\n\t\treturn permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));\n\t}\n\t/\n\t Clear the permission cache.\n\t/\n\tclearCache() {\n\t\tthis.permissionCache.clear();\n\t}\n\t/\n\t Get all role definitions.\n\t* Only available when using role definitions mode (not role mapping).\n\t/\n\tgetRoleDefinitions() {\n\t\treturn this.roles ?? [];\n\t}\n\t/\n\t Get a specific role definition.\n\t* Only available when using role definitions mode (not role mapping).\n\t/\n\tgetRoleDefinition(roleId) {\n\t\treturn this.roles?.find((r) => r.id === roleId);\n\t}\n\t/\n\t Get all available roles in the system.\n\t/\n\tasync getAvailableRoles() {\n\t\tif (this.roles) return this.roles.map((r) => ({\n\t\t\tid: r.id,\n\t\t\tname: r.name\n\t\t}));\n\t\tif (this._roleMapping) return Object.keys(this._roleMapping).filter((k) => k !== \"_default\").map((k) => ({\n\t\t\tid: k,\n\t\t\tname: k\n\t\t}));\n\t\treturn [];\n\t}\n\t/\n\t Get the resolved permissions for a specific role.\n\t/\n\tasync getPermissionsForRole(roleId) {\n\t\tif (this._roleMapping) return resolvePermissionsFromMapping([roleId], this._roleMapping);\n\t\tif (this.roles) return resolvePermissions([roleId], this.roles);\n\t\treturn [];\n\t}\n};\n//#endregion\n//#region src/ee/index.ts\n/\n @mastra/core/auth/ee\n\n Enterprise authentication capabilities for Mastra.\n* This code is licensed under the Mastra Enterprise License - see ee/LICENSE.\n\n @license Mastra Enterprise License - see ee/LICENSE\n* @packageDocumentation\n/\n//#endregion\nexport { validatePermissions as S, MastraFGAPermissions as _, matchesPermission as a, RESOURCES as b, FGADeniedError as c, getAgentToolFGAResourceId as d, getMCPToolFGAResourceId as f, ACTIONS as g, requireFGA as h, hasPermission as i, checkFGA as l, getWorkflowFGAResourceId as m, DEFAULT_ROLES as n, resolvePermissions as o, getStandaloneToolFGAResourceId as p, getDefaultRole as r, resolvePermissionsFromMapping as s, StaticRBACProvider as t, getAgentFGAResourceId as u, PERMISSIONS as v, isValidPermissionPattern as x, PERMISSION_PATTERNS as y };\n\n//# sourceMappingURL=ee-C8o0LZ3r.js.map","import { Transform } from \"stream\";\n//#region src/logger/index.ts\nconst RegisteredLogger = {\n\tAGENT: \"AGENT\",\n\tOBSERVABILITY: \"OBSERVABILITY\",\n\tAUTH: \"AUTH\",\n\tBROWSER: \"BROWSER\",\n\tNETWORK: \"NETWORK\",\n\tWORKFLOW: \"WORKFLOW\",\n\tLLM: \"LLM\",\n\tTTS: \"TTS\",\n\tVOICE: \"VOICE\",\n\tVECTOR: \"VECTOR\",\n\tBUNDLER: \"BUNDLER\",\n\tDEPLOYER: \"DEPLOYER\",\n\tMEMORY: \"MEMORY\",\n\tSTORAGE: \"STORAGE\",\n\tEMBEDDINGS: \"EMBEDDINGS\",\n\tMCP_SERVER: \"MCP_SERVER\",\n\tSERVER_CACHE: \"SERVER_CACHE\",\n\tSERVER: \"SERVER\",\n\tWORKSPACE: \"WORKSPACE\",\n\tCHANNEL: \"CHANNEL\"\n};\nconst LogLevel = {\n\tDEBUG: \"debug\",\n\tINFO: \"info\",\n\tWARN: \"warn\",\n\tERROR: \"error\",\n\tNONE: \"silent\"\n};\nvar LoggerTransport = class extends Transform {\n\tconstructor(opts = {}) {\n\t\tsuper({\n\t\t\t...opts,\n\t\t\tobjectMode: true\n\t\t});\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogs(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args?.page ?? 1,\n\t\t\tperPage: _args?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nconst createCustomTransport = (stream, listLogs, listLogsByRunId) => {\n\tlet transport = stream;\n\tif (listLogs) transport.listLogs = listLogs;\n\tif (listLogsByRunId) transport.listLogsByRunId = listLogsByRunId;\n\treturn transport;\n};\nvar MastraLogger = class {\n\tname;\n\tlevel;\n\ttransports;\n\tconstructor(options = {}) {\n\t\tthis.name = options.name \|\| \"Mastra\";\n\t\tthis.level = options.level \|\| LogLevel.ERROR;\n\t\tthis.transports = new Map(Object.entries(options.transports \|\| {}));\n\t}\n\tgetTransports() {\n\t\treturn this.transports;\n\t}\n\ttrackException(_error, _metadata) {}\n\tasync listLogs(transportId, params) {\n\t\tif (!transportId \|\| !this.transports.has(transportId)) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogs?.(params) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: params?.page ?? 1,\n\t\t\tperPage: params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {\n\t\tif (!transportId \|\| !this.transports.has(transportId) \|\| !runId) return {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t\treturn this.transports.get(transportId).listLogsByRunId?.({\n\t\t\trunId,\n\t\t\tfromDate,\n\t\t\ttoDate,\n\t\t\tlogLevel,\n\t\t\tfilters,\n\t\t\tpage,\n\t\t\tperPage\n\t\t}) ?? {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: page ?? 1,\n\t\t\tperPage: perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\nvar ConsoleLogger = class ConsoleLogger extends MastraLogger {\n\tcomponent;\n\tfilter;\n\tconstructor(options = {}) {\n\t\tsuper(options);\n\t\tthis.component = options.component;\n\t\tthis.filter = options.filter;\n\t}\n\tchild(componentOrBindings) {\n\t\tconst component = typeof componentOrBindings === \"string\" ? componentOrBindings : componentOrBindings?.component ?? this.component;\n\t\treturn new ConsoleLogger({\n\t\t\tname: this.name,\n\t\t\tlevel: this.level,\n\t\t\tcomponent,\n\t\t\tfilter: this.filter\n\t\t});\n\t}\n\tshouldLog(level, message, args) {\n\t\tif (!this.filter) return true;\n\t\ttry {\n\t\t\treturn this.filter({\n\t\t\t\tcomponent: this.component,\n\t\t\t\tlevel,\n\t\t\t\tmessage,\n\t\t\t\targs\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tconsole.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n\t\t\treturn true;\n\t\t}\n\t}\n\tprefix() {\n\t\treturn this.component ? `[${this.component}] ` : \"\";\n\t}\n\tdebug(message, ...args) {\n\t\tif (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...args);\n\t}\n\tinfo(message, ...args) {\n\t\tif ((this.level === LogLevel.INFO \|\| this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...args);\n\t}\n\twarn(message, ...args) {\n\t\tif ((this.level === LogLevel.WARN \|\| this.level === LogLevel.INFO \|\| this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...args);\n\t}\n\terror(message, ...args) {\n\t\tif ((this.level === LogLevel.ERROR \|\| this.level === LogLevel.WARN \|\| this.level === LogLevel.INFO \|\| this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...args);\n\t}\n\tasync listLogs(_transportId, _params) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _params?.page ?? 1,\n\t\t\tperPage: _params?.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n\tasync listLogsByRunId(_args) {\n\t\treturn {\n\t\t\tlogs: [],\n\t\t\ttotal: 0,\n\t\t\tpage: _args.page ?? 1,\n\t\t\tperPage: _args.perPage ?? 100,\n\t\t\thasMore: false\n\t\t};\n\t}\n};\n//#endregion\nexport { ConsoleLogger, LogLevel, LoggerTransport, MastraLogger, RegisteredLogger, createCustomTransport };\n\n//# sourceMappingURL=index.js.map","import { ConsoleLogger, RegisteredLogger } from \"../logger/index.js\";\n//#region src/base/MastraBase.ts\nvar MastraBase = class {\n\tcomponent = RegisteredLogger.LLM;\n\tlogger;\n\tname;\n\t#rawConfig;\n\tconstructor({ component, name, rawConfig }) {\n\t\tthis.component = component \|\| RegisteredLogger.LLM;\n\t\tthis.name = name;\n\t\tthis.#rawConfig = rawConfig;\n\t\tthis.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n\t}\n\t/\n\t Returns the raw storage configuration this primitive was created from,\n\t* or undefined if it was created from code.\n\t/\n\ttoRawConfig() {\n\t\treturn this.#rawConfig;\n\t}\n\t/\n\t Sets the raw storage configuration for this primitive.\n\t* @internal\n\t/\n\t__setRawConfig(rawConfig) {\n\t\tthis.#rawConfig = rawConfig;\n\t}\n\t/\n\t Set the logger for the agent\n\t* @param logger\n\t/\n\t__setLogger(logger) {\n\t\tthis.logger = \"child\" in logger && typeof logger.child === \"function\" ? logger.child({ component: this.component }) : logger;\n\t}\n};\n//#endregion\nexport { MastraBase };\n\n//# sourceMappingURL=index.js.map","import { getRequestHeader } from \"../types/index.js\";\nimport { MastraBase } from \"@internal/core/base\";\n//#region src/provider/index.ts\nvar MastraAuthProvider = class extends MastraBase {\n\tprotected;\n\tpublic;\n\tconstructor(options) {\n\t\tsuper({\n\t\t\tcomponent: \"AUTH\",\n\t\t\tname: options?.name\n\t\t});\n\t\tif (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);\n\t\tthis.protected = options?.protected;\n\t\tthis.public = options?.public;\n\t\tthis.mapUserToResourceId = options?.mapUserToResourceId;\n\t}\n\tregisterOptions(opts) {\n\t\tif (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);\n\t\tif (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;\n\t\tif (opts?.protected) this.protected = opts.protected;\n\t\tif (opts?.public) this.public = opts.public;\n\t}\n};\nfunction isSSOProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getLoginUrl === \"function\" && typeof p.handleCallback === \"function\";\n}\nfunction isSessionProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.validateSession === \"function\" && typeof p.createSession === \"function\";\n}\nfunction isUserProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.getCurrentUser === \"function\";\n}\nfunction isCredentialsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.signIn === \"function\";\n}\nfunction isOrganizationsProvider(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.ensureOrganization === \"function\" && typeof p.isOrganizationAdmin === \"function\";\n}\nfunction isAuthHttpHandler(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.handleAuthRequest === \"function\";\n}\nfunction hasAuthInit(p) {\n\treturn p !== null && typeof p === \"object\" && typeof p.init === \"function\";\n}\nfunction isObjectLike(value) {\n\treturn typeof value === \"object\" && value !== null \|\| typeof value === \"function\";\n}\nvar CompositeAuth = class extends MastraAuthProvider {\n\tproviders;\n\tauthenticatedProviderByObject = / @__PURE__ / new WeakMap();\n\tauthenticatedProviderByPrimitive = / @__PURE__ / new Map();\n\tconstructor(providers) {\n\t\tconst combinedPublic = providers.flatMap((provider) => provider.public ?? []);\n\t\tconst combinedProtected = providers.flatMap((provider) => provider.protected ?? []);\n\t\tsuper({\n\t\t\tpublic: combinedPublic,\n\t\t\tprotected: combinedProtected\n\t\t});\n\t\tthis.providers = providers;\n\t\tif (providers.some((provider) => typeof provider.mapUserToResourceId === \"function\")) this.mapUserToResourceId = (user) => this.mapAuthenticatedUserToResourceId(user);\n\t\tif (!providers.some(isSSOProvider)) {\n\t\t\tthis.getLoginUrl = void 0;\n\t\t\tthis.handleCallback = void 0;\n\t\t\tthis.getLoginButtonConfig = void 0;\n\t\t}\n\t\tif (!providers.some(isSessionProvider)) {\n\t\t\tthis.createSession = void 0;\n\t\t\tthis.validateSession = void 0;\n\t\t\tthis.getSessionIdFromRequest = void 0;\n\t\t}\n\t\tif (!providers.some(isUserProvider)) {\n\t\t\tthis.getCurrentUser = void 0;\n\t\t\tthis.getUser = void 0;\n\t\t\tthis.getUsers = void 0;\n\t\t}\n\t\tconst credProvider = providers.find(isCredentialsProvider);\n\t\tif (credProvider) {\n\t\t\tthis.signIn = credProvider.signIn.bind(credProvider);\n\t\t\tif (typeof credProvider.signUp === \"function\") this.signUp = credProvider.signUp.bind(credProvider);\n\t\t\tif (typeof credProvider.requestPasswordReset === \"function\") this.requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n\t\t\tif (typeof credProvider.resetPassword === \"function\") this.resetPassword = credProvider.resetPassword.bind(credProvider);\n\t\t\tthis.isSignUpEnabled = typeof credProvider.isSignUpEnabled === \"function\" ? credProvider.isSignUpEnabled.bind(credProvider) : () => true;\n\t\t} else {\n\t\t\tthis.signIn = void 0;\n\t\t\tthis.signUp = void 0;\n\t\t\tthis.requestPasswordReset = void 0;\n\t\t\tthis.resetPassword = void 0;\n\t\t\tthis.isSignUpEnabled = void 0;\n\t\t}\n\t}\n\tfindProvider(check) {\n\t\treturn this.providers.find(check);\n\t}\n\trememberAuthenticatedProvider(user, provider) {\n\t\tif (isObjectLike(user)) {\n\t\t\tthis.authenticatedProviderByObject.set(user, provider);\n\t\t\treturn;\n\t\t}\n\t\tthis.authenticatedProviderByPrimitive.set(user, provider);\n\t}\n\ttakeAuthenticatedProvider(user) {\n\t\tif (isObjectLike(user)) {\n\t\t\tconst provider = this.authenticatedProviderByObject.get(user);\n\t\t\tthis.authenticatedProviderByObject.delete(user);\n\t\t\treturn provider;\n\t\t}\n\t\tconst primitiveUser = user;\n\t\tconst provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n\t\tthis.authenticatedProviderByPrimitive.delete(primitiveUser);\n\t\treturn provider;\n\t}\n\tmapAuthenticatedUserToResourceId(user) {\n\t\treturn this.takeAuthenticatedProvider(user)?.mapUserToResourceId?.(user);\n\t}\n\t/\n\t True if any provider is MastraCloudAuth (exempt from license requirement).\n\t/\n\tget isMastraCloudAuth() {\n\t\treturn this.providers.some((p) => \"isMastraCloudAuth\" in p && p.isMastraCloudAuth === true);\n\t}\n\t/\n\t True if any provider is SimpleAuth (exempt from license requirement).\n\t/\n\tget isSimpleAuth() {\n\t\treturn this.providers.some((p) => \"isSimpleAuth\" in p && p.isSimpleAuth === true);\n\t}\n\tasync authenticateToken(token, request) {\n\t\tfor (const provider of this.providers) try {\n\t\t\tconst user = await provider.authenticateToken(token, request);\n\t\t\tif (user) {\n\t\t\t\tthis.rememberAuthenticatedProvider(user, provider);\n\t\t\t\treturn user;\n\t\t\t}\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync authorizeUser(user, request) {\n\t\tfor (const provider of this.providers) if (await provider.authorizeUser(user, request)) return true;\n\t\treturn false;\n\t}\n\t/\n\t Forward cookie header to SSO provider for PKCE validation.\n\t* Called by auth handler before handleCallback().\n\t/\n\tsetCallbackCookieHeader(cookieHeader) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (sso && typeof sso.setCallbackCookieHeader === \"function\") sso.setCallbackCookieHeader(cookieHeader);\n\t}\n\tgetLoginUrl(redirectUri, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.getLoginUrl(redirectUri, state);\n\t}\n\tgetLoginCookies(redirectUri, state) {\n\t\treturn this.findProvider(isSSOProvider)?.getLoginCookies?.(redirectUri, state);\n\t}\n\tasync handleCallback(code, state) {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) throw new Error(\"No SSO provider configured in CompositeAuth\");\n\t\treturn sso.handleCallback(code, state);\n\t}\n\tgetLoginButtonConfig() {\n\t\tconst sso = this.findProvider(isSSOProvider);\n\t\tif (!sso) return {\n\t\t\tprovider: \"unknown\",\n\t\t\ttext: \"Sign in\"\n\t\t};\n\t\treturn sso.getLoginButtonConfig();\n\t}\n\tasync getLogoutUrl(redirectUri, request) {\n\t\tfor (const provider of this.providers) if (isSSOProvider(provider) && provider.getLogoutUrl) try {\n\t\t\tconst url = await provider.getLogoutUrl(redirectUri, request);\n\t\t\tif (url) return url;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync createSession(userId, metadata) {\n\t\tconst session = this.findProvider(isSessionProvider);\n\t\tif (!session) throw new Error(\"No session provider configured in CompositeAuth\");\n\t\treturn session.createSession(userId, metadata);\n\t}\n\tasync validateSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.validateSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync destroySession(sessionId) {\n\t\tconst destroyPromises = [];\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) destroyPromises.push(provider.destroySession(sessionId).catch(() => {}));\n\t\tawait Promise.all(destroyPromises);\n\t}\n\tasync refreshSession(sessionId) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst session = await provider.refreshSession(sessionId);\n\t\t\tif (session) return session;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionIdFromRequest(request) {\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst sessionId = provider.getSessionIdFromRequest(request);\n\t\t\tif (sessionId) return sessionId;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tgetSessionHeaders(session) {\n\t\treturn this.findProvider(isSessionProvider)?.getSessionHeaders(session) ?? {};\n\t}\n\tgetClearSessionHeaders() {\n\t\tconst headers = {};\n\t\tfor (const provider of this.providers) if (isSessionProvider(provider)) try {\n\t\t\tconst providerHeaders = provider.getClearSessionHeaders();\n\t\t\tObject.assign(headers, providerHeaders);\n\t\t} catch {}\n\t\treturn headers;\n\t}\n\tasync getCurrentUser(request) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getCurrentUser(request);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUser(userId) {\n\t\tfor (const provider of this.providers) if (isUserProvider(provider)) try {\n\t\t\tconst user = await provider.getUser(userId);\n\t\t\tif (user) return user;\n\t\t} catch {}\n\t\treturn null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn Promise.all(userIds.map((userId) => this.getUser(userId)));\n\t}\n};\nconst DEFAULT_HEADERS = [\"Authorization\", \"X-Playground-Access\"];\nvar SimpleAuth = class extends MastraAuthProvider {\n\t/\n\t Marker to exempt SimpleAuth from EE license requirement.\n\t* SimpleAuth is for development/testing and should work without a license.\n\t/\n\tisSimpleAuth = true;\n\ttokens;\n\theaders;\n\tusers;\n\tuserById;\n\tconstructor(options) {\n\t\tsuper(options);\n\t\tthis.tokens = options.tokens;\n\t\tthis.users = Object.values(this.tokens);\n\t\tthis.headers = [...DEFAULT_HEADERS].concat(options.headers \|\| []);\n\t\tthis.userById = new Map(this.users.map((u) => [String(u?.id), u]));\n\t}\n\tasync authenticateToken(token, request) {\n\t\tconst requestTokens = this.getTokensFromHeaders(token, request);\n\t\tfor (const requestToken of requestTokens) {\n\t\t\tconst tokenToUser = this.tokens[requestToken];\n\t\t\tif (tokenToUser) return tokenToUser;\n\t\t}\n\t\treturn this.getUserFromCookie(getRequestHeader(request, \"Cookie\"));\n\t}\n\tasync authorizeUser(user, _request) {\n\t\treturn this.users.includes(user);\n\t}\n\t/* Get current user from request headers or cookie. /\n\tasync getCurrentUser(request) {\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = request.headers.get(headerName);\n\t\t\tif (headerValue) {\n\t\t\t\tconst token = this.stripBearerPrefix(headerValue);\n\t\t\t\tconst user = this.tokens[token];\n\t\t\t\tif (user) return user;\n\t\t\t}\n\t\t}\n\t\treturn this.getUserFromCookie(request.headers.get(\"Cookie\"));\n\t}\n\tgetUserFromCookie(cookieHeader) {\n\t\tif (!cookieHeader) return null;\n\t\tconst cookies = cookieHeader.split(\";\").map((c) => c.trim());\n\t\tfor (const cookie of cookies) if (cookie.startsWith(\"mastra-token=\")) {\n\t\t\tconst token = cookie.slice(13);\n\t\t\tconst user = this.tokens[token];\n\t\t\tif (user) return user;\n\t\t}\n\t\treturn null;\n\t}\n\t/* Get user by ID. /\n\tasync getUser(userId) {\n\t\treturn this.userById.get(userId) ?? null;\n\t}\n\tasync getUsers(userIds) {\n\t\treturn userIds.map((userId) => this.userById.get(userId) ?? null);\n\t}\n\t/\n\t Sign in with token (passed as password field).\n\t* The email field is ignored - only the token matters.\n\t/\n\tasync signIn(_email, password, _request) {\n\t\tconst token = password;\n\t\tconst user = this.tokens[token];\n\t\tif (!user) throw new Error(\"Invalid token\");\n\t\treturn {\n\t\t\tuser,\n\t\t\ttoken,\n\t\t\tcookies: [`mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`]\n\t\t};\n\t}\n\tasync signUp() {\n\t\tthrow new Error(\"Sign up is not supported with SimpleAuth. Use pre-configured tokens.\");\n\t}\n\tisSignUpEnabled() {\n\t\treturn false;\n\t}\n\t/\n\t Get headers to clear the session cookie on logout.\n\t* Partial ISessionProvider implementation for logout support.\n\t/\n\tgetClearSessionHeaders() {\n\t\treturn { \"Set-Cookie\": \"mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\" };\n\t}\n\tstripBearerPrefix(token) {\n\t\treturn token.startsWith(\"Bearer \") ? token.slice(7) : token;\n\t}\n\tgetTokensFromHeaders(token, request) {\n\t\tconst tokens = [token];\n\t\tfor (const headerName of this.headers) {\n\t\t\tconst headerValue = getRequestHeader(request, headerName);\n\t\t\tif (headerValue) tokens.push(this.stripBearerPrefix(headerValue));\n\t\t}\n\t\treturn tokens;\n\t}\n};\n//#endregion\nexport { CompositeAuth, MastraAuthProvider, SimpleAuth, hasAuthInit, isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider };\n\n//# sourceMappingURL=index.js.map","import { createHash } from 'node:crypto';\n\nimport type {\n IOrganizationsProvider,\n ISSOProvider,\n ISessionProvider,\n IUserProvider,\n Session,\n SSOCallbackResult,\n SSOLoginConfig,\n} from '@internal/auth';\nimport type { EEUser, IRBACProvider, RoleMapping } from '@internal/auth/ee';\nimport { resolvePermissionsFromMapping, matchesPermission } from '@internal/auth/ee';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\n\ntype HonoRequestLike = {\n raw?: Request;\n headers?: Headers;\n header(name: string): string \| undefined;\n};\n\ntype MastraAuthRequest = Request \| HonoRequestLike;\n\nfunction getRequestHeader(request: MastraAuthRequest, name: string): string \| null {\n if (request instanceof Request) {\n return request.headers.get(name);\n }\n\n return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;\n}\n\nexport interface StudioUser extends EEUser {\n id: string;\n email?: string;\n name?: string;\n avatarUrl?: string;\n organizationId?: string;\n role?: string;\n permissions?: string[];\n /* All organization IDs the user is a member of (for cross-org access checks) /\n memberOrgIds?: string[];\n}\n\nexport interface MastraAuthStudioOptions extends MastraAuthProviderOptions<StudioUser> {\n /* Base URL of the Mastra shared API (e.g., https://api.mastra.ai/v1) /\n sharedApiUrl?: string;\n /* Organization ID that owns this deployed instance. Users not in this org are rejected. /\n organizationId?: string;\n /\n Cookie domain for session cookies (e.g., '.example.com').\n * When set, cookies will include Secure and Domain attributes.\n * Defaults to auto-detecting from sharedApiUrl (uses '.mastra.ai' when sharedApiUrl contains '.mastra.ai').\n * Can also be set via MASTRA_COOKIE_DOMAIN environment variable.\n /\n cookieDomain?: string;\n}\n\nconst COOKIE_NAME = 'wos-session';\n\n/\n Upper bound for shared-API verification fetches. Matches the platform API\n * client's request budget: a slow shared API must fail a single request in\n * bounded time instead of hanging every authenticated endpoint behind it.\n /\nconst VERIFY_FETCH_TIMEOUT_MS = 15_000;\n\n/\n How long a successful credential verification may be reused without\n * re-contacting the shared API. Bounds revocation lag: a signed-out or\n * revoked session can be honored for at most this long.\n /\nconst VERIFY_CACHE_TTL_MS = 30_000;\n\n/\n Auth provider for Mastra Studio deployed instances.\n \n Proxies all authentication through the shared API, keeping the\n * WorkOS API key safely in the shared API. Deployed instances only\n * need the shared API URL — no secrets required.\n \n The shared API's sealed session cookie (`wos-session`) is set with\n * `Domain=.mastra.ai` in production, so it's included in requests\n * to deployed instances and can be forwarded for validation.\n /\nexport class MastraAuthStudio\n extends MastraAuthProvider<StudioUser>\n implements ISSOProvider<StudioUser>, ISessionProvider<Session>, IUserProvider<StudioUser>, IOrganizationsProvider\n{\n readonly isMastraCloudAuth = true;\n\n private sharedApiUrl: string;\n private organizationId: string \| undefined;\n private useProductionCookies: boolean;\n private cookieDomain: string \| undefined;\n /\n `userId → sealed session cookie` cache. The `IOrganizationsProvider`\n * interface only hands us a `userId`, but the shared API's org endpoints are\n * cookie-authenticated — so we remember the cookie last seen for a user\n * inside `verifySessionCookie` and reuse it here. Kept small: bounded to\n * the last 1000 users, LRU-evicted on insert.\n /\n private userSessionCookies = new Map<string, string>();\n private readonly maxCachedSessions = 1000;\n\n /\n Short-TTL cache of SUCCESSFUL credential verifications, keyed by a\n * sha256 of the credential (never the raw cookie/token). Every protected\n * request re-verifies against the shared API otherwise — one network\n * round trip per request. Failures are never cached, so a rejected\n * credential is always re-checked. Bounded + insert-order evicted.\n /\n private verifiedCredentials = new Map<string, { user: StudioUser; expiresAt: number }>();\n private readonly maxCachedVerifications = 1000;\n\n /\n In-flight `ensureOrganization` promises keyed by userId. Concurrent calls\n * for the same brand-new user (multiple tabs, parallel requests) would\n * otherwise all see \"no org\" from `GET /auth/me` and each fire\n * `POST /auth/orgs`, creating duplicate personal organizations. The first\n * caller's promise is reused by every follower until it settles.\n /\n private organizationBootstrapInFlight = new Map<string, Promise<string \| undefined>>();\n\n constructor(options?: MastraAuthStudioOptions) {\n super({ name: 'mastra-studio', ...options });\n const explicitSharedApiUrl = options?.sharedApiUrl \|\| process.env.MASTRA_SHARED_API_URL;\n this.sharedApiUrl = explicitSharedApiUrl \|\| 'https://platform.mastra.ai/v1';\n this.organizationId = options?.organizationId \|\| process.env.MASTRA_ORGANIZATION_ID;\n\n // Strip trailing slash\n if (this.sharedApiUrl.endsWith('/')) {\n this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);\n }\n\n // Cookie domain can be explicitly configured, read from env, or auto-detected from sharedApiUrl\n this.cookieDomain = options?.cookieDomain \|\| process.env.MASTRA_COOKIE_DOMAIN;\n\n // Use production cookie settings (Secure + Domain) when:\n // 1. An explicit cookieDomain is configured, OR\n // 2. The shared API is explicitly* configured on .mastra.ai (auto-detect\n // default domain). The built-in platform.mastra.ai fallback doesn't\n // count — a localhost studio using the default would otherwise mint\n // Domain=.mastra.ai cookies the browser rejects.\n // Use hostname-based detection to avoid false positives (e.g., api.mastra.ai.evil.com)\n let autoDetectMastraAi = false;\n if (explicitSharedApiUrl) {\n try {\n const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();\n autoDetectMastraAi = hostname === 'mastra.ai' \|\| hostname.endsWith('.mastra.ai');\n } catch {\n autoDetectMastraAi = false;\n }\n }\n this.useProductionCookies = !!this.cookieDomain \|\| autoDetectMastraAi;\n\n // If no explicit domain but we're on .mastra.ai, use the default domain\n if (!this.cookieDomain && autoDetectMastraAi) {\n this.cookieDomain = '.mastra.ai';\n }\n\n if (options) {\n this.registerOptions(options);\n }\n }\n\n // ---------------------------------------------------------------------------\n // MastraAuthProvider abstract methods\n // ---------------------------------------------------------------------------\n\n /*\n Authenticate an incoming request by forwarding the sealed session cookie\n * to the shared API's /auth/me endpoint, or a Bearer token to /auth/verify.\n /\n async authenticateToken(token: string, request: MastraAuthRequest): Promise<StudioUser \| null> {\n let user: StudioUser \| null = null;\n\n // Try sealed session cookie first (browser flow)\n const cookieHeader = getRequestHeader(request, 'Cookie');\n const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);\n\n if (sessionCookie) {\n user = await this.verifySessionCookie(sessionCookie);\n }\n\n // Fall back to Bearer token (CLI / API token flow)\n if (!user && token) {\n user = await this.verifyBearerToken(token);\n }\n\n if (!user) return null;\n\n // Org-scoping: if this instance belongs to a specific org, reject users not a member of that org\n // Check memberOrgIds (all orgs user belongs to) rather than organizationId (current org)\n if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) {\n return null;\n }\n\n return user;\n }\n\n authorizeUser(user: StudioUser): boolean {\n return !!user?.id;\n }\n\n // ---------------------------------------------------------------------------\n // ISSOProvider\n // ---------------------------------------------------------------------------\n\n getLoginUrl(redirectUri: string, state: string): string {\n // Extract the post-login redirect from state (format: uuid\|encodedPostLoginRedirect)\n let postLoginRedirect = '/';\n if (state) {\n const pipeIndex = state.indexOf('\|');\n if (pipeIndex !== -1) {\n try {\n postLoginRedirect = decodeURIComponent(state.slice(pipeIndex + 1));\n } catch {\n // ignore decode errors\n }\n }\n }\n\n const params = new URLSearchParams({\n product: 'deploy',\n redirect_uri: redirectUri,\n post_login_redirect: postLoginRedirect,\n // Force re-authentication so AuthKit always shows the account picker\n prompt: 'login',\n ...(this.organizationId ? { organization_id: this.organizationId } : {}),\n });\n\n return `${this.sharedApiUrl}/auth/login?${params.toString()}`;\n }\n\n async handleCallback(code: string, _state: string): Promise<SSOCallbackResult<StudioUser>> {\n // The shared API already consumed the OAuth code and passes the sealed\n // session directly as the `code` parameter in the redirect to this callback.\n // Validate it to get user info.\n this.logger.debug('SSO callback: validating sealed session via shared API', {\n sharedApiUrl: this.sharedApiUrl,\n codeLength: code?.length,\n });\n const user = await this.verifySessionCookie(code);\n if (!user) {\n this.logger.error('SSO callback: session validation failed — verifySessionCookie returned null', {\n sharedApiUrl: this.sharedApiUrl,\n codeLength: code?.length,\n });\n throw new Error('Session validation failed');\n }\n\n // Omit `cookies` so the Mastra server fallback path calls\n // createSession() + getSessionHeaders() to build a cookie scoped to\n // the deployed instance's domain.\n return {\n user,\n tokens: {\n accessToken: code,\n },\n };\n }\n\n setCallbackCookieHeader(_cookieHeader: string \| null): void {\n // No-op: we don't use PKCE cookies — the shared API handles the full OAuth flow\n }\n\n getLoginCookies(): string[] \| undefined {\n // No PKCE cookies needed — shared API manages the OAuth state\n return undefined;\n }\n\n getLoginButtonConfig(): SSOLoginConfig {\n return {\n provider: 'mastra-studio',\n text: 'Sign in with Mastra',\n description:\n 'Your deployed Studio is secured by your Mastra account. Sign in with the same email you used to sign up on mastra.ai.',\n };\n }\n\n async getLogoutUrl(_redirectUri: string, request?: Request): Promise<string \| null> {\n const cookieHeader = request?.headers.get('Cookie');\n const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);\n\n if (!sessionCookie) return null;\n\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/logout`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Cookie: `${COOKIE_NAME}=${sessionCookie}`,\n },\n });\n\n if (res.ok) {\n const data = (await res.json()) as { ok: boolean; logoutUrl?: string };\n return data.logoutUrl ?? null;\n }\n } catch {\n // Failed to get logout URL — return null\n }\n\n return null;\n }\n\n // ---------------------------------------------------------------------------\n // ISessionProvider\n // ---------------------------------------------------------------------------\n\n async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n const now = new Date();\n return {\n id: (metadata?.accessToken as string) \|\| crypto.randomUUID(),\n userId,\n expiresAt: new Date(now.getTime() + 24 60 * 60 * 1000), // 24 hours\n createdAt: now,\n metadata,\n };\n }\n\n async validateSession(sessionId: string): Promise<Session \| null> {\n const user = await this.verifySessionCookie(sessionId);\n if (!user) return null;\n\n const now = new Date();\n return {\n id: sessionId,\n userId: user.id,\n expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1000),\n createdAt: now,\n };\n }\n\n async destroySession(sessionId: string): Promise<void> {\n try {\n await fetch(`${this.sharedApiUrl}/auth/logout`, {\n method: 'POST',\n headers: {\n Cookie: `${COOKIE_NAME}=${sessionId}`,\n },\n });\n } catch {\n // Best effort\n }\n }\n\n async refreshSession(sessionId: string): Promise<Session \| null> {\n try {\n // Call the shared API's /auth/refresh endpoint to get a fresh access token\n const res = await fetch(`${this.sharedApiUrl}/auth/refresh`, {\n method: 'GET',\n headers: {\n Cookie: `${COOKIE_NAME}=${sessionId}`,\n },\n });\n\n if (!res.ok) {\n this.logger.warn('refreshSession: shared API refresh returned non-OK status', {\n status: res.status,\n url: `${this.sharedApiUrl}/auth/refresh`,\n });\n // Refresh failed, fall back to validation (will likely also fail)\n return this.validateSession(sessionId);\n }\n\n // Parse the new sealed session from Set-Cookie header\n const setCookie = res.headers.get('Set-Cookie');\n const newSessionId = setCookie ? parseCookieFromHeader(setCookie, COOKIE_NAME) : null;\n\n if (!newSessionId) {\n this.logger.warn('refreshSession: no Set-Cookie header in refresh response');\n // No new cookie returned, fall back to validation with original\n return this.validateSession(sessionId);\n }\n\n // Verify the new session works and return it\n const user = await this.verifySessionCookie(newSessionId);\n if (!user) return null;\n\n const now = new Date();\n return {\n id: newSessionId,\n userId: user.id,\n expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1000),\n createdAt: now,\n };\n } catch (error) {\n this.logger.error('refreshSession: fetch to shared API failed', {\n url: `${this.sharedApiUrl}/auth/refresh`,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n // On error, fall back to validation\n return this.validateSession(sessionId);\n }\n }\n\n getSessionIdFromRequest(request: Request): string \| null {\n const cookieHeader = request.headers.get('Cookie');\n return parseCookie(cookieHeader, COOKIE_NAME);\n }\n\n getSessionHeaders(session: Session): Record<string, string> {\n const parts = [`${COOKIE_NAME}=${session.id}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', 'Max-Age=86400'];\n if (this.useProductionCookies && this.cookieDomain) {\n parts.push('Secure');\n parts.push(`Domain=${this.cookieDomain}`);\n }\n return { 'Set-Cookie': parts.join('; ') };\n }\n\n getClearSessionHeaders(): Record<string, string> {\n const parts = [`${COOKIE_NAME}=`, 'HttpOnly', 'SameSite=Lax', 'Path=/', 'Max-Age=0'];\n if (this.useProductionCookies && this.cookieDomain) {\n parts.push('Secure');\n parts.push(`Domain=${this.cookieDomain}`);\n }\n return { 'Set-Cookie': parts.join('; ') };\n }\n\n // ---------------------------------------------------------------------------\n // IUserProvider\n // ---------------------------------------------------------------------------\n\n async getCurrentUser(request: Request): Promise<StudioUser \| null> {\n const cookieHeader = request.headers.get('Cookie');\n const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);\n\n if (sessionCookie) {\n return this.verifySessionCookie(sessionCookie);\n }\n\n // Try bearer token\n const authHeader = request.headers.get('Authorization');\n if (authHeader?.startsWith('Bearer ')) {\n return this.verifyBearerToken(authHeader.slice(7));\n }\n\n return null;\n }\n\n async getUser(_userId: string): Promise<StudioUser \| null> {\n // Cannot look up users by ID — only validate sessions\n return null;\n }\n\n // ---------------------------------------------------------------------------\n // IOrganizationsProvider\n // ---------------------------------------------------------------------------\n\n /*\n Ensure the user belongs to an organization, bootstrapping a personal org\n * on first use when they have none.\n \n Because the shared API's org endpoints are cookie-authenticated but this\n * method only receives a userId, we look up the user's sealed session cookie\n * from the {@link userSessionCookies} cache populated by\n * {@link verifySessionCookie}. If we have never seen a cookie for this user\n * (e.g. bearer-token flow, or the cache was evicted), we skip bootstrap and\n * return `undefined` — the caller keeps the user in their current no-org\n * state and the next authenticated request retries.\n \n Best-effort: any shared-API failure returns `undefined` rather than\n * throwing, mirroring `MastraAuthWorkos.ensureOrganization`.\n /\n async ensureOrganization(userId: string): Promise<string \| undefined> {\n // Dedupe concurrent bootstraps for the same user — otherwise parallel tabs\n // for a brand-new user each POST /auth/orgs and create duplicate personal\n // organizations.\n const inFlight = this.organizationBootstrapInFlight.get(userId);\n if (inFlight) return inFlight;\n\n const bootstrap = this.doEnsureOrganization(userId).finally(() => {\n this.organizationBootstrapInFlight.delete(userId);\n });\n this.organizationBootstrapInFlight.set(userId, bootstrap);\n return bootstrap;\n }\n\n private async doEnsureOrganization(userId: string): Promise<string \| undefined> {\n const sessionCookie = this.userSessionCookies.get(userId);\n if (!sessionCookie) {\n this.logger.debug('ensureOrganization: no cached session cookie for user; skipping bootstrap', { userId });\n return undefined;\n }\n\n try {\n // Check /auth/me first — the session may already carry an organizationId\n // (existing user) or memberOrgIds we can pick from (multi-org user with\n // no active selection).\n const me = await this.fetchMe(sessionCookie);\n if (me?.organizationId) return me.organizationId;\n if (me?.memberOrgIds && me.memberOrgIds.length > 0) return me.memberOrgIds[0];\n\n // No org anywhere → create a personal org. The shared API auto-switches\n // the session cookie to the new org, but the browser holds the sealed\n // cookie, not us, so we can't update it in-place. Next validated request\n // will observe the new org via /auth/me.\n const orgName = me?.user?.email ? `${me.user.email}'s org` : `Personal (${userId})`;\n const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Cookie: `${COOKIE_NAME}=${sessionCookie}`,\n },\n body: JSON.stringify({ name: orgName }),\n });\n\n if (!res.ok) {\n this.logger.warn('ensureOrganization: shared API POST /auth/orgs returned non-OK', {\n status: res.status,\n userId,\n });\n return undefined;\n }\n\n const data = (await res.json()) as { organization?: { id?: string } };\n return data.organization?.id;\n } catch (error) {\n this.logger.error('ensureOrganization: fetch to shared API failed', {\n userId,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n return undefined;\n }\n }\n\n /\n Whether the user holds an admin-equivalent role in the organization.\n \n Fast path: if the org matches the user's currently-active session org, we\n * read the role directly from `/auth/me`. Cross-org path: we call\n * `/auth/orgs` (which returns per-membership roles) and look up the target\n * org. Any shared-API failure resolves to `false`.\n /\n async isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean> {\n const sessionCookie = this.userSessionCookies.get(userId);\n if (!sessionCookie) return false;\n\n try {\n const me = await this.fetchMe(sessionCookie);\n if (me?.organizationId === organizationId) {\n return isAdminRole(me.role);\n }\n\n // Not the active org — fall back to /auth/orgs for the per-org role.\n const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {\n headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },\n });\n if (!res.ok) return false;\n\n const data = (await res.json()) as {\n organizations?: Array<{ id: string; role?: string \| null }>;\n };\n const membership = data.organizations?.find(o => o.id === organizationId);\n return isAdminRole(membership?.role ?? undefined);\n } catch {\n return false;\n }\n }\n\n // ---------------------------------------------------------------------------\n // Internal helpers\n // ---------------------------------------------------------------------------\n\n /\n Record the sealed session cookie last seen for a user so\n * {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their\n * behalf. LRU-evicted at {@link maxCachedSessions} entries.\n /\n private rememberUserSession(userId: string, sessionCookie: string): void {\n // Refresh recency by re-inserting.\n this.userSessionCookies.delete(userId);\n this.userSessionCookies.set(userId, sessionCookie);\n if (this.userSessionCookies.size > this.maxCachedSessions) {\n const oldest = this.userSessionCookies.keys().next().value;\n if (oldest !== undefined) this.userSessionCookies.delete(oldest);\n }\n }\n\n /* Cache key for a verified credential — hash, never the raw secret. /\n private verificationKey(kind: 'cookie' \| 'bearer', credential: string): string {\n return createHash('sha256').update(`${kind}:${credential}`).digest('hex');\n }\n\n private getCachedVerification(key: string): StudioUser \| null {\n const entry = this.verifiedCredentials.get(key);\n if (!entry) return null;\n if (entry.expiresAt <= Date.now()) {\n this.verifiedCredentials.delete(key);\n return null;\n }\n return entry.user;\n }\n\n private cacheVerification(key: string, user: StudioUser): void {\n this.verifiedCredentials.delete(key);\n this.verifiedCredentials.set(key, { user, expiresAt: Date.now() + VERIFY_CACHE_TTL_MS });\n if (this.verifiedCredentials.size > this.maxCachedVerifications) {\n const oldest = this.verifiedCredentials.keys().next().value;\n if (oldest !== undefined) this.verifiedCredentials.delete(oldest);\n }\n }\n\n /\n Fetch the shared API's `/auth/me` and return the raw response body, or\n * `null` on any non-OK / network error. Split out so `ensureOrganization`\n * and `isOrganizationAdmin` can reuse it without duplicating the shape.\n /\n private async fetchMe(sessionCookie: string): Promise<{\n user?: { id?: string; email?: string };\n organizationId?: string;\n role?: string;\n memberOrgIds?: string[];\n } \| null> {\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/me`, {\n headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },\n signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS),\n });\n if (!res.ok) return null;\n return (await res.json()) as {\n user?: { id?: string; email?: string };\n organizationId?: string;\n role?: string;\n memberOrgIds?: string[];\n };\n } catch {\n return null;\n }\n }\n\n /\n Forward a sealed session cookie to the shared API's /auth/me endpoint\n * to validate it and get user info.\n /\n private async verifySessionCookie(sessionCookie: string): Promise<StudioUser \| null> {\n const cacheKey = this.verificationKey('cookie', sessionCookie);\n const cached = this.getCachedVerification(cacheKey);\n if (cached) {\n // Keep the userId → cookie mapping warm for IOrganizationsProvider.\n this.rememberUserSession(cached.id, sessionCookie);\n return cached;\n }\n\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/me`, {\n headers: {\n Cookie: `${COOKIE_NAME}=${sessionCookie}`,\n },\n signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS),\n });\n\n if (!res.ok) {\n this.logger.warn('verifySessionCookie: shared API returned non-OK status', {\n status: res.status,\n statusText: res.statusText,\n url: `${this.sharedApiUrl}/auth/me`,\n });\n return null;\n }\n\n const data = (await res.json()) as {\n user: {\n id: string;\n email: string;\n firstName: string;\n lastName: string;\n profilePictureUrl?: string;\n };\n organizationId: string;\n role?: string;\n permissions?: string[];\n memberOrgIds?: string[];\n };\n\n // Remember the sealed cookie for this user so IOrganizationsProvider\n // methods (invoked with only a userId) can act on the user's behalf.\n this.rememberUserSession(data.user.id, sessionCookie);\n\n const user: StudioUser = {\n id: data.user.id,\n email: data.user.email,\n name: [data.user.firstName, data.user.lastName].filter(Boolean).join(' ') \|\| undefined,\n avatarUrl: data.user.profilePictureUrl,\n organizationId: data.organizationId,\n role: data.role,\n permissions: data.permissions,\n memberOrgIds: data.memberOrgIds,\n };\n // Don't pin brand-new users in the no-org state: org bootstrap runs on\n // the next request, which must re-read /auth/me to see the new org.\n if (user.organizationId) this.cacheVerification(cacheKey, user);\n return user;\n } catch (error) {\n this.logger.error('verifySessionCookie: fetch to shared API failed', {\n url: `${this.sharedApiUrl}/auth/me`,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n return null;\n }\n }\n\n /\n Forward a Bearer token to the shared API's /auth/verify endpoint\n * to validate it and get user info (used for CLI tokens).\n /\n private async verifyBearerToken(token: string): Promise<StudioUser \| null> {\n const cacheKey = this.verificationKey('bearer', token);\n const cached = this.getCachedVerification(cacheKey);\n if (cached) return cached;\n\n try {\n const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {\n headers: {\n Authorization: `Bearer ${token}`,\n },\n signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS),\n });\n\n if (!res.ok) {\n this.logger.warn('verifyBearerToken: shared API returned non-OK status', {\n status: res.status,\n url: `${this.sharedApiUrl}/auth/verify`,\n });\n return null;\n }\n\n const data = (await res.json()) as {\n user: {\n id: string;\n email: string;\n firstName: string;\n lastName: string;\n };\n organizationId: string;\n role?: string;\n memberOrgIds?: string[];\n };\n\n const user: StudioUser = {\n id: data.user.id,\n email: data.user.email,\n name: [data.user.firstName, data.user.lastName].filter(Boolean).join(' ') \|\| undefined,\n organizationId: data.organizationId,\n role: data.role,\n memberOrgIds: data.memberOrgIds,\n };\n // Same no-org guard as verifySessionCookie: cache only after the user's\n // organization bootstrap has completed.\n if (user.organizationId) this.cacheVerification(cacheKey, user);\n return user;\n } catch (error) {\n this.logger.error('verifyBearerToken: fetch to shared API failed', {\n url: `${this.sharedApiUrl}/auth/verify`,\n error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error),\n });\n return null;\n }\n }\n}\n\n// ---------------------------------------------------------------------------\n// Cookie helpers\n// ---------------------------------------------------------------------------\n\nfunction parseCookie(cookieHeader: string \| null \| undefined, name: string): string \| null {\n if (!cookieHeader) return null;\n const match = cookieHeader.match(new RegExp(`${name}=([^;]+)`));\n return match?.[1] ?? null;\n}\n\n/\n WorkOS AuthKit conventionally uses `admin` / `owner` for admin-equivalent\n * roles; the shared API surfaces the WorkOS role slug directly on\n * `/auth/me` and `/auth/orgs`.\n /\nfunction isAdminRole(role: string \| undefined): boolean {\n return role === 'admin' \|\| role === 'owner';\n}\n\n/\n Parse a cookie value from a Set-Cookie header.\n * Set-Cookie format: \"name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400\"\n /\nfunction parseCookieFromHeader(setCookieHeader: string, name: string): string \| null {\n // Set-Cookie header starts with \"name=value\" followed by optional attributes\n const parts = setCookieHeader.split(';');\n if (parts.length === 0) return null;\n\n const [cookieName, ...valueParts] = parts[0]!.split('=');\n if (cookieName?.trim() !== name) return null;\n\n // Value could contain = characters, so rejoin\n return valueParts.join('=') \|\| null;\n}\n\n// ---------------------------------------------------------------------------\n// MastraRBACStudio — role-based permission provider for Studio auth\n// ---------------------------------------------------------------------------\n\nexport interface MastraRBACStudioOptions {\n /\n Mapping from role names to permission arrays.\n \n @example\n * ```typescript\n * {\n * admin: [''],\n member: ['agents:read', 'workflows:'],\n viewer: ['agents:read', 'workflows:read'],\n * _default: [],\n * }\n * ```\n /\n roleMapping: RoleMapping;\n}\n\n/\n RBAC provider for Mastra Studio authentication.\n \n Maps user roles (from the shared API's /auth/me endpoint) to Mastra permissions\n * using a configurable role mapping.\n */\nexport class MastraRBACStudio implements IRBACProvider<StudioUser> {\n private options: MastraRBACStudioOptions;\n\n get roleMapping(): RoleMapping {\n return this.options.roleMapping;\n }\n\n constructor(options: MastraRBACStudioOptions) {\n this.options = options;\n }\n\n async getRoles(user: StudioUser): Promise<string[]> {\n return user.role ? [user.role] : [];\n }\n\n async hasRole(user: StudioUser, role: string): Promise<boolean> {\n const roles = await this.getRoles(user);\n return roles.includes(role);\n }\n\n async getPermissions(user: StudioUser): Promise<string[]> {\n const roles = await this.getRoles(user);\n if (roles.length === 0) {\n return this.options.roleMapping['_default'] ?? [];\n }\n return resolvePermissionsFromMapping(roles, this.options.roleMapping);\n }\n\n async hasPermission(user: StudioUser, permission: string): Promise<boolean> {\n const permissions = await this.getPermissions(user);\n return permissions.some(p => matchesPermission(p, permission));\n }\n\n async hasAllPermissions(user: StudioUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.every(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n\n async hasAnyPermission(user: StudioUser, permissions: string[]): Promise<boolean> {\n const userPermissions = await this.getPermissions(user);\n return permissions.some(required => userPermissions.some(p => matchesPermission(p, required)));\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAszBA,MAAM,sBAAsB,EAAE,QAAQ;CACrC;CACA;CACA;CACA;CACA;CACA;AACD,EAAE;;;;;;;;;;;;;;;;;;AAkBF,SAAS,kBAAkB,gBAAgB,oBAAoB;CAC9D,IAAI,mBAAmB,KAAK,OAAO;CACnC,MAAM,eAAe,eAAe,MAAM,GAAG;CAC7C,MAAM,gBAAgB,mBAAmB,MAAM,GAAG;CAClD,MAAM,mBAAmB,oBAAoB,aAAa,MAAM;CAChE,IAAI,oBAAoB,iBAAiB,SAAS,cAAc,MAAM,EAAE,GAAG,OAAO,kBAAkB,CAAC,cAAc,IAAI,GAAG,aAAa,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,kBAAkB;CAC9K,IAAI,aAAa,SAAS,KAAK,cAAc,SAAS,GAAG,OAAO,mBAAmB;CACnF,MAAM,CAAC,iBAAiB,eAAe,aAAa;CACpD,MAAM,CAAC,kBAAkB,gBAAgB,cAAc;CACvD,IAAI,oBAAoB,KAAK;EAC5B,IAAI,kBAAkB,KAAK;GAC1B,IAAI,cAAc,KAAK,GAAG,OAAO;GACjC,OAAO,cAAc;EACtB;EACA,IAAI,kBAAkB,gBAAgB,OAAO;EAC7C,IAAI,cAAc,KAAK,GAAG,OAAO;EACjC,OAAO,cAAc;CACtB;CACA,IAAI,oBAAoB,kBAAkB,OAAO;CACjD,IAAI,kBAAkB,KAAK;EAC1B,IAAI,cAAc,KAAK,GAAG,OAAO;EACjC,OAAO,cAAc;CACtB;CACA,IAAI,kBAAkB,gBAAgB,OAAO;CAC7C,IAAI,cAAc,KAAK,GAAG,OAAO;CACjC,OAAO,cAAc;AACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,8BAA8B,OAAO,SAAS;CACtD,MAAM,8BAA8B,IAAI,IAAI;CAC5C,MAAM,eAAe,QAAQ,eAAe,CAAC;CAC7C,KAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,YAAY,QAAQ;EAC1B,IAAI,WAAW,KAAK,MAAM,QAAQ,WAAW,YAAY,IAAI,IAAI;OAC5D,KAAK,MAAM,QAAQ,cAAc,YAAY,IAAI,IAAI;CAC3D;CACA,OAAO,MAAM,KAAK,WAAW;AAC9B;;;;;;;;;;;;ACr5BA,MAAM,mBAAmB;CACxB,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACT,SAAS;CACT,UAAU;CACV,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,cAAc;CACd,QAAQ;CACR,WAAW;CACX,SAAS;AACV;AACA,MAAM,WAAW;CAChB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACP,MAAM;AACP;AAiCA,IAAI,eAAe,MAAM;CACxB;CACA;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,KAAK,OAAO,QAAQ,QAAQ;EAC5B,KAAK,QAAQ,QAAQ,SAAS,SAAS;EACvC,KAAK,aAAa,IAAI,IAAI,OAAO,QAAQ,QAAQ,cAAc,CAAC,CAAC,CAAC;CACnE;CACA,gBAAgB;EACf,OAAO,KAAK;CACb;CACA,eAAe,QAAQ,WAAW,CAAC;CACnC,MAAM,SAAS,aAAa,QAAQ;EACnC,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,GAAG,OAAO;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,WAAW,MAAM,KAAK;GAC7D,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,SAAS,QAAQ,WAAW;GAC5B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,EAAE,aAAa,OAAO,UAAU,QAAQ,UAAU,SAAS,MAAM,WAAW;EACjG,IAAI,CAAC,eAAe,CAAC,KAAK,WAAW,IAAI,WAAW,KAAK,CAAC,OAAO,OAAO;GACvE,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;EACA,OAAO,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,kBAAkB;GACzD;GACA;GACA;GACA;GACA;GACA;GACA;EACD,CAAC,KAAK;GACL,MAAM,CAAC;GACP,OAAO;GACP,MAAM,QAAQ;GACd,SAAS,WAAW;GACpB,SAAS;EACV;CACD;AACD;AACA,IAAI,gBAAgB,MAAM,sBAAsB,aAAa;CAC5D;CACA;CACA,YAAY,UAAU,CAAC,GAAG;EACzB,MAAM,OAAO;EACb,KAAK,YAAY,QAAQ;EACzB,KAAK,SAAS,QAAQ;CACvB;CACA,MAAM,qBAAqB;EAC1B,MAAM,YAAY,OAAO,wBAAwB,WAAW,sBAAsB,qBAAqB,aAAa,KAAK;EACzH,OAAO,IAAI,cAAc;GACxB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ;GACA,QAAQ,KAAK;EACd,CAAC;CACF;CACA,UAAU,OAAO,SAAS,MAAM;EAC/B,IAAI,CAAC,KAAK,QAAQ,OAAO;EACzB,IAAI;GACH,OAAO,KAAK,OAAO;IAClB,WAAW,KAAK;IAChB;IACA;IACA;GACD,CAAC;EACF,SAAS,GAAG;GACX,QAAQ,MAAM,uCAAuC,KAAK,UAAU,SAAS,MAAM,IAAI,CAAC;GACxF,OAAO;EACR;CACD;CACA,SAAS;EACR,OAAO,KAAK,YAAY,IAAI,KAAK,UAAU,MAAM;CAClD;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,IAAI,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,IAAI;CACvI;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,IAAI;CACxK;CACA,KAAK,SAAS,GAAG,MAAM;EACtB,KAAK,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,MAAM,SAAS,IAAI,GAAG,QAAQ,KAAK,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,IAAI;CACxM;CACA,MAAM,SAAS,GAAG,MAAM;EACvB,KAAK,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,QAAQ,KAAK,UAAU,SAAS,UAAU,KAAK,UAAU,SAAS,OAAO,SAAS,IAAI,GAAG,QAAQ,MAAM,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG,IAAI;CAC3O;CACA,MAAM,SAAS,cAAc,SAAS;EACrC,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,SAAS,QAAQ;GACvB,SAAS,SAAS,WAAW;GAC7B,SAAS;EACV;CACD;CACA,MAAM,gBAAgB,OAAO;EAC5B,OAAO;GACN,MAAM,CAAC;GACP,OAAO;GACP,MAAM,MAAM,QAAQ;GACpB,SAAS,MAAM,WAAW;GAC1B,SAAS;EACV;CACD;AACD;;;ACnLA,IAAI,aAAa,MAAM;CACtB,YAAY,iBAAiB;CAC7B;CACA;CACA;CACA,YAAY,EAAE,WAAW,MAAM,aAAa;EAC3C,KAAK,YAAY,aAAa,iBAAiB;EAC/C,KAAK,OAAO;EACZ,KAAKA,aAAa;EAClB,KAAK,SAAS,IAAI,cAAc,EAAE,MAAM,GAAG,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC;CAC7E;;;;;CAKA,cAAc;EACb,OAAO,KAAKA;CACb;;;;;CAKA,eAAe,WAAW;EACzB,KAAKA,aAAa;CACnB;;;;;CAKA,YAAY,QAAQ;EACnB,KAAK,SAAS,WAAW,UAAU,OAAO,OAAO,UAAU,aAAa,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,IAAI;CACvH;AACD;;;AC/BA,IAAI,qBAAqB,cAAc,WAAW;CACjD;CACA;CACA,YAAY,SAAS;EACpB,MAAM;GACL,WAAW;GACX,MAAM,SAAS;EAChB,CAAC;EACD,IAAI,SAAS,eAAe,KAAK,gBAAgB,QAAQ,cAAc,KAAK,IAAI;EAChF,KAAK,YAAY,SAAS;EAC1B,KAAK,SAAS,SAAS;EACvB,KAAK,sBAAsB,SAAS;CACrC;CACA,gBAAgB,MAAM;EACrB,IAAI,MAAM,eAAe,KAAK,gBAAgB,KAAK,cAAc,KAAK,IAAI;EAC1E,IAAI,MAAM,qBAAqB,KAAK,sBAAsB,KAAK;EAC/D,IAAI,MAAM,WAAW,KAAK,YAAY,KAAK;EAC3C,IAAI,MAAM,QAAQ,KAAK,SAAS,KAAK;CACtC;AACD;;;ACEA,SAAS,iBAAiB,SAA4B,MAA6B;CACjF,IAAI,mBAAmB,SACrB,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAGjC,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,SAAS,IAAI,IAAI,KAAK,QAAQ,OAAO,IAAI,KAAK;AACjG;AA4BA,MAAM,cAAc;;;;;;AAOpB,MAAM,0BAA0B;;;;;;AAOhC,MAAM,sBAAsB;;;;;;;;;;;;AAa5B,IAAa,mBAAb,cACU,mBAEV;CACE,oBAA6B;CAE7B;CACA;CACA;CACA;;;;;;;;CAQA,qCAA6B,IAAI,IAAoB;CACrD,oBAAqC;;;;;;;;CASrC,sCAA8B,IAAI,IAAqD;CACvF,yBAA0C;;;;;;;;CAS1C,gDAAwC,IAAI,IAAyC;CAErF,YAAY,SAAmC;EAC7C,MAAM;GAAE,MAAM;GAAiB,GAAG;EAAQ,CAAC;EAC3C,MAAM,uBAAuB,SAAS,gBAAgB,QAAQ,IAAI;EAClE,KAAK,eAAe,wBAAwB;EAC5C,KAAK,iBAAiB,SAAS,kBAAkB,QAAQ,IAAI;EAG7D,IAAI,KAAK,aAAa,SAAS,GAAG,GAChC,KAAK,eAAe,KAAK,aAAa,MAAM,GAAG,EAAE;EAInD,KAAK,eAAe,SAAS,gBAAgB,QAAQ,IAAI;EASzD,IAAI,qBAAqB;EACzB,IAAI,sBACF,IAAI;GACF,MAAM,WAAW,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,SAAS,YAAY;GACjE,qBAAqB,aAAa,eAAe,SAAS,SAAS,YAAY;EACjF,QAAQ;GACN,qBAAqB;EACvB;EAEF,KAAK,uBAAuB,CAAC,CAAC,KAAK,gBAAgB;EAGnD,IAAI,CAAC,KAAK,gBAAgB,oBACxB,KAAK,eAAe;EAGtB,IAAI,SACF,KAAK,gBAAgB,OAAO;CAEhC;;;;;CAUA,MAAM,kBAAkB,OAAe,SAAwD;EAC7F,IAAI,OAA0B;EAI9B,MAAM,gBAAgB,YADD,iBAAiB,SAAS,QACF,GAAG,WAAW;EAE3D,IAAI,eACF,OAAO,MAAM,KAAK,oBAAoB,aAAa;EAIrD,IAAI,CAAC,QAAQ,OACX,OAAO,MAAM,KAAK,kBAAkB,KAAK;EAG3C,IAAI,CAAC,MAAM,OAAO;EAIlB,IAAI,KAAK,kBAAkB,CAAC,KAAK,cAAc,SAAS,KAAK,cAAc,GACzE,OAAO;EAGT,OAAO;CACT;CAEA,cAAc,MAA2B;EACvC,OAAO,CAAC,CAAC,MAAM;CACjB;CAMA,YAAY,aAAqB,OAAuB;EAEtD,IAAI,oBAAoB;EACxB,IAAI,OAAO;GACT,MAAM,YAAY,MAAM,QAAQ,GAAG;GACnC,IAAI,cAAc,IAChB,IAAI;IACF,oBAAoB,mBAAmB,MAAM,MAAM,YAAY,CAAC,CAAC;GACnE,QAAQ,CAER;EAEJ;EAEA,MAAM,SAAS,IAAI,gBAAgB;GACjC,SAAS;GACT,cAAc;GACd,qBAAqB;GAErB,QAAQ;GACR,GAAI,KAAK,iBAAiB,EAAE,iBAAiB,KAAK,eAAe,IAAI,CAAC;EACxE,CAAC;EAED,OAAO,GAAG,KAAK,aAAa,cAAc,OAAO,SAAS;CAC5D;CAEA,MAAM,eAAe,MAAc,QAAwD;EAIzF,KAAK,OAAO,MAAM,0DAA0D;GAC1E,cAAc,KAAK;GACnB,YAAY,MAAM;EACpB,CAAC;EACD,MAAM,OAAO,MAAM,KAAK,oBAAoB,IAAI;EAChD,IAAI,CAAC,MAAM;GACT,KAAK,OAAO,MAAM,+EAA+E;IAC/F,cAAc,KAAK;IACnB,YAAY,MAAM;GACpB,CAAC;GACD,MAAM,IAAI,MAAM,2BAA2B;EAC7C;EAKA,OAAO;GACL;GACA,QAAQ,EACN,aAAa,KACf;EACF;CACF;CAEA,wBAAwB,eAAoC,CAE5D;CAEA,kBAAwC,CAGxC;CAEA,uBAAuC;EACrC,OAAO;GACL,UAAU;GACV,MAAM;GACN,aACE;EACJ;CACF;CAEA,MAAM,aAAa,cAAsB,SAA2C;EAClF,MAAM,eAAe,SAAS,QAAQ,IAAI,QAAQ;EAClD,MAAM,gBAAgB,YAAY,cAAc,WAAW;EAE3D,IAAI,CAAC,eAAe,OAAO;EAE3B,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,eAAe;IAC1D,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ,GAAG,YAAY,GAAG;IAC5B;GACF,CAAC;GAED,IAAI,IAAI,IAEN,QAAO,MADa,IAAI,KAAK,EAAA,CACjB,aAAa;EAE7B,QAAQ,CAER;EAEA,OAAO;CACT;CAMA,MAAM,cAAc,QAAgB,UAAsD;EACxF,MAAM,sBAAM,IAAI,KAAK;EACrB,OAAO;GACL,IAAK,UAAU,eAA0B,OAAO,WAAW;GAC3D;GACA,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAU,KAAK,GAAI;GACvD,WAAW;GACX;EACF;CACF;CAEA,MAAM,gBAAgB,WAA4C;EAChE,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,IAAI,CAAC,MAAM,OAAO;EAElB,MAAM,sBAAM,IAAI,KAAK;EACrB,OAAO;GACL,IAAI;GACJ,QAAQ,KAAK;GACb,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAU,KAAK,GAAI;GACvD,WAAW;EACb;CACF;CAEA,MAAM,eAAe,WAAkC;EACrD,IAAI;GACF,MAAM,MAAM,GAAG,KAAK,aAAa,eAAe;IAC9C,QAAQ;IACR,SAAS,EACP,QAAQ,GAAG,YAAY,GAAG,YAC5B;GACF,CAAC;EACH,QAAQ,CAER;CACF;CAEA,MAAM,eAAe,WAA4C;EAC/D,IAAI;GAEF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,gBAAgB;IAC3D,QAAQ;IACR,SAAS,EACP,QAAQ,GAAG,YAAY,GAAG,YAC5B;GACF,CAAC;GAED,IAAI,CAAC,IAAI,IAAI;IACX,KAAK,OAAO,KAAK,6DAA6D;KAC5E,QAAQ,IAAI;KACZ,KAAK,GAAG,KAAK,aAAa;IAC5B,CAAC;IAED,OAAO,KAAK,gBAAgB,SAAS;GACvC;GAGA,MAAM,YAAY,IAAI,QAAQ,IAAI,YAAY;GAC9C,MAAM,eAAe,YAAY,sBAAsB,WAAW,WAAW,IAAI;GAEjF,IAAI,CAAC,cAAc;IACjB,KAAK,OAAO,KAAK,0DAA0D;IAE3E,OAAO,KAAK,gBAAgB,SAAS;GACvC;GAGA,MAAM,OAAO,MAAM,KAAK,oBAAoB,YAAY;GACxD,IAAI,CAAC,MAAM,OAAO;GAElB,MAAM,sBAAM,IAAI,KAAK;GACrB,OAAO;IACL,IAAI;IACJ,QAAQ,KAAK;IACb,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAU,KAAK,GAAI;IACvD,WAAW;GACb;EACF,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,8CAA8C;IAC9D,KAAK,GAAG,KAAK,aAAa;IAC1B,OAAO,iBAAiB,QAAQ;KAAE,SAAS,MAAM;KAAS,OAAO,MAAM;IAAM,IAAI,OAAO,KAAK;GAC/F,CAAC;GAED,OAAO,KAAK,gBAAgB,SAAS;EACvC;CACF;CAEA,wBAAwB,SAAiC;EAEvD,OAAO,YADc,QAAQ,QAAQ,IAAI,QACX,GAAG,WAAW;CAC9C;CAEA,kBAAkB,SAA0C;EAC1D,MAAM,QAAQ;GAAC,GAAG,YAAY,GAAG,QAAQ;GAAM;GAAY;GAAgB;GAAU;EAAe;EACpG,IAAI,KAAK,wBAAwB,KAAK,cAAc;GAClD,MAAM,KAAK,QAAQ;GACnB,MAAM,KAAK,UAAU,KAAK,cAAc;EAC1C;EACA,OAAO,EAAE,cAAc,MAAM,KAAK,IAAI,EAAE;CAC1C;CAEA,yBAAiD;EAC/C,MAAM,QAAQ;GAAC,GAAG,YAAY;GAAI;GAAY;GAAgB;GAAU;EAAW;EACnF,IAAI,KAAK,wBAAwB,KAAK,cAAc;GAClD,MAAM,KAAK,QAAQ;GACnB,MAAM,KAAK,UAAU,KAAK,cAAc;EAC1C;EACA,OAAO,EAAE,cAAc,MAAM,KAAK,IAAI,EAAE;CAC1C;CAMA,MAAM,eAAe,SAA8C;EAEjE,MAAM,gBAAgB,YADD,QAAQ,QAAQ,IAAI,QACI,GAAG,WAAW;EAE3D,IAAI,eACF,OAAO,KAAK,oBAAoB,aAAa;EAI/C,MAAM,aAAa,QAAQ,QAAQ,IAAI,eAAe;EACtD,IAAI,YAAY,WAAW,SAAS,GAClC,OAAO,KAAK,kBAAkB,WAAW,MAAM,CAAC,CAAC;EAGnD,OAAO;CACT;CAEA,MAAM,QAAQ,SAA6C;EAEzD,OAAO;CACT;;;;;;;;;;;;;;;;CAqBA,MAAM,mBAAmB,QAA6C;EAIpE,MAAM,WAAW,KAAK,8BAA8B,IAAI,MAAM;EAC9D,IAAI,UAAU,OAAO;EAErB,MAAM,YAAY,KAAK,qBAAqB,MAAM,CAAC,CAAC,cAAc;GAChE,KAAK,8BAA8B,OAAO,MAAM;EAClD,CAAC;EACD,KAAK,8BAA8B,IAAI,QAAQ,SAAS;EACxD,OAAO;CACT;CAEA,MAAc,qBAAqB,QAA6C;EAC9E,MAAM,gBAAgB,KAAK,mBAAmB,IAAI,MAAM;EACxD,IAAI,CAAC,eAAe;GAClB,KAAK,OAAO,MAAM,6EAA6E,EAAE,OAAO,CAAC;GACzG;EACF;EAEA,IAAI;GAIF,MAAM,KAAK,MAAM,KAAK,QAAQ,aAAa;GAC3C,IAAI,IAAI,gBAAgB,OAAO,GAAG;GAClC,IAAI,IAAI,gBAAgB,GAAG,aAAa,SAAS,GAAG,OAAO,GAAG,aAAa;GAM3E,MAAM,UAAU,IAAI,MAAM,QAAQ,GAAG,GAAG,KAAK,MAAM,UAAU,aAAa,OAAO;GACjF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,aAAa;IACxD,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ,GAAG,YAAY,GAAG;IAC5B;IACA,MAAM,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;GACxC,CAAC;GAED,IAAI,CAAC,IAAI,IAAI;IACX,KAAK,OAAO,KAAK,kEAAkE;KACjF,QAAQ,IAAI;KACZ;IACF,CAAC;IACD;GACF;GAGA,QAAO,MADa,IAAI,KAAK,EAAA,CACjB,cAAc;EAC5B,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,kDAAkD;IAClE;IACA,OAAO,iBAAiB,QAAQ;KAAE,SAAS,MAAM;KAAS,OAAO,MAAM;IAAM,IAAI,OAAO,KAAK;GAC/F,CAAC;GACD;EACF;CACF;;;;;;;;;CAUA,MAAM,oBAAoB,gBAAwB,QAAkC;EAClF,MAAM,gBAAgB,KAAK,mBAAmB,IAAI,MAAM;EACxD,IAAI,CAAC,eAAe,OAAO;EAE3B,IAAI;GACF,MAAM,KAAK,MAAM,KAAK,QAAQ,aAAa;GAC3C,IAAI,IAAI,mBAAmB,gBACzB,OAAO,YAAY,GAAG,IAAI;GAI5B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,aAAa,EACxD,SAAS,EAAE,QAAQ,GAAG,YAAY,GAAG,gBAAgB,EACvD,CAAC;GACD,IAAI,CAAC,IAAI,IAAI,OAAO;GAKpB,MAAM,cAAa,MAHC,IAAI,KAAK,EAAA,CAGL,eAAe,MAAK,MAAK,EAAE,OAAO,cAAc;GACxE,OAAO,YAAY,YAAY,QAAQ,KAAA,CAAS;EAClD,QAAQ;GACN,OAAO;EACT;CACF;;;;;;CAWA,oBAA4B,QAAgB,eAA6B;EAEvE,KAAK,mBAAmB,OAAO,MAAM;EACrC,KAAK,mBAAmB,IAAI,QAAQ,aAAa;EACjD,IAAI,KAAK,mBAAmB,OAAO,KAAK,mBAAmB;GACzD,MAAM,SAAS,KAAK,mBAAmB,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GACrD,IAAI,WAAW,KAAA,GAAW,KAAK,mBAAmB,OAAO,MAAM;EACjE;CACF;;CAGA,gBAAwB,MAA2B,YAA4B;EAC7E,QAAA,GAAA,SAAA,WAAA,CAAkB,QAAQ,CAAC,CAAC,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,CAAC,OAAO,KAAK;CAC1E;CAEA,sBAA8B,KAAgC;EAC5D,MAAM,QAAQ,KAAK,oBAAoB,IAAI,GAAG;EAC9C,IAAI,CAAC,OAAO,OAAO;EACnB,IAAI,MAAM,aAAa,KAAK,IAAI,GAAG;GACjC,KAAK,oBAAoB,OAAO,GAAG;GACnC,OAAO;EACT;EACA,OAAO,MAAM;CACf;CAEA,kBAA0B,KAAa,MAAwB;EAC7D,KAAK,oBAAoB,OAAO,GAAG;EACnC,KAAK,oBAAoB,IAAI,KAAK;GAAE;GAAM,WAAW,KAAK,IAAI,IAAI;EAAoB,CAAC;EACvF,IAAI,KAAK,oBAAoB,OAAO,KAAK,wBAAwB;GAC/D,MAAM,SAAS,KAAK,oBAAoB,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GACtD,IAAI,WAAW,KAAA,GAAW,KAAK,oBAAoB,OAAO,MAAM;EAClE;CACF;;;;;;CAOA,MAAc,QAAQ,eAKZ;EACR,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,WAAW;IACtD,SAAS,EAAE,QAAQ,GAAG,YAAY,GAAG,gBAAgB;IACrD,QAAQ,YAAY,QAAQ,uBAAuB;GACrD,CAAC;GACD,IAAI,CAAC,IAAI,IAAI,OAAO;GACpB,OAAQ,MAAM,IAAI,KAAK;EAMzB,QAAQ;GACN,OAAO;EACT;CACF;;;;;CAMA,MAAc,oBAAoB,eAAmD;EACnF,MAAM,WAAW,KAAK,gBAAgB,UAAU,aAAa;EAC7D,MAAM,SAAS,KAAK,sBAAsB,QAAQ;EAClD,IAAI,QAAQ;GAEV,KAAK,oBAAoB,OAAO,IAAI,aAAa;GACjD,OAAO;EACT;EAEA,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,WAAW;IACtD,SAAS,EACP,QAAQ,GAAG,YAAY,GAAG,gBAC5B;IACA,QAAQ,YAAY,QAAQ,uBAAuB;GACrD,CAAC;GAED,IAAI,CAAC,IAAI,IAAI;IACX,KAAK,OAAO,KAAK,0DAA0D;KACzE,QAAQ,IAAI;KACZ,YAAY,IAAI;KAChB,KAAK,GAAG,KAAK,aAAa;IAC5B,CAAC;IACD,OAAO;GACT;GAEA,MAAM,OAAQ,MAAM,IAAI,KAAK;GAgB7B,KAAK,oBAAoB,KAAK,KAAK,IAAI,aAAa;GAEpD,MAAM,OAAmB;IACvB,IAAI,KAAK,KAAK;IACd,OAAO,KAAK,KAAK;IACjB,MAAM,CAAC,KAAK,KAAK,WAAW,KAAK,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,KAAK,KAAA;IAC7E,WAAW,KAAK,KAAK;IACrB,gBAAgB,KAAK;IACrB,MAAM,KAAK;IACX,aAAa,KAAK;IAClB,cAAc,KAAK;GACrB;GAGA,IAAI,KAAK,gBAAgB,KAAK,kBAAkB,UAAU,IAAI;GAC9D,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,mDAAmD;IACnE,KAAK,GAAG,KAAK,aAAa;IAC1B,OAAO,iBAAiB,QAAQ;KAAE,SAAS,MAAM;KAAS,OAAO,MAAM;IAAM,IAAI,OAAO,KAAK;GAC/F,CAAC;GACD,OAAO;EACT;CACF;;;;;CAMA,MAAc,kBAAkB,OAA2C;EACzE,MAAM,WAAW,KAAK,gBAAgB,UAAU,KAAK;EACrD,MAAM,SAAS,KAAK,sBAAsB,QAAQ;EAClD,IAAI,QAAQ,OAAO;EAEnB,IAAI;GACF,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,aAAa,eAAe;IAC1D,SAAS,EACP,eAAe,UAAU,QAC3B;IACA,QAAQ,YAAY,QAAQ,uBAAuB;GACrD,CAAC;GAED,IAAI,CAAC,IAAI,IAAI;IACX,KAAK,OAAO,KAAK,wDAAwD;KACvE,QAAQ,IAAI;KACZ,KAAK,GAAG,KAAK,aAAa;IAC5B,CAAC;IACD,OAAO;GACT;GAEA,MAAM,OAAQ,MAAM,IAAI,KAAK;GAY7B,MAAM,OAAmB;IACvB,IAAI,KAAK,KAAK;IACd,OAAO,KAAK,KAAK;IACjB,MAAM,CAAC,KAAK,KAAK,WAAW,KAAK,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,KAAK,KAAA;IAC7E,gBAAgB,KAAK;IACrB,MAAM,KAAK;IACX,cAAc,KAAK;GACrB;GAGA,IAAI,KAAK,gBAAgB,KAAK,kBAAkB,UAAU,IAAI;GAC9D,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,iDAAiD;IACjE,KAAK,GAAG,KAAK,aAAa;IAC1B,OAAO,iBAAiB,QAAQ;KAAE,SAAS,MAAM;KAAS,OAAO,MAAM;IAAM,IAAI,OAAO,KAAK;GAC/F,CAAC;GACD,OAAO;EACT;CACF;AACF;AAMA,SAAS,YAAY,cAAyC,MAA6B;CACzF,IAAI,CAAC,cAAc,OAAO;CAE1B,OADc,aAAa,MAAM,IAAI,OAAO,GAAG,KAAK,SAAS,CAClD,CAAC,GAAG,MAAM;AACvB;;;;;;AAOA,SAAS,YAAY,MAAmC;CACtD,OAAO,SAAS,WAAW,SAAS;AACtC;;;;;AAMA,SAAS,sBAAsB,iBAAyB,MAA6B;CAEnF,MAAM,QAAQ,gBAAgB,MAAM,GAAG;CACvC,IAAI,MAAM,WAAW,GAAG,OAAO;CAE/B,MAAM,CAAC,YAAY,GAAG,cAAc,MAAM,EAAE,CAAE,MAAM,GAAG;CACvD,IAAI,YAAY,KAAK,MAAM,MAAM,OAAO;CAGxC,OAAO,WAAW,KAAK,GAAG,KAAK;AACjC;;;;;;;AA6BA,IAAa,mBAAb,MAAmE;CACjE;CAEA,IAAI,cAA2B;EAC7B,OAAO,KAAK,QAAQ;CACtB;CAEA,YAAY,SAAkC;EAC5C,KAAK,UAAU;CACjB;CAEA,MAAM,SAAS,MAAqC;EAClD,OAAO,KAAK,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;CACpC;CAEA,MAAM,QAAQ,MAAkB,MAAgC;EAE9D,QAAO,MADa,KAAK,SAAS,IAAI,EAAA,CACzB,SAAS,IAAI;CAC5B;CAEA,MAAM,eAAe,MAAqC;EACxD,MAAM,QAAQ,MAAM,KAAK,SAAS,IAAI;EACtC,IAAI,MAAM,WAAW,GACnB,OAAO,KAAK,QAAQ,YAAY,eAAe,CAAC;EAElD,OAAO,8BAA8B,OAAO,KAAK,QAAQ,WAAW;CACtE;CAEA,MAAM,cAAc,MAAkB,YAAsC;EAE1E,QAAO,MADmB,KAAK,eAAe,IAAI,EAAA,CAC/B,MAAK,MAAK,kBAAkB,GAAG,UAAU,CAAC;CAC/D;CAEA,MAAM,kBAAkB,MAAkB,aAAyC;EACjF,MAAM,kBAAkB,MAAM,KAAK,eAAe,IAAI;EACtD,OAAO,YAAY,OAAM,aAAY,gBAAgB,MAAK,MAAK,kBAAkB,GAAG,QAAQ,CAAC,CAAC;CAChG;CAEA,MAAM,iBAAiB,MAAkB,aAAyC;EAChF,MAAM,kBAAkB,MAAM,KAAK,eAAe,IAAI;EACtD,OAAO,YAAY,MAAK,aAAY,gBAAgB,MAAK,MAAK,kBAAkB,GAAG,QAAQ,CAAC,CAAC;CAC/F;AACF"}

package/dist/index.d.ts CHANGED Viewed

@@ -58,6 +58,15 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
      */
     private userSessionCookies;
     private readonly maxCachedSessions;
+    /**
+     * Short-TTL cache of SUCCESSFUL credential verifications, keyed by a
+     * sha256 of the credential (never the raw cookie/token). Every protected
+     * request re-verifies against the shared API otherwise — one network
+     * round trip per request. Failures are never cached, so a rejected
+     * credential is always re-checked. Bounded + insert-order evicted.
+     */
+    private verifiedCredentials;
+    private readonly maxCachedVerifications;
     /**
      * In-flight `ensureOrganization` promises keyed by userId. Concurrent calls
      * for the same brand-new user (multiple tabs, parallel requests) would
@@ -120,6 +129,10 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
      * behalf. LRU-evicted at {@link maxCachedSessions} entries.
      */
     private rememberUserSession;
+    /** Cache key for a verified credential — hash, never the raw secret. */
+    private verificationKey;
+    private getCachedVerification;
+    private cacheVerification;
     /**
      * Fetch the shared API's `/auth/me` and return the raw response body, or
      * `null` on any non-OK / network error. Split out so `ensureOrganization`

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"~~AAAA~~,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,KAAK,eAAe,GAAG;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC1C,CAAC;AAEF,KAAK,iBAAiB,GAAG,OAAO,GAAG,eAAe,CAAC;AAUnD,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;~~AAID~~;;;;;;;;;;GAUG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,YAAY,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAEjH,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,oBAAoB,CAAU;IACtC,OAAO,CAAC,YAAY,CAAqB;IACzC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B,CAAkD;gBAE3E,OAAO,CAAC,EAAE,uBAAuB;IA8C7C;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IA2B9F,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAQxC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IA0BjD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IA4B1F,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI3D,eAAe,IAAI,MAAM,EAAE,GAAG,SAAS;IAKvC,oBAAoB,IAAI,cAAc;IAShC,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA8B7E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAa3D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAahD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAkDhE,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAKxD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAS3D,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAa1C,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAiB5D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAS1D;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;YAcvD,oBAAoB;IAgDlC;;;;;;;OAOG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BnF;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;OAIG;YACW,OAAO;~~IAsBrB~~;;;OAGG;YACW,mBAAmB;~~IAsDjC~~;;;OAGG;YACW,iBAAiB;~~CA4ChC~~;AAyCD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa,CAAC,UAAU,CAAC;IAChE,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,WAAW,IAAI,WAAW,CAE7B;gBAEW,OAAO,EAAE,uBAAuB;IAItC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI7C,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzD,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQnD,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrE,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5E,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAIlF"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,KAAK,eAAe,GAAG;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC1C,CAAC;AAEF,KAAK,iBAAiB,GAAG,OAAO,GAAG,eAAe,CAAC;AAUnD,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;;;;;;;;;GAUG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,YAAY,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAEjH,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,oBAAoB,CAAU;IACtC,OAAO,CAAC,YAAY,CAAqB;IACzC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAA8D;IACzF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B,CAAkD;gBAE3E,OAAO,CAAC,EAAE,uBAAuB;IA8C7C;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IA2B9F,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAQxC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IA0BjD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IA4B1F,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI3D,eAAe,IAAI,MAAM,EAAE,GAAG,SAAS;IAKvC,oBAAoB,IAAI,cAAc;IAShC,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA8B7E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnF,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAa3D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAahD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAkDhE,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAKxD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAS3D,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAa1C,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAiB5D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAS1D;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;YAcvD,oBAAoB;IAgDlC;;;;;;;OAOG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BnF;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B,wEAAwE;IACxE,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB;;;;OAIG;YACW,OAAO;IAuBrB;;;OAGG;YACW,mBAAmB;IAmEjC;;;OAGG;YACW,iBAAiB;CAqDhC;AAyCD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa,CAAC,UAAU,CAAC;IAChE,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,WAAW,IAAI,WAAW,CAE7B;gBAEW,OAAO,EAAE,uBAAuB;IAItC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI7C,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzD,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQnD,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrE,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5E,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAIlF"}