@mastra/auth-studio 1.3.2 → 1.3.3

package/dist/index.js

@@ -1,812 +1,878 @@
-// ../../packages/_internals/auth/dist/chunk-LZCWL5CT.js
-var RESOURCE_EXPANSIONS = {
-  stored: [
-    "stored-agents",
-    "stored-mcp-clients",
-    "stored-prompt-blocks",
-    "stored-scorers",
-    "stored-skills",
-    "stored-workspaces"
-  ]
-};
+import { createHash } from "crypto";
+//#region ../../packages/_internals/auth/dist/ee-C8o0LZ3r.js
+/**
+* FGA enforcement utility for checking fine-grained authorization.
+*
+* @license Mastra Enterprise License - see ee/LICENSE
+*/
+/**
+* Compound resource keys that expand to a set of per-family resources.
+* A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`
+* (and `stored:*` matches any `stored-<family>:*`).
+*/
+const RESOURCE_EXPANSIONS = { stored: [
+	"stored-agents",
+	"stored-mcp-clients",
+	"stored-prompt-blocks",
+	"stored-scorers",
+	"stored-skills",
+	"stored-workspaces"
+] };
+/**
+* Check if a permission matches (including wildcard support).
+*
+* Permission format: `{resource}:{action}[:{resource-id}]`
+*
+* Examples:
+* - `*` matches everything
+* - `agents:*` matches `agents:read`, `agents:read:my-agent`
+* - `*:read` matches `agents:read`, `workflows:read` (action across all resources)
+* - `agents:read` matches `agents:read`, `agents:read:my-agent`
+* - `agents:read:my-agent` matches only `agents:read:my-agent`
+* - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`
+*
+* @param userPermission - Permission the user has
+* @param requiredPermission - Permission being checked
+* @returns True if permission matches
+*/
 function matchesPermission(userPermission, requiredPermission) {
-  if (userPermission === "*") {
-    return true;
-  }
-  const grantedParts = userPermission.split(":");
-  const requiredParts = requiredPermission.split(":");
-  const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
-  if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) {
-    const aliased = [requiredParts[0], ...grantedParts.slice(1)].join(":");
-    return matchesPermission(aliased, requiredPermission);
-  }
-  if (grantedParts.length < 2 || requiredParts.length < 2) {
-    return userPermission === requiredPermission;
-  }
-  const [grantedResource, grantedAction, grantedId] = grantedParts;
-  const [requiredResource, requiredAction, requiredId] = requiredParts;
-  if (grantedResource === "*") {
-    if (grantedAction === "*") {
-      if (grantedId === void 0) {
-        return true;
-      }
-      return grantedId === requiredId;
-    }
-    if (grantedAction !== requiredAction) {
-      return false;
-    }
-    if (grantedId === void 0) {
-      return true;
-    }
-    return grantedId === requiredId;
-  }
-  if (grantedResource !== requiredResource) {
-    return false;
-  }
-  if (grantedAction === "*") {
-    if (grantedId === void 0) {
-      return true;
-    }
-    return grantedId === requiredId;
-  }
-  if (grantedAction !== requiredAction) {
-    return false;
-  }
-  if (grantedId === void 0) {
-    return true;
-  }
-  return grantedId === requiredId;
+	if (userPermission === "*") return true;
+	const grantedParts = userPermission.split(":");
+	const requiredParts = requiredPermission.split(":");
+	const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
+	if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) return matchesPermission([requiredParts[0], ...grantedParts.slice(1)].join(":"), requiredPermission);
+	if (grantedParts.length < 2 || requiredParts.length < 2) return userPermission === requiredPermission;
+	const [grantedResource, grantedAction, grantedId] = grantedParts;
+	const [requiredResource, requiredAction, requiredId] = requiredParts;
+	if (grantedResource === "*") {
+		if (grantedAction === "*") {
+			if (grantedId === void 0) return true;
+			return grantedId === requiredId;
+		}
+		if (grantedAction !== requiredAction) return false;
+		if (grantedId === void 0) return true;
+		return grantedId === requiredId;
+	}
+	if (grantedResource !== requiredResource) return false;
+	if (grantedAction === "*") {
+		if (grantedId === void 0) return true;
+		return grantedId === requiredId;
+	}
+	if (grantedAction !== requiredAction) return false;
+	if (grantedId === void 0) return true;
+	return grantedId === requiredId;
 }
+/**
+* Resolve permissions from user roles using a role mapping.
+*
+* This function translates provider-defined roles (from WorkOS, Okta, etc.)
+* to Mastra permissions using a configurable mapping.
+*
+* @example
+* ```typescript
+* const roleMapping = {
+*   "Engineering": ["agents:*", "workflows:*"],
+*   "Product": ["agents:read"],
+*   "_default": [],
+* };
+*
+* // User has "Engineering" and "QA" roles
+* const permissions = resolvePermissionsFromMapping(
+*   ["Engineering", "QA"],
+*   roleMapping
+* );
+* // Result: ["agents:*", "workflows:*"] (QA is unmapped, gets _default)
+* ```
+*
+* @param roles - User's roles from the identity provider
+* @param mapping - Role to permission mapping
+* @returns Array of resolved permissions
+*/
 function resolvePermissionsFromMapping(roles, mapping) {
-  const permissions = /* @__PURE__ */ new Set();
-  const defaultPerms = mapping["_default"] ?? [];
-  for (const role of roles) {
-    const rolePerms = mapping[role];
-    if (rolePerms) {
-      for (const perm of rolePerms) {
-        permissions.add(perm);
-      }
-    } else {
-      for (const perm of defaultPerms) {
-        permissions.add(perm);
-      }
-    }
-  }
-  return Array.from(permissions);
+	const permissions = /* @__PURE__ */ new Set();
+	const defaultPerms = mapping["_default"] ?? [];
+	for (const role of roles) {
+		const rolePerms = mapping[role];
+		if (rolePerms) for (const perm of rolePerms) permissions.add(perm);
+		else for (const perm of defaultPerms) permissions.add(perm);
+	}
+	return Array.from(permissions);
 }
-
-// ../../packages/_internal-core/dist/chunk-3M4SEWMI.js
-var RegisteredLogger = {
-  LLM: "LLM"};
-var LogLevel = {
-  DEBUG: "debug",
-  INFO: "info",
-  WARN: "warn",
-  ERROR: "error"};
+/**
+* @mastra/core/auth/ee
+*
+* Enterprise authentication capabilities for Mastra.
+* This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
+*
+* @license Mastra Enterprise License - see ee/LICENSE
+* @packageDocumentation
+*/
+//#endregion
+//#region ../../packages/_internal-core/dist/logger/index.js
+const RegisteredLogger = {
+	AGENT: "AGENT",
+	OBSERVABILITY: "OBSERVABILITY",
+	AUTH: "AUTH",
+	BROWSER: "BROWSER",
+	NETWORK: "NETWORK",
+	WORKFLOW: "WORKFLOW",
+	LLM: "LLM",
+	TTS: "TTS",
+	VOICE: "VOICE",
+	VECTOR: "VECTOR",
+	BUNDLER: "BUNDLER",
+	DEPLOYER: "DEPLOYER",
+	MEMORY: "MEMORY",
+	STORAGE: "STORAGE",
+	EMBEDDINGS: "EMBEDDINGS",
+	MCP_SERVER: "MCP_SERVER",
+	SERVER_CACHE: "SERVER_CACHE",
+	SERVER: "SERVER",
+	WORKSPACE: "WORKSPACE",
+	CHANNEL: "CHANNEL"
+};
+const LogLevel = {
+	DEBUG: "debug",
+	INFO: "info",
+	WARN: "warn",
+	ERROR: "error",
+	NONE: "silent"
+};
 var MastraLogger = class {
-  name;
-  level;
-  transports;
-  constructor(options = {}) {
-    this.name = options.name || "Mastra";
-    this.level = options.level || LogLevel.ERROR;
-    this.transports = new Map(Object.entries(options.transports || {}));
-  }
-  getTransports() {
-    return this.transports;
-  }
-  trackException(_error, _metadata) {
-  }
-  async listLogs(transportId, params) {
-    if (!transportId || !this.transports.has(transportId)) {
-      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };
-    }
-    return this.transports.get(transportId).listLogs?.(params) ?? {
-      logs: [],
-      total: 0,
-      page: params?.page ?? 1,
-      perPage: params?.perPage ?? 100,
-      hasMore: false
-    };
-  }
-  async listLogsByRunId({
-    transportId,
-    runId,
-    fromDate,
-    toDate,
-    logLevel,
-    filters,
-    page,
-    perPage
-  }) {
-    if (!transportId || !this.transports.has(transportId) || !runId) {
-      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };
-    }
-    return this.transports.get(transportId).listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {
-      logs: [],
-      total: 0,
-      page: page ?? 1,
-      perPage: perPage ?? 100,
-      hasMore: false
-    };
-  }
+	name;
+	level;
+	transports;
+	constructor(options = {}) {
+		this.name = options.name || "Mastra";
+		this.level = options.level || LogLevel.ERROR;
+		this.transports = new Map(Object.entries(options.transports || {}));
+	}
+	getTransports() {
+		return this.transports;
+	}
+	trackException(_error, _metadata) {}
+	async listLogs(transportId, params) {
+		if (!transportId || !this.transports.has(transportId)) return {
+			logs: [],
+			total: 0,
+			page: params?.page ?? 1,
+			perPage: params?.perPage ?? 100,
+			hasMore: false
+		};
+		return this.transports.get(transportId).listLogs?.(params) ?? {
+			logs: [],
+			total: 0,
+			page: params?.page ?? 1,
+			perPage: params?.perPage ?? 100,
+			hasMore: false
+		};
+	}
+	async listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }) {
+		if (!transportId || !this.transports.has(transportId) || !runId) return {
+			logs: [],
+			total: 0,
+			page: page ?? 1,
+			perPage: perPage ?? 100,
+			hasMore: false
+		};
+		return this.transports.get(transportId).listLogsByRunId?.({
+			runId,
+			fromDate,
+			toDate,
+			logLevel,
+			filters,
+			page,
+			perPage
+		}) ?? {
+			logs: [],
+			total: 0,
+			page: page ?? 1,
+			perPage: perPage ?? 100,
+			hasMore: false
+		};
+	}
 };
-var ConsoleLogger = class _ConsoleLogger extends MastraLogger {
-  component;
-  filter;
-  constructor(options = {}) {
-    super(options);
-    this.component = options.component;
-    this.filter = options.filter;
-  }
-  child(componentOrBindings) {
-    const component = typeof componentOrBindings === "string" ? componentOrBindings : componentOrBindings?.component ?? this.component;
-    return new _ConsoleLogger({
-      name: this.name,
-      level: this.level,
-      component,
-      filter: this.filter
-    });
-  }
-  shouldLog(level, message, args) {
-    if (!this.filter) return true;
-    try {
-      return this.filter({ component: this.component, level, message, args });
-    } catch (e) {
-      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);
-      return true;
-    }
-  }
-  prefix() {
-    return this.component ? `[${this.component}] ` : "";
-  }
-  debug(message, ...args) {
-    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {
-      console.info(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  info(message, ...args) {
-    if ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) {
-      console.info(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  warn(message, ...args) {
-    if ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) {
-      console.warn(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  error(message, ...args) {
-    if ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) {
-      console.error(`${this.prefix()}${message}`, ...args);
-    }
-  }
-  async listLogs(_transportId, _params) {
-    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };
-  }
-  async listLogsByRunId(_args) {
-    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };
-  }
+var ConsoleLogger = class ConsoleLogger extends MastraLogger {
+	component;
+	filter;
+	constructor(options = {}) {
+		super(options);
+		this.component = options.component;
+		this.filter = options.filter;
+	}
+	child(componentOrBindings) {
+		const component = typeof componentOrBindings === "string" ? componentOrBindings : componentOrBindings?.component ?? this.component;
+		return new ConsoleLogger({
+			name: this.name,
+			level: this.level,
+			component,
+			filter: this.filter
+		});
+	}
+	shouldLog(level, message, args) {
+		if (!this.filter) return true;
+		try {
+			return this.filter({
+				component: this.component,
+				level,
+				message,
+				args
+			});
+		} catch (e) {
+			console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);
+			return true;
+		}
+	}
+	prefix() {
+		return this.component ? `[${this.component}] ` : "";
+	}
+	debug(message, ...args) {
+		if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) console.info(`${this.prefix()}${message}`, ...args);
+	}
+	info(message, ...args) {
+		if ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) console.info(`${this.prefix()}${message}`, ...args);
+	}
+	warn(message, ...args) {
+		if ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) console.warn(`${this.prefix()}${message}`, ...args);
+	}
+	error(message, ...args) {
+		if ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) console.error(`${this.prefix()}${message}`, ...args);
+	}
+	async listLogs(_transportId, _params) {
+		return {
+			logs: [],
+			total: 0,
+			page: _params?.page ?? 1,
+			perPage: _params?.perPage ?? 100,
+			hasMore: false
+		};
+	}
+	async listLogsByRunId(_args) {
+		return {
+			logs: [],
+			total: 0,
+			page: _args.page ?? 1,
+			perPage: _args.perPage ?? 100,
+			hasMore: false
+		};
+	}
 };
-
-// ../../packages/_internal-core/dist/base/index.js
+//#endregion
+//#region ../../packages/_internal-core/dist/base/index.js
 var MastraBase = class {
-  component = RegisteredLogger.LLM;
-  logger;
-  name;
-  #rawConfig;
-  constructor({
-    component,
-    name,
-    rawConfig
-  }) {
-    this.component = component || RegisteredLogger.LLM;
-    this.name = name;
-    this.#rawConfig = rawConfig;
-    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });
-  }
-  /**
-   * Returns the raw storage configuration this primitive was created from,
-   * or undefined if it was created from code.
-   */
-  toRawConfig() {
-    return this.#rawConfig;
-  }
-  /**
-   * Sets the raw storage configuration for this primitive.
-   * @internal
-   */
-  __setRawConfig(rawConfig) {
-    this.#rawConfig = rawConfig;
-  }
-  /**
-   * Set the logger for the agent
-   * @param logger
-   */
-  __setLogger(logger) {
-    this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
-  }
+	component = RegisteredLogger.LLM;
+	logger;
+	name;
+	#rawConfig;
+	constructor({ component, name, rawConfig }) {
+		this.component = component || RegisteredLogger.LLM;
+		this.name = name;
+		this.#rawConfig = rawConfig;
+		this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });
+	}
+	/**
+	* Returns the raw storage configuration this primitive was created from,
+	* or undefined if it was created from code.
+	*/
+	toRawConfig() {
+		return this.#rawConfig;
+	}
+	/**
+	* Sets the raw storage configuration for this primitive.
+	* @internal
+	*/
+	__setRawConfig(rawConfig) {
+		this.#rawConfig = rawConfig;
+	}
+	/**
+	* Set the logger for the agent
+	* @param logger
+	*/
+	__setLogger(logger) {
+		this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
+	}
 };
-
-// ../../packages/_internals/auth/dist/chunk-NJOKT6V5.js
+//#endregion
+//#region ../../packages/_internals/auth/dist/provider/index.js
 var MastraAuthProvider = class extends MastraBase {
-  protected;
-  public;
-  constructor(options) {
-    super({ component: "AUTH", name: options?.name });
-    if (options?.authorizeUser) {
-      this.authorizeUser = options.authorizeUser.bind(this);
-    }
-    this.protected = options?.protected;
-    this.public = options?.public;
-    this.mapUserToResourceId = options?.mapUserToResourceId;
-  }
-  registerOptions(opts) {
-    if (opts?.authorizeUser) {
-      this.authorizeUser = opts.authorizeUser.bind(this);
-    }
-    if (opts?.mapUserToResourceId) {
-      this.mapUserToResourceId = opts.mapUserToResourceId;
-    }
-    if (opts?.protected) {
-      this.protected = opts.protected;
-    }
-    if (opts?.public) {
-      this.public = opts.public;
-    }
-  }
+	protected;
+	public;
+	constructor(options) {
+		super({
+			component: "AUTH",
+			name: options?.name
+		});
+		if (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);
+		this.protected = options?.protected;
+		this.public = options?.public;
+		this.mapUserToResourceId = options?.mapUserToResourceId;
+	}
+	registerOptions(opts) {
+		if (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);
+		if (opts?.mapUserToResourceId) this.mapUserToResourceId = opts.mapUserToResourceId;
+		if (opts?.protected) this.protected = opts.protected;
+		if (opts?.public) this.public = opts.public;
+	}
 };
-
-// src/index.ts
-function getRequestHeader2(request, name) {
-  if (request instanceof Request) {
-    return request.headers.get(name);
-  }
-  return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
+//#endregion
+//#region src/index.ts
+function getRequestHeader(request, name) {
+	if (request instanceof Request) return request.headers.get(name);
+	return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
 }
-var COOKIE_NAME = "wos-session";
+const COOKIE_NAME = "wos-session";
+/**
+* Upper bound for shared-API verification fetches. Matches the platform API
+* client's request budget: a slow shared API must fail a single request in
+* bounded time instead of hanging every authenticated endpoint behind it.
+*/
+const VERIFY_FETCH_TIMEOUT_MS = 15e3;
+/**
+* How long a successful credential verification may be reused without
+* re-contacting the shared API. Bounds revocation lag: a signed-out or
+* revoked session can be honored for at most this long.
+*/
+const VERIFY_CACHE_TTL_MS = 3e4;
+/**
+* Auth provider for Mastra Studio deployed instances.
+*
+* Proxies all authentication through the shared API, keeping the
+* WorkOS API key safely in the shared API. Deployed instances only
+* need the shared API URL — no secrets required.
+*
+* The shared API's sealed session cookie (`wos-session`) is set with
+* `Domain=.mastra.ai` in production, so it's included in requests
+* to deployed instances and can be forwarded for validation.
+*/
 var MastraAuthStudio = class extends MastraAuthProvider {
-  isMastraCloudAuth = true;
-  sharedApiUrl;
-  organizationId;
-  useProductionCookies;
-  cookieDomain;
-  /**
-   * `userId → sealed session cookie` cache. The `IOrganizationsProvider`
-   * interface only hands us a `userId`, but the shared API's org endpoints are
-   * cookie-authenticated — so we remember the cookie last seen for a user
-   * inside `verifySessionCookie` and reuse it here. Kept small: bounded to
-   * the last 1000 users, LRU-evicted on insert.
-   */
-  userSessionCookies = /* @__PURE__ */ new Map();
-  maxCachedSessions = 1e3;
-  /**
-   * In-flight `ensureOrganization` promises keyed by userId. Concurrent calls
-   * for the same brand-new user (multiple tabs, parallel requests) would
-   * otherwise all see "no org" from `GET /auth/me` and each fire
-   * `POST /auth/orgs`, creating duplicate personal organizations. The first
-   * caller's promise is reused by every follower until it settles.
-   */
-  organizationBootstrapInFlight = /* @__PURE__ */ new Map();
-  constructor(options) {
-    super({ name: "mastra-studio", ...options });
-    const explicitSharedApiUrl = options?.sharedApiUrl || process.env.MASTRA_SHARED_API_URL;
-    this.sharedApiUrl = explicitSharedApiUrl || "https://platform.mastra.ai/v1";
-    this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID;
-    if (this.sharedApiUrl.endsWith("/")) {
-      this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
-    }
-    this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
-    let autoDetectMastraAi = false;
-    if (explicitSharedApiUrl) {
-      try {
-        const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();
-        autoDetectMastraAi = hostname === "mastra.ai" || hostname.endsWith(".mastra.ai");
-      } catch {
-        autoDetectMastraAi = false;
-      }
-    }
-    this.useProductionCookies = !!this.cookieDomain || autoDetectMastraAi;
-    if (!this.cookieDomain && autoDetectMastraAi) {
-      this.cookieDomain = ".mastra.ai";
-    }
-    if (options) {
-      this.registerOptions(options);
-    }
-  }
-  // ---------------------------------------------------------------------------
-  // MastraAuthProvider abstract methods
-  // ---------------------------------------------------------------------------
-  /**
-   * Authenticate an incoming request by forwarding the sealed session cookie
-   * to the shared API's /auth/me endpoint, or a Bearer token to /auth/verify.
-   */
-  async authenticateToken(token, request) {
-    let user = null;
-    const cookieHeader = getRequestHeader2(request, "Cookie");
-    const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);
-    if (sessionCookie) {
-      user = await this.verifySessionCookie(sessionCookie);
-    }
-    if (!user && token) {
-      user = await this.verifyBearerToken(token);
-    }
-    if (!user) return null;
-    if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) {
-      return null;
-    }
-    return user;
-  }
-  authorizeUser(user) {
-    return !!user?.id;
-  }
-  // ---------------------------------------------------------------------------
-  // ISSOProvider
-  // ---------------------------------------------------------------------------
-  getLoginUrl(redirectUri, state) {
-    let postLoginRedirect = "/";
-    if (state) {
-      const pipeIndex = state.indexOf("|");
-      if (pipeIndex !== -1) {
-        try {
-          postLoginRedirect = decodeURIComponent(state.slice(pipeIndex + 1));
-        } catch {
-        }
-      }
-    }
-    const params = new URLSearchParams({
-      product: "deploy",
-      redirect_uri: redirectUri,
-      post_login_redirect: postLoginRedirect,
-      // Force re-authentication so AuthKit always shows the account picker
-      prompt: "login",
-      ...this.organizationId ? { organization_id: this.organizationId } : {}
-    });
-    return `${this.sharedApiUrl}/auth/login?${params.toString()}`;
-  }
-  async handleCallback(code, _state) {
-    this.logger.debug("SSO callback: validating sealed session via shared API", {
-      sharedApiUrl: this.sharedApiUrl,
-      codeLength: code?.length
-    });
-    const user = await this.verifySessionCookie(code);
-    if (!user) {
-      this.logger.error("SSO callback: session validation failed \u2014 verifySessionCookie returned null", {
-        sharedApiUrl: this.sharedApiUrl,
-        codeLength: code?.length
-      });
-      throw new Error("Session validation failed");
-    }
-    return {
-      user,
-      tokens: {
-        accessToken: code
-      }
-    };
-  }
-  setCallbackCookieHeader(_cookieHeader) {
-  }
-  getLoginCookies() {
-    return void 0;
-  }
-  getLoginButtonConfig() {
-    return {
-      provider: "mastra-studio",
-      text: "Sign in with Mastra",
-      description: "Your deployed Studio is secured by your Mastra account. Sign in with the same email you used to sign up on mastra.ai."
-    };
-  }
-  async getLogoutUrl(_redirectUri, request) {
-    const cookieHeader = request?.headers.get("Cookie");
-    const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);
-    if (!sessionCookie) return null;
-    try {
-      const res = await fetch(`${this.sharedApiUrl}/auth/logout`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Cookie: `${COOKIE_NAME}=${sessionCookie}`
-        }
-      });
-      if (res.ok) {
-        const data = await res.json();
-        return data.logoutUrl ?? null;
-      }
-    } catch {
-    }
-    return null;
-  }
-  // ---------------------------------------------------------------------------
-  // ISessionProvider
-  // ---------------------------------------------------------------------------
-  async createSession(userId, metadata) {
-    const now = /* @__PURE__ */ new Date();
-    return {
-      id: metadata?.accessToken || crypto.randomUUID(),
-      userId,
-      expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1e3),
-      // 24 hours
-      createdAt: now,
-      metadata
-    };
-  }
-  async validateSession(sessionId) {
-    const user = await this.verifySessionCookie(sessionId);
-    if (!user) return null;
-    const now = /* @__PURE__ */ new Date();
-    return {
-      id: sessionId,
-      userId: user.id,
-      expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1e3),
-      createdAt: now
-    };
-  }
-  async destroySession(sessionId) {
-    try {
-      await fetch(`${this.sharedApiUrl}/auth/logout`, {
-        method: "POST",
-        headers: {
-          Cookie: `${COOKIE_NAME}=${sessionId}`
-        }
-      });
-    } catch {
-    }
-  }
-  async refreshSession(sessionId) {
-    try {
-      const res = await fetch(`${this.sharedApiUrl}/auth/refresh`, {
-        method: "GET",
-        headers: {
-          Cookie: `${COOKIE_NAME}=${sessionId}`
-        }
-      });
-      if (!res.ok) {
-        this.logger.warn("refreshSession: shared API refresh returned non-OK status", {
-          status: res.status,
-          url: `${this.sharedApiUrl}/auth/refresh`
-        });
-        return this.validateSession(sessionId);
-      }
-      const setCookie = res.headers.get("Set-Cookie");
-      const newSessionId = setCookie ? parseCookieFromHeader(setCookie, COOKIE_NAME) : null;
-      if (!newSessionId) {
-        this.logger.warn("refreshSession: no Set-Cookie header in refresh response");
-        return this.validateSession(sessionId);
-      }
-      const user = await this.verifySessionCookie(newSessionId);
-      if (!user) return null;
-      const now = /* @__PURE__ */ new Date();
-      return {
-        id: newSessionId,
-        userId: user.id,
-        expiresAt: new Date(now.getTime() + 24 * 60 * 60 * 1e3),
-        createdAt: now
-      };
-    } catch (error) {
-      this.logger.error("refreshSession: fetch to shared API failed", {
-        url: `${this.sharedApiUrl}/auth/refresh`,
-        error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error)
-      });
-      return this.validateSession(sessionId);
-    }
-  }
-  getSessionIdFromRequest(request) {
-    const cookieHeader = request.headers.get("Cookie");
-    return parseCookie(cookieHeader, COOKIE_NAME);
-  }
-  getSessionHeaders(session) {
-    const parts = [`${COOKIE_NAME}=${session.id}`, "HttpOnly", "SameSite=Lax", "Path=/", "Max-Age=86400"];
-    if (this.useProductionCookies && this.cookieDomain) {
-      parts.push("Secure");
-      parts.push(`Domain=${this.cookieDomain}`);
-    }
-    return { "Set-Cookie": parts.join("; ") };
-  }
-  getClearSessionHeaders() {
-    const parts = [`${COOKIE_NAME}=`, "HttpOnly", "SameSite=Lax", "Path=/", "Max-Age=0"];
-    if (this.useProductionCookies && this.cookieDomain) {
-      parts.push("Secure");
-      parts.push(`Domain=${this.cookieDomain}`);
-    }
-    return { "Set-Cookie": parts.join("; ") };
-  }
-  // ---------------------------------------------------------------------------
-  // IUserProvider
-  // ---------------------------------------------------------------------------
-  async getCurrentUser(request) {
-    const cookieHeader = request.headers.get("Cookie");
-    const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);
-    if (sessionCookie) {
-      return this.verifySessionCookie(sessionCookie);
-    }
-    const authHeader = request.headers.get("Authorization");
-    if (authHeader?.startsWith("Bearer ")) {
-      return this.verifyBearerToken(authHeader.slice(7));
-    }
-    return null;
-  }
-  async getUser(_userId) {
-    return null;
-  }
-  // ---------------------------------------------------------------------------
-  // IOrganizationsProvider
-  // ---------------------------------------------------------------------------
-  /**
-   * Ensure the user belongs to an organization, bootstrapping a personal org
-   * on first use when they have none.
-   *
-   * Because the shared API's org endpoints are cookie-authenticated but this
-   * method only receives a userId, we look up the user's sealed session cookie
-   * from the {@link userSessionCookies} cache populated by
-   * {@link verifySessionCookie}. If we have never seen a cookie for this user
-   * (e.g. bearer-token flow, or the cache was evicted), we skip bootstrap and
-   * return `undefined` — the caller keeps the user in their current no-org
-   * state and the next authenticated request retries.
-   *
-   * Best-effort: any shared-API failure returns `undefined` rather than
-   * throwing, mirroring `MastraAuthWorkos.ensureOrganization`.
-   */
-  async ensureOrganization(userId) {
-    const inFlight = this.organizationBootstrapInFlight.get(userId);
-    if (inFlight) return inFlight;
-    const bootstrap = this.doEnsureOrganization(userId).finally(() => {
-      this.organizationBootstrapInFlight.delete(userId);
-    });
-    this.organizationBootstrapInFlight.set(userId, bootstrap);
-    return bootstrap;
-  }
-  async doEnsureOrganization(userId) {
-    const sessionCookie = this.userSessionCookies.get(userId);
-    if (!sessionCookie) {
-      this.logger.debug("ensureOrganization: no cached session cookie for user; skipping bootstrap", { userId });
-      return void 0;
-    }
-    try {
-      const me = await this.fetchMe(sessionCookie);
-      if (me?.organizationId) return me.organizationId;
-      if (me?.memberOrgIds && me.memberOrgIds.length > 0) return me.memberOrgIds[0];
-      const orgName = me?.user?.email ? `${me.user.email}'s org` : `Personal (${userId})`;
-      const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Cookie: `${COOKIE_NAME}=${sessionCookie}`
-        },
-        body: JSON.stringify({ name: orgName })
-      });
-      if (!res.ok) {
-        this.logger.warn("ensureOrganization: shared API POST /auth/orgs returned non-OK", {
-          status: res.status,
-          userId
-        });
-        return void 0;
-      }
-      const data = await res.json();
-      return data.organization?.id;
-    } catch (error) {
-      this.logger.error("ensureOrganization: fetch to shared API failed", {
-        userId,
-        error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error)
-      });
-      return void 0;
-    }
-  }
-  /**
-   * Whether the user holds an admin-equivalent role in the organization.
-   *
-   * Fast path: if the org matches the user's currently-active session org, we
-   * read the role directly from `/auth/me`. Cross-org path: we call
-   * `/auth/orgs` (which returns per-membership roles) and look up the target
-   * org. Any shared-API failure resolves to `false`.
-   */
-  async isOrganizationAdmin(organizationId, userId) {
-    const sessionCookie = this.userSessionCookies.get(userId);
-    if (!sessionCookie) return false;
-    try {
-      const me = await this.fetchMe(sessionCookie);
-      if (me?.organizationId === organizationId) {
-        return isAdminRole(me.role);
-      }
-      const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
-        headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` }
-      });
-      if (!res.ok) return false;
-      const data = await res.json();
-      const membership = data.organizations?.find((o) => o.id === organizationId);
-      return isAdminRole(membership?.role ?? void 0);
-    } catch {
-      return false;
-    }
-  }
-  // ---------------------------------------------------------------------------
-  // Internal helpers
-  // ---------------------------------------------------------------------------
-  /**
-   * Record the sealed session cookie last seen for a user so
-   * {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
-   * behalf. LRU-evicted at {@link maxCachedSessions} entries.
-   */
-  rememberUserSession(userId, sessionCookie) {
-    this.userSessionCookies.delete(userId);
-    this.userSessionCookies.set(userId, sessionCookie);
-    if (this.userSessionCookies.size > this.maxCachedSessions) {
-      const oldest = this.userSessionCookies.keys().next().value;
-      if (oldest !== void 0) this.userSessionCookies.delete(oldest);
-    }
-  }
-  /**
-   * Fetch the shared API's `/auth/me` and return the raw response body, or
-   * `null` on any non-OK / network error. Split out so `ensureOrganization`
-   * and `isOrganizationAdmin` can reuse it without duplicating the shape.
-   */
-  async fetchMe(sessionCookie) {
-    try {
-      const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
-        headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` }
-      });
-      if (!res.ok) return null;
-      return await res.json();
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Forward a sealed session cookie to the shared API's /auth/me endpoint
-   * to validate it and get user info.
-   */
-  async verifySessionCookie(sessionCookie) {
-    try {
-      const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
-        headers: {
-          Cookie: `${COOKIE_NAME}=${sessionCookie}`
-        }
-      });
-      if (!res.ok) {
-        this.logger.warn("verifySessionCookie: shared API returned non-OK status", {
-          status: res.status,
-          statusText: res.statusText,
-          url: `${this.sharedApiUrl}/auth/me`
-        });
-        return null;
-      }
-      const data = await res.json();
-      this.rememberUserSession(data.user.id, sessionCookie);
-      return {
-        id: data.user.id,
-        email: data.user.email,
-        name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
-        avatarUrl: data.user.profilePictureUrl,
-        organizationId: data.organizationId,
-        role: data.role,
-        permissions: data.permissions,
-        memberOrgIds: data.memberOrgIds
-      };
-    } catch (error) {
-      this.logger.error("verifySessionCookie: fetch to shared API failed", {
-        url: `${this.sharedApiUrl}/auth/me`,
-        error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error)
-      });
-      return null;
-    }
-  }
-  /**
-   * Forward a Bearer token to the shared API's /auth/verify endpoint
-   * to validate it and get user info (used for CLI tokens).
-   */
-  async verifyBearerToken(token) {
-    try {
-      const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {
-        headers: {
-          Authorization: `Bearer ${token}`
-        }
-      });
-      if (!res.ok) {
-        this.logger.warn("verifyBearerToken: shared API returned non-OK status", {
-          status: res.status,
-          url: `${this.sharedApiUrl}/auth/verify`
-        });
-        return null;
-      }
-      const data = await res.json();
-      return {
-        id: data.user.id,
-        email: data.user.email,
-        name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
-        organizationId: data.organizationId,
-        role: data.role,
-        memberOrgIds: data.memberOrgIds
-      };
-    } catch (error) {
-      this.logger.error("verifyBearerToken: fetch to shared API failed", {
-        url: `${this.sharedApiUrl}/auth/verify`,
-        error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error)
-      });
-      return null;
-    }
-  }
+	isMastraCloudAuth = true;
+	sharedApiUrl;
+	organizationId;
+	useProductionCookies;
+	cookieDomain;
+	/**
+	* `userId → sealed session cookie` cache. The `IOrganizationsProvider`
+	* interface only hands us a `userId`, but the shared API's org endpoints are
+	* cookie-authenticated — so we remember the cookie last seen for a user
+	* inside `verifySessionCookie` and reuse it here. Kept small: bounded to
+	* the last 1000 users, LRU-evicted on insert.
+	*/
+	userSessionCookies = /* @__PURE__ */ new Map();
+	maxCachedSessions = 1e3;
+	/**
+	* Short-TTL cache of SUCCESSFUL credential verifications, keyed by a
+	* sha256 of the credential (never the raw cookie/token). Every protected
+	* request re-verifies against the shared API otherwise — one network
+	* round trip per request. Failures are never cached, so a rejected
+	* credential is always re-checked. Bounded + insert-order evicted.
+	*/
+	verifiedCredentials = /* @__PURE__ */ new Map();
+	maxCachedVerifications = 1e3;
+	/**
+	* In-flight `ensureOrganization` promises keyed by userId. Concurrent calls
+	* for the same brand-new user (multiple tabs, parallel requests) would
+	* otherwise all see "no org" from `GET /auth/me` and each fire
+	* `POST /auth/orgs`, creating duplicate personal organizations. The first
+	* caller's promise is reused by every follower until it settles.
+	*/
+	organizationBootstrapInFlight = /* @__PURE__ */ new Map();
+	constructor(options) {
+		super({
+			name: "mastra-studio",
+			...options
+		});
+		const explicitSharedApiUrl = options?.sharedApiUrl || process.env.MASTRA_SHARED_API_URL;
+		this.sharedApiUrl = explicitSharedApiUrl || "https://platform.mastra.ai/v1";
+		this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID;
+		if (this.sharedApiUrl.endsWith("/")) this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
+		this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
+		let autoDetectMastraAi = false;
+		if (explicitSharedApiUrl) try {
+			const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();
+			autoDetectMastraAi = hostname === "mastra.ai" || hostname.endsWith(".mastra.ai");
+		} catch {
+			autoDetectMastraAi = false;
+		}
+		this.useProductionCookies = !!this.cookieDomain || autoDetectMastraAi;
+		if (!this.cookieDomain && autoDetectMastraAi) this.cookieDomain = ".mastra.ai";
+		if (options) this.registerOptions(options);
+	}
+	/**
+	* Authenticate an incoming request by forwarding the sealed session cookie
+	* to the shared API's /auth/me endpoint, or a Bearer token to /auth/verify.
+	*/
+	async authenticateToken(token, request) {
+		let user = null;
+		const sessionCookie = parseCookie(getRequestHeader(request, "Cookie"), COOKIE_NAME);
+		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie);
+		if (!user && token) user = await this.verifyBearerToken(token);
+		if (!user) return null;
+		if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) return null;
+		return user;
+	}
+	authorizeUser(user) {
+		return !!user?.id;
+	}
+	getLoginUrl(redirectUri, state) {
+		let postLoginRedirect = "/";
+		if (state) {
+			const pipeIndex = state.indexOf("|");
+			if (pipeIndex !== -1) try {
+				postLoginRedirect = decodeURIComponent(state.slice(pipeIndex + 1));
+			} catch {}
+		}
+		const params = new URLSearchParams({
+			product: "deploy",
+			redirect_uri: redirectUri,
+			post_login_redirect: postLoginRedirect,
+			prompt: "login",
+			...this.organizationId ? { organization_id: this.organizationId } : {}
+		});
+		return `${this.sharedApiUrl}/auth/login?${params.toString()}`;
+	}
+	async handleCallback(code, _state) {
+		this.logger.debug("SSO callback: validating sealed session via shared API", {
+			sharedApiUrl: this.sharedApiUrl,
+			codeLength: code?.length
+		});
+		const user = await this.verifySessionCookie(code);
+		if (!user) {
+			this.logger.error("SSO callback: session validation failed — verifySessionCookie returned null", {
+				sharedApiUrl: this.sharedApiUrl,
+				codeLength: code?.length
+			});
+			throw new Error("Session validation failed");
+		}
+		return {
+			user,
+			tokens: { accessToken: code }
+		};
+	}
+	setCallbackCookieHeader(_cookieHeader) {}
+	getLoginCookies() {}
+	getLoginButtonConfig() {
+		return {
+			provider: "mastra-studio",
+			text: "Sign in with Mastra",
+			description: "Your deployed Studio is secured by your Mastra account. Sign in with the same email you used to sign up on mastra.ai."
+		};
+	}
+	async getLogoutUrl(_redirectUri, request) {
+		const cookieHeader = request?.headers.get("Cookie");
+		const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);
+		if (!sessionCookie) return null;
+		try {
+			const res = await fetch(`${this.sharedApiUrl}/auth/logout`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Cookie: `${COOKIE_NAME}=${sessionCookie}`
+				}
+			});
+			if (res.ok) return (await res.json()).logoutUrl ?? null;
+		} catch {}
+		return null;
+	}
+	async createSession(userId, metadata) {
+		const now = /* @__PURE__ */ new Date();
+		return {
+			id: metadata?.accessToken || crypto.randomUUID(),
+			userId,
+			expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+			createdAt: now,
+			metadata
+		};
+	}
+	async validateSession(sessionId) {
+		const user = await this.verifySessionCookie(sessionId);
+		if (!user) return null;
+		const now = /* @__PURE__ */ new Date();
+		return {
+			id: sessionId,
+			userId: user.id,
+			expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+			createdAt: now
+		};
+	}
+	async destroySession(sessionId) {
+		try {
+			await fetch(`${this.sharedApiUrl}/auth/logout`, {
+				method: "POST",
+				headers: { Cookie: `${COOKIE_NAME}=${sessionId}` }
+			});
+		} catch {}
+	}
+	async refreshSession(sessionId) {
+		try {
+			const res = await fetch(`${this.sharedApiUrl}/auth/refresh`, {
+				method: "GET",
+				headers: { Cookie: `${COOKIE_NAME}=${sessionId}` }
+			});
+			if (!res.ok) {
+				this.logger.warn("refreshSession: shared API refresh returned non-OK status", {
+					status: res.status,
+					url: `${this.sharedApiUrl}/auth/refresh`
+				});
+				return this.validateSession(sessionId);
+			}
+			const setCookie = res.headers.get("Set-Cookie");
+			const newSessionId = setCookie ? parseCookieFromHeader(setCookie, COOKIE_NAME) : null;
+			if (!newSessionId) {
+				this.logger.warn("refreshSession: no Set-Cookie header in refresh response");
+				return this.validateSession(sessionId);
+			}
+			const user = await this.verifySessionCookie(newSessionId);
+			if (!user) return null;
+			const now = /* @__PURE__ */ new Date();
+			return {
+				id: newSessionId,
+				userId: user.id,
+				expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+				createdAt: now
+			};
+		} catch (error) {
+			this.logger.error("refreshSession: fetch to shared API failed", {
+				url: `${this.sharedApiUrl}/auth/refresh`,
+				error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : String(error)
+			});
+			return this.validateSession(sessionId);
+		}
+	}
+	getSessionIdFromRequest(request) {
+		return parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
+	}
+	getSessionHeaders(session) {
+		const parts = [
+			`${COOKIE_NAME}=${session.id}`,
+			"HttpOnly",
+			"SameSite=Lax",
+			"Path=/",
+			"Max-Age=86400"
+		];
+		if (this.useProductionCookies && this.cookieDomain) {
+			parts.push("Secure");
+			parts.push(`Domain=${this.cookieDomain}`);
+		}
+		return { "Set-Cookie": parts.join("; ") };
+	}
+	getClearSessionHeaders() {
+		const parts = [
+			`${COOKIE_NAME}=`,
+			"HttpOnly",
+			"SameSite=Lax",
+			"Path=/",
+			"Max-Age=0"
+		];
+		if (this.useProductionCookies && this.cookieDomain) {
+			parts.push("Secure");
+			parts.push(`Domain=${this.cookieDomain}`);
+		}
+		return { "Set-Cookie": parts.join("; ") };
+	}
+	async getCurrentUser(request) {
+		const sessionCookie = parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
+		if (sessionCookie) return this.verifySessionCookie(sessionCookie);
+		const authHeader = request.headers.get("Authorization");
+		if (authHeader?.startsWith("Bearer ")) return this.verifyBearerToken(authHeader.slice(7));
+		return null;
+	}
+	async getUser(_userId) {
+		return null;
+	}
+	/**
+	* Ensure the user belongs to an organization, bootstrapping a personal org
+	* on first use when they have none.
+	*
+	* Because the shared API's org endpoints are cookie-authenticated but this
+	* method only receives a userId, we look up the user's sealed session cookie
+	* from the {@link userSessionCookies} cache populated by
+	* {@link verifySessionCookie}. If we have never seen a cookie for this user
+	* (e.g. bearer-token flow, or the cache was evicted), we skip bootstrap and
+	* return `undefined` — the caller keeps the user in their current no-org
+	* state and the next authenticated request retries.
+	*
+	* Best-effort: any shared-API failure returns `undefined` rather than
+	* throwing, mirroring `MastraAuthWorkos.ensureOrganization`.
+	*/
+	async ensureOrganization(userId) {
+		const inFlight = this.organizationBootstrapInFlight.get(userId);
+		if (inFlight) return inFlight;
+		const bootstrap = this.doEnsureOrganization(userId).finally(() => {
+			this.organizationBootstrapInFlight.delete(userId);
+		});
+		this.organizationBootstrapInFlight.set(userId, bootstrap);
+		return bootstrap;
+	}
+	async doEnsureOrganization(userId) {
+		const sessionCookie = this.userSessionCookies.get(userId);
+		if (!sessionCookie) {
+			this.logger.debug("ensureOrganization: no cached session cookie for user; skipping bootstrap", { userId });
+			return;
+		}
+		try {
+			const me = await this.fetchMe(sessionCookie);
+			if (me?.organizationId) return me.organizationId;
+			if (me?.memberOrgIds && me.memberOrgIds.length > 0) return me.memberOrgIds[0];
+			const orgName = me?.user?.email ? `${me.user.email}'s org` : `Personal (${userId})`;
+			const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Cookie: `${COOKIE_NAME}=${sessionCookie}`
+				},
+				body: JSON.stringify({ name: orgName })
+			});
+			if (!res.ok) {
+				this.logger.warn("ensureOrganization: shared API POST /auth/orgs returned non-OK", {
+					status: res.status,
+					userId
+				});
+				return;
+			}
+			return (await res.json()).organization?.id;
+		} catch (error) {
+			this.logger.error("ensureOrganization: fetch to shared API failed", {
+				userId,
+				error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : String(error)
+			});
+			return;
+		}
+	}
+	/**
+	* Whether the user holds an admin-equivalent role in the organization.
+	*
+	* Fast path: if the org matches the user's currently-active session org, we
+	* read the role directly from `/auth/me`. Cross-org path: we call
+	* `/auth/orgs` (which returns per-membership roles) and look up the target
+	* org. Any shared-API failure resolves to `false`.
+	*/
+	async isOrganizationAdmin(organizationId, userId) {
+		const sessionCookie = this.userSessionCookies.get(userId);
+		if (!sessionCookie) return false;
+		try {
+			const me = await this.fetchMe(sessionCookie);
+			if (me?.organizationId === organizationId) return isAdminRole(me.role);
+			const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, { headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` } });
+			if (!res.ok) return false;
+			const membership = (await res.json()).organizations?.find((o) => o.id === organizationId);
+			return isAdminRole(membership?.role ?? void 0);
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Record the sealed session cookie last seen for a user so
+	* {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
+	* behalf. LRU-evicted at {@link maxCachedSessions} entries.
+	*/
+	rememberUserSession(userId, sessionCookie) {
+		this.userSessionCookies.delete(userId);
+		this.userSessionCookies.set(userId, sessionCookie);
+		if (this.userSessionCookies.size > this.maxCachedSessions) {
+			const oldest = this.userSessionCookies.keys().next().value;
+			if (oldest !== void 0) this.userSessionCookies.delete(oldest);
+		}
+	}
+	/** Cache key for a verified credential — hash, never the raw secret. */
+	verificationKey(kind, credential) {
+		return createHash("sha256").update(`${kind}:${credential}`).digest("hex");
+	}
+	getCachedVerification(key) {
+		const entry = this.verifiedCredentials.get(key);
+		if (!entry) return null;
+		if (entry.expiresAt <= Date.now()) {
+			this.verifiedCredentials.delete(key);
+			return null;
+		}
+		return entry.user;
+	}
+	cacheVerification(key, user) {
+		this.verifiedCredentials.delete(key);
+		this.verifiedCredentials.set(key, {
+			user,
+			expiresAt: Date.now() + VERIFY_CACHE_TTL_MS
+		});
+		if (this.verifiedCredentials.size > this.maxCachedVerifications) {
+			const oldest = this.verifiedCredentials.keys().next().value;
+			if (oldest !== void 0) this.verifiedCredentials.delete(oldest);
+		}
+	}
+	/**
+	* Fetch the shared API's `/auth/me` and return the raw response body, or
+	* `null` on any non-OK / network error. Split out so `ensureOrganization`
+	* and `isOrganizationAdmin` can reuse it without duplicating the shape.
+	*/
+	async fetchMe(sessionCookie) {
+		try {
+			const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
+				headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
+				signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
+			});
+			if (!res.ok) return null;
+			return await res.json();
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Forward a sealed session cookie to the shared API's /auth/me endpoint
+	* to validate it and get user info.
+	*/
+	async verifySessionCookie(sessionCookie) {
+		const cacheKey = this.verificationKey("cookie", sessionCookie);
+		const cached = this.getCachedVerification(cacheKey);
+		if (cached) {
+			this.rememberUserSession(cached.id, sessionCookie);
+			return cached;
+		}
+		try {
+			const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
+				headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
+				signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
+			});
+			if (!res.ok) {
+				this.logger.warn("verifySessionCookie: shared API returned non-OK status", {
+					status: res.status,
+					statusText: res.statusText,
+					url: `${this.sharedApiUrl}/auth/me`
+				});
+				return null;
+			}
+			const data = await res.json();
+			this.rememberUserSession(data.user.id, sessionCookie);
+			const user = {
+				id: data.user.id,
+				email: data.user.email,
+				name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
+				avatarUrl: data.user.profilePictureUrl,
+				organizationId: data.organizationId,
+				role: data.role,
+				permissions: data.permissions,
+				memberOrgIds: data.memberOrgIds
+			};
+			if (user.organizationId) this.cacheVerification(cacheKey, user);
+			return user;
+		} catch (error) {
+			this.logger.error("verifySessionCookie: fetch to shared API failed", {
+				url: `${this.sharedApiUrl}/auth/me`,
+				error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : String(error)
+			});
+			return null;
+		}
+	}
+	/**
+	* Forward a Bearer token to the shared API's /auth/verify endpoint
+	* to validate it and get user info (used for CLI tokens).
+	*/
+	async verifyBearerToken(token) {
+		const cacheKey = this.verificationKey("bearer", token);
+		const cached = this.getCachedVerification(cacheKey);
+		if (cached) return cached;
+		try {
+			const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {
+				headers: { Authorization: `Bearer ${token}` },
+				signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
+			});
+			if (!res.ok) {
+				this.logger.warn("verifyBearerToken: shared API returned non-OK status", {
+					status: res.status,
+					url: `${this.sharedApiUrl}/auth/verify`
+				});
+				return null;
+			}
+			const data = await res.json();
+			const user = {
+				id: data.user.id,
+				email: data.user.email,
+				name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
+				organizationId: data.organizationId,
+				role: data.role,
+				memberOrgIds: data.memberOrgIds
+			};
+			if (user.organizationId) this.cacheVerification(cacheKey, user);
+			return user;
+		} catch (error) {
+			this.logger.error("verifyBearerToken: fetch to shared API failed", {
+				url: `${this.sharedApiUrl}/auth/verify`,
+				error: error instanceof Error ? {
+					message: error.message,
+					stack: error.stack
+				} : String(error)
+			});
+			return null;
+		}
+	}
 };
 function parseCookie(cookieHeader, name) {
-  if (!cookieHeader) return null;
-  const match = cookieHeader.match(new RegExp(`${name}=([^;]+)`));
-  return match?.[1] ?? null;
+	if (!cookieHeader) return null;
+	return cookieHeader.match(new RegExp(`${name}=([^;]+)`))?.[1] ?? null;
 }
+/**
+* WorkOS AuthKit conventionally uses `admin` / `owner` for admin-equivalent
+* roles; the shared API surfaces the WorkOS role slug directly on
+* `/auth/me` and `/auth/orgs`.
+*/
 function isAdminRole(role) {
-  return role === "admin" || role === "owner";
+	return role === "admin" || role === "owner";
 }
+/**
+* Parse a cookie value from a Set-Cookie header.
+* Set-Cookie format: "name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400"
+*/
 function parseCookieFromHeader(setCookieHeader, name) {
-  const parts = setCookieHeader.split(";");
-  if (parts.length === 0) return null;
-  const [cookieName, ...valueParts] = parts[0].split("=");
-  if (cookieName?.trim() !== name) return null;
-  return valueParts.join("=") || null;
+	const parts = setCookieHeader.split(";");
+	if (parts.length === 0) return null;
+	const [cookieName, ...valueParts] = parts[0].split("=");
+	if (cookieName?.trim() !== name) return null;
+	return valueParts.join("=") || null;
 }
+/**
+* RBAC provider for Mastra Studio authentication.
+*
+* Maps user roles (from the shared API's /auth/me endpoint) to Mastra permissions
+* using a configurable role mapping.
+*/
 var MastraRBACStudio = class {
-  options;
-  get roleMapping() {
-    return this.options.roleMapping;
-  }
-  constructor(options) {
-    this.options = options;
-  }
-  async getRoles(user) {
-    return user.role ? [user.role] : [];
-  }
-  async hasRole(user, role) {
-    const roles = await this.getRoles(user);
-    return roles.includes(role);
-  }
-  async getPermissions(user) {
-    const roles = await this.getRoles(user);
-    if (roles.length === 0) {
-      return this.options.roleMapping["_default"] ?? [];
-    }
-    return resolvePermissionsFromMapping(roles, this.options.roleMapping);
-  }
-  async hasPermission(user, permission) {
-    const permissions = await this.getPermissions(user);
-    return permissions.some((p) => matchesPermission(p, permission));
-  }
-  async hasAllPermissions(user, permissions) {
-    const userPermissions = await this.getPermissions(user);
-    return permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));
-  }
-  async hasAnyPermission(user, permissions) {
-    const userPermissions = await this.getPermissions(user);
-    return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
-  }
+	options;
+	get roleMapping() {
+		return this.options.roleMapping;
+	}
+	constructor(options) {
+		this.options = options;
+	}
+	async getRoles(user) {
+		return user.role ? [user.role] : [];
+	}
+	async hasRole(user, role) {
+		return (await this.getRoles(user)).includes(role);
+	}
+	async getPermissions(user) {
+		const roles = await this.getRoles(user);
+		if (roles.length === 0) return this.options.roleMapping["_default"] ?? [];
+		return resolvePermissionsFromMapping(roles, this.options.roleMapping);
+	}
+	async hasPermission(user, permission) {
+		return (await this.getPermissions(user)).some((p) => matchesPermission(p, permission));
+	}
+	async hasAllPermissions(user, permissions) {
+		const userPermissions = await this.getPermissions(user);
+		return permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));
+	}
+	async hasAnyPermission(user, permissions) {
+		const userPermissions = await this.getPermissions(user);
+		return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
+	}
 };
-/**
- * EE Authentication Interfaces
- *
- * Enterprise interfaces for RBAC, ACL, and advanced authorization.
- *
- * @license Mastra Enterprise License - see ee/LICENSE
- * @packageDocumentation
- */
-/**
- * FGA enforcement utility for checking fine-grained authorization.
- *
- * @license Mastra Enterprise License - see ee/LICENSE
- */
-/**
- * RBAC provider implementations.
- *
- * @license Mastra Enterprise License - see ee/LICENSE
- */
-/**
- * Default implementations for EE authentication.
- *
- * @license Mastra Enterprise License - see ee/LICENSE
- */
-/**
- * @mastra/core/auth/ee
- *
- * Enterprise authentication capabilities for Mastra.
- * This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
- *
- * @license Mastra Enterprise License - see ee/LICENSE
- * @packageDocumentation
- */
-
+//#endregion
 export { MastraAuthStudio, MastraRBACStudio };
-//# sourceMappingURL=index.js.map
+
 //# sourceMappingURL=index.js.map