@mastra/auth-studio 1.3.8 → 1.3.9

package/dist/index.d.ts

@@ -32,6 +32,13 @@ export interface MastraAuthStudioOptions extends MastraAuthProviderOptions<Studi
      * Can also be set via MASTRA_COOKIE_DOMAIN environment variable.
      */
     cookieDomain?: string;
+    /**
+     * Lifetime of the session cookie (and Session.expiresAt) in seconds.
+     * Should match the identity provider's maximum session length.
+     * Can also be set via MASTRA_SESSION_MAX_AGE environment variable.
+     * Defaults to 14 days.
+     */
+    sessionMaxAgeSeconds?: number;
 }
 /**
  * Auth provider for Mastra Studio deployed instances.
@@ -50,6 +57,7 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
     private organizationId;
     private useProductionCookies;
     private cookieDomain;
+    private sessionMaxAgeSeconds;
     /**
      * `userId → sealed session cookie` cache. The `IOrganizationsProvider`
      * interface only hands us a `userId`, but the shared API's org endpoints are
@@ -76,6 +84,19 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
      * caller's promise is reused by every follower until it settles.
      */
     private organizationBootstrapInFlight;
+    /**
+     * Per-request response headers to forward to the browser — specifically a
+     * rotated `wos-session` `Set-Cookie` returned by the shared API when the
+     * platform `sessionAuth` middleware transparently refreshes an expired
+     * access token. Without this, the browser's sealed cookie would never
+     * rotate: platform would succeed server-to-server by refreshing on every
+     * request, but the next refresh would hit `invalid_grant` once WorkOS
+     * invalidated the previous refresh token.
+     *
+     * Keyed by the underlying `Request` (via `getWebRequest`) so we don't retain
+     * requests after the response is written.
+     */
+    private pendingResponseHeaders;
     constructor(options?: MastraAuthStudioOptions);
     /**
      * Authenticate an incoming request by forwarding the sealed session cookie
@@ -137,6 +158,25 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
     private verificationKey;
     private getCachedVerification;
     private cacheVerification;
+    /**
+     * Read every `Set-Cookie` header from a response, falling back to the
+     * single-value accessor on runtimes without `Headers.getSetCookie()`.
+     */
+    private readSetCookieHeaders;
+    /**
+     * If the shared API rotated the sealed `wos-session` cookie on this
+     * response, stash the `Set-Cookie` header against the inbound request so
+     * the server middleware can forward it to the browser, and invalidate the
+     * short-TTL verification cache entry for the old cookie value. Returns the
+     * rotated sealed value, or null when the cookie was not rotated.
+     */
+    private captureRotatedCookie;
+    /**
+     * Server middleware hook: emit any response headers the provider
+     * accumulated for this request (currently a rotated `Set-Cookie`) and
+     * clear them from the provider's per-request state.
+     */
+    consumePendingResponseHeaders(request: MastraAuthRequest): Record<string, string> | undefined;
     /**
      * Fetch the shared API's `/auth/me` and return the raw response body, or
      * `null` on any non-OK / network error. Split out so `ensureOrganization`

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA6CD;;;;;;;;;;GAUG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,YAAY,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAEjH,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,oBAAoB,CAAU;IACtC,OAAO,CAAC,YAAY,CAAqB;IACzC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAA8D;IACzF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B,CAAkD;IAEvF,YAAY,OAAO,CAAC,EAAE,uBAAuB,EA4C5C;IAMD;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAyB7F;IAED,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvC;IAMD,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBtD;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CA0BzF;IAED,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D;IAED,eAAe,IAAI,MAAM,EAAE,GAAG,SAAS,CAGtC;IAED,oBAAoB,IAAI,cAAc,CAOrC;IAEK,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBlF;IAMK,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CASxF;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAWhE;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrD;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgD/D;IAED,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGvD;IAED,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO1D;IAED,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO/C;IAMK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAejE;IAEK,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGzD;IAMD;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAYpE;YAEa,oBAAoB;IAgDlC;;;;;;;OAOG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASlF;YAEa,qBAAqB;YAMrB,mBAAmB;YAYnB,0BAA0B;IAexC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B,wEAAwE;YAC1D,eAAe;IAO7B,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB;;;;OAIG;YACW,OAAO;IAuBrB;;;OAGG;YACW,mBAAmB;IAoEjC;;;OAGG;YACW,iBAAiB;CAqDhC;AAyCD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa,CAAC,UAAU,CAAC;IAChE,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,WAAW,IAAI,WAAW,CAE7B;IAED,YAAY,OAAO,EAAE,uBAAuB,EAE3C;IAEK,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElD;IAEK,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;IAEK,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMxD;IAEK,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG1E;IAEK,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjF;IAEK,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhF;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AA+CD;;;;;;;;;;GAUG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,YAAY,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAEjH,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,oBAAoB,CAAU;IACtC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,oBAAoB,CAAS;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAA8D;IACzF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B,CAAkD;IAEvF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB,CAAkD;IAEhF,YAAY,OAAO,CAAC,EAAE,uBAAuB,EAiD5C;IAMD;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAyB7F;IAED,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvC;IAMD,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBtD;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CA0BzF;IAED,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D;IAED,eAAe,IAAI,MAAM,EAAE,GAAG,SAAS,CAGtC;IAED,oBAAoB,IAAI,cAAc,CAOrC;IAEK,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBlF;IAMK,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CASxF;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAWhE;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrD;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgD/D;IAED,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGvD;IAED,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa1D;IAED,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO/C;IAMK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAejE;IAEK,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGzD;IAMD;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAYpE;YAEa,oBAAoB;IAgDlC;;;;;;;OAOG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASlF;YAEa,qBAAqB;YAMrB,mBAAmB;YAYnB,0BAA0B;IAexC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B,wEAAwE;YAC1D,eAAe;IAO7B,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAS5B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IA2C5B;;;;OAIG;IACH,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAO5F;IAED;;;;OAIG;YACW,OAAO;IAuBrB;;;OAGG;YACW,mBAAmB;IA6EjC;;;OAGG;YACW,iBAAiB;CAqDhC;AAyCD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa,CAAC,UAAU,CAAC;IAChE,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,WAAW,IAAI,WAAW,CAE7B;IAED,YAAY,OAAO,EAAE,uBAAuB,EAE3C;IAEK,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElD;IAEK,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;IAEK,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMxD;IAEK,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG1E;IAEK,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjF;IAEK,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhF;CACF"}

package/dist/index.js

@@ -20,6 +20,10 @@ function getRequestHeader(request, name) {
 	if (headers && typeof headers === "object") return headerFromPlainObject(headers, name);
 	return null;
 }
+function getWebRequest(request) {
+	if (request instanceof Request) return request;
+	return request.raw instanceof Request ? request.raw : void 0;
+}
 //#endregion
 //#region ../../packages/_internal-core/dist/logger/index.js
 /**
@@ -423,6 +427,7 @@ function resolvePermissionsFromMapping(roles, mapping) {
 */
 //#endregion
 //#region src/index.ts
+const DEFAULT_SESSION_MAX_AGE_SECONDS = 336 * 60 * 60;
 const COOKIE_NAME = "wos-session";
 const PROJECT_CONFIG_FILE = ".mastra-project.json";
 /**
@@ -473,6 +478,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	organizationId;
 	useProductionCookies;
 	cookieDomain;
+	sessionMaxAgeSeconds;
 	/**
 	* `userId → sealed session cookie` cache. The `IOrganizationsProvider`
 	* interface only hands us a `userId`, but the shared API's org endpoints are
@@ -499,6 +505,19 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	* caller's promise is reused by every follower until it settles.
 	*/
 	organizationBootstrapInFlight = /* @__PURE__ */ new Map();
+	/**
+	* Per-request response headers to forward to the browser — specifically a
+	* rotated `wos-session` `Set-Cookie` returned by the shared API when the
+	* platform `sessionAuth` middleware transparently refreshes an expired
+	* access token. Without this, the browser's sealed cookie would never
+	* rotate: platform would succeed server-to-server by refreshing on every
+	* request, but the next refresh would hit `invalid_grant` once WorkOS
+	* invalidated the previous refresh token.
+	*
+	* Keyed by the underlying `Request` (via `getWebRequest`) so we don't retain
+	* requests after the response is written.
+	*/
+	pendingResponseHeaders = /* @__PURE__ */ new WeakMap();
 	constructor(options) {
 		super({
 			name: "mastra-studio",
@@ -509,6 +528,9 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID || readOrganizationIdFromProjectConfig();
 		if (this.sharedApiUrl.endsWith("/")) this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
 		this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
+		const envMaxAge = Number(process.env.MASTRA_SESSION_MAX_AGE);
+		const maxAge = options?.sessionMaxAgeSeconds ?? (envMaxAge > 0 ? envMaxAge : void 0);
+		this.sessionMaxAgeSeconds = maxAge && Number.isFinite(maxAge) && maxAge > 0 ? Math.floor(maxAge) : DEFAULT_SESSION_MAX_AGE_SECONDS;
 		let autoDetectMastraAi = false;
 		if (explicitSharedApiUrl) try {
 			const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();
@@ -527,7 +549,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	async authenticateToken(token, request) {
 		let user = null;
 		const sessionCookie = parseCookie(getRequestHeader(request, "Cookie"), COOKIE_NAME);
-		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie);
+		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie, request);
 		if (!user && token) user = await this.verifyBearerToken(token);
 		if (!user) return null;
 		if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) return null;
@@ -601,7 +623,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		return {
 			id: metadata?.accessToken || crypto.randomUUID(),
 			userId,
-			expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+			expiresAt: new Date(now.getTime() + this.sessionMaxAgeSeconds * 1e3),
 			createdAt: now,
 			metadata
 		};
@@ -613,7 +635,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		return {
 			id: sessionId,
 			userId: user.id,
-			expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+			expiresAt: new Date(now.getTime() + this.sessionMaxAgeSeconds * 1e3),
 			createdAt: now
 		};
 	}
@@ -650,7 +672,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 			return {
 				id: newSessionId,
 				userId: user.id,
-				expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+				expiresAt: new Date(now.getTime() + this.sessionMaxAgeSeconds * 1e3),
 				createdAt: now
 			};
 		} catch (error) {
@@ -673,7 +695,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 			"HttpOnly",
 			"SameSite=Lax",
 			"Path=/",
-			"Max-Age=86400"
+			`Max-Age=${this.sessionMaxAgeSeconds}`
 		];
 		if (this.useProductionCookies && this.cookieDomain) {
 			parts.push("Secure");
@@ -697,7 +719,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	}
 	async getCurrentUser(request) {
 		const sessionCookie = parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
-		if (sessionCookie) return this.verifySessionCookie(sessionCookie);
+		if (sessionCookie) return this.verifySessionCookie(sessionCookie, request);
 		const authHeader = request.headers.get("Authorization");
 		if (authHeader?.startsWith("Bearer ")) return this.verifyBearerToken(authHeader.slice(7));
 		return null;
@@ -850,6 +872,57 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		}
 	}
 	/**
+	* Read every `Set-Cookie` header from a response, falling back to the
+	* single-value accessor on runtimes without `Headers.getSetCookie()`.
+	*/
+	readSetCookieHeaders(res) {
+		const headers = res.headers;
+		if (typeof headers.getSetCookie === "function") return headers.getSetCookie();
+		const single = res.headers.get("Set-Cookie");
+		return single ? [single] : [];
+	}
+	/**
+	* If the shared API rotated the sealed `wos-session` cookie on this
+	* response, stash the `Set-Cookie` header against the inbound request so
+	* the server middleware can forward it to the browser, and invalidate the
+	* short-TTL verification cache entry for the old cookie value. Returns the
+	* rotated sealed value, or null when the cookie was not rotated.
+	*/
+	captureRotatedCookie(res, oldSessionCookie, oldCacheKey, request) {
+		const setCookies = this.readSetCookieHeaders(res);
+		if (setCookies.length === 0) return null;
+		const rotatedCookieHeader = setCookies.find((h) => parseCookieFromHeader(h, COOKIE_NAME) !== null);
+		if (!rotatedCookieHeader) return null;
+		const rotatedValue = parseCookieFromHeader(rotatedCookieHeader, COOKIE_NAME);
+		if (!rotatedValue || rotatedValue === oldSessionCookie) return null;
+		const reissued = this.getSessionHeaders({
+			id: rotatedValue,
+			userId: "",
+			expiresAt: /* @__PURE__ */ new Date(),
+			createdAt: /* @__PURE__ */ new Date()
+		});
+		this.verifiedCredentials.delete(oldCacheKey);
+		if (request) {
+			const rawRequest = getWebRequest(request);
+			if (rawRequest) this.pendingResponseHeaders.set(rawRequest, reissued);
+			else this.logger.warn("captureRotatedCookie: renewed session cookie cannot be forwarded (no web Request)");
+		}
+		return rotatedValue;
+	}
+	/**
+	* Server middleware hook: emit any response headers the provider
+	* accumulated for this request (currently a rotated `Set-Cookie`) and
+	* clear them from the provider's per-request state.
+	*/
+	consumePendingResponseHeaders(request) {
+		const rawRequest = getWebRequest(request);
+		if (!rawRequest) return void 0;
+		const headers = this.pendingResponseHeaders.get(rawRequest);
+		if (!headers) return void 0;
+		this.pendingResponseHeaders.delete(rawRequest);
+		return headers;
+	}
+	/**
 	* Fetch the shared API's `/auth/me` and return the raw response body, or
 	* `null` on any non-OK / network error. Split out so `ensureOrganization`
 	* and `isOrganizationAdmin` can reuse it without duplicating the shape.
@@ -870,7 +943,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	* Forward a sealed session cookie to the shared API's /auth/me endpoint
 	* to validate it and get user info.
 	*/
-	async verifySessionCookie(sessionCookie) {
+	async verifySessionCookie(sessionCookie, request) {
 		const cacheKey = await this.verificationKey("cookie", sessionCookie);
 		const cached = this.getCachedVerification(cacheKey);
 		if (cached) {
@@ -882,6 +955,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
 				signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
 			});
+			const rotated = this.captureRotatedCookie(res, sessionCookie, cacheKey, request);
 			if (!res.ok) {
 				this.logger.warn("verifySessionCookie: shared API returned non-OK status", {
 					status: res.status,
@@ -891,7 +965,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				return null;
 			}
 			const data = await res.json();
-			this.rememberUserSession(data.user.id, sessionCookie);
+			this.rememberUserSession(data.user.id, rotated ?? sessionCookie);
 			const sessionUser = {
 				id: data.user.id,
 				email: data.user.email,
@@ -903,7 +977,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				memberOrgIds: data.memberOrgIds
 			};
 			const user = await this.asPinnedOrganizationMember(sessionUser, sessionCookie);
-			if (user.organizationId) this.cacheVerification(cacheKey, user);
+			if (user.organizationId && !rotated) this.cacheVerification(cacheKey, user);
 			return user;
 		} catch (error) {
 			this.logger.error("verifySessionCookie: fetch to shared API failed", {
@@ -975,7 +1049,7 @@ function isAdminRole(role) {
 }
 /**
 * Parse a cookie value from a Set-Cookie header.
-* Set-Cookie format: "name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400"
+* Set-Cookie format: "name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=1209600"
 */
 function parseCookieFromHeader(setCookieHeader, name) {
 	const parts = setCookieHeader.split(";");