@mastra/code-sdk 1.13.1-alpha.0 → 1.14.0-alpha.2

package/dist/agents/credential-resolver.d.ts

@@ -3,56 +3,60 @@
  *
  * Locally, model resolution reads the server-global file-backed `AuthStorage`.
  * A deployed web host registers a {@link CredentialStoreProvider} at boot; from
- * then on `resolveModel` derives the calling tenant from the request context
- * (the web auth gate stashes the authenticated user under the `user` key) and
- * resolves credentials through the tenant's own store — user credentials over
- * org credentials over server env vars, with OAuth refresh owned by the store.
+ * then on `resolveModel` uses the host's trusted execution policy, never mutable
+ * session state. Factory scope reads organization credentials only. User scope reads
+ * the Factory session owner's credentials only, or the authenticated principal
+ * for project-less personal sessions.
  *
  * When no provider is registered (TUI, local web), everything falls through to
  * the existing global behavior unchanged.
  */
 import type { RequestContext } from '@mastra/core/request-context';
 import type { CredentialStore } from '../auth/types.js';
-/** The identity a credential lookup is scoped to. */
+export type CredentialScope = 'factory' | 'user';
+/** The identity and exclusive scope a credential lookup is resolved against. */
 export interface CredentialTenant {
     /** Org tenant; absent for personal accounts (store impls may synthesize one). */
     orgId?: string;
-    /** Stable user id from the web auth adapter. */
+    /** Stable user id used for user-scoped credentials and tenant cache keys. */
     userId: string;
-    /**
-     * Resolve org-shared credentials over the user's personal ones. Set by
-     * trusted server code for automated (factory) runs so they ride the org's
-     * shared keys first and only fall back to the acting user's credentials.
-     */
-    orgFirst?: boolean;
+    /** Exclusive credential scope for this request. */
+    credentialScope: CredentialScope;
 }
 /**
- * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back
- * to the global store (e.g. tenant storage temporarily unavailable). Must be
- * synchronous — implementations serve from a primed snapshot and do
- * authoritative async work inside `getApiKey`.
+ * Returns a tenant-scoped {@link CredentialStore}, or `undefined` when tenant
+ * storage is unavailable. Must be synchronous — implementations serve from a
+ * primed snapshot and do authoritative async work inside `getApiKey`.
  */
 export type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;
+export type CredentialTenantResolver = (requestContext: RequestContext) => Promise<CredentialTenant | undefined>;
 /** Register (or clear) the tenant credential store provider. Deployed-web only. */
-export declare function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined): void;
+export declare function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined, resolveTenant?: CredentialTenantResolver): void;
+/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */
+export declare function prepareCredentialTenant(requestContext?: RequestContext): Promise<void>;
+export declare function withCredentialTenantPreparation<T>(resolve: (ctx: {
+    requestContext: RequestContext;
+}) => T): (ctx: {
+    requestContext: RequestContext;
+}) => Promise<T>;
 /**
  * Whether a tenant provider is registered. Used to disable the
  * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant
  * credentials must never leak into process-global env vars.
  */
 export declare function hasCredentialStoreProvider(): boolean;
+export declare function hasCredentialTenantResolver(): boolean;
+export declare function resolveCredentialScope(requestContext?: RequestContext): CredentialScope;
 /**
  * Derive the calling tenant from a request context, if an authenticated web
  * user was stashed on it. Mirrors the web layer's stable-id resolution
  * (`workosId` falling back to the provider `id`).
  *
- * The value under `user` is whatever the active auth provider's
- * `authenticateToken` returned, so its shape follows the provider: a flat user
- * (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the
- * flat shape resolves no tenant at all for the wrapper, which in deployed mode
- * fails closed to an empty credential store.
+ * Session state and HTTP-supplied policy values never establish credential authority.
  */
 export declare function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined;
+/** Authenticated principal only, for hosts resolving durable session ownership. */
+export declare function resolveAuthenticatedCredentialTenant(requestContext?: RequestContext): CredentialTenant | undefined;
 /**
  * Resolve the credential store for a request. Local mode returns `undefined`
  * and keeps the global `AuthStorage` behavior. Once deployed web registers a

package/dist/agents/credential-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAkBhG,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAAG,IAAI,CAE9F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAqCD;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAsB7G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAsBnG"}
+{"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,eAAe,EAAE,eAAe,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAEhG,MAAM,MAAM,wBAAwB,GAAG,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAqBjH,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,EAC7C,aAAa,CAAC,EAAE,wBAAwB,GACvC,IAAI,CAIN;AAED,uGAAuG;AACvG,wBAAsB,uBAAuB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB5F;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAK,CAAC,IAC1F,KAAK;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAG,OAAO,CAAC,CAAC,CAAC,CAInE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAkBD,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAI7G;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAclH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAsBnG"}

package/dist/agents/credential-resolver.js

@@ -1,5 +1,8 @@
 //#region src/agents/credential-resolver.ts
+const CREDENTIAL_POLICY_KEY = "mastracode__credentialPolicy";
 let credentialStoreProvider;
+let credentialTenantResolver;
+let trustedTenants = /* @__PURE__ */ new WeakMap();
 const unavailableTenantCredentialStore = {
 	allowEnvironmentFallback: false,
 	reload() {},
@@ -8,8 +11,34 @@ const unavailableTenantCredentialStore = {
 	async getApiKey() {}
 };
 /** Register (or clear) the tenant credential store provider. Deployed-web only. */
-function setCredentialStoreProvider(provider) {
+function setCredentialStoreProvider(provider, resolveTenant) {
 	credentialStoreProvider = provider;
+	credentialTenantResolver = provider ? resolveTenant : void 0;
+	trustedTenants = /* @__PURE__ */ new WeakMap();
+}
+/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */
+async function prepareCredentialTenant(requestContext) {
+	if (!credentialTenantResolver) return;
+	if (!requestContext) throw new Error("Tenant model resolution requires a request context.");
+	const inheritedToken = requestContext.get(CREDENTIAL_POLICY_KEY);
+	const inheritedPolicy = inheritedToken && typeof inheritedToken === "object" ? trustedTenants.get(inheritedToken) : void 0;
+	const sourceController = inheritedPolicy?.sourceContext.get("controller");
+	const sourceContext = inheritedPolicy && sourceController?.resourceId ? inheritedPolicy.sourceContext : requestContext;
+	const token = {};
+	requestContext.set(CREDENTIAL_POLICY_KEY, token);
+	trustedTenants.set(token, { sourceContext });
+	const tenant = await credentialTenantResolver(sourceContext);
+	if (!tenant) throw new Error("Tenant model credential policy could not be resolved.");
+	trustedTenants.set(token, {
+		tenant,
+		sourceContext
+	});
+}
+function withCredentialTenantPreparation(resolve) {
+	return async (ctx) => {
+		await prepareCredentialTenant(ctx.requestContext);
+		return resolve(ctx);
+	};
 }
 /**
 * Whether a tenant provider is registered. Used to disable the
@@ -19,47 +48,38 @@ function setCredentialStoreProvider(provider) {
 function hasCredentialStoreProvider() {
 	return credentialStoreProvider !== void 0;
 }
-/**
-* Whether the request context belongs to a run on a factory-owned session.
-*
-* The agent controller stamps the session's state onto the request context
-* under `controller`, and only trusted factory server code ever writes
-* `factoryProjectId` into session state (board-run creation) — interactive
-* chat sessions never carry it. Runs on such sessions resolve credentials
-* org > user regardless of who sent the message: a board run continued
-* interactively, or a model switch inside it, is still org work.
-*/
-function isFactorySessionContext(requestContext) {
-	const controller = requestContext?.get("controller");
-	if (!controller || typeof controller !== "object") return false;
-	const factoryProjectId = controller.state?.factoryProjectId;
-	return typeof factoryProjectId === "string" && factoryProjectId.length > 0;
+function hasCredentialTenantResolver() {
+	return credentialTenantResolver !== void 0;
+}
+function resolveCredentialScope(requestContext) {
+	return resolveTenantFromRequestContext(requestContext)?.credentialScope ?? "user";
 }
 /**
 * Derive the calling tenant from a request context, if an authenticated web
 * user was stashed on it. Mirrors the web layer's stable-id resolution
 * (`workosId` falling back to the provider `id`).
 *
-* The value under `user` is whatever the active auth provider's
-* `authenticateToken` returned, so its shape follows the provider: a flat user
-* (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the
-* flat shape resolves no tenant at all for the wrapper, which in deployed mode
-* fails closed to an empty credential store.
+* Session state and HTTP-supplied policy values never establish credential authority.
 */
 function resolveTenantFromRequestContext(requestContext) {
+	if (!credentialTenantResolver) return resolveAuthenticatedCredentialTenant(requestContext);
+	const token = requestContext?.get(CREDENTIAL_POLICY_KEY);
+	return token && typeof token === "object" ? trustedTenants.get(token)?.tenant : void 0;
+}
+/** Authenticated principal only, for hosts resolving durable session ownership. */
+function resolveAuthenticatedCredentialTenant(requestContext) {
 	const raw = requestContext?.get("user");
 	if (!raw || typeof raw !== "object") return void 0;
 	const wrapped = Boolean(raw.user && typeof raw.user === "object" && raw.session && typeof raw.session === "object");
 	const user = wrapped ? raw.user : raw;
-	const orgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;
-	const userId = user.workosId ?? user.id;
-	if (typeof userId !== "string" || !userId) return void 0;
-	if (orgId !== void 0 && typeof orgId !== "string") return void 0;
-	const orgFirst = raw.orgFirstCredentials === true || user.orgFirstCredentials === true || isFactorySessionContext(requestContext);
+	const principalOrgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;
+	const principalUserId = user.workosId ?? user.id;
+	if (typeof principalUserId !== "string" || !principalUserId) return void 0;
+	if (principalOrgId !== void 0 && typeof principalOrgId !== "string") return void 0;
 	return {
-		orgId,
-		userId,
-		...orgFirst ? { orgFirst } : {}
+		orgId: principalOrgId,
+		userId: principalUserId,
+		credentialScope: "user"
 	};
 }
 /**
@@ -74,9 +94,8 @@ function resolveCredentialStore(requestContext) {
 	if (!tenant) {
 		const rawUser = requestContext?.get("user");
 		console.warn("[MastraCode] Tenant credential resolution failed closed", {
-			reason: rawUser === void 0 ? "missing-user-context" : "invalid-principal-shape",
-			hasRequestContext: requestContext !== void 0,
-			factorySession: isFactorySessionContext(requestContext)
+			reason: rawUser === void 0 ? "missing-user-context" : "credential-policy-unavailable",
+			hasRequestContext: requestContext !== void 0
 		});
 		return unavailableTenantCredentialStore;
 	}
@@ -85,13 +104,14 @@ function resolveCredentialStore(requestContext) {
 		console.warn("[MastraCode] Tenant credential resolution failed closed", {
 			reason: "credential-store-unavailable",
 			hasOrganization: tenant.orgId !== void 0,
-			orgFirst: tenant.orgFirst === true
+			credentialScope: tenant.credentialScope,
+			ownerResolved: tenant.credentialScope === "factory" || tenant.userId !== void 0
 		});
 		return unavailableTenantCredentialStore;
 	}
 	return store;
 }
 //#endregion
-export { hasCredentialStoreProvider, resolveCredentialStore, resolveTenantFromRequestContext, setCredentialStoreProvider };
+export { hasCredentialStoreProvider, hasCredentialTenantResolver, prepareCredentialTenant, resolveAuthenticatedCredentialTenant, resolveCredentialScope, resolveCredentialStore, resolveTenantFromRequestContext, setCredentialStoreProvider, withCredentialTenantPreparation };
 
 //# sourceMappingURL=credential-resolver.js.map

package/dist/agents/credential-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` derives the calling tenant from the request context\n * (the web auth gate stashes the authenticated user under the `user` key) and\n * resolves credentials through the tenant's own store — user credentials over\n * org credentials over server env vars, with OAuth refresh owned by the store.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\n/** The identity a credential lookup is scoped to. */\nexport interface CredentialTenant {\n  /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n  orgId?: string;\n  /** Stable user id from the web auth adapter. */\n  userId: string;\n  /**\n   * Resolve org-shared credentials over the user's personal ones. Set by\n   * trusted server code for automated (factory) runs so they ride the org's\n   * shared keys first and only fall back to the acting user's credentials.\n   */\n  orgFirst?: boolean;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back\n * to the global store (e.g. tenant storage temporarily unavailable). Must be\n * synchronous — implementations serve from a primed snapshot and do\n * authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n  allowEnvironmentFallback: false,\n  reload() {},\n  get() {\n    return undefined;\n  },\n  getStoredApiKey() {\n    return undefined;\n  },\n  async getApiKey() {\n    return undefined;\n  },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined): void {\n  credentialStoreProvider = provider;\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n  return credentialStoreProvider !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n  workosId?: string;\n  id?: string;\n  organizationId?: string;\n  /** Trusted server code marks automated runs to resolve org > user credentials. */\n  orgFirstCredentials?: boolean;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n  user?: RequestContextUser;\n  session?: { activeOrganizationId?: string };\n}\n\n/**\n * Whether the request context belongs to a run on a factory-owned session.\n *\n * The agent controller stamps the session's state onto the request context\n * under `controller`, and only trusted factory server code ever writes\n * `factoryProjectId` into session state (board-run creation) — interactive\n * chat sessions never carry it. Runs on such sessions resolve credentials\n * org > user regardless of who sent the message: a board run continued\n * interactively, or a model switch inside it, is still org work.\n */\nfunction isFactorySessionContext(requestContext?: RequestContext): boolean {\n  const controller = requestContext?.get('controller') as { state?: { factoryProjectId?: unknown } } | undefined;\n  if (!controller || typeof controller !== 'object') return false;\n  const factoryProjectId = controller.state?.factoryProjectId;\n  return typeof factoryProjectId === 'string' && factoryProjectId.length > 0;\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * The value under `user` is whatever the active auth provider's\n * `authenticateToken` returned, so its shape follows the provider: a flat user\n * (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the\n * flat shape resolves no tenant at all for the wrapper, which in deployed mode\n * fails closed to an empty credential store.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n  const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n  if (!raw || typeof raw !== 'object') return undefined;\n\n  // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n  // comes from the session half only, never from the inner user. The two parsers\n  // cannot share code across the package boundary, so they must agree by rule.\n  const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n  const user = wrapped ? (raw.user as RequestContextUser) : raw;\n  const orgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n  const userId = user.workosId ?? user.id;\n  // The slot holds whatever the provider returned, so the declared string\n  // types are hopes, not guarantees. A non-string id must refuse the tenant\n  // (fail closed), not flow onward as a mistyped key.\n  if (typeof userId !== 'string' || !userId) return undefined;\n  if (orgId !== undefined && typeof orgId !== 'string') return undefined;\n  // Only an exact `true` flips precedence — anything else keeps user > org.\n  // Server code stamps the flag on the stashed value itself, so read it from\n  // the top level as well as the unwrapped user (better-auth wrapper shape).\n  const orgFirst =\n    raw.orgFirstCredentials === true || user.orgFirstCredentials === true || isFactorySessionContext(requestContext);\n  return { orgId, userId, ...(orgFirst ? { orgFirst } : {}) };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n  if (!credentialStoreProvider) return undefined;\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) {\n    const rawUser = requestContext?.get('user');\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: rawUser === undefined ? 'missing-user-context' : 'invalid-principal-shape',\n      hasRequestContext: requestContext !== undefined,\n      factorySession: isFactorySessionContext(requestContext),\n    });\n    return unavailableTenantCredentialStore;\n  }\n  const store = credentialStoreProvider(tenant);\n  if (!store) {\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: 'credential-store-unavailable',\n      hasOrganization: tenant.orgId !== undefined,\n      orgFirst: tenant.orgFirst === true,\n    });\n    return unavailableTenantCredentialStore;\n  }\n  return store;\n}\n"],"mappings":";AAuCA,IAAI;AAEJ,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BAA2B,UAAqD;CAC9F,0BAA0B;AAC5B;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;;;;;;;;;;;AA8BA,SAAS,wBAAwB,gBAA0C;CACzE,MAAM,aAAa,gBAAgB,IAAI,YAAY;CACnD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,mBAAmB,WAAW,OAAO;CAC3C,OAAO,OAAO,qBAAqB,YAAY,iBAAiB,SAAS;AAC3E;;;;;;;;;;;;AAaA,SAAgB,gCAAgC,gBAA+D;CAC7G,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAK5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,QAAQ,UAAU,IAAI,SAAS,uBAAuB,KAAK;CACjE,MAAM,SAAS,KAAK,YAAY,KAAK;CAIrC,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAA;CAClD,IAAI,UAAU,KAAA,KAAa,OAAO,UAAU,UAAU,OAAO,KAAA;CAI7D,MAAM,WACJ,IAAI,wBAAwB,QAAQ,KAAK,wBAAwB,QAAQ,wBAAwB,cAAc;CACjH,OAAO;EAAE;EAAO;EAAQ,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CAAG;AAC5D;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;EACX,MAAM,UAAU,gBAAgB,IAAI,MAAM;EAC1C,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,YAAY,KAAA,IAAY,yBAAyB;GACzD,mBAAmB,mBAAmB,KAAA;GACtC,gBAAgB,wBAAwB,cAAc;EACxD,CAAC;EACD,OAAO;CACT;CACA,MAAM,QAAQ,wBAAwB,MAAM;CAC5C,IAAI,CAAC,OAAO;EACV,QAAQ,KAAK,2DAA2D;GACtE,QAAQ;GACR,iBAAiB,OAAO,UAAU,KAAA;GAClC,UAAU,OAAO,aAAa;EAChC,CAAC;EACD,OAAO;CACT;CACA,OAAO;AACT"}
+{"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` uses the host's trusted execution policy, never mutable\n * session state. Factory scope reads organization credentials only. User scope reads\n * the Factory session owner's credentials only, or the authenticated principal\n * for project-less personal sessions.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\nexport type CredentialScope = 'factory' | 'user';\n\n/** The identity and exclusive scope a credential lookup is resolved against. */\nexport interface CredentialTenant {\n  /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n  orgId?: string;\n  /** Stable user id used for user-scoped credentials and tenant cache keys. */\n  userId: string;\n  /** Exclusive credential scope for this request. */\n  credentialScope: CredentialScope;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` when tenant\n * storage is unavailable. Must be synchronous — implementations serve from a\n * primed snapshot and do authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nexport type CredentialTenantResolver = (requestContext: RequestContext) => Promise<CredentialTenant | undefined>;\n\nconst CREDENTIAL_POLICY_KEY = 'mastracode__credentialPolicy';\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\nlet credentialTenantResolver: CredentialTenantResolver | undefined;\nlet trustedTenants = new WeakMap<object, { tenant?: CredentialTenant; sourceContext: RequestContext }>();\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n  allowEnvironmentFallback: false,\n  reload() {},\n  get() {\n    return undefined;\n  },\n  getStoredApiKey() {\n    return undefined;\n  },\n  async getApiKey() {\n    return undefined;\n  },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(\n  provider: CredentialStoreProvider | undefined,\n  resolveTenant?: CredentialTenantResolver,\n): void {\n  credentialStoreProvider = provider;\n  credentialTenantResolver = provider ? resolveTenant : undefined;\n  trustedTenants = new WeakMap();\n}\n\n/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */\nexport async function prepareCredentialTenant(requestContext?: RequestContext): Promise<void> {\n  if (!credentialTenantResolver) return;\n  if (!requestContext) throw new Error('Tenant model resolution requires a request context.');\n  const inheritedToken = requestContext.get(CREDENTIAL_POLICY_KEY);\n  const inheritedPolicy =\n    inheritedToken && typeof inheritedToken === 'object' ? trustedTenants.get(inheritedToken) : undefined;\n  // Subagents and internal memory contexts can strip the controller's thread identity.\n  // Keep their billing origin outside those mutable context fields.\n  const sourceController = inheritedPolicy?.sourceContext.get('controller') as { resourceId?: string } | undefined;\n  const sourceContext =\n    inheritedPolicy && sourceController?.resourceId ? inheritedPolicy.sourceContext : requestContext;\n  const token = {};\n  requestContext.set(CREDENTIAL_POLICY_KEY, token);\n  trustedTenants.set(token, { sourceContext });\n  const tenant = await credentialTenantResolver(sourceContext);\n  if (!tenant) throw new Error('Tenant model credential policy could not be resolved.');\n  trustedTenants.set(token, { tenant, sourceContext });\n}\n\nexport function withCredentialTenantPreparation<T>(resolve: (ctx: { requestContext: RequestContext }) => T) {\n  return async (ctx: { requestContext: RequestContext }): Promise<T> => {\n    await prepareCredentialTenant(ctx.requestContext);\n    return resolve(ctx);\n  };\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n  return credentialStoreProvider !== undefined;\n}\n\nexport function hasCredentialTenantResolver(): boolean {\n  return credentialTenantResolver !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n  workosId?: string;\n  id?: string;\n  organizationId?: string;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n  user?: RequestContextUser;\n  session?: { activeOrganizationId?: string };\n}\n\nexport function resolveCredentialScope(requestContext?: RequestContext): CredentialScope {\n  return resolveTenantFromRequestContext(requestContext)?.credentialScope ?? 'user';\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * Session state and HTTP-supplied policy values never establish credential authority.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n  if (!credentialTenantResolver) return resolveAuthenticatedCredentialTenant(requestContext);\n  const token = requestContext?.get(CREDENTIAL_POLICY_KEY);\n  return token && typeof token === 'object' ? trustedTenants.get(token)?.tenant : undefined;\n}\n\n/** Authenticated principal only, for hosts resolving durable session ownership. */\nexport function resolveAuthenticatedCredentialTenant(requestContext?: RequestContext): CredentialTenant | undefined {\n  const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n  if (!raw || typeof raw !== 'object') return undefined;\n\n  // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n  // comes from the session half only, never from the inner user.\n  const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n  const user = wrapped ? (raw.user as RequestContextUser) : raw;\n  const principalOrgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n  const principalUserId = user.workosId ?? user.id;\n  if (typeof principalUserId !== 'string' || !principalUserId) return undefined;\n  if (principalOrgId !== undefined && typeof principalOrgId !== 'string') return undefined;\n\n  return { orgId: principalOrgId, userId: principalUserId, credentialScope: 'user' };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n  if (!credentialStoreProvider) return undefined;\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) {\n    const rawUser = requestContext?.get('user');\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: rawUser === undefined ? 'missing-user-context' : 'credential-policy-unavailable',\n      hasRequestContext: requestContext !== undefined,\n    });\n    return unavailableTenantCredentialStore;\n  }\n  const store = credentialStoreProvider(tenant);\n  if (!store) {\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: 'credential-store-unavailable',\n      hasOrganization: tenant.orgId !== undefined,\n      credentialScope: tenant.credentialScope,\n      ownerResolved: tenant.credentialScope === 'factory' || tenant.userId !== undefined,\n    });\n    return unavailableTenantCredentialStore;\n  }\n  return store;\n}\n"],"mappings":";AAsCA,MAAM,wBAAwB;AAC9B,IAAI;AACJ,IAAI;AACJ,IAAI,iCAAiB,IAAI,QAA8E;AAEvG,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BACd,UACA,eACM;CACN,0BAA0B;CAC1B,2BAA2B,WAAW,gBAAgB,KAAA;CACtD,iCAAiB,IAAI,QAAQ;AAC/B;;AAGA,eAAsB,wBAAwB,gBAAgD;CAC5F,IAAI,CAAC,0BAA0B;CAC/B,IAAI,CAAC,gBAAgB,MAAM,IAAI,MAAM,qDAAqD;CAC1F,MAAM,iBAAiB,eAAe,IAAI,qBAAqB;CAC/D,MAAM,kBACJ,kBAAkB,OAAO,mBAAmB,WAAW,eAAe,IAAI,cAAc,IAAI,KAAA;CAG9F,MAAM,mBAAmB,iBAAiB,cAAc,IAAI,YAAY;CACxE,MAAM,gBACJ,mBAAmB,kBAAkB,aAAa,gBAAgB,gBAAgB;CACpF,MAAM,QAAQ,CAAC;CACf,eAAe,IAAI,uBAAuB,KAAK;CAC/C,eAAe,IAAI,OAAO,EAAE,cAAc,CAAC;CAC3C,MAAM,SAAS,MAAM,yBAAyB,aAAa;CAC3D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,uDAAuD;CACpF,eAAe,IAAI,OAAO;EAAE;EAAQ;CAAc,CAAC;AACrD;AAEA,SAAgB,gCAAmC,SAAyD;CAC1G,OAAO,OAAO,QAAwD;EACpE,MAAM,wBAAwB,IAAI,cAAc;EAChD,OAAO,QAAQ,GAAG;CACpB;AACF;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;AAEA,SAAgB,8BAAuC;CACrD,OAAO,6BAA6B,KAAA;AACtC;AAkBA,SAAgB,uBAAuB,gBAAkD;CACvF,OAAO,gCAAgC,cAAc,CAAC,EAAE,mBAAmB;AAC7E;;;;;;;;AASA,SAAgB,gCAAgC,gBAA+D;CAC7G,IAAI,CAAC,0BAA0B,OAAO,qCAAqC,cAAc;CACzF,MAAM,QAAQ,gBAAgB,IAAI,qBAAqB;CACvD,OAAO,SAAS,OAAO,UAAU,WAAW,eAAe,IAAI,KAAK,CAAC,EAAE,SAAS,KAAA;AAClF;;AAGA,SAAgB,qCAAqC,gBAA+D;CAClH,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAI5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,iBAAiB,UAAU,IAAI,SAAS,uBAAuB,KAAK;CAC1E,MAAM,kBAAkB,KAAK,YAAY,KAAK;CAC9C,IAAI,OAAO,oBAAoB,YAAY,CAAC,iBAAiB,OAAO,KAAA;CACpE,IAAI,mBAAmB,KAAA,KAAa,OAAO,mBAAmB,UAAU,OAAO,KAAA;CAE/E,OAAO;EAAE,OAAO;EAAgB,QAAQ;EAAiB,iBAAiB;CAAO;AACnF;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;EACX,MAAM,UAAU,gBAAgB,IAAI,MAAM;EAC1C,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,YAAY,KAAA,IAAY,yBAAyB;GACzD,mBAAmB,mBAAmB,KAAA;EACxC,CAAC;EACD,OAAO;CACT;CACA,MAAM,QAAQ,wBAAwB,MAAM;CAC5C,IAAI,CAAC,OAAO;EACV,QAAQ,KAAK,2DAA2D;GACtE,QAAQ;GACR,iBAAiB,OAAO,UAAU,KAAA;GAClC,iBAAiB,OAAO;GACxB,eAAe,OAAO,oBAAoB,aAAa,OAAO,WAAW,KAAA;EAC3E,CAAC;EACD,OAAO;CACT;CACA,OAAO;AACT"}

package/dist/agents/mastracode-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastracode-gateway.d.ts","sourceRoot":"","sources":["../../src/agents/mastracode-gateway.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAwB,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAGL,kBAAkB,EAGnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAMlE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAIlD,MAAM,MAAM,wBAAwB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEzG,MAAM,MAAM,wBAAwB,GAAG;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,OAAO,CAAC;IACnC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IACtD,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AAcF,wBAAgB,oBAAoB,IAAI,WAAW,CAUlD;AAED,wBAAgB,iBAAiB,SAEhC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,GAAE,eAAwC,GAAG,MAAM,GAAG,SAAS,CAU5G;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,GAAE,eAAwC,GAAG,MAAM,GAAG,SAAS,CAQzG;AAwDD,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAEpH;AAgFD,qBAAa,iBAAkB,SAAQ,kBAAkB;;IACvD,QAAQ,CAAC,EAAE,gBAAyB;IACpC,QAAQ,CAAC,IAAI,wBAAwB;gBAYzB,EACV,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,EACb,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,eAAe,GAChB,EAAE,wBAAwB;IAa3B,MAAM,CAAC,sBAAsB,IAAI,MAAM,GAAG,SAAS;IAInD,+EAA+E;IAC/E,MAAM,CAAC,sBAAsB,IAAI,MAAM,GAAG,SAAS;IAInD;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAsBtC,MAAM,CAAC,mBAAmB,CACxB,OAAO,EAAE,kBAAkB,EAC3B,mBAAmB,CAAC,EAAE,MAAM,EAC5B,WAAW,GAAE,eAAwC,GACpD,iBAAiB,GAAG,SAAS;IAehC,MAAM,CAAC,0BAA0B,CAAC,OAAO,EAAE,2BAA2B,GAAG,0BAA0B;IA+BnG,0BAA0B,IAAI,0BAA0B;IAWlD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAuC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIrE,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMjD,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,SAAS;IAevE,oBAAoB,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,kBAAkB,CAAC,EAAE,GAAG,CAAC;KAC1B,GAAG,oBAAoB;CAwPzB"}
+{"version":3,"file":"mastracode-gateway.d.ts","sourceRoot":"","sources":["../../src/agents/mastracode-gateway.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAwB,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAGL,kBAAkB,EAGnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,EACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AA4BxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUlE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAIlD,MAAM,MAAM,wBAAwB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEzG,MAAM,MAAM,wBAAwB,GAAG;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,OAAO,CAAC;IACnC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IACtD,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AAcF,wBAAgB,oBAAoB,IAAI,WAAW,CAUlD;AAED,wBAAgB,iBAAiB,SAEhC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,GAAE,eAAwC,GAAG,MAAM,GAAG,SAAS,CAU5G;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,GAAE,eAAwC,GAAG,MAAM,GAAG,SAAS,CAQzG;AAwDD,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAEpH;AAgFD,qBAAa,iBAAkB,SAAQ,kBAAkB;;IACvD,QAAQ,CAAC,EAAE,gBAAyB;IACpC,QAAQ,CAAC,IAAI,wBAAwB;gBAYzB,EACV,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,EACzB,aAAa,EACb,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,eAAe,GAChB,EAAE,wBAAwB;IAa3B,MAAM,CAAC,sBAAsB,IAAI,MAAM,GAAG,SAAS;IAInD,+EAA+E;IAC/E,MAAM,CAAC,sBAAsB,IAAI,MAAM,GAAG,SAAS;IAInD;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAsBtC,MAAM,CAAC,mBAAmB,CACxB,OAAO,EAAE,kBAAkB,EAC3B,mBAAmB,CAAC,EAAE,MAAM,EAC5B,WAAW,GAAE,eAAwC,GACpD,iBAAiB,GAAG,SAAS;IAehC,MAAM,CAAC,0BAA0B,CAAC,OAAO,EAAE,2BAA2B,GAAG,0BAA0B;IA+BnG,0BAA0B,IAAI,0BAA0B;IAWlD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IA0B/D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIrE,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMjD,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,SAAS;IAevE,oBAAoB,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,kBAAkB,CAAC,EAAE,GAAG,CAAC;KAC1B,GAAG,oBAAoB;CAyOzB"}

package/dist/agents/mastracode-gateway.js

@@ -1,15 +1,14 @@
 import { getAppDataDir } from "../utils/project.js";
 import { AuthStorage } from "../auth/storage.js";
 import { createGoogleThinkingMiddleware } from "../providers/google-thinking.js";
-import { MASTRA_GATEWAY_PREFIX, OPENAI_PREFIX, normalizeAnthropicModelId, remapOpenAIModelForCodexOAuth, stripMastraGatewayPrefix } from "../providers/model-ids.js";
+import { MASTRA_GATEWAY_PREFIX, OPENAI_PREFIX, getCredentialProviderId, normalizeAnthropicModelId, remapOpenAIModelForCodexOAuth, stripMastraGatewayPrefix } from "../providers/model-ids.js";
 import { THINKING_LEVEL_TO_REASONING_EFFORT, buildOpenAICodexOAuthFetch, createCodexMiddleware, createReasoningEffortMiddleware, getEffectiveThinkingLevel, openaiCodexProvider } from "../providers/openai-codex.js";
 import { getCustomProviderId, loadSettings } from "../onboarding/settings.js";
 import { resolveCustomProviders } from "./custom-provider-source.js";
 import { buildAnthropicOAuthFetch, claudeCodeMiddleware, createAnthropicThinkingMiddleware, createPromptCacheMiddleware, opencodeClaudeMaxProvider } from "../providers/claude-max.js";
-import { deepseekThinkingOptions } from "../providers/deepseek-thinking.js";
-import { getCopilotModelCatalog, githubCopilotProvider } from "../providers/github-copilot.js";
-import { KIMI_CODING_MODELS, kimiCodingProvider } from "../providers/kimi-coding.js";
-import { ModelRouterLanguageModelWithThinking } from "../providers/provider-thinking.js";
+import { githubCopilotProvider } from "../providers/github-copilot.js";
+import { kimiCodingProvider } from "../providers/kimi-coding.js";
+import { ModelRouterLanguageModelWithThinking, providerThinkingOptions, withThinkingOptionsModel } from "../providers/provider-thinking.js";
 import { xaiProvider } from "../providers/xai.js";
 import { GATEWAY_AUTH_HEADER, MastraGateway, MastraModelGateway, ModelRouterLanguageModel, PROVIDER_REGISTRY } from "@mastra/core/llm";
 import { createOpenAI } from "@ai-sdk/openai";
@@ -85,15 +84,14 @@ function openaiApiKeyProvider(modelId, apiKey, headers, thinkingLevel) {
 		middleware: middleware ? [middleware] : []
 	});
 }
-function getAuthProviderId(providerId) {
-	return providerId === "openai" ? "openai-codex" : providerId;
-}
 function getProviderAuthKey(providerId, credentials = getGlobalAuthStorage()) {
-	const authProviderId = getAuthProviderId(providerId);
+	const authProviderId = getCredentialProviderId(providerId);
 	const storedCred = credentials.get(authProviderId);
 	if (storedCred?.type === "api_key" && storedCred.key.trim().length > 0) return storedCred.key.trim();
 	const dedicatedKey = credentials.getStoredApiKey(authProviderId)?.trim();
 	if (dedicatedKey) return dedicatedKey;
+	const catalogKey = authProviderId !== providerId ? credentials.getStoredApiKey(providerId)?.trim() : void 0;
+	if (catalogKey) return catalogKey;
 	if (credentials.allowEnvironmentFallback === false) return void 0;
 	return authProviderId === "kimi-for-coding" ? process.env.KIMI_API_KEY?.trim() || void 0 : void 0;
 }
@@ -209,7 +207,7 @@ var MastraCodeGateway = class MastraCodeGateway extends MastraModelGateway {
 			apiKey: mastraGatewayApiKey,
 			source: "gateway"
 		};
-		const authProviderId = getAuthProviderId(request.providerId);
+		const authProviderId = getCredentialProviderId(request.providerId);
 		if (credentials.get(authProviderId)?.type === "oauth") return {
 			bearerToken: "oauth",
 			source: "gateway"
@@ -251,6 +249,7 @@ var MastraCodeGateway = class MastraCodeGateway extends MastraModelGateway {
 		return this.#customProviders ?? resolveCustomProviders() ?? loadSettings(this.#settingsPath).customProviders;
 	}
 	async fetchProviders() {
+		this.#credentials.reload();
 		const providers = {};
 		for (const provider of this.#getCustomProviders()) {
 			const models = provider.models ?? [];
@@ -264,25 +263,6 @@ var MastraCodeGateway = class MastraCodeGateway extends MastraModelGateway {
 				models
 			};
 		}
-		providers["kimi-for-coding"] = {
-			name: "Kimi For Coding",
-			apiKeyEnvVar: "KIMI_API_KEY",
-			apiKeyHeader: "Authorization",
-			gateway: this.id,
-			models: [...KIMI_CODING_MODELS]
-		};
-		try {
-			const copilotModels = await getCopilotModelCatalog({ authStorage: this.#credentials });
-			providers["github-copilot"] = {
-				name: "GitHub Copilot",
-				apiKeyEnvVar: "",
-				apiKeyHeader: "Authorization",
-				gateway: this.id,
-				models: copilotModels.map((model) => model.id)
-			};
-		} catch (error) {
-			console.warn("Failed to load GitHub Copilot model catalog:", error);
-		}
 		return providers;
 	}
 	buildUrl(modelId) {
@@ -341,24 +321,23 @@ var MastraCodeGateway = class MastraCodeGateway extends MastraModelGateway {
 			const openaiModel = this.#resolveOpenAIModel(args);
 			if (openaiModel) return openaiModel;
 		}
-		if (args.providerId === "xai" && this.#credentials.get("xai")?.type === "oauth") return xaiProvider(args.modelId, {
+		if (args.providerId === "xai" && this.#credentials.get("xai")?.type === "oauth") return withThinkingOptionsModel(xaiProvider(args.modelId, {
 			headers: args.headers,
 			authStorage: this.#credentials
-		});
-		if (args.providerId === "google") return this.#resolveGoogleModel(args);
+		}), providerThinkingOptions(`xai/${args.modelId}`, this.#thinkingLevel));
 		if (this.#routeThroughMastraGateway) return this.#mastraGateway.resolveLanguageModel(args);
-		if (args.providerId === "kimi-for-coding") return kimiCodingProvider(args.modelId, {
+		if (args.providerId === "google") return this.#resolveGoogleModel(args);
+		if (args.providerId === "kimi-code-plan-cn" || args.providerId === "kimi-for-coding") return kimiCodingProvider(args.modelId, {
 			apiKey: args.apiKey,
 			headers: args.headers,
 			credentialStore: this.#credentials
 		});
 		const routedModelId = `${args.providerId}/${args.modelId}`;
-		const thinking = args.providerId === "deepseek" ? deepseekThinkingOptions(routedModelId, this.#thinkingLevel) : void 0;
 		return new ModelRouterLanguageModelWithThinking({
 			id: routedModelId,
 			apiKey: args.apiKey,
 			headers: args.headers
-		}, thinking);
+		}, providerThinkingOptions(routedModelId, this.#thinkingLevel));
 	}
 	#resolveAnthropicModel(args) {
 		const bareModelId = normalizeAnthropicModelId(args.modelId);
@@ -381,15 +360,10 @@ var MastraCodeGateway = class MastraCodeGateway extends MastraModelGateway {
 					...thinkingMiddleware ? [thinkingMiddleware] : []
 				]
 			});
-			const gatewayModel = this.#mastraGateway.resolveLanguageModel({
+			return this.#mastraGateway.resolveLanguageModel({
 				...args,
 				modelId: bareModelId
 			});
-			if (!thinkingMiddleware) return gatewayModel;
-			return wrapLanguageModel({
-				model: gatewayModel,
-				middleware: [thinkingMiddleware]
-			});
 		}
 		if (storedCred?.type === "oauth") return opencodeClaudeMaxProvider(bareModelId, {
 			headers: args.headers,
@@ -441,15 +415,15 @@ var MastraCodeGateway = class MastraCodeGateway extends MastraModelGateway {
 		if (apiKey) return openaiApiKeyProvider(args.modelId, apiKey, args.headers, this.#thinkingLevel);
 	}
 	#resolveGoogleModel(args) {
-		const baseModel = this.#routeThroughMastraGateway ? this.#mastraGateway.resolveLanguageModel(args) : new ModelRouterLanguageModel({
+		const routerModel = new ModelRouterLanguageModel({
 			id: `${args.providerId}/${args.modelId}`,
 			apiKey: args.apiKey,
 			headers: args.headers
 		});
 		const thinkingMiddleware = createGoogleThinkingMiddleware(args.modelId, this.#thinkingLevel);
-		if (!thinkingMiddleware) return baseModel;
+		if (!thinkingMiddleware) return routerModel;
 		return wrapLanguageModel({
-			model: baseModel,
+			model: routerModel,
 			middleware: [thinkingMiddleware]
 		});
 	}