@mastra/code-sdk 1.14.0-alpha.6 → 1.14.0-alpha.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/agents/credential-resolver.d.ts.map +1 -1
  2. package/dist/agents/credential-resolver.js +20 -1
  3. package/dist/agents/credential-resolver.js.map +1 -1
  4. package/package.json +12 -12
package/dist/agents/credential-resolver.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,eAAe,EAAE,eAAe,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAEhG,MAAM,MAAM,wBAAwB,GAAG,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAqBjH,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,EAC7C,aAAa,CAAC,EAAE,wBAAwB,GACvC,IAAI,CAIN;AAED,uGAAuG;AACvG,wBAAsB,uBAAuB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB5F;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAK,CAAC,IAC1F,KAAK;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAG,OAAO,CAAC,CAAC,CAAC,CAInE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAkBD,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAI7G;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAclH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAsBnG"}
1
+ {"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,eAAe,EAAE,eAAe,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAEhG,MAAM,MAAM,wBAAwB,GAAG,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAqBjH,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,EAC7C,aAAa,CAAC,EAAE,wBAAwB,GACvC,IAAI,CAIN;AAED,uGAAuG;AACvG,wBAAsB,uBAAuB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB5F;AA0BD,wBAAgB,+BAA+B,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAK,CAAC,IAC1F,KAAK;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAG,OAAO,CAAC,CAAC,CAAC,CAInE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAkBD,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAI7G;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAclH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAsBnG"}
package/dist/agents/credential-resolver.js CHANGED
@@ -28,12 +28,31 @@ async function prepareCredentialTenant(requestContext) {
28
28
  requestContext.set(CREDENTIAL_POLICY_KEY, token);
29
29
  trustedTenants.set(token, { sourceContext });
30
30
  const tenant = await credentialTenantResolver(sourceContext);
31
- if (!tenant) throw new Error("Tenant model credential policy could not be resolved.");
31
+ if (!tenant) throw unresolvedTenantError(sourceContext, Boolean(inheritedPolicy));
32
32
  trustedTenants.set(token, {
33
33
  tenant,
34
34
  sourceContext
35
35
  });
36
36
  }
37
+ /**
38
+ * Explain a failed tenant resolution. The message is safe to show the end user
39
+ * (channels post it into the chat); the warning carries non-secret diagnostics
40
+ * and the stack, which is what locates a caller that dropped the request context.
41
+ */
42
+ function unresolvedTenantError(sourceContext, inherited) {
43
+ const authenticated = resolveAuthenticatedCredentialTenant(sourceContext) !== void 0;
44
+ const error = /* @__PURE__ */ new Error(authenticated ? "Tenant model credential policy could not be resolved: no credential policy applies to this request." : "Tenant model credential policy could not be resolved: the request has no authenticated user.");
45
+ const controller = sourceContext.get("controller");
46
+ console.warn("[MastraCode] Tenant model credential policy could not be resolved", {
47
+ reason: authenticated ? "no-policy-for-principal" : "missing-user-context",
48
+ hasUser: sourceContext.get("user") !== void 0,
49
+ inheritedPolicy: inherited,
50
+ hasControllerResource: typeof controller?.resourceId === "string",
51
+ hasControllerThread: typeof controller?.threadId === "string",
52
+ stack: error.stack
53
+ });
54
+ return error;
55
+ }
37
56
  function withCredentialTenantPreparation(resolve) {
38
57
  return async (ctx) => {
39
58
  await prepareCredentialTenant(ctx.requestContext);
package/dist/agents/credential-resolver.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` uses the host's trusted execution policy, never mutable\n * session state. Factory scope reads organization credentials only. User scope reads\n * the Factory session owner's credentials only, or the authenticated principal\n * for project-less personal sessions.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\nexport type CredentialScope = 'factory' | 'user';\n\n/** The identity and exclusive scope a credential lookup is resolved against. */\nexport interface CredentialTenant {\n /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n orgId?: string;\n /** Stable user id used for user-scoped credentials and tenant cache keys. */\n userId: string;\n /** Exclusive credential scope for this request. */\n credentialScope: CredentialScope;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` when tenant\n * storage is unavailable. Must be synchronous — implementations serve from a\n * primed snapshot and do authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nexport type CredentialTenantResolver = (requestContext: RequestContext) => Promise<CredentialTenant | undefined>;\n\nconst CREDENTIAL_POLICY_KEY = 'mastracode__credentialPolicy';\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\nlet credentialTenantResolver: CredentialTenantResolver | undefined;\nlet trustedTenants = new WeakMap<object, { tenant?: CredentialTenant; sourceContext: RequestContext }>();\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n allowEnvironmentFallback: false,\n reload() {},\n get() {\n return undefined;\n },\n getStoredApiKey() {\n return undefined;\n },\n async getApiKey() {\n return undefined;\n },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(\n provider: CredentialStoreProvider | undefined,\n resolveTenant?: CredentialTenantResolver,\n): void {\n credentialStoreProvider = provider;\n credentialTenantResolver = provider ? resolveTenant : undefined;\n trustedTenants = new WeakMap();\n}\n\n/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */\nexport async function prepareCredentialTenant(requestContext?: RequestContext): Promise<void> {\n if (!credentialTenantResolver) return;\n if (!requestContext) throw new Error('Tenant model resolution requires a request context.');\n const inheritedToken = requestContext.get(CREDENTIAL_POLICY_KEY);\n const inheritedPolicy =\n inheritedToken && typeof inheritedToken === 'object' ? trustedTenants.get(inheritedToken) : undefined;\n // Subagents and internal memory contexts can strip the controller's thread identity.\n // Keep their billing origin outside those mutable context fields.\n const sourceController = inheritedPolicy?.sourceContext.get('controller') as { resourceId?: string } | undefined;\n const sourceContext =\n inheritedPolicy && sourceController?.resourceId ? inheritedPolicy.sourceContext : requestContext;\n const token = {};\n requestContext.set(CREDENTIAL_POLICY_KEY, token);\n trustedTenants.set(token, { sourceContext });\n const tenant = await credentialTenantResolver(sourceContext);\n if (!tenant) throw new Error('Tenant model credential policy could not be resolved.');\n trustedTenants.set(token, { tenant, sourceContext });\n}\n\nexport function withCredentialTenantPreparation<T>(resolve: (ctx: { requestContext: RequestContext }) => T) {\n return async (ctx: { requestContext: RequestContext }): Promise<T> => {\n await prepareCredentialTenant(ctx.requestContext);\n return resolve(ctx);\n };\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n return credentialStoreProvider !== undefined;\n}\n\nexport function hasCredentialTenantResolver(): boolean {\n return credentialTenantResolver !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n workosId?: string;\n id?: string;\n organizationId?: string;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n user?: RequestContextUser;\n session?: { activeOrganizationId?: string };\n}\n\nexport function resolveCredentialScope(requestContext?: RequestContext): CredentialScope {\n return resolveTenantFromRequestContext(requestContext)?.credentialScope ?? 'user';\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * Session state and HTTP-supplied policy values never establish credential authority.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n if (!credentialTenantResolver) return resolveAuthenticatedCredentialTenant(requestContext);\n const token = requestContext?.get(CREDENTIAL_POLICY_KEY);\n return token && typeof token === 'object' ? trustedTenants.get(token)?.tenant : undefined;\n}\n\n/** Authenticated principal only, for hosts resolving durable session ownership. */\nexport function resolveAuthenticatedCredentialTenant(requestContext?: RequestContext): CredentialTenant | undefined {\n const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n if (!raw || typeof raw !== 'object') return undefined;\n\n // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n // comes from the session half only, never from the inner user.\n const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n const user = wrapped ? (raw.user as RequestContextUser) : raw;\n const principalOrgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n const principalUserId = user.workosId ?? user.id;\n if (typeof principalUserId !== 'string' || !principalUserId) return undefined;\n if (principalOrgId !== undefined && typeof principalOrgId !== 'string') return undefined;\n\n return { orgId: principalOrgId, userId: principalUserId, credentialScope: 'user' };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n if (!credentialStoreProvider) return undefined;\n const tenant = resolveTenantFromRequestContext(requestContext);\n if (!tenant) {\n const rawUser = requestContext?.get('user');\n console.warn('[MastraCode] Tenant credential resolution failed closed', {\n reason: rawUser === undefined ? 'missing-user-context' : 'credential-policy-unavailable',\n hasRequestContext: requestContext !== undefined,\n });\n return unavailableTenantCredentialStore;\n }\n const store = credentialStoreProvider(tenant);\n if (!store) {\n console.warn('[MastraCode] Tenant credential resolution failed closed', {\n reason: 'credential-store-unavailable',\n hasOrganization: tenant.orgId !== undefined,\n credentialScope: tenant.credentialScope,\n ownerResolved: tenant.credentialScope === 'factory' || tenant.userId !== undefined,\n });\n return unavailableTenantCredentialStore;\n }\n return store;\n}\n"],"mappings":";AAsCA,MAAM,wBAAwB;AAC9B,IAAI;AACJ,IAAI;AACJ,IAAI,iCAAiB,IAAI,QAA8E;AAEvG,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BACd,UACA,eACM;CACN,0BAA0B;CAC1B,2BAA2B,WAAW,gBAAgB,KAAA;CACtD,iCAAiB,IAAI,QAAQ;AAC/B;;AAGA,eAAsB,wBAAwB,gBAAgD;CAC5F,IAAI,CAAC,0BAA0B;CAC/B,IAAI,CAAC,gBAAgB,MAAM,IAAI,MAAM,qDAAqD;CAC1F,MAAM,iBAAiB,eAAe,IAAI,qBAAqB;CAC/D,MAAM,kBACJ,kBAAkB,OAAO,mBAAmB,WAAW,eAAe,IAAI,cAAc,IAAI,KAAA;CAG9F,MAAM,mBAAmB,iBAAiB,cAAc,IAAI,YAAY;CACxE,MAAM,gBACJ,mBAAmB,kBAAkB,aAAa,gBAAgB,gBAAgB;CACpF,MAAM,QAAQ,CAAC;CACf,eAAe,IAAI,uBAAuB,KAAK;CAC/C,eAAe,IAAI,OAAO,EAAE,cAAc,CAAC;CAC3C,MAAM,SAAS,MAAM,yBAAyB,aAAa;CAC3D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,uDAAuD;CACpF,eAAe,IAAI,OAAO;EAAE;EAAQ;CAAc,CAAC;AACrD;AAEA,SAAgB,gCAAmC,SAAyD;CAC1G,OAAO,OAAO,QAAwD;EACpE,MAAM,wBAAwB,IAAI,cAAc;EAChD,OAAO,QAAQ,GAAG;CACpB;AACF;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;AAEA,SAAgB,8BAAuC;CACrD,OAAO,6BAA6B,KAAA;AACtC;AAkBA,SAAgB,uBAAuB,gBAAkD;CACvF,OAAO,gCAAgC,cAAc,CAAC,EAAE,mBAAmB;AAC7E;;;;;;;;AASA,SAAgB,gCAAgC,gBAA+D;CAC7G,IAAI,CAAC,0BAA0B,OAAO,qCAAqC,cAAc;CACzF,MAAM,QAAQ,gBAAgB,IAAI,qBAAqB;CACvD,OAAO,SAAS,OAAO,UAAU,WAAW,eAAe,IAAI,KAAK,CAAC,EAAE,SAAS,KAAA;AAClF;;AAGA,SAAgB,qCAAqC,gBAA+D;CAClH,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAI5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,iBAAiB,UAAU,IAAI,SAAS,uBAAuB,KAAK;CAC1E,MAAM,kBAAkB,KAAK,YAAY,KAAK;CAC9C,IAAI,OAAO,oBAAoB,YAAY,CAAC,iBAAiB,OAAO,KAAA;CACpE,IAAI,mBAAmB,KAAA,KAAa,OAAO,mBAAmB,UAAU,OAAO,KAAA;CAE/E,OAAO;EAAE,OAAO;EAAgB,QAAQ;EAAiB,iBAAiB;CAAO;AACnF;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;EACX,MAAM,UAAU,gBAAgB,IAAI,MAAM;EAC1C,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,YAAY,KAAA,IAAY,yBAAyB;GACzD,mBAAmB,mBAAmB,KAAA;EACxC,CAAC;EACD,OAAO;CACT;CACA,MAAM,QAAQ,wBAAwB,MAAM;CAC5C,IAAI,CAAC,OAAO;EACV,QAAQ,KAAK,2DAA2D;GACtE,QAAQ;GACR,iBAAiB,OAAO,UAAU,KAAA;GAClC,iBAAiB,OAAO;GACxB,eAAe,OAAO,oBAAoB,aAAa,OAAO,WAAW,KAAA;EAC3E,CAAC;EACD,OAAO;CACT;CACA,OAAO;AACT"}
1
+ {"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` uses the host's trusted execution policy, never mutable\n * session state. Factory scope reads organization credentials only. User scope reads\n * the Factory session owner's credentials only, or the authenticated principal\n * for project-less personal sessions.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\nexport type CredentialScope = 'factory' | 'user';\n\n/** The identity and exclusive scope a credential lookup is resolved against. */\nexport interface CredentialTenant {\n /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n orgId?: string;\n /** Stable user id used for user-scoped credentials and tenant cache keys. */\n userId: string;\n /** Exclusive credential scope for this request. */\n credentialScope: CredentialScope;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` when tenant\n * storage is unavailable. Must be synchronous — implementations serve from a\n * primed snapshot and do authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nexport type CredentialTenantResolver = (requestContext: RequestContext) => Promise<CredentialTenant | undefined>;\n\nconst CREDENTIAL_POLICY_KEY = 'mastracode__credentialPolicy';\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\nlet credentialTenantResolver: CredentialTenantResolver | undefined;\nlet trustedTenants = new WeakMap<object, { tenant?: CredentialTenant; sourceContext: RequestContext }>();\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n allowEnvironmentFallback: false,\n reload() {},\n get() {\n return undefined;\n },\n getStoredApiKey() {\n return undefined;\n },\n async getApiKey() {\n return undefined;\n },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(\n provider: CredentialStoreProvider | undefined,\n resolveTenant?: CredentialTenantResolver,\n): void {\n credentialStoreProvider = provider;\n credentialTenantResolver = provider ? resolveTenant : undefined;\n trustedTenants = new WeakMap();\n}\n\n/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */\nexport async function prepareCredentialTenant(requestContext?: RequestContext): Promise<void> {\n if (!credentialTenantResolver) return;\n if (!requestContext) throw new Error('Tenant model resolution requires a request context.');\n const inheritedToken = requestContext.get(CREDENTIAL_POLICY_KEY);\n const inheritedPolicy =\n inheritedToken && typeof inheritedToken === 'object' ? trustedTenants.get(inheritedToken) : undefined;\n // Subagents and internal memory contexts can strip the controller's thread identity.\n // Keep their billing origin outside those mutable context fields.\n const sourceController = inheritedPolicy?.sourceContext.get('controller') as { resourceId?: string } | undefined;\n const sourceContext =\n inheritedPolicy && sourceController?.resourceId ? inheritedPolicy.sourceContext : requestContext;\n const token = {};\n requestContext.set(CREDENTIAL_POLICY_KEY, token);\n trustedTenants.set(token, { sourceContext });\n const tenant = await credentialTenantResolver(sourceContext);\n if (!tenant) throw unresolvedTenantError(sourceContext, Boolean(inheritedPolicy));\n trustedTenants.set(token, { tenant, sourceContext });\n}\n\n/**\n * Explain a failed tenant resolution. The message is safe to show the end user\n * (channels post it into the chat); the warning carries non-secret diagnostics\n * and the stack, which is what locates a caller that dropped the request context.\n */\nfunction unresolvedTenantError(sourceContext: RequestContext, inherited: boolean): Error {\n const authenticated = resolveAuthenticatedCredentialTenant(sourceContext) !== undefined;\n const error = new Error(\n authenticated\n ? 'Tenant model credential policy could not be resolved: no credential policy applies to this request.'\n : 'Tenant model credential policy could not be resolved: the request has no authenticated user.',\n );\n const controller = sourceContext.get('controller') as { resourceId?: unknown; threadId?: unknown } | undefined;\n console.warn('[MastraCode] Tenant model credential policy could not be resolved', {\n reason: authenticated ? 'no-policy-for-principal' : 'missing-user-context',\n hasUser: sourceContext.get('user') !== undefined,\n inheritedPolicy: inherited,\n hasControllerResource: typeof controller?.resourceId === 'string',\n hasControllerThread: typeof controller?.threadId === 'string',\n stack: error.stack,\n });\n return error;\n}\n\nexport function withCredentialTenantPreparation<T>(resolve: (ctx: { requestContext: RequestContext }) => T) {\n return async (ctx: { requestContext: RequestContext }): Promise<T> => {\n await prepareCredentialTenant(ctx.requestContext);\n return resolve(ctx);\n };\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n return credentialStoreProvider !== undefined;\n}\n\nexport function hasCredentialTenantResolver(): boolean {\n return credentialTenantResolver !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n workosId?: string;\n id?: string;\n organizationId?: string;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n user?: RequestContextUser;\n session?: { activeOrganizationId?: string };\n}\n\nexport function resolveCredentialScope(requestContext?: RequestContext): CredentialScope {\n return resolveTenantFromRequestContext(requestContext)?.credentialScope ?? 'user';\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * Session state and HTTP-supplied policy values never establish credential authority.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n if (!credentialTenantResolver) return resolveAuthenticatedCredentialTenant(requestContext);\n const token = requestContext?.get(CREDENTIAL_POLICY_KEY);\n return token && typeof token === 'object' ? trustedTenants.get(token)?.tenant : undefined;\n}\n\n/** Authenticated principal only, for hosts resolving durable session ownership. */\nexport function resolveAuthenticatedCredentialTenant(requestContext?: RequestContext): CredentialTenant | undefined {\n const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n if (!raw || typeof raw !== 'object') return undefined;\n\n // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n // comes from the session half only, never from the inner user.\n const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n const user = wrapped ? (raw.user as RequestContextUser) : raw;\n const principalOrgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n const principalUserId = user.workosId ?? user.id;\n if (typeof principalUserId !== 'string' || !principalUserId) return undefined;\n if (principalOrgId !== undefined && typeof principalOrgId !== 'string') return undefined;\n\n return { orgId: principalOrgId, userId: principalUserId, credentialScope: 'user' };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n if (!credentialStoreProvider) return undefined;\n const tenant = resolveTenantFromRequestContext(requestContext);\n if (!tenant) {\n const rawUser = requestContext?.get('user');\n console.warn('[MastraCode] Tenant credential resolution failed closed', {\n reason: rawUser === undefined ? 'missing-user-context' : 'credential-policy-unavailable',\n hasRequestContext: requestContext !== undefined,\n });\n return unavailableTenantCredentialStore;\n }\n const store = credentialStoreProvider(tenant);\n if (!store) {\n console.warn('[MastraCode] Tenant credential resolution failed closed', {\n reason: 'credential-store-unavailable',\n hasOrganization: tenant.orgId !== undefined,\n credentialScope: tenant.credentialScope,\n ownerResolved: tenant.credentialScope === 'factory' || tenant.userId !== undefined,\n });\n return unavailableTenantCredentialStore;\n }\n return store;\n}\n"],"mappings":";AAsCA,MAAM,wBAAwB;AAC9B,IAAI;AACJ,IAAI;AACJ,IAAI,iCAAiB,IAAI,QAA8E;AAEvG,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BACd,UACA,eACM;CACN,0BAA0B;CAC1B,2BAA2B,WAAW,gBAAgB,KAAA;CACtD,iCAAiB,IAAI,QAAQ;AAC/B;;AAGA,eAAsB,wBAAwB,gBAAgD;CAC5F,IAAI,CAAC,0BAA0B;CAC/B,IAAI,CAAC,gBAAgB,MAAM,IAAI,MAAM,qDAAqD;CAC1F,MAAM,iBAAiB,eAAe,IAAI,qBAAqB;CAC/D,MAAM,kBACJ,kBAAkB,OAAO,mBAAmB,WAAW,eAAe,IAAI,cAAc,IAAI,KAAA;CAG9F,MAAM,mBAAmB,iBAAiB,cAAc,IAAI,YAAY;CACxE,MAAM,gBACJ,mBAAmB,kBAAkB,aAAa,gBAAgB,gBAAgB;CACpF,MAAM,QAAQ,CAAC;CACf,eAAe,IAAI,uBAAuB,KAAK;CAC/C,eAAe,IAAI,OAAO,EAAE,cAAc,CAAC;CAC3C,MAAM,SAAS,MAAM,yBAAyB,aAAa;CAC3D,IAAI,CAAC,QAAQ,MAAM,sBAAsB,eAAe,QAAQ,eAAe,CAAC;CAChF,eAAe,IAAI,OAAO;EAAE;EAAQ;CAAc,CAAC;AACrD;;;;;;AAOA,SAAS,sBAAsB,eAA+B,WAA2B;CACvF,MAAM,gBAAgB,qCAAqC,aAAa,MAAM,KAAA;CAC9E,MAAM,wBAAQ,IAAI,MAChB,gBACI,wGACA,8FACN;CACA,MAAM,aAAa,cAAc,IAAI,YAAY;CACjD,QAAQ,KAAK,qEAAqE;EAChF,QAAQ,gBAAgB,4BAA4B;EACpD,SAAS,cAAc,IAAI,MAAM,MAAM,KAAA;EACvC,iBAAiB;EACjB,uBAAuB,OAAO,YAAY,eAAe;EACzD,qBAAqB,OAAO,YAAY,aAAa;EACrD,OAAO,MAAM;CACf,CAAC;CACD,OAAO;AACT;AAEA,SAAgB,gCAAmC,SAAyD;CAC1G,OAAO,OAAO,QAAwD;EACpE,MAAM,wBAAwB,IAAI,cAAc;EAChD,OAAO,QAAQ,GAAG;CACpB;AACF;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;AAEA,SAAgB,8BAAuC;CACrD,OAAO,6BAA6B,KAAA;AACtC;AAkBA,SAAgB,uBAAuB,gBAAkD;CACvF,OAAO,gCAAgC,cAAc,CAAC,EAAE,mBAAmB;AAC7E;;;;;;;;AASA,SAAgB,gCAAgC,gBAA+D;CAC7G,IAAI,CAAC,0BAA0B,OAAO,qCAAqC,cAAc;CACzF,MAAM,QAAQ,gBAAgB,IAAI,qBAAqB;CACvD,OAAO,SAAS,OAAO,UAAU,WAAW,eAAe,IAAI,KAAK,CAAC,EAAE,SAAS,KAAA;AAClF;;AAGA,SAAgB,qCAAqC,gBAA+D;CAClH,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAI5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,iBAAiB,UAAU,IAAI,SAAS,uBAAuB,KAAK;CAC1E,MAAM,kBAAkB,KAAK,YAAY,KAAK;CAC9C,IAAI,OAAO,oBAAoB,YAAY,CAAC,iBAAiB,OAAO,KAAA;CACpE,IAAI,mBAAmB,KAAA,KAAa,OAAO,mBAAmB,UAAU,OAAO,KAAA;CAE/E,OAAO;EAAE,OAAO;EAAgB,QAAQ;EAAiB,iBAAiB;CAAO;AACnF;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;EACX,MAAM,UAAU,gBAAgB,IAAI,MAAM;EAC1C,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,YAAY,KAAA,IAAY,yBAAyB;GACzD,mBAAmB,mBAAmB,KAAA;EACxC,CAAC;EACD,OAAO;CACT;CACA,MAAM,QAAQ,wBAAwB,MAAM;CAC5C,IAAI,CAAC,OAAO;EACV,QAAQ,KAAK,2DAA2D;GACtE,QAAQ;GACR,iBAAiB,OAAO,UAAU,KAAA;GAClC,iBAAiB,OAAO;GACxB,eAAe,OAAO,oBAAoB,aAAa,OAAO,WAAW,KAAA;EAC3E,CAAC;EACD,OAAO;CACT;CACA,OAAO;AACT"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mastra/code-sdk",
3
- "version": "1.14.0-alpha.6",
3
+ "version": "1.14.0-alpha.7",
4
4
  "description": "Mastra Code SDK: the agent core behind Mastra Code (everything except the TUI) — build your own UIs and surfaces on top of it",
5
5
  "type": "module",
6
6
  "publishConfig": {
@@ -63,19 +63,19 @@
63
63
  "yaml": "^2.7.1",
64
64
  "zod": "^4.6.4",
65
65
  "@mastra/agent-browser": "0.5.3",
66
+ "@mastra/core": "1.78.0-alpha.7",
67
+ "@mastra/duckdb": "1.14.1-alpha.0",
68
+ "@mastra/github-signals": "0.5.1",
66
69
  "@mastra/fastembed": "1.3.3",
67
- "@mastra/core": "1.78.0-alpha.6",
68
70
  "@mastra/memory": "1.38.0-alpha.0",
69
- "@mastra/github-signals": "0.5.1",
70
- "@mastra/parallel": "0.1.2",
71
+ "@mastra/mcp": "2.4.1-alpha.1",
72
+ "@mastra/libsql": "1.26.2-alpha.0",
71
73
  "@mastra/observability": "1.20.1-alpha.1",
72
- "@mastra/duckdb": "1.14.1-alpha.0",
73
- "@mastra/pg": "1.31.2-alpha.1",
74
+ "@mastra/parallel": "0.1.2",
74
75
  "@mastra/schema-compat": "1.3.15-alpha.0",
75
- "@mastra/libsql": "1.26.2-alpha.0",
76
- "@mastra/tavily": "1.1.2",
77
- "@mastra/mcp": "2.4.1-alpha.1",
78
- "@mastra/stagehand": "0.3.5"
76
+ "@mastra/pg": "1.31.2-alpha.1",
77
+ "@mastra/stagehand": "0.3.5",
78
+ "@mastra/tavily": "1.1.2"
79
79
  },
80
80
  "devDependencies": {
81
81
  "@libsql/client": "^0.18.0",
@@ -87,8 +87,8 @@
87
87
  "typescript-eslint": "^8.57.0",
88
88
  "vitest": "4.1.11",
89
89
  "@internal/lint": "0.0.143",
90
- "@internal/types-builder": "0.0.118",
91
- "@internal/workspace-test-utils": "0.0.87"
90
+ "@internal/workspace-test-utils": "0.0.87",
91
+ "@internal/types-builder": "0.0.118"
92
92
  },
93
93
  "engines": {
94
94
  "node": ">=22.19.0"