@mastra/code-sdk 1.4.0-alpha.2 → 1.4.0-alpha.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @mastra/code-sdk
 
+## 1.4.0-alpha.3
+
+### Patch Changes
+
+- Factory runs now resolve provider credentials with org > user precedence, so an org-wide "Everyone in org" key takes priority over a run's acting user's personal key. This means factory automation always bills against the org's shared credentials when they exist, regardless of who triggered the run. Interactive (non-factory) sessions keep the existing user > org precedence, so personal plan subscriptions and keys still take priority there. ([#21899](https://github.com/mastra-ai/mastra/pull/21899))
+
+- Interactive messages and model switches on factory sessions now resolve provider credentials org-first (org > user), matching board-run kickoff. The credential resolver keys off the session's `factoryProjectId` in controller state, so any run on a factory-owned session rides the org's shared keys with the caller's personal credentials as fallback — switching to a personal-only model still works through that fallback. Repo-backed Slack channel sessions now stamp the owning factory project onto session state so they get the same behavior. ([#21899](https://github.com/mastra-ai/mastra/pull/21899))
+
+- Fixed shared threads running with a stale model in multi-server deployments. The model selected for a mode is now re-read from the thread's persisted settings at the start of every run, so a model switch made in one browser session or server replica is picked up by all others instead of silently diverging until the next mode switch. ([#21899](https://github.com/mastra-ai/mastra/pull/21899))
+
+- Updated dependencies [[`9267e9b`](https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab), [`acc3471`](https://github.com/mastra-ai/mastra/commit/acc3471de5f3fde8027ee4e355af292b2bc1bc30), [`b6a771e`](https://github.com/mastra-ai/mastra/commit/b6a771ef23d203ddb348efca8065eff65def8191), [`9267e9b`](https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab), [`acc3471`](https://github.com/mastra-ai/mastra/commit/acc3471de5f3fde8027ee4e355af292b2bc1bc30), [`26d4016`](https://github.com/mastra-ai/mastra/commit/26d40160ff7f7d8bf95fee2039a52cbc83863533), [`9267e9b`](https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab), [`9267e9b`](https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab), [`57c5103`](https://github.com/mastra-ai/mastra/commit/57c51035a2a36e3df3c4f32f46bb789a66ed5946), [`acc3471`](https://github.com/mastra-ai/mastra/commit/acc3471de5f3fde8027ee4e355af292b2bc1bc30)]:
+  - @mastra/core@1.61.0-alpha.3
+  - @mastra/libsql@1.21.1-alpha.1
+  - @mastra/pg@1.21.1-alpha.1
+
 ## 1.4.0-alpha.2
 
 ### Patch Changes

package/dist/agents/credential-resolver.d.ts

@@ -19,6 +19,12 @@ export interface CredentialTenant {
     orgId?: string;
     /** Stable user id from the web auth adapter. */
     userId: string;
+    /**
+     * Resolve org-shared credentials over the user's personal ones. Set by
+     * trusted server code for automated (factory) runs so they ride the org's
+     * shared keys first and only fall back to the acting user's credentials.
+     */
+    orgFirst?: boolean;
 }
 /**
  * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back

package/dist/agents/credential-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAkBhG,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAAG,IAAI,CAE9F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAkBD;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAiB7G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAKnG"}
+{"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAkBhG,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAAG,IAAI,CAE9F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAqCD;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAsB7G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAKnG"}

package/dist/agents/credential-resolver.js

@@ -20,6 +20,22 @@ function hasCredentialStoreProvider() {
 	return credentialStoreProvider !== void 0;
 }
 /**
+* Whether the request context belongs to a run on a factory-owned session.
+*
+* The agent controller stamps the session's state onto the request context
+* under `controller`, and only trusted factory server code ever writes
+* `factoryProjectId` into session state (board-run creation) — interactive
+* chat sessions never carry it. Runs on such sessions resolve credentials
+* org > user regardless of who sent the message: a board run continued
+* interactively, or a model switch inside it, is still org work.
+*/
+function isFactorySessionContext(requestContext) {
+	const controller = requestContext?.get("controller");
+	if (!controller || typeof controller !== "object") return false;
+	const factoryProjectId = controller.state?.factoryProjectId;
+	return typeof factoryProjectId === "string" && factoryProjectId.length > 0;
+}
+/**
 * Derive the calling tenant from a request context, if an authenticated web
 * user was stashed on it. Mirrors the web layer's stable-id resolution
 * (`workosId` falling back to the provider `id`).
@@ -39,9 +55,11 @@ function resolveTenantFromRequestContext(requestContext) {
 	const userId = user.workosId ?? user.id;
 	if (typeof userId !== "string" || !userId) return void 0;
 	if (orgId !== void 0 && typeof orgId !== "string") return void 0;
+	const orgFirst = raw.orgFirstCredentials === true || user.orgFirstCredentials === true || isFactorySessionContext(requestContext);
 	return {
 		orgId,
-		userId
+		userId,
+		...orgFirst ? { orgFirst } : {}
 	};
 }
 /**

package/dist/agents/credential-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` derives the calling tenant from the request context\n * (the web auth gate stashes the authenticated user under the `user` key) and\n * resolves credentials through the tenant's own store — user credentials over\n * org credentials over server env vars, with OAuth refresh owned by the store.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\n/** The identity a credential lookup is scoped to. */\nexport interface CredentialTenant {\n  /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n  orgId?: string;\n  /** Stable user id from the web auth adapter. */\n  userId: string;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back\n * to the global store (e.g. tenant storage temporarily unavailable). Must be\n * synchronous — implementations serve from a primed snapshot and do\n * authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n  allowEnvironmentFallback: false,\n  reload() {},\n  get() {\n    return undefined;\n  },\n  getStoredApiKey() {\n    return undefined;\n  },\n  async getApiKey() {\n    return undefined;\n  },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined): void {\n  credentialStoreProvider = provider;\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n  return credentialStoreProvider !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n  workosId?: string;\n  id?: string;\n  organizationId?: string;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n  user?: RequestContextUser;\n  session?: { activeOrganizationId?: string };\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * The value under `user` is whatever the active auth provider's\n * `authenticateToken` returned, so its shape follows the provider: a flat user\n * (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the\n * flat shape resolves no tenant at all for the wrapper, which in deployed mode\n * fails closed to an empty credential store.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n  const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n  if (!raw || typeof raw !== 'object') return undefined;\n\n  // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n  // comes from the session half only, never from the inner user. The two parsers\n  // cannot share code across the package boundary, so they must agree by rule.\n  const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n  const user = wrapped ? (raw.user as RequestContextUser) : raw;\n  const orgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n  const userId = user.workosId ?? user.id;\n  // The slot holds whatever the provider returned, so the declared string\n  // types are hopes, not guarantees. A non-string id must refuse the tenant\n  // (fail closed), not flow onward as a mistyped key.\n  if (typeof userId !== 'string' || !userId) return undefined;\n  if (orgId !== undefined && typeof orgId !== 'string') return undefined;\n  return { orgId, userId };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n  if (!credentialStoreProvider) return undefined;\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) return unavailableTenantCredentialStore;\n  return credentialStoreProvider(tenant) ?? unavailableTenantCredentialStore;\n}\n"],"mappings":";AAiCA,IAAI;AAEJ,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BAA2B,UAAqD;CAC9F,0BAA0B;AAC5B;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;;;;;;;;;;;;AA6BA,SAAgB,gCAAgC,gBAA+D;CAC7G,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAK5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,QAAQ,UAAU,IAAI,SAAS,uBAAuB,KAAK;CACjE,MAAM,SAAS,KAAK,YAAY,KAAK;CAIrC,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAA;CAClD,IAAI,UAAU,KAAA,KAAa,OAAO,UAAU,UAAU,OAAO,KAAA;CAC7D,OAAO;EAAE;EAAO;CAAO;AACzB;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO,wBAAwB,MAAM,KAAK;AAC5C"}
+{"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` derives the calling tenant from the request context\n * (the web auth gate stashes the authenticated user under the `user` key) and\n * resolves credentials through the tenant's own store — user credentials over\n * org credentials over server env vars, with OAuth refresh owned by the store.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\n/** The identity a credential lookup is scoped to. */\nexport interface CredentialTenant {\n  /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n  orgId?: string;\n  /** Stable user id from the web auth adapter. */\n  userId: string;\n  /**\n   * Resolve org-shared credentials over the user's personal ones. Set by\n   * trusted server code for automated (factory) runs so they ride the org's\n   * shared keys first and only fall back to the acting user's credentials.\n   */\n  orgFirst?: boolean;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back\n * to the global store (e.g. tenant storage temporarily unavailable). Must be\n * synchronous — implementations serve from a primed snapshot and do\n * authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n  allowEnvironmentFallback: false,\n  reload() {},\n  get() {\n    return undefined;\n  },\n  getStoredApiKey() {\n    return undefined;\n  },\n  async getApiKey() {\n    return undefined;\n  },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined): void {\n  credentialStoreProvider = provider;\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n  return credentialStoreProvider !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n  workosId?: string;\n  id?: string;\n  organizationId?: string;\n  /** Trusted server code marks automated runs to resolve org > user credentials. */\n  orgFirstCredentials?: boolean;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n  user?: RequestContextUser;\n  session?: { activeOrganizationId?: string };\n}\n\n/**\n * Whether the request context belongs to a run on a factory-owned session.\n *\n * The agent controller stamps the session's state onto the request context\n * under `controller`, and only trusted factory server code ever writes\n * `factoryProjectId` into session state (board-run creation) — interactive\n * chat sessions never carry it. Runs on such sessions resolve credentials\n * org > user regardless of who sent the message: a board run continued\n * interactively, or a model switch inside it, is still org work.\n */\nfunction isFactorySessionContext(requestContext?: RequestContext): boolean {\n  const controller = requestContext?.get('controller') as { state?: { factoryProjectId?: unknown } } | undefined;\n  if (!controller || typeof controller !== 'object') return false;\n  const factoryProjectId = controller.state?.factoryProjectId;\n  return typeof factoryProjectId === 'string' && factoryProjectId.length > 0;\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * The value under `user` is whatever the active auth provider's\n * `authenticateToken` returned, so its shape follows the provider: a flat user\n * (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the\n * flat shape resolves no tenant at all for the wrapper, which in deployed mode\n * fails closed to an empty credential store.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n  const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n  if (!raw || typeof raw !== 'object') return undefined;\n\n  // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n  // comes from the session half only, never from the inner user. The two parsers\n  // cannot share code across the package boundary, so they must agree by rule.\n  const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n  const user = wrapped ? (raw.user as RequestContextUser) : raw;\n  const orgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n  const userId = user.workosId ?? user.id;\n  // The slot holds whatever the provider returned, so the declared string\n  // types are hopes, not guarantees. A non-string id must refuse the tenant\n  // (fail closed), not flow onward as a mistyped key.\n  if (typeof userId !== 'string' || !userId) return undefined;\n  if (orgId !== undefined && typeof orgId !== 'string') return undefined;\n  // Only an exact `true` flips precedence — anything else keeps user > org.\n  // Server code stamps the flag on the stashed value itself, so read it from\n  // the top level as well as the unwrapped user (better-auth wrapper shape).\n  const orgFirst =\n    raw.orgFirstCredentials === true || user.orgFirstCredentials === true || isFactorySessionContext(requestContext);\n  return { orgId, userId, ...(orgFirst ? { orgFirst } : {}) };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n  if (!credentialStoreProvider) return undefined;\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) return unavailableTenantCredentialStore;\n  return credentialStoreProvider(tenant) ?? unavailableTenantCredentialStore;\n}\n"],"mappings":";AAuCA,IAAI;AAEJ,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BAA2B,UAAqD;CAC9F,0BAA0B;AAC5B;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;;;;;;;;;;;AA8BA,SAAS,wBAAwB,gBAA0C;CACzE,MAAM,aAAa,gBAAgB,IAAI,YAAY;CACnD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,mBAAmB,WAAW,OAAO;CAC3C,OAAO,OAAO,qBAAqB,YAAY,iBAAiB,SAAS;AAC3E;;;;;;;;;;;;AAaA,SAAgB,gCAAgC,gBAA+D;CAC7G,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAK5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,QAAQ,UAAU,IAAI,SAAS,uBAAuB,KAAK;CACjE,MAAM,SAAS,KAAK,YAAY,KAAK;CAIrC,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAA;CAClD,IAAI,UAAU,KAAA,KAAa,OAAO,UAAU,UAAU,OAAO,KAAA;CAI7D,MAAM,WACJ,IAAI,wBAAwB,QAAQ,KAAK,wBAAwB,QAAQ,wBAAwB,cAAc;CACjH,OAAO;EAAE;EAAO;EAAQ,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CAAG;AAC5D;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ,OAAO;CACpB,OAAO,wBAAwB,MAAM,KAAK;AAC5C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/code-sdk",
-  "version": "1.4.0-alpha.2",
+  "version": "1.4.0-alpha.3",
   "description": "Mastra Code SDK: the agent core behind Mastra Code (everything except the TUI) — build your own UIs and surfaces on top of it",
   "type": "module",
   "publishConfig": {
@@ -57,17 +57,17 @@
     "vscode-languageserver-protocol": "^3.17.5",
     "yaml": "^2.7.1",
     "zod": "^4.3.6",
-    "@mastra/core": "1.61.0-alpha.2",
+    "@mastra/agent-browser": "0.5.1",
+    "@mastra/core": "1.61.0-alpha.3",
     "@mastra/duckdb": "1.6.2",
     "@mastra/github-signals": "0.2.5",
+    "@mastra/libsql": "1.21.1-alpha.1",
     "@mastra/fastembed": "1.2.0",
-    "@mastra/libsql": "1.21.1-alpha.0",
-    "@mastra/agent-browser": "0.5.1",
     "@mastra/mcp": "1.17.1-alpha.0",
+    "@mastra/pg": "1.21.1-alpha.1",
+    "@mastra/observability": "1.17.1",
     "@mastra/memory": "1.27.0",
     "@mastra/schema-compat": "1.3.7",
-    "@mastra/observability": "1.17.1",
-    "@mastra/pg": "1.21.1-alpha.0",
     "@mastra/tavily": "1.1.1",
     "@mastra/stagehand": "0.3.3"
   },
@@ -80,9 +80,9 @@
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.57.0",
     "vitest": "4.1.10",
-    "@internal/lint": "0.0.124",
     "@internal/types-builder": "0.0.99",
-    "@internal/workspace-test-utils": "0.0.68"
+    "@internal/workspace-test-utils": "0.0.68",
+    "@internal/lint": "0.0.124"
   },
   "engines": {
     "node": ">=22.19.0"