@mastra/connect 1.0.4-alpha.0 → 1.1.0-alpha.1

package/dist/index.js

@@ -2,6 +2,7 @@ import { MCPClient } from "@mastra/mcp";
 import { z } from "zod";
 import { SpanType, resolveCurrentSpan } from "@mastra/core/observability";
 import { createTool } from "@mastra/core/tools";
+import { hkdfSync } from "crypto";
 //#region src/errors.ts
 const MAX_DETAIL_LENGTH = 2e3;
 var MastraConnectError = class extends Error {
@@ -244,6 +245,8 @@ function resolveClient(options) {
 	};
 	const orgId = options?.orgId?.trim() || process.env.MASTRA_ORG_ID?.trim();
 	if (orgId) headers["x-organization-id"] = orgId;
+	const projectId = options?.projectId?.trim() || process.env.MASTRA_PROJECT_ID?.trim();
+	if (projectId) headers["x-mastra-project-id"] = projectId;
 	return {
 		baseUrl,
 		headers,
@@ -1026,7 +1029,6 @@ const CHANNELS$1 = [
 		integrationId: "microsoft-teams",
 		async create(options, runtime) {
 			const mod = await import("@mastra/teams");
-			if (!process.env.MASTRA_ENCRYPTION_KEY) throw new MastraConnectError("invalid_options", "Microsoft Teams channel: MASTRA_ENCRYPTION_KEY is not set. The Teams install store persists per-agent bot secrets and requires an at-rest encryption key (a 32-byte value, base64-encoded).");
 			const safeOptions = stripReservedOptions("microsoft-teams", options);
 			const tokenResolver = async (scope) => {
 				const fresh = await runtime.getCredential();
@@ -1035,10 +1037,22 @@ const CHANNELS$1 = [
 				if (!token) throw new MastraConnectError("no_active_connection", `Teams connection ${runtime.getConnectionId()} has no Dev Portal token on its credential. Reconnect with an integration that requests the ${mod.TEAMS_DEV_PORTAL_SCOPE} scope.`);
 				return token;
 			};
-			return { provider: new mod.TeamsProvider({
+			const config = {
 				tokenResolver,
 				...safeOptions ?? {}
-			}) };
+			};
+			const usingDerivedKey = !process.env.MASTRA_ENCRYPTION_KEY;
+			if (usingDerivedKey) config.encryptionKey = Buffer.from(hkdfSync("sha256", runtime.client.accessToken, "mastra-connect", "microsoft-teams-install-store", 32)).toString("base64");
+			let warnedDerivedKey = false;
+			return {
+				provider: new mod.TeamsProvider(config),
+				async sync() {
+					if (usingDerivedKey && !warnedDerivedKey) {
+						warnedDerivedKey = true;
+						console.warn("[@mastra/connect] MASTRA_ENCRYPTION_KEY is not set: encrypting the Microsoft Teams install store with a key derived from the platform access token. Set MASTRA_ENCRYPTION_KEY to use a dedicated key — otherwise rotating the platform access token makes stored bot credentials unreadable (disconnect and reconnect the channel to re-provision).");
+					}
+				}
+			};
 		}
 	}
 ];
@@ -75094,7 +75108,11 @@ function tools(options = {}) {
 	if (!projectId) throw new MastraConnectError("missing_project_id", "Missing project id: set MASTRA_PROJECT_ID or pass projectId.");
 	if (options.ttlMs !== void 0 && (!Number.isFinite(options.ttlMs) || options.ttlMs < 0)) throw new MastraConnectError("invalid_options", `Invalid ttlMs (${options.ttlMs}): expected a finite number of milliseconds >= 0.`);
 	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS$1;
-	const client = resolveClient(options.client);
+	const clientOptions = {
+		...options.client,
+		projectId
+	};
+	const client = resolveClient(clientOptions);
 	const resolverId = ++nextResolverId;
 	const mcpClients = /* @__PURE__ */ new Map();
 	const normalizedProviders = normalizeProviderOverrides(options.providers);
@@ -75142,7 +75160,7 @@ function tools(options = {}) {
 		if (!inflight) inflight = (async () => {
 			try {
 				const { connections, catalog, catalogAvailable } = await loadSnapshotInputs();
-				const snapshot = await mapTools(connections, buildRequests(normalizedProviders, catalog, catalogAvailable), options, client, mcpClients, resolverId);
+				const snapshot = await mapTools(connections, buildRequests(normalizedProviders, catalog, catalogAvailable), options, clientOptions, client, mcpClients, resolverId);
 				cache = {
 					snapshot,
 					fetchedAt: Date.now()
@@ -75323,7 +75341,7 @@ function buildRequests(providers, catalog, catalogAvailable) {
 	return requests;
 }
 /** Maps one platform connection list snapshot to a flat tool record without allowing ambiguous tool ownership. */
-async function mapTools(connections, requests, options, client, mcpClients, resolverId) {
+async function mapTools(connections, requests, options, clientOptions, client, mcpClients, resolverId) {
 	const byIntegrationId = groupByIntegrationId(connections);
 	const activeMcpKeys = /* @__PURE__ */ new Set();
 	const result = {};
@@ -75356,7 +75374,7 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 			} else {
 				providerTools = request.registration.createTools({
 					connectionId: resolution.connectionId,
-					client: options.client,
+					client: clientOptions,
 					...providerFilterOptions(request.options)
 				});
 				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval);
@@ -75379,7 +75397,7 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connections: resolution.connections,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					client: options.client
+					client: clientOptions
 				});
 				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval, [listConnectionsToolKey(integrationId)]);
 			}
@@ -75581,7 +75599,10 @@ async function channels(options = {}) {
 	const unknownChannelIds = Object.keys(providerOverrides).filter((integrationId) => !knownChannelIds.has(integrationId) && !providerOverrides[integrationId]?.disabled);
 	if (unknownChannelIds.length > 0) throw new MastraConnectError("invalid_options", `Unknown channel${unknownChannelIds.length > 1 ? "s" : ""} in the providers option: ${unknownChannelIds.map((id) => `'${id}'`).join(", ")}. Known channels: ${[...knownChannelIds].join(", ")}.`);
 	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-	const client = resolveClient(options.client);
+	const client = resolveClient({
+		...options.client,
+		projectId
+	});
 	const states = [];
 	for (const registration of CHANNELS) {
 		if (only !== void 0 && !only.has(registration.integrationId)) continue;