@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @mastra/factory
 
+## 0.1.0-alpha.3
+
+### Patch Changes
+
+- Forwarded closed Platform GitHub event-log deliveries into Factory governance before dispatching repository subscriptions, and kept default GitHub rules from auto-starting issues or pull requests created before the Factory. ([#19988](https://github.com/mastra-ai/mastra/pull/19988))
+
+- Deployed factories now authenticate API and Studio requests with the same provider, so Studio sessions work without extra configuration. ([#19966](https://github.com/mastra-ai/mastra/pull/19966))
+
+- Fixed cloned session threads reading from a previous storage instance. The dynamic memory cache now invalidates when the storage or vector instance changes, so thread cloning always uses the current database. ([#19966](https://github.com/mastra-ai/mastra/pull/19966))
+
+- Updated dependencies [[`cc656b9`](https://github.com/mastra-ai/mastra/commit/cc656b92cc8fe40af3e2ea8bb796a6b406e96791), [`cc656b9`](https://github.com/mastra-ai/mastra/commit/cc656b92cc8fe40af3e2ea8bb796a6b406e96791), [`337d41d`](https://github.com/mastra-ai/mastra/commit/337d41d8aae0399d2bf42d42ebddac0c21953891)]:
+  - @mastra/code-sdk@1.0.0-alpha.15
+
+## 0.1.0-alpha.2
+
+### Patch Changes
+
+- Fixed Factory metrics windowing to use inclusive UTC calendar days. Date-only `from`/`to` bounds now include both selected days, an item completing at the current instant is counted in today's throughput (previously it could be dropped on the window's exclusive edge), and `windowDays` reflects the number of gap-filled day buckets. Cards feed the source mix only when created inside the window. ([#19971](https://github.com/mastra-ai/mastra/pull/19971))
+
+- Fixed duplicate repositories in Factory source control settings. ([#19971](https://github.com/mastra-ai/mastra/pull/19971))
+
+- Fixed Factory automation so polled GitHub events reach governance rules, authenticated sessions start with the correct ownership, and board moves reliably notify active or idle agents. ([#19979](https://github.com/mastra-ai/mastra/pull/19979))
+
 ## 0.1.0-alpha.1
 
 ### Minor Changes

package/LICENSE.md

@@ -0,0 +1,30 @@
+Portions of this software are licensed as follows:
+
+- All content that resides under any directory named "ee/" within this
+  repository, including but not limited to:
+  - `packages/core/src/auth/ee/`
+  - `packages/server/src/server/auth/ee/`
+    is licensed under the license defined in `ee/LICENSE`.
+
+- All third-party components incorporated into the Mastra Software are
+  licensed under the original license provided by the owner of the
+  applicable component.
+
+- Content outside of the above-mentioned directories or restrictions is
+  available under the "Apache License 2.0" as defined below.
+
+# Apache License 2.0
+
+Copyright (c) 2025 Kepler Software, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/dist/auth.d.ts

@@ -0,0 +1,181 @@
+import { MastraAuthWorkos } from '@mastra/auth-workos';
+import type { ApiRoute, IMastraAuthProvider } from '@mastra/core/server';
+import type { Context, Hono } from 'hono';
+import type { RouteAuth } from './routes/route.js';
+/**
+ * Provider-neutral factory auth gating for the MastraCode web server.
+ *
+ * When an auth provider is active (a `MastraAuthProvider` instance passed to
+ * `MastraFactory`'s `auth` slot, or — back-compat for suites/paths that never
+ * boot the factory — implied by the WorkOS env vars), every route on the web
+ * server is placed behind it: unauthenticated browser navigations are
+ * redirected to the SPA's `/signin` page, API/XHR calls receive a 401, and a
+ * small set of public routes stay reachable while signed out — the provider's
+ * `/auth/*` routes plus `/auth/me`, the `/signin` page and its `/assets/*`
+ * bundle. When no provider is active, `mountFactoryAuth` is a no-op and the server
+ * behaves exactly as it does without auth.
+ *
+ * Provider specifics stay in the providers (`@mastra/auth-workos`,
+ * `@mastra/auth-better-auth`, or any custom `IMastraAuthProvider`); this
+ * module composes them capability-first via the core type guards:
+ * - `authenticateToken` — session/bearer validation (all providers)
+ * - `ISSOProvider` — hosted-login `/auth/login`, `/auth/callback`, `/auth/logout`
+ * - `IAuthHttpHandler` — provider-owned `/auth/api/*` endpoints (better-auth)
+ * - `IOrganizationsProvider` — personal-org bootstrap + admin checks
+ * - `ICredentialsProvider.isSignUpEnabled` — SPA sign-up affordance
+ * - `getClearSessionHeaders` — session cookie clearing on logout
+ */
+/** Minimal shape of the signed-in user surfaced to the SPA (no tokens). */
+export interface FactoryAuthUser {
+    /** Stable WorkOS user id used to scope per-user data (GitHub installs etc.). */
+    workosId?: string;
+    /** Provider user id; WorkOS shapes may use `workosId` instead (see {@link workosId}). */
+    id?: string;
+    email?: string;
+    name?: string;
+    /**
+     * Organization id. The org is the top-level tenant: it owns the GitHub
+     * App installation and connected projects, while each user inside the org gets
+     * isolated building instances. Absent for personal (no-org) accounts.
+     */
+    organizationId?: string;
+}
+/**
+ * Tenant identity: the org is the top-level tenant, and each user inside it is
+ * an isolated builder. Agent state, worktrees and sandboxes are scoped per
+ * `(orgId, userId)`. Personal (no-org) users have `orgId === undefined`.
+ */
+export interface FactoryAuthTenant {
+    /** Organization id, or `undefined` for personal (no-org) accounts. */
+    orgId?: string;
+    /** Stable provider user id. */
+    userId: string;
+}
+/**
+ * Validate that a `returnTo` value is a safe same-site path, to prevent
+ * open-redirect attacks. Only absolute local paths (`/foo`) are allowed;
+ * protocol-relative (`//evil.com`) and absolute URLs are rejected.
+ */
+export declare function sanitizeReturnTo(raw: string | undefined): string;
+/** Extract a bearer token from the Authorization header, if present. */
+export declare function getBearerToken(authorization: string | undefined): string;
+/**
+ * Whether the SPA is served cross-origin from this API (platform deploy). When
+ * `MASTRACODE_ALLOWED_ORIGINS` is set the browser talks to us cross-site, so
+ * session cookies must be `SameSite=None; Secure` for the browser to send them.
+ * Same-origin local dev leaves this unset and keeps the stricter `SameSite=Lax`.
+ */
+export declare function isCrossSiteAuth(): boolean;
+/** Hono context variables set by the auth gate. */
+export interface FactoryAuthVariables {
+    factoryAuthUser: FactoryAuthUser;
+}
+/**
+ * Read the authenticated user the gate stashed on the context, or
+ * `undefined` when unauthenticated / auth disabled. Used by downstream routes
+ * (e.g. GitHub) to scope rows per user.
+ */
+export declare function getFactoryAuthUser(c: Context): FactoryAuthUser | undefined;
+/** Resolve the stable user id from an authenticated user shape. */
+export declare function getFactoryAuthUserId(user: FactoryAuthUser | undefined): string | undefined;
+/** Resolve the organization id from a user shape, if present. */
+export declare function getFactoryAuthOrgId(user: FactoryAuthUser | undefined): string | undefined;
+/**
+ * Resolve the tenant identity `(orgId, userId)` from the authenticated user on
+ * the context. Returns `undefined` when there is no signed-in user (auth
+ * disabled or unauthenticated). `orgId` is `undefined` for personal accounts;
+ * callers gate org-scoped GitHub features on its presence while agent state
+ * falls back to a user-only tenant.
+ */
+export declare function factoryAuthTenant(c: Context): FactoryAuthTenant | undefined;
+/**
+ * Fail-closed authorization for organization-level administrative mutations.
+ * The caller must belong to the same active organization and the provider must
+ * explicitly confirm an admin/owner role.
+ */
+export declare function isOrganizationAdmin(provider: IMastraAuthProvider | undefined, c: Context, organizationId: string): Promise<boolean>;
+/**
+ * Build the factory's implementation of the `RouteAuth` seam over the
+ * resolved provider (`undefined` = auth disabled). Constructed once per boot
+ * by `MastraFactory.prepare()` and handed to factory route modules at
+ * construction — they never import the factory auth module directly.
+ */
+export declare function createFactoryRouteAuth(provider: IMastraAuthProvider | undefined): RouteAuth;
+/** True when the given provider is WorkOS. Gates WorkOS-only capabilities. */
+export declare function isWorkOSAuth(provider: IMastraAuthProvider | undefined): boolean;
+/**
+ * The raw WorkOS provider, for features that need the WorkOS client directly
+ * (audit-log export, Admin Portal links). Callers must gate on
+ * {@link isWorkOSAuth} first — throws when the provider is not WorkOS.
+ */
+export declare function getWorkOSProvider(provider: IMastraAuthProvider | undefined): MastraAuthWorkos;
+/**
+ * Resolve the authenticated user for a request, stashing it on the context.
+ *
+ * The gate only authenticates non-`/auth/*` requests via the `Authorization`
+ * header, so cookie-based browser navigations to public `/auth/*` routes (the
+ * GitHub connect/callback flow) arrive without a gate-stashed user. This reads
+ * the session cookie from the raw request the same way `/auth/me` does,
+ * caches the result on the context, and returns it so downstream helpers like
+ * {@link factoryAuthTenant} work uniformly on both gated and public routes.
+ *
+ * Returns `undefined` when there is no valid session (or auth is disabled).
+ */
+export declare function ensureFactoryAuthUser(provider: IMastraAuthProvider | undefined, c: Context): Promise<FactoryAuthUser | undefined>;
+export interface MountFactoryAuthOptions {
+    /**
+     * Explicit auth provider to mount. When omitted, falls back to a WorkOS
+     * provider implied by the `WORKOS_*` env vars (back-compat for suites that
+     * never boot the factory).
+     */
+    provider?: IMastraAuthProvider;
+    /**
+     * Absolute URL the identity provider redirects back to after login (WorkOS
+     * env-fallback path only). Defaults to the `WORKOS_REDIRECT_URI` env var.
+     */
+    redirectUri?: string;
+    /** Browser-facing origin used to derive the SSO callback URL. */
+    publicUrl?: string;
+}
+/**
+ * Register the public `/auth/*` routes on a Hono app: the capability-derived
+ * provider routes (login/callback/logout/provider APIs) plus the
+ * provider-neutral `/auth/me`. Split out from `mountFactoryAuth` so both the local
+ * Hono server and the platform Mastra entry can reuse the exact same handlers.
+ */
+export declare function registerAuthRoutes(app: Hono<any>, provider: IMastraAuthProvider, options?: {
+    publicUrl?: string;
+}): void;
+/**
+ * Build the public `/auth/*` routes (provider routes + `/auth/me`) as Mastra
+ * `server.apiRoutes`. Used by the platform Mastra entry (`src/mastra/index.ts`),
+ * which can't register plain Hono routes on the deployer-generated app the way
+ * the local server does via {@link registerAuthRoutes}.
+ *
+ * Handlers are identical to {@link registerAuthRoutes}. All are `requiresAuth: false`
+ * (they must be reachable while unauthenticated), and the gate middleware skips
+ * `/auth/*` so it never blocks them. `/auth/*` is not under `/api`, so it is a
+ * valid custom-route path.
+ */
+export declare function buildAuthRoutes(provider: IMastraAuthProvider, options?: {
+    publicUrl?: string;
+}): ApiRoute[];
+/**
+ * Build the auth gate as a plain Hono middleware handler `(c, next)`. Protects
+ * everything that is not a public `/auth/*` route: authenticated requests stash
+ * the user on the context and continue; unauthenticated navigations redirect to
+ * login and XHR/API calls get a 401 JSON. Shared by the local Hono server
+ * (`mountFactoryAuth`) and the platform Mastra entry (`server.middleware`).
+ */
+export declare function createFactoryAuthGate(provider: IMastraAuthProvider): (c: Context, next: () => Promise<void>) => Promise<Response | void>;
+/**
+ * Mount factory auth gating onto the host app. No-op when auth is disabled
+ * (no provider active).
+ *
+ * Must be called before the Mastra adapter routes, the `/web/*` routes, and
+ * the static UI handlers so the gate covers every request. Composes the shared
+ * `registerAuthRoutes` + `createFactoryAuthGate` factories so the local Hono server
+ * and the platform Mastra entry stay behavior-identical.
+ */
+export declare function mountFactoryAuth(app: Hono<any>, options?: MountFactoryAuthOptions): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAoB,MAAM,qBAAqB,CAAC;AAC3F,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMhE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAIxE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,eAAe,CAAC;CAClC;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAE1E;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE1F;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEzF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAK3E;AAyHD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,EACzC,CAAC,EAAE,OAAO,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAO3F;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GAAG,gBAAgB,CAG7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,EACzC,CAAC,EAAE,OAAO,GACT,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAatC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4ND;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EACd,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,IAAI,CAMN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,EAAE,CAmB/G;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,mBAAmB,IACnD,GAAG,OAAO,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkC/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAO/F"}

package/dist/auth.js

@@ -0,0 +1,370 @@
+// src/auth.ts
+import { MastraAuthWorkos } from "@mastra/auth-workos";
+import {
+  registerApiRoute,
+  isAuthHttpHandler,
+  isCredentialsProvider,
+  isOrganizationsProvider,
+  isSessionProvider,
+  isSSOProvider
+} from "@mastra/core/server";
+function sanitizeReturnTo(raw) {
+  if (!raw) return "/";
+  if (!raw.startsWith("/")) return "/";
+  if (raw.startsWith("//") || raw.startsWith("/\\")) return "/";
+  return raw;
+}
+function getBearerToken(authorization) {
+  if (!authorization) return "";
+  const match = /^Bearer\s+(.+)$/i.exec(authorization);
+  return match?.[1] ?? "";
+}
+function isCrossSiteAuth() {
+  return Boolean(process.env.MASTRACODE_ALLOWED_ORIGINS?.trim());
+}
+var FACTORY_AUTH_USER_KEY = "factoryAuthUser";
+function getFactoryAuthUser(c) {
+  return c.get(FACTORY_AUTH_USER_KEY);
+}
+function getFactoryAuthUserId(user) {
+  return user?.workosId ?? user?.id;
+}
+function getFactoryAuthOrgId(user) {
+  return user?.organizationId;
+}
+function factoryAuthTenant(c) {
+  const user = getFactoryAuthUser(c);
+  const userId = getFactoryAuthUserId(user);
+  if (!userId) return void 0;
+  return { orgId: getFactoryAuthOrgId(user), userId };
+}
+function envWorkosConfigured() {
+  return Boolean(process.env.WORKOS_API_KEY && process.env.WORKOS_CLIENT_ID);
+}
+function envFallbackAuthProvider(redirectUri) {
+  if (!envWorkosConfigured()) return void 0;
+  return new MastraAuthWorkos({
+    redirectUri: redirectUri ?? process.env.WORKOS_REDIRECT_URI,
+    fetchMemberships: true
+  });
+}
+function toFactoryAuthUser(result) {
+  if (!result || typeof result !== "object") return null;
+  const record = result;
+  if (record.user && typeof record.user === "object" && record.session && typeof record.session === "object") {
+    const user = record.user;
+    const session = record.session;
+    if (typeof user.id !== "string") return null;
+    return {
+      id: user.id,
+      email: typeof user.email === "string" ? user.email : void 0,
+      name: typeof user.name === "string" ? user.name : void 0,
+      organizationId: typeof session.activeOrganizationId === "string" ? session.activeOrganizationId : void 0
+    };
+  }
+  const flat = record;
+  const id = typeof flat.id === "string" ? flat.id : void 0;
+  const workosId = typeof flat.workosId === "string" ? flat.workosId : void 0;
+  if (!id && !workosId) return null;
+  return {
+    id,
+    workosId,
+    email: typeof flat.email === "string" ? flat.email : void 0,
+    name: typeof flat.name === "string" ? flat.name : void 0,
+    organizationId: typeof flat.organizationId === "string" ? flat.organizationId : void 0
+  };
+}
+async function authenticateRequest(provider, token, raw) {
+  try {
+    const result = await provider.authenticateToken(token, raw);
+    return toFactoryAuthUser(result);
+  } catch {
+    return null;
+  }
+}
+async function ensureUserOrg(provider, user) {
+  if (getFactoryAuthOrgId(user)) return;
+  if (!isOrganizationsProvider(provider)) return;
+  const userId = getFactoryAuthUserId(user);
+  if (!userId) return;
+  try {
+    const orgId = await provider.ensureOrganization(userId);
+    if (orgId) user.organizationId = orgId;
+  } catch {
+  }
+}
+function providerClearCookies(provider) {
+  const getClearSessionHeaders = provider.getClearSessionHeaders;
+  if (typeof getClearSessionHeaders !== "function") return [];
+  const headers = getClearSessionHeaders.call(provider) ?? {};
+  const setCookie = headers["Set-Cookie"];
+  if (!setCookie) return [];
+  return setCookie.split(/,(?=\s*[^;=,\s]+=)/).map((cookie) => cookie.trim());
+}
+async function isOrganizationAdmin(provider, c, organizationId) {
+  const user = await ensureFactoryAuthUser(provider, c);
+  if (!user || user.organizationId !== organizationId || !provider || !isOrganizationsProvider(provider)) {
+    return false;
+  }
+  const userId = getFactoryAuthUserId(user);
+  if (!userId) return false;
+  try {
+    return await provider.isOrganizationAdmin(organizationId, userId);
+  } catch {
+    return false;
+  }
+}
+function createFactoryRouteAuth(provider) {
+  return {
+    enabled: () => provider !== void 0,
+    ensureUser: (c) => ensureFactoryAuthUser(provider, c),
+    tenant: (c) => factoryAuthTenant(c),
+    isOrganizationAdmin: (c, organizationId) => isOrganizationAdmin(provider, c, organizationId)
+  };
+}
+function isWorkOSAuth(provider) {
+  return provider instanceof MastraAuthWorkos;
+}
+function getWorkOSProvider(provider) {
+  if (provider instanceof MastraAuthWorkos) return provider;
+  throw new Error("WorkOS provider requested but the active factory auth provider is not WorkOS");
+}
+async function ensureFactoryAuthUser(provider, c) {
+  const existing = getFactoryAuthUser(c);
+  if (existing) return existing;
+  if (!provider) return void 0;
+  const token = getBearerToken(c.req.header("Authorization"));
+  const user = await authenticateRequest(provider, token, c.req.raw);
+  if (!user) return void 0;
+  await ensureUserOrg(provider, user);
+  c.set(FACTORY_AUTH_USER_KEY, user);
+  return user;
+}
+function isNavigationRequest(path, accept) {
+  if (path.startsWith("/api/")) return false;
+  return (accept ?? "").includes("text/html");
+}
+async function handleAuthMe(provider, c) {
+  const token = getBearerToken(c.req.header("Authorization"));
+  const user = await authenticateRequest(provider, token, c.req.raw);
+  const signUpDisabled = isCredentialsProvider(provider) && provider.isSignUpEnabled?.() === false;
+  const meta = { provider: provider.name, ...signUpDisabled ? { signUpDisabled: true } : {} };
+  if (!user) {
+    return c.json({ authenticated: false, user: null, ...meta });
+  }
+  await ensureUserOrg(provider, user);
+  return c.json({
+    authenticated: true,
+    user: {
+      userId: getFactoryAuthUserId(user),
+      email: user.email,
+      name: user.name,
+      organizationId: user.organizationId
+    },
+    ...meta
+  });
+}
+function encodeState(returnTo) {
+  return Buffer.from(JSON.stringify({ returnTo }), "utf8").toString("base64url");
+}
+function decodeState(state) {
+  if (!state) return "/";
+  try {
+    const parsed = JSON.parse(Buffer.from(state, "base64url").toString("utf8"));
+    return sanitizeReturnTo(parsed.returnTo);
+  } catch {
+    return "/";
+  }
+}
+function providerAuthRoutes(provider, publicUrl) {
+  const routes = [];
+  if (isAuthHttpHandler(provider)) {
+    routes.push({
+      path: "/auth/api/*",
+      method: "ALL",
+      handler: (c) => provider.handleAuthRequest(c.req.raw)
+    });
+  }
+  if (isSSOProvider(provider)) {
+    routes.push(
+      {
+        path: "/auth/login",
+        method: "GET",
+        handler: async (c) => {
+          const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
+          const state = encodeState(returnTo);
+          const redirectUri = publicUrl ? new URL("/auth/callback", publicUrl).toString() : "";
+          const loginUrl = await provider.getLoginUrl(redirectUri, state);
+          for (const cookie of await provider.getLoginCookies?.(redirectUri, state) ?? []) {
+            c.header("Set-Cookie", cookie, { append: true });
+          }
+          return c.redirect(loginUrl);
+        }
+      },
+      {
+        path: "/auth/callback",
+        method: "GET",
+        handler: async (c) => {
+          const code = c.req.query("code");
+          const returnTo = decodeState(c.req.query("state"));
+          if (!code) {
+            return c.redirect("/auth/login");
+          }
+          try {
+            const result = await provider.handleCallback(code, c.req.query("state") ?? "");
+            if (result.cookies?.length) {
+              for (const cookie of result.cookies) {
+                c.header("Set-Cookie", cookie, { append: true });
+              }
+            } else if (isSessionProvider(provider) && result.tokens) {
+              const resultUser = result.user;
+              const session = await provider.createSession(resultUser.id, {
+                accessToken: result.tokens.accessToken,
+                refreshToken: result.tokens.refreshToken,
+                expiresAt: result.tokens.expiresAt,
+                organizationId: resultUser.organizationId
+              });
+              for (const [key, value] of Object.entries(provider.getSessionHeaders(session))) {
+                c.header(key, value, { append: true });
+              }
+            }
+            return c.redirect(returnTo);
+          } catch {
+            return c.redirect("/auth/login");
+          }
+        }
+      },
+      {
+        path: "/auth/logout",
+        method: "GET",
+        handler: async (c) => {
+          let logoutUrl = null;
+          try {
+            logoutUrl = await provider.getLogoutUrl?.("/", c.req.raw) ?? null;
+          } catch {
+            logoutUrl = null;
+          }
+          for (const cookie of providerClearCookies(provider)) {
+            c.header("Set-Cookie", cookie, { append: true });
+          }
+          return c.redirect(logoutUrl ?? "/");
+        }
+      }
+    );
+  } else if (isAuthHttpHandler(provider)) {
+    routes.push(
+      {
+        // Hosted-login equivalent: no hosted page, so send the browser to the
+        // SPA's /signin form, preserving returnTo.
+        path: "/auth/login",
+        method: "GET",
+        handler: (c) => {
+          const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
+          return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
+        }
+      },
+      {
+        path: "/auth/logout",
+        method: "GET",
+        handler: async (c) => {
+          try {
+            const origin = new URL(c.req.url).origin;
+            const response = await provider.handleAuthRequest(
+              new Request(`${origin}/auth/api/sign-out`, { method: "POST", headers: c.req.raw.headers })
+            );
+            for (const cookie of response.headers.getSetCookie()) {
+              c.header("Set-Cookie", cookie, { append: true });
+            }
+          } catch {
+          }
+          for (const cookie of providerClearCookies(provider)) {
+            c.header("Set-Cookie", cookie, { append: true });
+          }
+          return c.redirect("/");
+        }
+      }
+    );
+  }
+  return routes;
+}
+function registerAuthRoutes(app, provider, options = {}) {
+  for (const route of providerAuthRoutes(provider, options.publicUrl)) {
+    const methods = route.method === "ALL" ? ["GET", "POST", "PUT", "DELETE", "PATCH"] : [route.method];
+    app.on(methods, route.path, (c) => route.handler(c));
+  }
+  app.get("/auth/me", (c) => handleAuthMe(provider, c));
+}
+function buildAuthRoutes(provider, options = {}) {
+  return [
+    // `registerApiRoute` handlers see @mastra/core's bundled hono Context type,
+    // which is structurally identical to (but nominally distinct from) the
+    // local hono version the route handlers are typed against — cast across
+    // the seam.
+    ...providerAuthRoutes(provider, options.publicUrl).map(
+      (route) => registerApiRoute(route.path, {
+        method: route.method,
+        requiresAuth: false,
+        handler: (c) => route.handler(c)
+      })
+    ),
+    registerApiRoute("/auth/me", {
+      method: "GET",
+      requiresAuth: false,
+      handler: (c) => handleAuthMe(provider, c)
+    })
+  ];
+}
+function createFactoryAuthGate(provider) {
+  return async (c, next) => {
+    const path = c.req.path;
+    if (path.startsWith("/auth/")) {
+      return next();
+    }
+    if (c.req.method === "POST" && path === "/web/github/webhook") {
+      return next();
+    }
+    if (path === "/signin" || path.startsWith("/assets/")) {
+      return next();
+    }
+    const token = getBearerToken(c.req.header("Authorization"));
+    const user = await authenticateRequest(provider, token, c.req.raw);
+    if (user) {
+      await ensureUserOrg(provider, user);
+      c.set(FACTORY_AUTH_USER_KEY, user);
+      c.get("requestContext")?.set("user", user);
+      return next();
+    }
+    if (isNavigationRequest(path, c.req.header("Accept"))) {
+      const url = new URL(c.req.url);
+      const returnTo = sanitizeReturnTo(url.pathname + url.search);
+      return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
+    }
+    return c.json({ error: "unauthorized" }, 401);
+  };
+}
+function mountFactoryAuth(app, options = {}) {
+  const provider = options.provider ?? envFallbackAuthProvider(options.redirectUri);
+  if (!provider) return false;
+  registerAuthRoutes(app, provider, { publicUrl: options.publicUrl });
+  app.use("*", createFactoryAuthGate(provider));
+  return true;
+}
+export {
+  buildAuthRoutes,
+  createFactoryAuthGate,
+  createFactoryRouteAuth,
+  ensureFactoryAuthUser,
+  factoryAuthTenant,
+  getBearerToken,
+  getFactoryAuthOrgId,
+  getFactoryAuthUser,
+  getFactoryAuthUserId,
+  getWorkOSProvider,
+  isCrossSiteAuth,
+  isOrganizationAdmin,
+  isWorkOSAuth,
+  mountFactoryAuth,
+  registerAuthRoutes,
+  sanitizeReturnTo
+};
+//# sourceMappingURL=auth.js.map