@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.2

package/dist/auth.js

@@ -1,370 +1,457 @@
-// src/auth.ts
+import { timedAboveThreshold } from "./timing.js";
 import { MastraAuthWorkos } from "@mastra/auth-workos";
-import {
-  registerApiRoute,
-  isAuthHttpHandler,
-  isCredentialsProvider,
-  isOrganizationsProvider,
-  isSessionProvider,
-  isSSOProvider
-} from "@mastra/core/server";
+import { isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, registerApiRoute } from "@mastra/core/server";
+//#region src/auth.ts
+/**
+* Validate that a `returnTo` value is a safe same-site path, to prevent
+* open-redirect attacks. Only absolute local paths (`/foo`) are allowed;
+* protocol-relative (`//evil.com`) and absolute URLs are rejected.
+*/
 function sanitizeReturnTo(raw) {
-  if (!raw) return "/";
-  if (!raw.startsWith("/")) return "/";
-  if (raw.startsWith("//") || raw.startsWith("/\\")) return "/";
-  return raw;
+	if (!raw) return "/";
+	if (!raw.startsWith("/")) return "/";
+	if (raw.startsWith("//") || raw.startsWith("/\\")) return "/";
+	return raw;
 }
+/** Extract a bearer token from the Authorization header, if present. */
 function getBearerToken(authorization) {
-  if (!authorization) return "";
-  const match = /^Bearer\s+(.+)$/i.exec(authorization);
-  return match?.[1] ?? "";
+	if (!authorization) return "";
+	return /^Bearer\s+(.+)$/i.exec(authorization)?.[1] ?? "";
 }
+/**
+* Whether the SPA is served cross-origin from this API (platform deploy). When
+* `MASTRACODE_ALLOWED_ORIGINS` is set the browser talks to us cross-site, so
+* session cookies must be `SameSite=None; Secure` for the browser to send them.
+* Same-origin local dev leaves this unset and keeps the stricter `SameSite=Lax`.
+*/
 function isCrossSiteAuth() {
-  return Boolean(process.env.MASTRACODE_ALLOWED_ORIGINS?.trim());
+	return Boolean(process.env.MASTRACODE_ALLOWED_ORIGINS?.trim());
 }
-var FACTORY_AUTH_USER_KEY = "factoryAuthUser";
+/** Context key under which the gate stashes the authenticated user. */
+const FACTORY_AUTH_USER_KEY = "factoryAuthUser";
+/**
+* Read the authenticated user the gate stashed on the context, or
+* `undefined` when unauthenticated / auth disabled. Used by downstream routes
+* (e.g. GitHub) to scope rows per user.
+*/
 function getFactoryAuthUser(c) {
-  return c.get(FACTORY_AUTH_USER_KEY);
+	return c.get(FACTORY_AUTH_USER_KEY);
 }
+/** Resolve the stable user id from an authenticated user shape. */
 function getFactoryAuthUserId(user) {
-  return user?.workosId ?? user?.id;
+	return user?.workosId ?? user?.id;
 }
+/** Resolve the organization id from a user shape, if present. */
 function getFactoryAuthOrgId(user) {
-  return user?.organizationId;
+	return user?.organizationId;
 }
+/**
+* Resolve the tenant identity `(orgId, userId)` from the authenticated user on
+* the context. Returns `undefined` when there is no signed-in user (auth
+* disabled or unauthenticated). `orgId` is `undefined` for personal accounts;
+* callers gate org-scoped GitHub features on its presence while agent state
+* falls back to a user-only tenant.
+*/
 function factoryAuthTenant(c) {
-  const user = getFactoryAuthUser(c);
-  const userId = getFactoryAuthUserId(user);
-  if (!userId) return void 0;
-  return { orgId: getFactoryAuthOrgId(user), userId };
+	const user = getFactoryAuthUser(c);
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return void 0;
+	return {
+		orgId: getFactoryAuthOrgId(user),
+		userId
+	};
 }
+/** True when both WorkOS credential env vars are present (legacy env gate). */
 function envWorkosConfigured() {
-  return Boolean(process.env.WORKOS_API_KEY && process.env.WORKOS_CLIENT_ID);
+	return Boolean(process.env.WORKOS_API_KEY && process.env.WORKOS_CLIENT_ID);
 }
+/**
+* WorkOS provider implied by the `WORKOS_*` env vars — back-compat for test
+* suites exercised without booting the factory (route suites set `WORKOS_*`
+* directly and call {@link mountFactoryAuth} without an explicit provider).
+* `fetchMemberships: true` lets `authenticateToken` resolve `organizationId`
+* from a single membership when the JWT has no org claim — required so a
+* bootstrapped personal org resolves without re-auth.
+*/
 function envFallbackAuthProvider(redirectUri) {
-  if (!envWorkosConfigured()) return void 0;
-  return new MastraAuthWorkos({
-    redirectUri: redirectUri ?? process.env.WORKOS_REDIRECT_URI,
-    fetchMemberships: true
-  });
+	if (!envWorkosConfigured()) return void 0;
+	return new MastraAuthWorkos({
+		redirectUri: redirectUri ?? process.env.WORKOS_REDIRECT_URI,
+		fetchMemberships: true
+	});
 }
+/**
+* Map a provider `authenticateToken` result onto the neutral SPA user shape.
+*
+* Two result families exist today:
+* - flat provider users (WorkOS `WorkOSUser` et al.): `id`/`workosId`/`email`/
+*   `name`/`organizationId` directly on the object;
+* - session-shaped results (better-auth `BetterAuthUser`): `{ session, user }`
+*   with the active org on the session.
+*/
 function toFactoryAuthUser(result) {
-  if (!result || typeof result !== "object") return null;
-  const record = result;
-  if (record.user && typeof record.user === "object" && record.session && typeof record.session === "object") {
-    const user = record.user;
-    const session = record.session;
-    if (typeof user.id !== "string") return null;
-    return {
-      id: user.id,
-      email: typeof user.email === "string" ? user.email : void 0,
-      name: typeof user.name === "string" ? user.name : void 0,
-      organizationId: typeof session.activeOrganizationId === "string" ? session.activeOrganizationId : void 0
-    };
-  }
-  const flat = record;
-  const id = typeof flat.id === "string" ? flat.id : void 0;
-  const workosId = typeof flat.workosId === "string" ? flat.workosId : void 0;
-  if (!id && !workosId) return null;
-  return {
-    id,
-    workosId,
-    email: typeof flat.email === "string" ? flat.email : void 0,
-    name: typeof flat.name === "string" ? flat.name : void 0,
-    organizationId: typeof flat.organizationId === "string" ? flat.organizationId : void 0
-  };
+	if (!result || typeof result !== "object") return null;
+	const record = result;
+	if (record.user && typeof record.user === "object" && record.session && typeof record.session === "object") {
+		const user = record.user;
+		const session = record.session;
+		if (typeof user.id !== "string") return null;
+		return {
+			id: user.id,
+			email: typeof user.email === "string" ? user.email : void 0,
+			name: typeof user.name === "string" ? user.name : void 0,
+			organizationId: typeof session.activeOrganizationId === "string" ? session.activeOrganizationId : void 0
+		};
+	}
+	const flat = record;
+	const id = typeof flat.id === "string" ? flat.id : void 0;
+	const workosId = typeof flat.workosId === "string" ? flat.workosId : void 0;
+	if (!id && !workosId) return null;
+	return {
+		id,
+		workosId,
+		email: typeof flat.email === "string" ? flat.email : void 0,
+		name: typeof flat.name === "string" ? flat.name : void 0,
+		organizationId: typeof flat.organizationId === "string" ? flat.organizationId : void 0
+	};
 }
+/**
+* Resolve the authenticated user for a request via the provider. Never throws:
+* ordinary invalid/expired sessions resolve to `null`.
+*/
 async function authenticateRequest(provider, token, raw) {
-  try {
-    const result = await provider.authenticateToken(token, raw);
-    return toFactoryAuthUser(result);
-  } catch {
-    return null;
-  }
+	try {
+		return toFactoryAuthUser(await provider.authenticateToken(token, raw));
+	} catch {
+		return null;
+	}
 }
+/**
+* Bootstrap a personal org for no-org accounts so org-scoped features (GitHub
+* connect) work without leaving the app. Mutates the resolved user so the
+* current request sees the org immediately; subsequent requests resolve it via
+* the provider's own session/membership lookup (providers cache internally).
+* Best-effort: providers swallow their own bootstrap failures, and any
+* unexpected throw leaves the user no-org.
+*/
 async function ensureUserOrg(provider, user) {
-  if (getFactoryAuthOrgId(user)) return;
-  if (!isOrganizationsProvider(provider)) return;
-  const userId = getFactoryAuthUserId(user);
-  if (!userId) return;
-  try {
-    const orgId = await provider.ensureOrganization(userId);
-    if (orgId) user.organizationId = orgId;
-  } catch {
-  }
+	if (getFactoryAuthOrgId(user)) return;
+	if (!isOrganizationsProvider(provider)) return;
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return;
+	try {
+		const orgId = await provider.ensureOrganization(userId);
+		if (orgId) user.organizationId = orgId;
+	} catch {}
 }
+/**
+* `Set-Cookie` values that clear the provider's session cookie(s), from the
+* provider's (possibly partial) `ISessionProvider.getClearSessionHeaders`.
+*/
 function providerClearCookies(provider) {
-  const getClearSessionHeaders = provider.getClearSessionHeaders;
-  if (typeof getClearSessionHeaders !== "function") return [];
-  const headers = getClearSessionHeaders.call(provider) ?? {};
-  const setCookie = headers["Set-Cookie"];
-  if (!setCookie) return [];
-  return setCookie.split(/,(?=\s*[^;=,\s]+=)/).map((cookie) => cookie.trim());
+	const getClearSessionHeaders = provider.getClearSessionHeaders;
+	if (typeof getClearSessionHeaders !== "function") return [];
+	const setCookie = (getClearSessionHeaders.call(provider) ?? {})["Set-Cookie"];
+	if (!setCookie) return [];
+	return setCookie.split(/,(?=\s*[^;=,\s]+=)/).map((cookie) => cookie.trim());
 }
+/**
+* Fail-closed authorization for organization-level administrative mutations.
+* The caller must belong to the same active organization and the provider must
+* explicitly confirm an admin/owner role.
+*/
 async function isOrganizationAdmin(provider, c, organizationId) {
-  const user = await ensureFactoryAuthUser(provider, c);
-  if (!user || user.organizationId !== organizationId || !provider || !isOrganizationsProvider(provider)) {
-    return false;
-  }
-  const userId = getFactoryAuthUserId(user);
-  if (!userId) return false;
-  try {
-    return await provider.isOrganizationAdmin(organizationId, userId);
-  } catch {
-    return false;
-  }
+	const user = await ensureFactoryAuthUser(provider, c);
+	if (!user || user.organizationId !== organizationId || !provider || !isOrganizationsProvider(provider)) return false;
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return false;
+	try {
+		return await provider.isOrganizationAdmin(organizationId, userId);
+	} catch {
+		return false;
+	}
 }
+/**
+* Build the factory's implementation of the `RouteAuth` seam over the
+* resolved provider (`undefined` = auth disabled). Constructed once per boot
+* by `MastraFactory.prepare()` and handed to factory route modules at
+* construction — they never import the factory auth module directly.
+*/
 function createFactoryRouteAuth(provider) {
-  return {
-    enabled: () => provider !== void 0,
-    ensureUser: (c) => ensureFactoryAuthUser(provider, c),
-    tenant: (c) => factoryAuthTenant(c),
-    isOrganizationAdmin: (c, organizationId) => isOrganizationAdmin(provider, c, organizationId)
-  };
+	return {
+		enabled: () => provider !== void 0,
+		ensureUser: (c) => ensureFactoryAuthUser(provider, c),
+		tenant: (c) => factoryAuthTenant(c),
+		isOrganizationAdmin: (c, organizationId) => isOrganizationAdmin(provider, c, organizationId)
+	};
 }
+/** True when the given provider is WorkOS. Gates WorkOS-only capabilities. */
 function isWorkOSAuth(provider) {
-  return provider instanceof MastraAuthWorkos;
+	return provider instanceof MastraAuthWorkos;
 }
+/**
+* The raw WorkOS provider, for features that need the WorkOS client directly
+* (audit-log export, Admin Portal links). Callers must gate on
+* {@link isWorkOSAuth} first — throws when the provider is not WorkOS.
+*/
 function getWorkOSProvider(provider) {
-  if (provider instanceof MastraAuthWorkos) return provider;
-  throw new Error("WorkOS provider requested but the active factory auth provider is not WorkOS");
+	if (provider instanceof MastraAuthWorkos) return provider;
+	throw new Error("WorkOS provider requested but the active factory auth provider is not WorkOS");
 }
+/**
+* Resolve the authenticated user for a request, stashing it on the context.
+*
+* The gate only authenticates non-`/auth/*` requests via the `Authorization`
+* header, so cookie-based browser navigations to public `/auth/*` routes (the
+* GitHub connect/callback flow) arrive without a gate-stashed user. This reads
+* the session cookie from the raw request the same way `/auth/me` does,
+* caches the result on the context, and returns it so downstream helpers like
+* {@link factoryAuthTenant} work uniformly on both gated and public routes.
+*
+* Returns `undefined` when there is no valid session (or auth is disabled).
+*/
 async function ensureFactoryAuthUser(provider, c) {
-  const existing = getFactoryAuthUser(c);
-  if (existing) return existing;
-  if (!provider) return void 0;
-  const token = getBearerToken(c.req.header("Authorization"));
-  const user = await authenticateRequest(provider, token, c.req.raw);
-  if (!user) return void 0;
-  await ensureUserOrg(provider, user);
-  c.set(FACTORY_AUTH_USER_KEY, user);
-  return user;
+	const existing = getFactoryAuthUser(c);
+	if (existing) return existing;
+	if (!provider) return void 0;
+	const user = await authenticateRequest(provider, getBearerToken(c.req.header("Authorization")), c.req.raw);
+	if (!user) return void 0;
+	await ensureUserOrg(provider, user);
+	c.set(FACTORY_AUTH_USER_KEY, user);
+	return user;
 }
+/**
+* Decide whether a request is a top-level browser navigation (which should be
+* redirected to `/signin`) versus an API/XHR call (which should get a 401 JSON
+* response the SPA can react to).
+*/
 function isNavigationRequest(path, accept) {
-  if (path.startsWith("/api/")) return false;
-  return (accept ?? "").includes("text/html");
+	if (path.startsWith("/api/")) return false;
+	return (accept ?? "").includes("text/html");
 }
+/**
+* Handle the provider-neutral `/auth/me` route: validate the session with the
+* active provider and report the signed-in user (no tokens) to the SPA.
+* `/auth/me` is public (the gate skips `/auth/*`), so it validates the session
+* itself rather than reading a value the gate would have stashed.
+*/
 async function handleAuthMe(provider, c) {
-  const token = getBearerToken(c.req.header("Authorization"));
-  const user = await authenticateRequest(provider, token, c.req.raw);
-  const signUpDisabled = isCredentialsProvider(provider) && provider.isSignUpEnabled?.() === false;
-  const meta = { provider: provider.name, ...signUpDisabled ? { signUpDisabled: true } : {} };
-  if (!user) {
-    return c.json({ authenticated: false, user: null, ...meta });
-  }
-  await ensureUserOrg(provider, user);
-  return c.json({
-    authenticated: true,
-    user: {
-      userId: getFactoryAuthUserId(user),
-      email: user.email,
-      name: user.name,
-      organizationId: user.organizationId
-    },
-    ...meta
-  });
+	const user = await authenticateRequest(provider, getBearerToken(c.req.header("Authorization")), c.req.raw);
+	const signUpDisabled = isCredentialsProvider(provider) && provider.isSignUpEnabled?.() === false;
+	const meta = {
+		provider: provider.name,
+		...signUpDisabled ? { signUpDisabled: true } : {}
+	};
+	if (!user) return c.json({
+		authenticated: false,
+		user: null,
+		...meta
+	});
+	await ensureUserOrg(provider, user);
+	return c.json({
+		authenticated: true,
+		user: {
+			userId: getFactoryAuthUserId(user),
+			email: user.email,
+			name: user.name,
+			organizationId: user.organizationId
+		},
+		...meta
+	});
 }
+/** Encode a validated returnTo path into the OAuth `state` parameter. */
 function encodeState(returnTo) {
-  return Buffer.from(JSON.stringify({ returnTo }), "utf8").toString("base64url");
+	return Buffer.from(JSON.stringify({ returnTo }), "utf8").toString("base64url");
 }
+/** Decode the OAuth `state` parameter back into a sanitized returnTo path. */
 function decodeState(state) {
-  if (!state) return "/";
-  try {
-    const parsed = JSON.parse(Buffer.from(state, "base64url").toString("utf8"));
-    return sanitizeReturnTo(parsed.returnTo);
-  } catch {
-    return "/";
-  }
+	if (!state) return "/";
+	try {
+		return sanitizeReturnTo(JSON.parse(Buffer.from(state, "base64url").toString("utf8")).returnTo);
+	} catch {
+		return "/";
+	}
 }
+/**
+* Derive the public `/auth/*` routes from the provider's capabilities:
+*
+* - `IAuthHttpHandler` → `ALL /auth/api/*` proxy to the provider's own HTTP
+*   surface (better-auth sign-in/up/out/session — what the SPA's
+*   email/password form posts to).
+* - `ISSOProvider` → hosted-login `GET /auth/login` / `GET /auth/callback` /
+*   `GET /auth/logout` (returnTo preserved through the OAuth `state` param).
+* - handler-shaped, non-SSO providers → `GET /auth/login` redirects to the
+*   SPA's `/signin` form, `GET /auth/logout` revokes via the provider's
+*   sign-out endpoint and clears the session cookie.
+*/
 function providerAuthRoutes(provider, publicUrl) {
-  const routes = [];
-  if (isAuthHttpHandler(provider)) {
-    routes.push({
-      path: "/auth/api/*",
-      method: "ALL",
-      handler: (c) => provider.handleAuthRequest(c.req.raw)
-    });
-  }
-  if (isSSOProvider(provider)) {
-    routes.push(
-      {
-        path: "/auth/login",
-        method: "GET",
-        handler: async (c) => {
-          const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
-          const state = encodeState(returnTo);
-          const redirectUri = publicUrl ? new URL("/auth/callback", publicUrl).toString() : "";
-          const loginUrl = await provider.getLoginUrl(redirectUri, state);
-          for (const cookie of await provider.getLoginCookies?.(redirectUri, state) ?? []) {
-            c.header("Set-Cookie", cookie, { append: true });
-          }
-          return c.redirect(loginUrl);
-        }
-      },
-      {
-        path: "/auth/callback",
-        method: "GET",
-        handler: async (c) => {
-          const code = c.req.query("code");
-          const returnTo = decodeState(c.req.query("state"));
-          if (!code) {
-            return c.redirect("/auth/login");
-          }
-          try {
-            const result = await provider.handleCallback(code, c.req.query("state") ?? "");
-            if (result.cookies?.length) {
-              for (const cookie of result.cookies) {
-                c.header("Set-Cookie", cookie, { append: true });
-              }
-            } else if (isSessionProvider(provider) && result.tokens) {
-              const resultUser = result.user;
-              const session = await provider.createSession(resultUser.id, {
-                accessToken: result.tokens.accessToken,
-                refreshToken: result.tokens.refreshToken,
-                expiresAt: result.tokens.expiresAt,
-                organizationId: resultUser.organizationId
-              });
-              for (const [key, value] of Object.entries(provider.getSessionHeaders(session))) {
-                c.header(key, value, { append: true });
-              }
-            }
-            return c.redirect(returnTo);
-          } catch {
-            return c.redirect("/auth/login");
-          }
-        }
-      },
-      {
-        path: "/auth/logout",
-        method: "GET",
-        handler: async (c) => {
-          let logoutUrl = null;
-          try {
-            logoutUrl = await provider.getLogoutUrl?.("/", c.req.raw) ?? null;
-          } catch {
-            logoutUrl = null;
-          }
-          for (const cookie of providerClearCookies(provider)) {
-            c.header("Set-Cookie", cookie, { append: true });
-          }
-          return c.redirect(logoutUrl ?? "/");
-        }
-      }
-    );
-  } else if (isAuthHttpHandler(provider)) {
-    routes.push(
-      {
-        // Hosted-login equivalent: no hosted page, so send the browser to the
-        // SPA's /signin form, preserving returnTo.
-        path: "/auth/login",
-        method: "GET",
-        handler: (c) => {
-          const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
-          return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
-        }
-      },
-      {
-        path: "/auth/logout",
-        method: "GET",
-        handler: async (c) => {
-          try {
-            const origin = new URL(c.req.url).origin;
-            const response = await provider.handleAuthRequest(
-              new Request(`${origin}/auth/api/sign-out`, { method: "POST", headers: c.req.raw.headers })
-            );
-            for (const cookie of response.headers.getSetCookie()) {
-              c.header("Set-Cookie", cookie, { append: true });
-            }
-          } catch {
-          }
-          for (const cookie of providerClearCookies(provider)) {
-            c.header("Set-Cookie", cookie, { append: true });
-          }
-          return c.redirect("/");
-        }
-      }
-    );
-  }
-  return routes;
+	const routes = [];
+	if (isAuthHttpHandler(provider)) routes.push({
+		path: "/auth/api/*",
+		method: "ALL",
+		handler: (c) => provider.handleAuthRequest(c.req.raw)
+	});
+	if (isSSOProvider(provider)) routes.push({
+		path: "/auth/login",
+		method: "GET",
+		handler: async (c) => {
+			const state = encodeState(sanitizeReturnTo(c.req.query("returnTo")));
+			const redirectUri = publicUrl ? new URL("/auth/callback", publicUrl).toString() : "";
+			const loginUrl = await provider.getLoginUrl(redirectUri, state);
+			for (const cookie of await provider.getLoginCookies?.(redirectUri, state) ?? []) c.header("Set-Cookie", cookie, { append: true });
+			return c.redirect(loginUrl);
+		}
+	}, {
+		path: "/auth/callback",
+		method: "GET",
+		handler: async (c) => {
+			const code = c.req.query("code");
+			const returnTo = decodeState(c.req.query("state"));
+			if (!code) return c.redirect("/auth/login");
+			try {
+				const result = await provider.handleCallback(code, c.req.query("state") ?? "");
+				if (result.cookies?.length) for (const cookie of result.cookies) c.header("Set-Cookie", cookie, { append: true });
+				else if (isSessionProvider(provider) && result.tokens) {
+					const resultUser = result.user;
+					const session = await provider.createSession(resultUser.id, {
+						accessToken: result.tokens.accessToken,
+						refreshToken: result.tokens.refreshToken,
+						expiresAt: result.tokens.expiresAt,
+						organizationId: resultUser.organizationId
+					});
+					for (const [key, value] of Object.entries(provider.getSessionHeaders(session))) c.header(key, value, { append: true });
+				}
+				return c.redirect(returnTo);
+			} catch {
+				return c.redirect("/auth/login");
+			}
+		}
+	}, {
+		path: "/auth/logout",
+		method: "GET",
+		handler: async (c) => {
+			let logoutUrl = null;
+			try {
+				logoutUrl = await provider.getLogoutUrl?.("/", c.req.raw) ?? null;
+			} catch {
+				logoutUrl = null;
+			}
+			for (const cookie of providerClearCookies(provider)) c.header("Set-Cookie", cookie, { append: true });
+			return c.redirect(logoutUrl ?? "/");
+		}
+	});
+	else if (isAuthHttpHandler(provider)) routes.push({
+		path: "/auth/login",
+		method: "GET",
+		handler: (c) => {
+			const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
+			return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
+		}
+	}, {
+		path: "/auth/logout",
+		method: "GET",
+		handler: async (c) => {
+			try {
+				const origin = new URL(c.req.url).origin;
+				const response = await provider.handleAuthRequest(new Request(`${origin}/auth/api/sign-out`, {
+					method: "POST",
+					headers: c.req.raw.headers
+				}));
+				for (const cookie of response.headers.getSetCookie()) c.header("Set-Cookie", cookie, { append: true });
+			} catch {}
+			for (const cookie of providerClearCookies(provider)) c.header("Set-Cookie", cookie, { append: true });
+			return c.redirect("/");
+		}
+	});
+	return routes;
 }
+/**
+* Register the public `/auth/*` routes on a Hono app: the capability-derived
+* provider routes (login/callback/logout/provider APIs) plus the
+* provider-neutral `/auth/me`. Split out from `mountFactoryAuth` so both the local
+* Hono server and the platform Mastra entry can reuse the exact same handlers.
+*/
 function registerAuthRoutes(app, provider, options = {}) {
-  for (const route of providerAuthRoutes(provider, options.publicUrl)) {
-    const methods = route.method === "ALL" ? ["GET", "POST", "PUT", "DELETE", "PATCH"] : [route.method];
-    app.on(methods, route.path, (c) => route.handler(c));
-  }
-  app.get("/auth/me", (c) => handleAuthMe(provider, c));
+	for (const route of providerAuthRoutes(provider, options.publicUrl)) {
+		const methods = route.method === "ALL" ? [
+			"GET",
+			"POST",
+			"PUT",
+			"DELETE",
+			"PATCH"
+		] : [route.method];
+		app.on(methods, route.path, (c) => route.handler(c));
+	}
+	app.get("/auth/me", (c) => handleAuthMe(provider, c));
 }
+/**
+* Build the public `/auth/*` routes (provider routes + `/auth/me`) as Mastra
+* `server.apiRoutes`. Used by the platform Mastra entry (`src/mastra/index.ts`),
+* which can't register plain Hono routes on the deployer-generated app the way
+* the local server does via {@link registerAuthRoutes}.
+*
+* Handlers are identical to {@link registerAuthRoutes}. All are `requiresAuth: false`
+* (they must be reachable while unauthenticated), and the gate middleware skips
+* `/auth/*` so it never blocks them. `/auth/*` is not under `/api`, so it is a
+* valid custom-route path.
+*/
 function buildAuthRoutes(provider, options = {}) {
-  return [
-    // `registerApiRoute` handlers see @mastra/core's bundled hono Context type,
-    // which is structurally identical to (but nominally distinct from) the
-    // local hono version the route handlers are typed against — cast across
-    // the seam.
-    ...providerAuthRoutes(provider, options.publicUrl).map(
-      (route) => registerApiRoute(route.path, {
-        method: route.method,
-        requiresAuth: false,
-        handler: (c) => route.handler(c)
-      })
-    ),
-    registerApiRoute("/auth/me", {
-      method: "GET",
-      requiresAuth: false,
-      handler: (c) => handleAuthMe(provider, c)
-    })
-  ];
+	return [...providerAuthRoutes(provider, options.publicUrl).map((route) => registerApiRoute(route.path, {
+		method: route.method,
+		requiresAuth: false,
+		handler: (c) => route.handler(c)
+	})), registerApiRoute("/auth/me", {
+		method: "GET",
+		requiresAuth: false,
+		handler: (c) => handleAuthMe(provider, c)
+	})];
 }
+/**
+* Build the auth gate as a plain Hono middleware handler `(c, next)`. Protects
+* everything that is not a public `/auth/*` route: authenticated requests stash
+* the user on the context and continue; unauthenticated navigations redirect to
+* login and XHR/API calls get a 401 JSON. Shared by the local Hono server
+* (`mountFactoryAuth`) and the platform Mastra entry (`server.middleware`).
+*/
 function createFactoryAuthGate(provider) {
-  return async (c, next) => {
-    const path = c.req.path;
-    if (path.startsWith("/auth/")) {
-      return next();
-    }
-    if (c.req.method === "POST" && path === "/web/github/webhook") {
-      return next();
-    }
-    if (path === "/signin" || path.startsWith("/assets/")) {
-      return next();
-    }
-    const token = getBearerToken(c.req.header("Authorization"));
-    const user = await authenticateRequest(provider, token, c.req.raw);
-    if (user) {
-      await ensureUserOrg(provider, user);
-      c.set(FACTORY_AUTH_USER_KEY, user);
-      c.get("requestContext")?.set("user", user);
-      return next();
-    }
-    if (isNavigationRequest(path, c.req.header("Accept"))) {
-      const url = new URL(c.req.url);
-      const returnTo = sanitizeReturnTo(url.pathname + url.search);
-      return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
-    }
-    return c.json({ error: "unauthorized" }, 401);
-  };
+	return async (c, next) => {
+		const path = c.req.path;
+		if (path.startsWith("/auth/")) return next();
+		if (c.req.method === "POST" && path === "/web/github/webhook") return next();
+		if (path === "/signin" || path.startsWith("/assets/") || path === "/manifest.webmanifest" || path === "/mastra.svg") return next();
+		const token = getBearerToken(c.req.header("Authorization"));
+		const user = await timedAboveThreshold("auth.gate.authenticate", 1e3, () => authenticateRequest(provider, token, c.req.raw));
+		if (user) {
+			await ensureUserOrg(provider, user);
+			c.set(FACTORY_AUTH_USER_KEY, user);
+			c.get("requestContext")?.set("user", user);
+			return next();
+		}
+		if (isNavigationRequest(path, c.req.header("Accept"))) {
+			const url = new URL(c.req.url);
+			const returnTo = sanitizeReturnTo(url.pathname + url.search);
+			return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
+		}
+		return c.json({ error: "unauthorized" }, 401);
+	};
 }
+/**
+* Mount factory auth gating onto the host app. No-op when auth is disabled
+* (no provider active).
+*
+* Must be called before the Mastra adapter routes, the `/web/*` routes, and
+* the static UI handlers so the gate covers every request. Composes the shared
+* `registerAuthRoutes` + `createFactoryAuthGate` factories so the local Hono server
+* and the platform Mastra entry stay behavior-identical.
+*/
 function mountFactoryAuth(app, options = {}) {
-  const provider = options.provider ?? envFallbackAuthProvider(options.redirectUri);
-  if (!provider) return false;
-  registerAuthRoutes(app, provider, { publicUrl: options.publicUrl });
-  app.use("*", createFactoryAuthGate(provider));
-  return true;
+	const provider = options.provider ?? envFallbackAuthProvider(options.redirectUri);
+	if (!provider) return false;
+	registerAuthRoutes(app, provider, { publicUrl: options.publicUrl });
+	app.use("*", createFactoryAuthGate(provider));
+	return true;
 }
-export {
-  buildAuthRoutes,
-  createFactoryAuthGate,
-  createFactoryRouteAuth,
-  ensureFactoryAuthUser,
-  factoryAuthTenant,
-  getBearerToken,
-  getFactoryAuthOrgId,
-  getFactoryAuthUser,
-  getFactoryAuthUserId,
-  getWorkOSProvider,
-  isCrossSiteAuth,
-  isOrganizationAdmin,
-  isWorkOSAuth,
-  mountFactoryAuth,
-  registerAuthRoutes,
-  sanitizeReturnTo
-};
+//#endregion
+export { buildAuthRoutes, createFactoryAuthGate, createFactoryRouteAuth, ensureFactoryAuthUser, factoryAuthTenant, getBearerToken, getFactoryAuthOrgId, getFactoryAuthUser, getFactoryAuthUserId, getWorkOSProvider, isCrossSiteAuth, isOrganizationAdmin, isWorkOSAuth, mountFactoryAuth, registerAuthRoutes, sanitizeReturnTo };
+
 //# sourceMappingURL=auth.js.map