@mastra/factory 0.23.0-alpha.5 → 0.23.0-alpha.7

package/dist/routes/automation-runs.js

@@ -1,5 +1,5 @@
-import { Route } from "./route.js";
 import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { Route } from "./route.js";
 import { auditRequestContext } from "../storage/domains/audit/domain.js";
 import { registerApiRoute } from "@mastra/core/server";
 //#region src/routes/automation-runs.ts

package/dist/routes/projects.js

@@ -1,8 +1,8 @@
 import { redactCredentials } from "../environment/build.js";
 import { ensureSchedule, invalidCronMessage, readSchedule, scheduleIdFor } from "../environment/build-schedule.js";
 import { ACTIVE_RUN_BINDING_STAGES } from "../storage/domains/work-items/base.js";
-import { Route } from "./route.js";
 import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { Route } from "./route.js";
 import { registerApiRoute } from "@mastra/core/server";
 import { describeFactorySandbox, normalizeFactorySandboxSettings } from "@mastra/core/workspace";
 import { MastraError } from "@mastra/core/error";

package/dist/routes/work-items.js

@@ -3,8 +3,8 @@ import "../boards/index.js";
 import { effectiveModelScope } from "../storage/domains/projects/base.js";
 import { FACTORY_PULL_REQUEST_RECONCILIATION_KEY, FACTORY_RULE_MATERIALIZATION_KEY, WorkItemRelationError, WorkItemUpdateConflictError } from "../storage/domains/work-items/base.js";
 import { EXTERNAL_SOURCE_MISSING_KEY } from "../integrations/issue-reconciler.js";
-import { Route } from "./route.js";
 import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { Route } from "./route.js";
 import { FactoryStartTransitionError, WorkItemRepositoryError } from "../rules/start-coordinator.js";
 import { auditRequestOrigin } from "../storage/domains/audit/domain.js";
 import { decisionRetryable, overtakenDecisionIds } from "../rules/decision-applicability.js";

package/dist/session/credential-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-policy.d.ts","sourceRoot":"","sources":["../../src/session/credential-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,UAAU,8BAA8B;IACtC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;IAClE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC7D;AAED,uGAAuG;AACvG,wBAAsB,8BAA8B,CAClD,cAAc,EAAE,cAAc,EAC9B,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAEvC;AAED,+FAA+F;AAC/F,wBAAsB,yBAAyB,CAC7C,cAAc,EAAE,cAAc,EAC9B,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,CAAC,CA0DrH"}
+{"version":3,"file":"credential-policy.d.ts","sourceRoot":"","sources":["../../src/session/credential-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAIvE,UAAU,8BAA8B;IACtC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;IAClE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC7D;AAED,uGAAuG;AACvG,wBAAsB,8BAA8B,CAClD,cAAc,EAAE,cAAc,EAC9B,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAEvC;AAED,+FAA+F;AAC/F,wBAAsB,yBAAyB,CAC7C,cAAc,EAAE,cAAc,EAC9B,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,CAAC,CAsErH"}

package/dist/session/credential-policy.js

@@ -1,7 +1,9 @@
 import { effectiveModelScope } from "../storage/domains/projects/base.js";
 import { parseSupervisorResourceId } from "../supervisor/session.js";
+import { UUID_PATTERN } from "../routes/contracts.js";
 import { resolveAuthenticatedCredentialTenant } from "@mastra/code-sdk/agents/credential-resolver";
 //#region src/session/credential-policy.ts
+const FACTORY_PROJECT_ID = new RegExp(UUID_PATTERN);
 /** Resolve billing authority from authenticated identity and durable bindings, never session state. */
 async function resolveFactoryCredentialTenant(requestContext, deps) {
 	return (await resolveFactoryModelPolicy(requestContext, deps))?.tenant;
@@ -36,6 +38,15 @@ async function resolveFactoryModelPolicy(requestContext, deps) {
 	}) : null;
 	if (!sourceSession) {
 		if (!binding && (controller.resourceId === principal.userId || controller.resourceId.startsWith("channel:"))) return { tenant: principal };
+		const factoryProject = !binding && FACTORY_PROJECT_ID.test(controller.resourceId) ? await deps.projects.getById({ id: controller.resourceId }) : null;
+		if (factoryProject && factoryProject.orgId === principal.orgId) return {
+			factoryProjectId: factoryProject.id,
+			factoryDefaultModelId: factoryProject.defaultModelId,
+			tenant: {
+				...principal,
+				credentialScope: effectiveModelScope(factoryProject.modelScope, "session")
+			}
+		};
 		throw new Error("Factory session ownership is unavailable.");
 	}
 	if (sourceSession.orgId !== principal.orgId || sourceSession.visibility === "private" && sourceSession.userId !== principal.userId) throw new Error("Factory session is not available to the current user.");

package/dist/session/credential-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-policy.js","names":[],"sources":["../../src/session/credential-policy.ts"],"sourcesContent":["import {\n  resolveAuthenticatedCredentialTenant,\n  type CredentialTenant,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { effectiveModelScope } from '../storage/domains/projects/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { parseSupervisorResourceId } from '../supervisor/session.js';\nimport type { SourceControlSessionLookup } from './factory-session.js';\n\ninterface FactoryModelPolicyDependencies {\n  projects: Pick<FactoryProjectsStorage, 'getById'>;\n  sourceControl: Pick<SourceControlSessionLookup, 'getBySessionId'>;\n  workItems: Pick<WorkItemsStorage, 'findRunBindingByThread'>;\n}\n\n/** Resolve billing authority from authenticated identity and durable bindings, never session state. */\nexport async function resolveFactoryCredentialTenant(\n  requestContext: RequestContext,\n  deps: FactoryModelPolicyDependencies,\n): Promise<CredentialTenant | undefined> {\n  return (await resolveFactoryModelPolicy(requestContext, deps))?.tenant;\n}\n\n/** Shared invocation and model-picker policy; no client-supplied owner or scope is trusted. */\nexport async function resolveFactoryModelPolicy(\n  requestContext: RequestContext,\n  deps: FactoryModelPolicyDependencies,\n): Promise<{ tenant: CredentialTenant; factoryProjectId?: string; factoryDefaultModelId?: string | null } | undefined> {\n  const principal = resolveAuthenticatedCredentialTenant(requestContext);\n  if (!principal) return undefined;\n  const controller = requestContext.get('controller') as AgentControllerRequestContext | undefined;\n  if (!controller?.resourceId) return { tenant: principal };\n\n  const supervisorProjectId = parseSupervisorResourceId(controller.resourceId);\n  if (supervisorProjectId) {\n    const project = await deps.projects.getById({ id: supervisorProjectId });\n    if (!project || project.orgId !== principal.orgId) throw new Error('Factory model policy is unavailable.');\n    // Supervisor turns are Factory-owned automation, so a hybrid Factory bills them as runs.\n    return {\n      factoryProjectId: project.id,\n      factoryDefaultModelId: project.defaultModelId,\n      tenant: {\n        orgId: project.orgId,\n        userId: project.createdBy,\n        credentialScope: effectiveModelScope(project.modelScope, 'run'),\n      },\n    };\n  }\n\n  const sourceSession = await deps.sourceControl.getBySessionId(controller.resourceId);\n  const binding =\n    principal.orgId && controller.threadId\n      ? await deps.workItems.findRunBindingByThread({\n          orgId: principal.orgId,\n          resourceId: controller.resourceId,\n          sessionId: controller.resourceId,\n          threadId: controller.threadId,\n          rejectAmbiguous: true,\n        })\n      : null;\n  if (!sourceSession) {\n    if (!binding && (controller.resourceId === principal.userId || controller.resourceId.startsWith('channel:')))\n      return { tenant: principal };\n    throw new Error('Factory session ownership is unavailable.');\n  }\n  if (\n    sourceSession.orgId !== principal.orgId ||\n    (sourceSession.visibility === 'private' && sourceSession.userId !== principal.userId)\n  ) {\n    throw new Error('Factory session is not available to the current user.');\n  }\n  if (!sourceSession.factoryProjectId) throw new Error('Factory session ownership is unavailable.');\n  const projectId = binding?.factoryProjectId ?? sourceSession.factoryProjectId;\n  const project = await deps.projects.getById({ id: projectId });\n  if (!project || project.orgId !== sourceSession.orgId) throw new Error('Factory model policy is unavailable.');\n  // Work-item threads keep their billing scope after revocation; history never restores run authority.\n  return {\n    factoryProjectId: project.id,\n    factoryDefaultModelId: project.defaultModelId,\n    tenant: {\n      orgId: project.orgId,\n      userId: sourceSession.userId,\n      credentialScope: effectiveModelScope(project.modelScope, binding ? 'run' : 'session'),\n    },\n  };\n}\n"],"mappings":";;;;;AAoBA,eAAsB,+BACpB,gBACA,MACuC;CACvC,QAAQ,MAAM,0BAA0B,gBAAgB,IAAI,EAAA,EAAI;AAClE;;AAGA,eAAsB,0BACpB,gBACA,MACqH;CACrH,MAAM,YAAY,qCAAqC,cAAc;CACrE,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,aAAa,eAAe,IAAI,YAAY;CAClD,IAAI,CAAC,YAAY,YAAY,OAAO,EAAE,QAAQ,UAAU;CAExD,MAAM,sBAAsB,0BAA0B,WAAW,UAAU;CAC3E,IAAI,qBAAqB;EACvB,MAAM,UAAU,MAAM,KAAK,SAAS,QAAQ,EAAE,IAAI,oBAAoB,CAAC;EACvE,IAAI,CAAC,WAAW,QAAQ,UAAU,UAAU,OAAO,MAAM,IAAI,MAAM,sCAAsC;EAEzG,OAAO;GACL,kBAAkB,QAAQ;GAC1B,uBAAuB,QAAQ;GAC/B,QAAQ;IACN,OAAO,QAAQ;IACf,QAAQ,QAAQ;IAChB,iBAAiB,oBAAoB,QAAQ,YAAY,KAAK;GAChE;EACF;CACF;CAEA,MAAM,gBAAgB,MAAM,KAAK,cAAc,eAAe,WAAW,UAAU;CACnF,MAAM,UACJ,UAAU,SAAS,WAAW,WAC1B,MAAM,KAAK,UAAU,uBAAuB;EAC1C,OAAO,UAAU;EACjB,YAAY,WAAW;EACvB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,iBAAiB;CACnB,CAAC,IACD;CACN,IAAI,CAAC,eAAe;EAClB,IAAI,CAAC,YAAY,WAAW,eAAe,UAAU,UAAU,WAAW,WAAW,WAAW,UAAU,IACxG,OAAO,EAAE,QAAQ,UAAU;EAC7B,MAAM,IAAI,MAAM,2CAA2C;CAC7D;CACA,IACE,cAAc,UAAU,UAAU,SACjC,cAAc,eAAe,aAAa,cAAc,WAAW,UAAU,QAE9E,MAAM,IAAI,MAAM,uDAAuD;CAEzE,IAAI,CAAC,cAAc,kBAAkB,MAAM,IAAI,MAAM,2CAA2C;CAChG,MAAM,YAAY,SAAS,oBAAoB,cAAc;CAC7D,MAAM,UAAU,MAAM,KAAK,SAAS,QAAQ,EAAE,IAAI,UAAU,CAAC;CAC7D,IAAI,CAAC,WAAW,QAAQ,UAAU,cAAc,OAAO,MAAM,IAAI,MAAM,sCAAsC;CAE7G,OAAO;EACL,kBAAkB,QAAQ;EAC1B,uBAAuB,QAAQ;EAC/B,QAAQ;GACN,OAAO,QAAQ;GACf,QAAQ,cAAc;GACtB,iBAAiB,oBAAoB,QAAQ,YAAY,UAAU,QAAQ,SAAS;EACtF;CACF;AACF"}
+{"version":3,"file":"credential-policy.js","names":[],"sources":["../../src/session/credential-policy.ts"],"sourcesContent":["import {\n  resolveAuthenticatedCredentialTenant,\n  type CredentialTenant,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { UUID_PATTERN } from '../routes/contracts.js';\nimport { effectiveModelScope } from '../storage/domains/projects/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { parseSupervisorResourceId } from '../supervisor/session.js';\nimport type { SourceControlSessionLookup } from './factory-session.js';\n\nconst FACTORY_PROJECT_ID = new RegExp(UUID_PATTERN);\n\ninterface FactoryModelPolicyDependencies {\n  projects: Pick<FactoryProjectsStorage, 'getById'>;\n  sourceControl: Pick<SourceControlSessionLookup, 'getBySessionId'>;\n  workItems: Pick<WorkItemsStorage, 'findRunBindingByThread'>;\n}\n\n/** Resolve billing authority from authenticated identity and durable bindings, never session state. */\nexport async function resolveFactoryCredentialTenant(\n  requestContext: RequestContext,\n  deps: FactoryModelPolicyDependencies,\n): Promise<CredentialTenant | undefined> {\n  return (await resolveFactoryModelPolicy(requestContext, deps))?.tenant;\n}\n\n/** Shared invocation and model-picker policy; no client-supplied owner or scope is trusted. */\nexport async function resolveFactoryModelPolicy(\n  requestContext: RequestContext,\n  deps: FactoryModelPolicyDependencies,\n): Promise<{ tenant: CredentialTenant; factoryProjectId?: string; factoryDefaultModelId?: string | null } | undefined> {\n  const principal = resolveAuthenticatedCredentialTenant(requestContext);\n  if (!principal) return undefined;\n  const controller = requestContext.get('controller') as AgentControllerRequestContext | undefined;\n  if (!controller?.resourceId) return { tenant: principal };\n\n  const supervisorProjectId = parseSupervisorResourceId(controller.resourceId);\n  if (supervisorProjectId) {\n    const project = await deps.projects.getById({ id: supervisorProjectId });\n    if (!project || project.orgId !== principal.orgId) throw new Error('Factory model policy is unavailable.');\n    // Supervisor turns are Factory-owned automation, so a hybrid Factory bills them as runs.\n    return {\n      factoryProjectId: project.id,\n      factoryDefaultModelId: project.defaultModelId,\n      tenant: {\n        orgId: project.orgId,\n        userId: project.createdBy,\n        credentialScope: effectiveModelScope(project.modelScope, 'run'),\n      },\n    };\n  }\n\n  const sourceSession = await deps.sourceControl.getBySessionId(controller.resourceId);\n  const binding =\n    principal.orgId && controller.threadId\n      ? await deps.workItems.findRunBindingByThread({\n          orgId: principal.orgId,\n          resourceId: controller.resourceId,\n          sessionId: controller.resourceId,\n          threadId: controller.threadId,\n          rejectAmbiguous: true,\n        })\n      : null;\n  if (!sourceSession) {\n    if (!binding && (controller.resourceId === principal.userId || controller.resourceId.startsWith('channel:')))\n      return { tenant: principal };\n    // Session-less Factory pages address the Factory itself: the resourceId is the project id.\n    const factoryProject =\n      !binding && FACTORY_PROJECT_ID.test(controller.resourceId)\n        ? await deps.projects.getById({ id: controller.resourceId })\n        : null;\n    if (factoryProject && factoryProject.orgId === principal.orgId) {\n      return {\n        factoryProjectId: factoryProject.id,\n        factoryDefaultModelId: factoryProject.defaultModelId,\n        tenant: { ...principal, credentialScope: effectiveModelScope(factoryProject.modelScope, 'session') },\n      };\n    }\n    throw new Error('Factory session ownership is unavailable.');\n  }\n  if (\n    sourceSession.orgId !== principal.orgId ||\n    (sourceSession.visibility === 'private' && sourceSession.userId !== principal.userId)\n  ) {\n    throw new Error('Factory session is not available to the current user.');\n  }\n  if (!sourceSession.factoryProjectId) throw new Error('Factory session ownership is unavailable.');\n  const projectId = binding?.factoryProjectId ?? sourceSession.factoryProjectId;\n  const project = await deps.projects.getById({ id: projectId });\n  if (!project || project.orgId !== sourceSession.orgId) throw new Error('Factory model policy is unavailable.');\n  // Work-item threads keep their billing scope after revocation; history never restores run authority.\n  return {\n    factoryProjectId: project.id,\n    factoryDefaultModelId: project.defaultModelId,\n    tenant: {\n      orgId: project.orgId,\n      userId: sourceSession.userId,\n      credentialScope: effectiveModelScope(project.modelScope, binding ? 'run' : 'session'),\n    },\n  };\n}\n"],"mappings":";;;;;AAcA,MAAM,qBAAqB,IAAI,OAAO,YAAY;;AASlD,eAAsB,+BACpB,gBACA,MACuC;CACvC,QAAQ,MAAM,0BAA0B,gBAAgB,IAAI,EAAA,EAAI;AAClE;;AAGA,eAAsB,0BACpB,gBACA,MACqH;CACrH,MAAM,YAAY,qCAAqC,cAAc;CACrE,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,aAAa,eAAe,IAAI,YAAY;CAClD,IAAI,CAAC,YAAY,YAAY,OAAO,EAAE,QAAQ,UAAU;CAExD,MAAM,sBAAsB,0BAA0B,WAAW,UAAU;CAC3E,IAAI,qBAAqB;EACvB,MAAM,UAAU,MAAM,KAAK,SAAS,QAAQ,EAAE,IAAI,oBAAoB,CAAC;EACvE,IAAI,CAAC,WAAW,QAAQ,UAAU,UAAU,OAAO,MAAM,IAAI,MAAM,sCAAsC;EAEzG,OAAO;GACL,kBAAkB,QAAQ;GAC1B,uBAAuB,QAAQ;GAC/B,QAAQ;IACN,OAAO,QAAQ;IACf,QAAQ,QAAQ;IAChB,iBAAiB,oBAAoB,QAAQ,YAAY,KAAK;GAChE;EACF;CACF;CAEA,MAAM,gBAAgB,MAAM,KAAK,cAAc,eAAe,WAAW,UAAU;CACnF,MAAM,UACJ,UAAU,SAAS,WAAW,WAC1B,MAAM,KAAK,UAAU,uBAAuB;EAC1C,OAAO,UAAU;EACjB,YAAY,WAAW;EACvB,WAAW,WAAW;EACtB,UAAU,WAAW;EACrB,iBAAiB;CACnB,CAAC,IACD;CACN,IAAI,CAAC,eAAe;EAClB,IAAI,CAAC,YAAY,WAAW,eAAe,UAAU,UAAU,WAAW,WAAW,WAAW,UAAU,IACxG,OAAO,EAAE,QAAQ,UAAU;EAE7B,MAAM,iBACJ,CAAC,WAAW,mBAAmB,KAAK,WAAW,UAAU,IACrD,MAAM,KAAK,SAAS,QAAQ,EAAE,IAAI,WAAW,WAAW,CAAC,IACzD;EACN,IAAI,kBAAkB,eAAe,UAAU,UAAU,OACvD,OAAO;GACL,kBAAkB,eAAe;GACjC,uBAAuB,eAAe;GACtC,QAAQ;IAAE,GAAG;IAAW,iBAAiB,oBAAoB,eAAe,YAAY,SAAS;GAAE;EACrG;EAEF,MAAM,IAAI,MAAM,2CAA2C;CAC7D;CACA,IACE,cAAc,UAAU,UAAU,SACjC,cAAc,eAAe,aAAa,cAAc,WAAW,UAAU,QAE9E,MAAM,IAAI,MAAM,uDAAuD;CAEzE,IAAI,CAAC,cAAc,kBAAkB,MAAM,IAAI,MAAM,2CAA2C;CAChG,MAAM,YAAY,SAAS,oBAAoB,cAAc;CAC7D,MAAM,UAAU,MAAM,KAAK,SAAS,QAAQ,EAAE,IAAI,UAAU,CAAC;CAC7D,IAAI,CAAC,WAAW,QAAQ,UAAU,cAAc,OAAO,MAAM,IAAI,MAAM,sCAAsC;CAE7G,OAAO;EACL,kBAAkB,QAAQ;EAC1B,uBAAuB,QAAQ;EAC/B,QAAQ;GACN,OAAO,QAAQ;GACf,QAAQ,cAAc;GACtB,iBAAiB,oBAAoB,QAAQ,YAAY,UAAU,QAAQ,SAAS;EACtF;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/factory",
-  "version": "0.23.0-alpha.5",
+  "version": "0.23.0-alpha.7",
   "description": "Mastra Software Factory module: the server core behind the Mastra Software Factory — storage domains, integrations, and surfaces for agent-powered software delivery",
   "type": "module",
   "publishConfig": {
@@ -57,11 +57,11 @@
     "hono": "^4.13.7",
     "posthog-node": "^5.46.1",
     "zod": "^4.6.4",
-    "@mastra/auth-studio": "1.3.9",
     "@mastra/auth-workos": "1.6.6",
-    "@mastra/code-sdk": "1.14.0-alpha.5",
+    "@mastra/code-sdk": "1.14.0-alpha.7",
+    "@mastra/core": "1.78.0-alpha.7",
     "@mastra/slack": "1.7.2",
-    "@mastra/core": "1.78.0-alpha.5"
+    "@mastra/auth-studio": "1.3.9"
   },
   "devDependencies": {
     "@types/node": "22.20.1",
@@ -71,11 +71,11 @@
     "typescript-eslint": "^8.57.0",
     "vitest": "4.1.11",
     "@internal/lint": "0.0.143",
-    "@mastra/libsql": "1.26.2-alpha.0",
     "@mastra/pg": "1.31.2-alpha.1",
-    "@mastra/server": "1.78.0-alpha.5",
-    "@internal/workspace": "0.0.15",
-    "@internal/types-builder": "0.0.118"
+    "@mastra/server": "1.78.0-alpha.7",
+    "@mastra/libsql": "1.26.2-alpha.0",
+    "@internal/types-builder": "0.0.118",
+    "@internal/workspace": "0.0.15"
   },
   "engines": {
     "node": ">=22.19.0"