@mastra/mcp-docs-server 1.2.13-alpha.1 → 1.2.13-alpha.11

package/.docs/reference/workspace/platform-filesystem.md

@@ -4,7 +4,7 @@
 
 Stores files in a Mastra Platform workspace bucket. Each Mastra Platform environment can have one bucket, and `PlatformFilesystem` gives agents `read`, `write`, `list`, `delete`, and `move` operations against it.
 
-Use `PlatformFilesystem` when your agent runs on a Mastra Platform deployment and you want the filesystem to be backed by the platform-provisioned bucket. For direct S3 access, see [`S3Filesystem`](https://mastra.ai/reference/workspace/s3-filesystem). For a local directory during development, see [`LocalFilesystem`](https://mastra.ai/reference/workspace/local-filesystem).
+Related providers: [`S3Filesystem`](https://mastra.ai/reference/workspace/s3-filesystem) for direct S3 access, [`LocalFilesystem`](https://mastra.ai/reference/workspace/local-filesystem) for local directories.
 
 > **Info:** For interface details, see [WorkspaceFilesystem interface](https://mastra.ai/reference/workspace/filesystem).
 
@@ -39,7 +39,7 @@ Configure the platform credentials. The access token, project ID, and bucket nam
 **.env file**:
 
 ```bash
-MASTRA_PLATFORM_SECRET_KEY=your-platform-secret-key
+MASTRA_PLATFORM_ACCESS_TOKEN=your-platform-access-token
 MASTRA_PROJECT_ID=your-project-id
 MASTRA_PLATFORM_BUCKET_NAME=your-bucket-name
 ```
@@ -54,7 +54,7 @@ new PlatformFilesystem({
 })
 ```
 
-On a Mastra Platform deployment these variables are injected automatically, so the constructor can be called with no options.
+On a Mastra Platform deployment, `MASTRA_PLATFORM_ACCESS_TOKEN`, `MASTRA_PROJECT_ID`, and `MASTRA_PLATFORM_BUCKET_NAME` are injected automatically, so the constructor can be called with no options. For local development, `MASTRA_PLATFORM_ACCESS_TOKEN` can contain an `sk_` API token from your organization's settings page under **API Tokens**.
 
 ## Usage
 
@@ -116,7 +116,7 @@ await fs.writeFile('/analyses/repo.md', 'x') // throws WorkspaceReadOnlyError
 
 ## Constructor parameters
 
-**accessToken** (`string`): Platform secret key. Falls back to the MASTRA\_PLATFORM\_SECRET\_KEY environment variable (MASTRA\_PLATFORM\_ACCESS\_TOKEN is a deprecated fallback).
+**accessToken** (`string`): Platform access token. Falls back to the MASTRA\_PLATFORM\_ACCESS\_TOKEN environment variable.
 
 **projectId** (`string`): Platform project ID. Falls back to the MASTRA\_PROJECT\_ID environment variable.
 
@@ -157,7 +157,8 @@ Filesystem-specific errors match the standard workspace error types:
 Other Platform API failures raise `PlatformApiError`. Structured `{ error: { message, type } }` responses are parsed into `.code` (machine-readable kind) and `.proxyMessage` (human string):
 
 ```typescript
-import { FileNotFoundError, PlatformApiError } from '@mastra/platform-workspace'
+import { FileNotFoundError } from '@mastra/core/workspace'
+import { PlatformApiError } from '@mastra/platform-workspace'
 
 try {
   await fs.readFile('/missing.txt')
@@ -173,6 +174,8 @@ try {
 }
 ```
 
+`FileNotFoundError`, `FileExistsError`, and `WorkspaceReadOnlyError` are re-exports of the standard workspace error types from `@mastra/core/workspace`. `PlatformApiError` is specific to `@mastra/platform-workspace`.
+
 `code` and `proxyMessage` are `undefined` when the response body isn't JSON, for example an HTML 502 from a load balancer.
 
 ## Related

package/.docs/reference/workspace/platform-sandbox.md

@@ -2,9 +2,11 @@
 
 # PlatformSandbox
 
-Executes commands inside a Mastra Platform sandbox tied to a Platform environment. Sandboxes boot from a pre-built recipe checkpoint with Python 3, Node 22, TypeScript, tsx, and common build tooling already installed.
+Client for provisioning sandboxes in a Mastra Platform environment. Each `PlatformSandbox` instance owns one remote sandbox: `start()` provisions it, `executeCommand()` runs against it, and `destroy()` tears it down. Construct additional instances to own additional remote sandboxes. Use `clone()` to derive them from a configured template (see [Cloning](#cloning-for-a-fleet-of-sandboxes)).
 
-Use `PlatformSandbox` when your agent runs on a Mastra Platform deployment and you want the sandbox to be provisioned and managed by the platform. For self-hosted Railway sandboxes, see [`RailwaySandbox`](https://mastra.ai/reference/workspace/railway-sandbox). For a local sandbox during development, see [`LocalSandbox`](https://mastra.ai/reference/workspace/local-sandbox).
+Sandboxes boot from a pre-built recipe checkpoint with Python 3, Node 22, TypeScript, tsx, and common build tooling already installed. Pass a stable `id` to opt into [checkpoint recovery](#checkpoint-recovery) so a new sandbox boots from the previous one's filesystem.
+
+Related providers: [`RailwaySandbox`](https://mastra.ai/reference/workspace/railway-sandbox) for self-hosted Railway sandboxes, [`LocalSandbox`](https://mastra.ai/reference/workspace/local-sandbox) for local sandboxes.
 
 > **Info:** For interface details, see [WorkspaceSandbox interface](https://mastra.ai/reference/workspace/sandbox).
 
@@ -39,7 +41,7 @@ Configure the platform credentials. The access token, project ID, and environmen
 **.env file**:
 
 ```bash
-MASTRA_PLATFORM_SECRET_KEY=your-platform-secret-key
+MASTRA_PLATFORM_ACCESS_TOKEN=your-platform-access-token
 MASTRA_PROJECT_ID=your-project-id
 MASTRA_ENVIRONMENT_ID=your-environment-id
 ```
@@ -54,7 +56,7 @@ new PlatformSandbox({
 })
 ```
 
-On a Mastra Platform deployment these variables are injected automatically, so the constructor can be called with no options.
+On a Mastra Platform deployment, `MASTRA_PLATFORM_ACCESS_TOKEN`, `MASTRA_PROJECT_ID`, and `MASTRA_ENVIRONMENT_ID` are injected automatically, so the constructor can be called with no options. For local development, `MASTRA_PLATFORM_ACCESS_TOKEN` can contain an `sk_` API token from your organization's settings page under **API Tokens**.
 
 ## Usage
 
@@ -103,7 +105,7 @@ The default `ISOLATED` mode allows outbound internet access only, with no privat
 
 ### Reattaching to a running sandbox
 
-Pass an existing `sandboxId` to reattach to a live sandbox instead of creating a new one. This is useful for stateful agents that resume between requests:
+Pass an existing `sandboxId` to reattach to a live sandbox instead of creating a new one:
 
 ```typescript
 const sandbox = new PlatformSandbox({
@@ -116,6 +118,42 @@ const result = await sandbox.executeCommand('cat', ['/workspace/state.json'])
 
 When `sandboxId` is set, `environmentId` isn't required because the sandbox already exists.
 
+### Checkpoint recovery
+
+The constructor `id` (explicit or auto-generated) is sent to the platform on `POST /sandbox` as an advisory recovery key:
+
+- If the platform recognises the `id` from a previous session, the new sandbox boots from the most recent checkpoint of that earlier sandbox's filesystem instead of the base recipe.
+- If the `id` isn't recognised, the platform starts a fresh sandbox from the base recipe. Auto-generated ids never match, so omitting `id` disables checkpoint recovery.
+
+Pass a stable `id` to preserve a sandbox's filesystem across sessions or across a `destroy()`/`start()` cycle:
+
+```typescript
+const sandbox = new PlatformSandbox({
+  id: `project-${projectId}`,
+})
+await sandbox.start() // Boots from the most recent checkpoint for this id, or fresh if unknown
+```
+
+Checkpoint recovery is coarser than `sandboxId` reattachment. Reattaching (via `sandboxId`) rejoins the exact live sandbox and its running processes. Checkpoint recovery constructs a brand new sandbox and restores its filesystem from the latest checkpoint the platform captured for the previous sandbox with that `id`. Running processes and any filesystem writes made after the last checkpoint aren't restored.
+
+Each `id` maps to one independent filesystem. Reusing the same `id` across unrelated sandboxes causes the platform to boot them from each other's checkpoint.
+
+### Cloning for a fleet of sandboxes
+
+`clone()` returns an independent sibling `PlatformSandbox` that inherits credentials and defaults (access token, project, environment, network isolation, timeout, instructions, env, idle timeout) with per-instance overrides. The returned sandbox is unstarted and provisions on its own `start()`, so `clone()` performs no I/O:
+
+```typescript
+const template = new PlatformSandbox({
+  networkIsolation: 'PRIVATE',
+  idleTimeoutMinutes: 30,
+})
+
+const perProject = template.clone({ id: `project-${projectId}` })
+await perProject.start()
+```
+
+Combine `clone()` with a stable `id` per clone to opt each clone into [checkpoint recovery](#checkpoint-recovery) independently.
+
 ### Executing commands
 
 `executeCommand` runs a command on the remote sandbox and returns its output. Pass `args` to have arguments safely shell-quoted:
@@ -135,7 +173,7 @@ console.log(result.exitCode)
 
 ## Constructor parameters
 
-**accessToken** (`string`): Platform secret key. Falls back to the MASTRA\_PLATFORM\_SECRET\_KEY environment variable (MASTRA\_PLATFORM\_ACCESS\_TOKEN is a deprecated fallback).
+**accessToken** (`string`): Platform access token. Falls back to the MASTRA\_PLATFORM\_ACCESS\_TOKEN environment variable.
 
 **projectId** (`string`): Platform project ID. Falls back to the MASTRA\_PROJECT\_ID environment variable.
 
@@ -153,7 +191,7 @@ console.log(result.exitCode)
 
 **instructions** (`string | ((opts: { defaultInstructions: string; requestContext?: RequestContext }) => string)`): Custom instructions returned by getInstructions(). A string fully replaces the defaults; a function receives the defaults and can extend or customize them per-request.
 
-**id** (`string`): Unique identifier for this sandbox instance. (Default: `Auto-generated`)
+**id** (`string`): Unique identifier for this sandbox instance. Sent to the platform as an advisory recovery key: if the platform recognizes the id from a previous sandbox, the new sandbox boots from that sandbox's most recent checkpoint instead of the base recipe. Unknown ids fall through to a fresh sandbox. Auto-generated when omitted, which disables checkpoint recovery. (Default: `Auto-generated`)
 
 **fetch** (`typeof fetch`): Custom fetch implementation, mainly for testing.
 
@@ -169,6 +207,22 @@ console.log(result.exitCode)
 
 **processes** (`PlatformProcessManager`): Background process manager. See SandboxProcessManager reference.
 
+## Methods
+
+**start** (`() => Promise<void>`): Provision the remote sandbox, or reattach when sandboxId was passed to the constructor. Idempotent once the sandbox is running. A destroyed reattach target falls through to a fresh provision.
+
+**destroy** (`() => Promise<void>`): Tear down the remote sandbox and clear the cached exec lease. A subsequent start() provisions a fresh sandbox (or restores from checkpoint when a stable id is set).
+
+**stop** (`() => Promise<void>`): Alias for destroy().
+
+**executeCommand** (`(command: string, args?: string[], options?: ExecuteCommandOptions) => Promise<CommandResult>`): Run a command on the remote sandbox and return its stdout, stderr, exitCode, and executionTimeMs. command is a shell string, args are safely shell-quoted.
+
+**clone** (`(options?: SandboxCloneOptions) => PlatformSandbox`): Construct an unstarted sibling PlatformSandbox that inherits credentials and defaults with per-instance overrides (id, sandboxId, env, idleTimeoutMinutes). Performs no I/O. Use to build a fleet of independent sandboxes from one configured template.
+
+**getInfo** (`() => Promise<SandboxInfo>`): Return the sandbox's platform id, provider, status, createdAt, and metadata (sandboxId, providerResourceId, platformStatus).
+
+**getInstructions** (`(opts?: { requestContext?: RequestContext }) => string`): Return the sandbox instructions the workspace surfaces in tool descriptions. Honors the instructions constructor option; otherwise returns platform-default instructions that include the current remote sandbox id when running.
+
 ## Errors
 
 Platform API failures raise `PlatformApiError`. Structured `{ error: { message, type } }` responses are parsed into `.code` (machine-readable kind) and `.proxyMessage` (human string); the raw response body stays available on `.body`:
@@ -192,6 +246,28 @@ try {
 
 `code` and `proxyMessage` are `undefined` when the response body isn't JSON, for example an HTML 502 from a load balancer.
 
+`executeCommand` runs over the direct-exec data plane (a WebSocket to the Railway tcp-proxy) and can also throw two typed sandbox errors on unrecoverable failure:
+
+```typescript
+import { SandboxDestroyedError, SandboxExecTransportError } from '@mastra/platform-workspace'
+
+try {
+  await sandbox.executeCommand('pytest')
+} catch (err) {
+  if (err instanceof SandboxDestroyedError) {
+    // /exec-lease returned 410; the sandbox has been destroyed.
+    // The cached sandbox id and lease have already been cleared,
+    // so reusing the instance will reprovision on the next call.
+  } else if (err instanceof SandboxExecTransportError) {
+    // Both the initial WebSocket attempt and the built-in retry
+    // closed without an exit frame against a live sandbox.
+    console.error(err.closeCode, err.closeReason, err.wsEndpoint)
+  }
+}
+```
+
+`SandboxExecTransportError` carries diagnostic fields (`opened`, `closeCode`, `closeReason`, `wsEndpoint`, plus `sandboxId`, `command`, and `attempts`) so operators can distinguish a broken Railway data plane from a failed command.
+
 ## Related
 
 - [PlatformFilesystem reference](https://mastra.ai/reference/workspace/platform-filesystem)

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # @mastra/mcp-docs-server
 
+## 1.2.13-alpha.10
+
+### Patch Changes
+
+- Updated dependencies [[`a19e5b7`](https://github.com/mastra-ai/mastra/commit/a19e5b79b76fffa92f9cf17e0e89c3fa714534e8), [`82201f7`](https://github.com/mastra-ai/mastra/commit/82201f75fae8e050a8de2df08b74875ee74c6b83), [`fb18da5`](https://github.com/mastra-ai/mastra/commit/fb18da56fc35689ae370621a8f10b5b0d8606e20), [`fb18da5`](https://github.com/mastra-ai/mastra/commit/fb18da56fc35689ae370621a8f10b5b0d8606e20), [`0a6598b`](https://github.com/mastra-ai/mastra/commit/0a6598bde80bde008986ad6616bed9632b9294cb), [`9e1dad8`](https://github.com/mastra-ai/mastra/commit/9e1dad8f7b1cab2bb7ade90e5b7561f24577b88a), [`2f43145`](https://github.com/mastra-ai/mastra/commit/2f4314504c03cbba280414ac81ba3197448ee6b0), [`34d34d8`](https://github.com/mastra-ai/mastra/commit/34d34d8c811df512fef4dd5459f79b7821be1866)]:
+  - @mastra/mcp@1.15.1-alpha.1
+  - @mastra/core@1.56.0-alpha.6
+
+## 1.2.13-alpha.9
+
+### Patch Changes
+
+- Updated dependencies [[`db4e6ff`](https://github.com/mastra-ai/mastra/commit/db4e6ff744503112eb64deeaf6c2b54bf26a54c7), [`6d19a65`](https://github.com/mastra-ai/mastra/commit/6d19a6517f5da3911023d446b7e2d5dad8adb1cb)]:
+  - @mastra/core@1.56.0-alpha.5
+
+## 1.2.13-alpha.7
+
+### Patch Changes
+
+- Updated dependencies [[`4844167`](https://github.com/mastra-ai/mastra/commit/4844167cff2d5ec5004e94edd34970833040fa3f), [`5faf93f`](https://github.com/mastra-ai/mastra/commit/5faf93f03e19daea394b9e2a923f2e4f833407f2), [`80ad891`](https://github.com/mastra-ai/mastra/commit/80ad891f8cd10379aa5b5af7510c763783b2ab56), [`c78aa4e`](https://github.com/mastra-ai/mastra/commit/c78aa4ecc422ba70476da73709c3e7d85edc71d6), [`a1cb98d`](https://github.com/mastra-ai/mastra/commit/a1cb98d11990b560b98482292a1f34aa1a2d9092), [`598ad82`](https://github.com/mastra-ai/mastra/commit/598ad82d41c41389a686338a1d0e50b7400e1938), [`1fd6aad`](https://github.com/mastra-ai/mastra/commit/1fd6aad1ea4a9d32f65efa832307c35e981a4c0a)]:
+  - @mastra/core@1.56.0-alpha.4
+  - @mastra/mcp@1.15.1-alpha.0
+
+## 1.2.13-alpha.5
+
+### Patch Changes
+
+- Updated dependencies [[`594f7b2`](https://github.com/mastra-ai/mastra/commit/594f7b28f5263fb9982fd50d95c471fb971ea984), [`311f943`](https://github.com/mastra-ai/mastra/commit/311f943bee60e8fdf5c84499ea50e884276c936c), [`0c89896`](https://github.com/mastra-ai/mastra/commit/0c8989673fb7d106837098398131e570c6023b68), [`23b4238`](https://github.com/mastra-ai/mastra/commit/23b423844ad0bcf2a502a68dd62866d6160f9f6d), [`e320a76`](https://github.com/mastra-ai/mastra/commit/e320a763feaf65c6be3cebecf746defcbde161b3), [`03b4918`](https://github.com/mastra-ai/mastra/commit/03b4918c80d188ce375334c393e131c6e94bd7eb), [`14ef73a`](https://github.com/mastra-ai/mastra/commit/14ef73a4bbd73e7808414816eb0628ce1d80b5d7), [`1d677d5`](https://github.com/mastra-ai/mastra/commit/1d677d5f99d7db403f7828585e8c25f299f72628), [`93e28ec`](https://github.com/mastra-ai/mastra/commit/93e28ecce9031c02397e0ae8406593e5c7a95883), [`729dab4`](https://github.com/mastra-ai/mastra/commit/729dab408faccfaef0cbb048e5a4338f9172847e), [`484003d`](https://github.com/mastra-ai/mastra/commit/484003d33ff59330c86b19863e4a38732d7e4155), [`933d291`](https://github.com/mastra-ai/mastra/commit/933d291146b789c19442ad206f94da3e4be90c64)]:
+  - @mastra/core@1.56.0-alpha.3
+
+## 1.2.13-alpha.4
+
+### Patch Changes
+
+- Updated dependencies [[`322daa6`](https://github.com/mastra-ai/mastra/commit/322daa6d90552909204044790d850958f6745fed), [`cadaa13`](https://github.com/mastra-ai/mastra/commit/cadaa1372e1077c8e85eb64c5499ba8803caa323), [`06000d7`](https://github.com/mastra-ai/mastra/commit/06000d73712911572e913b8a83339270296d0a22), [`3de0188`](https://github.com/mastra-ai/mastra/commit/3de0188bfaf9a9c09c95fe322b53838cf52c70b6)]:
+  - @mastra/core@1.56.0-alpha.2
+
+## 1.2.13-alpha.2
+
+### Patch Changes
+
+- Updated dependencies [[`c5e56ff`](https://github.com/mastra-ai/mastra/commit/c5e56ff3bcabdf062708f2d48744fec304df6792), [`4e35a56`](https://github.com/mastra-ai/mastra/commit/4e35a56cdf8d74a5ff6d5eda01f2c1deaf6cc7be)]:
+  - @mastra/core@1.56.0-alpha.1
+
 ## 1.2.13-alpha.1
 
 ### Patch Changes

package/README.md

@@ -4,7 +4,7 @@ Access Mastra's documentation via [Model Context Protocol (MCP)](https://modelco
 
 ## Usage
 
-Follow the [official installation](https://mastra.ai/docs/getting-started/mcp-docs-server) instructions.
+Follow the [official installation](https://mastra.ai/reference/build-with-ai#mcp-docs-server) instructions.
 
 ## Tools
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/mcp-docs-server",
-  "version": "1.2.13-alpha.1",
+  "version": "1.2.13-alpha.11",
   "description": "MCP server for accessing Mastra.ai documentation, changelogs, and news.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,8 +28,8 @@
     "jsdom": "^26.1.0",
     "local-pkg": "^1.1.2",
     "zod": "^4.4.3",
-    "@mastra/core": "1.56.0-alpha.0",
-    "@mastra/mcp": "^1.15.0"
+    "@mastra/core": "1.56.0-alpha.6",
+    "@mastra/mcp": "^1.15.1-alpha.1"
   },
   "devDependencies": {
     "@hono/node-server": "^1.19.14",
@@ -45,9 +45,9 @@
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
     "vitest": "4.1.10",
+    "@mastra/core": "1.56.0-alpha.6",
     "@internal/lint": "0.0.119",
-    "@internal/types-builder": "0.0.94",
-    "@mastra/core": "1.56.0-alpha.0"
+    "@internal/types-builder": "0.0.94"
   },
   "homepage": "https://mastra.ai",
   "repository": {

package/.docs/docs/agent-builder/access-control.md

@@ -1,99 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# Access control
-
-> **Note:** The Agent Builder is part of the Mastra Enterprise Edition. Production deployments require a valid EE license. [Contact sales](https://mastra.ai/contact) for more information.
-
-The Agent Builder includes with two supported roles: `admin` and `member`. Wire them through `Mastra.server.rbac`. Without an RBAC provider, every authenticated user has full Builder access; without authentication, the Builder is open to anyone who can reach the server.
-
-## Roles
-
-| Role     | Permissions         | What they can do                                                                                |
-| -------- | ------------------- | ----------------------------------------------------------------------------------------------- |
-| `admin`  | `*`                 | Full access. Create, edit, publish, and delete agents and skills. Manage every Builder surface. |
-| `member` | scoped list (below) | Open the Builder, browse agents and skills, populate pickers, and chat with the Builder agent.  |
-
-## Minimum permissions
-
-The Builder UI calls several resources on load, so a usable `member` role needs explicit grants on each. The Builder action layer (`/agent-builder/*`) is one resource. The data it reads and writes lives under separate resources.
-
-| Permission                            | Used for                                                                                                                                                    |
-| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `agent-builder:*`                     | Load Builder actions and run Builder workflows. The derived Builder actions are `agent-builder:read` and `agent-builder:execute`. The wildcard grants both. |
-| `agents:read`, `agents:execute`       | List registered agents and chat with the Builder agent                                                                                                      |
-| `stored-agents:*`                     | List, view, create, and edit agents                                                                                                                         |
-| `stored-skills:*`                     | List, view, create, and edit stored skills                                                                                                                  |
-| `stored-workspaces:*`                 | Pick a workspace when editing an agent                                                                                                                      |
-| `tools:read`, `tools:execute`         | Populate the tool picker and run tools through agents                                                                                                       |
-| `workflows:read`, `workflows:execute` | Populate the workflow picker and run workflows through agents                                                                                               |
-| `memory:read`                         | Preview memory configuration in the picker                                                                                                                  |
-| `channels:read`                       | Show Slack/channel chips on agent pages                                                                                                                     |
-| `infrastructure:read`                 | Builder diagnostics banner on the shell                                                                                                                     |
-
-Grant `:write`, `:delete`, and `:publish` on `stored-agents` and `stored-skills` for users who should create or modify agents. The `:*` wildcards in the table above cover those actions. `admin` covers everything through the `*` wildcard.
-
-## Quickstart with WorkOS
-
-`@mastra/auth-workos` provides `MastraAuthWorkos` for SSO and `MastraRBACWorkos` for role-based access. Map WorkOS organization roles to the Builder's `admin` and `member` roles via `roleMapping`:
-
-```typescript
-import { MastraAuthWorkos, MastraRBACWorkos } from '@mastra/auth-workos'
-
-export const mastraAuth = new MastraAuthWorkos({
-  redirectUri: process.env.WORKOS_REDIRECT_URI || 'http://localhost:4111/api/auth/callback',
-})
-
-export const rbacProvider = new MastraRBACWorkos({
-  roleMapping: {
-    admin: ['*'],
-    member: [
-      'agent-builder:*',
-      'agents:read',
-      'agents:execute',
-      'stored-agents:*',
-      'stored-skills:*',
-      'stored-workspaces:*',
-      'tools:read',
-      'tools:execute',
-      'workflows:read',
-      'workflows:execute',
-      'memory:read',
-      'channels:read',
-      'infrastructure:read',
-    ],
-    _default: [],
-  },
-})
-```
-
-Register both providers on the Mastra server:
-
-```typescript
-import { Mastra } from '@mastra/core/mastra'
-import { mastraAuth, rbacProvider } from './auth'
-
-export const mastra = new Mastra({
-  server: {
-    auth: mastraAuth,
-    rbac: rbacProvider,
-  },
-  // ...storage, agents, editor
-})
-```
-
-`_default` covers WorkOS roles not listed in the mapping. Omit it to deny unmapped users. Set `WORKOS_API_KEY` and `WORKOS_CLIENT_ID` in your environment.
-
-## Permission grammar
-
-Permission patterns follow `resource:action`. Wildcards are supported on either side:
-
-- `*`: Full access (every resource, every action). Used by `admin`.
-- `agent-builder:*`: Every action on the `agent-builder` resource.
-- `*:read`: `read` Across every resource.
-
-Patterns resolve through `matchesPermission()`. The first matching role permission grants the action.
-
-## Related
-
-- [Configuration](https://mastra.ai/docs/agent-builder/configuration): Wire RBAC alongside the rest of the Builder config.
-- [Deploying](https://mastra.ai/docs/agent-builder/deploying): Auth, RBAC, and EE license setup for production.

package/.docs/docs/agent-builder/browser.md

@@ -1,63 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# Browser
-
-> **Note:** The Agent Builder is part of the Mastra Enterprise Edition. Production deployments require a valid EE license. [Contact sales](https://mastra.ai/contact) for more information.
-
-The Agent Builder can give end-user agents a browser tool driven by a registered provider. Unlike filesystems and sandboxes, **there are no built-in browser providers** and you must register one through `MastraEditor.browsers`.
-
-## Quickstart
-
-Register a browser provider on `MastraEditor`, then pin it as the Builder default through `builder.configuration.agent.browser`:
-
-```typescript
-import { MastraEditor } from '@mastra/editor'
-import { StagehandBrowser } from '@mastra/stagehand'
-
-new MastraEditor({
-  browsers: {
-    stagehand: {
-      id: 'stagehand',
-      name: 'Stagehand Browser',
-      createBrowser: config =>
-        new StagehandBrowser({
-          ...config,
-          apiKey: process.env.BROWSERBASE_API_KEY ?? '',
-          env: 'BROWSERBASE',
-          projectId: process.env.BROWSERBASE_PROJECT_ID ?? '',
-        }),
-    },
-  },
-  builder: {
-    enabled: true,
-    configuration: {
-      agent: {
-        browser: {
-          type: 'inline',
-          config: { provider: 'stagehand', headless: true },
-        },
-      },
-    },
-  },
-})
-```
-
-## Browser providers
-
-`MastraEditor.browsers` accepts a `Record<string, BrowserProvider>`. Each provider exposes:
-
-- `id`: Provider identifier, matched against `StorageBrowserConfig.provider` (e.g., `'stagehand'`).
-- `name`: Display name shown in the Builder UI.
-- `createBrowser(config)`: Hydrates a stored browser config into a runtime `MastraBrowser`. This is where you inject runtime-only credentials (API keys, project IDs) that aren't stored in the agent snapshot.
-
-Browser classes release as separate packages (e.g., `@mastra/stagehand`, `@mastra/agent-browser`). The provider entry is a plain object wrapping the class, register one entry per browser you want the Builder to expose to end users. See the [StorageBrowserRef reference](https://mastra.ai/reference/editor/storage-browser-ref) for the full `browser` field schema, including all `StorageBrowserConfig` options.
-
-## Feature toggle
-
-The `features.agent.browser` toggle controls whether end users can enable browser access per agent in the Builder UI. It defaults to `true` only when a valid `configuration.agent.browser` (with a `config.provider`) is provided. Without a registered provider matching the pinned config, the toggle is forced off.
-
-## Related
-
-- [BuilderAgentDefaults reference](https://mastra.ai/reference/editor/agent-builder/builder-agent-defaults): The full `browser` field schema.
-- [AgentBuilderOptions reference](https://mastra.ai/reference/editor/agent-builder/agent-builder-options): The full Builder config surface, including `features.agent.browser`.
-- [Configuration](https://mastra.ai/docs/agent-builder/configuration): Wire `browser` alongside the rest of the Builder config.

package/.docs/docs/agent-builder/channels.md

@@ -1,78 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# Channels
-
-> **Note:** The Agent Builder is part of the Mastra Enterprise Edition. Production deployments require a valid EE license. [Contact sales](https://mastra.ai/contact) for more information.
-
-Channels let Builder-created agents reach users outside the Mastra server. Register a channel provider on `Mastra.channels` and the Builder exposes the channel as an integration option for every agent.
-
-Slack is currently the only supported channel.
-
-## Quickstart
-
-Install the Slack provider:
-
-**npm**:
-
-```bash
-npm install @mastra/slack
-```
-
-**pnpm**:
-
-```bash
-pnpm add @mastra/slack
-```
-
-**Yarn**:
-
-```bash
-yarn add @mastra/slack
-```
-
-**Bun**:
-
-```bash
-bun add @mastra/slack
-```
-
-Register `SlackProvider` on `Mastra.channels`:
-
-```typescript
-import { Mastra } from '@mastra/core/mastra'
-import { MastraEditor } from '@mastra/editor'
-import { createBuilderAgent } from '@mastra/editor/ee'
-import { SlackProvider } from '@mastra/slack'
-
-export const mastra = new Mastra({
-  storage,
-  channels: {
-    slack: new SlackProvider({
-      refreshToken: process.env.SLACK_APP_CONFIG_REFRESH_TOKEN,
-      baseUrl: process.env.SLACK_BASE_URL,
-    }),
-  },
-  agents: { builderAgent: createBuilderAgent() },
-  editor: new MastraEditor({
-    builder: { enabled: true },
-  }),
-})
-```
-
-The Slack provider handles app creation, OAuth, slash commands, and message routing for every Builder-created agent that opts in.
-
-## Configuration
-
-`SlackProvider` requires one environment variable and accepts one optional override:
-
-- `SLACK_APP_CONFIG_REFRESH_TOKEN` (required): The refresh token from your Slack app configuration tokens, available under **Your App Configuration Tokens** on [api.slack.com/apps](https://api.slack.com/apps). The refresh token doesn't expire, but the access tokens it issues rotate every 12 hours and are auto-persisted to `Mastra.storage`.
-- `baseUrl` (optional): The public URL Slack should send events and OAuth callbacks to. Defaults to the running Mastra server's host and port (for example, `http://localhost:4111` in local development). Pass `baseUrl` explicitly when the public URL differs from the server's resolved address: typically a tunnel for local development (`cloudflared tunnel --url http://localhost:4111`) or a deployed URL in production.
-
-## Storage requirement
-
-`SlackProvider` requires a persistent storage backend on the `Mastra` instance. Without storage, rotated tokens and app installations are lost on restart.
-
-## Related
-
-- [Deploying](https://mastra.ai/docs/agent-builder/deploying): Set a public `baseUrl` for production deployments.
-- [Configuration](https://mastra.ai/docs/agent-builder/configuration): Wire channel toggles into the Builder UI.