@mastra/mcp-docs-server 1.2.2-alpha.9 → 1.2.2

package/.docs/docs/server/auth/google.md

@@ -0,0 +1,281 @@
+# Google
+
+The `@mastra/auth-google` package provides authentication and role-based access control for Mastra using Google Workspace. It supports an OAuth 2.0 / OIDC login flow with encrypted session cookies, verifies Google ID tokens, and maps Google Workspace groups to Mastra permissions.
+
+Use it when your Studio users sign in with Google and access should be limited to one or more Google Workspace domains.
+
+## Prerequisites
+
+This guide uses Google Workspace authentication. Make sure to:
+
+1. Create or select a Google Cloud project
+2. Set up an OAuth client for web applications
+3. Add your Mastra SSO callback URL to the authorized redirect URIs
+4. Configure Google Workspace groups if you plan to use RBAC
+
+For Google Groups RBAC, also configure a Google Workspace service account with domain-wide delegation and grant it the Directory API read-only group scope:
+
+```text
+https://www.googleapis.com/auth/admin.directory.group.readonly
+```
+
+Make sure your environment variables are set.
+
+```env
+GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
+GOOGLE_CLIENT_SECRET=your-client-secret
+GOOGLE_REDIRECT_URI=http://localhost:4111/api/auth/sso/callback
+GOOGLE_COOKIE_PASSWORD=a-random-string-at-least-32-characters-long
+GOOGLE_ALLOWED_DOMAINS=example.com
+
+GOOGLE_SERVICE_ACCOUNT_EMAIL=service-account@project.iam.gserviceaccount.com
+GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"
+GOOGLE_WORKSPACE_ADMIN_EMAIL=admin@example.com
+```
+
+> **Note:** `GOOGLE_COOKIE_PASSWORD` encrypts session cookies. If omitted, an auto-generated value is used that doesn't survive server restarts. Set it explicitly for production.
+>
+> `MastraAuthGoogle` reads the `GOOGLE_*` auth variables automatically. The service-account variables shown above are read by the configuration code you pass to `MastraRBACGoogle`.
+
+## Installation
+
+Before you can use the `MastraAuthGoogle` class, install the `@mastra/auth-google` package.
+
+**npm**:
+
+```bash
+npm install @mastra/auth-google
+```
+
+**pnpm**:
+
+```bash
+pnpm add @mastra/auth-google
+```
+
+**Yarn**:
+
+```bash
+yarn add @mastra/auth-google
+```
+
+**Bun**:
+
+```bash
+bun add @mastra/auth-google
+```
+
+## Usage examples
+
+### Basic usage with environment variables
+
+With the environment variables above set, all constructor parameters are optional:
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthGoogle(),
+  },
+})
+```
+
+> **Warning:** Use `allowedDomains` or `GOOGLE_ALLOWED_DOMAINS` to enforce Workspace access. Mastra checks Google's verified `hd` claim, not the email address suffix.
+
+### Custom configuration
+
+Pass constructor options directly if you don't want to rely on environment variables:
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthGoogle({
+      clientId: process.env.GOOGLE_CLIENT_ID,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+      redirectUri: process.env.GOOGLE_REDIRECT_URI,
+      allowedDomains: ['example.com'],
+    }),
+  },
+})
+```
+
+### Auth with Google Groups RBAC
+
+Add `MastraRBACGoogle` to map Google Workspace groups to Mastra permissions:
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthGoogle, MastraRBACGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthGoogle(),
+    rbac: new MastraRBACGoogle({
+      serviceAccount: {
+        clientEmail: process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL!,
+        privateKey: process.env.GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY!,
+        subject: process.env.GOOGLE_WORKSPACE_ADMIN_EMAIL!,
+      },
+      roleMapping: {
+        'admins@example.com': ['*'],
+        'engineering@example.com': ['agents:*', 'workflows:*', 'tools:*'],
+        'viewers@example.com': ['agents:read', 'workflows:read'],
+        _default: [], // users with unmapped groups get no permissions
+      },
+    }),
+  },
+})
+```
+
+### Cross-provider usage
+
+Use a different auth provider (Auth0, Clerk, etc.) for login and Google Workspace groups for RBAC. Pass a `getUserKey` function to resolve the Google Directory API user key from the other provider's user object:
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthAuth0 } from '@mastra/auth-auth0'
+import { MastraRBACGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthAuth0(),
+    rbac: new MastraRBACGoogle({
+      getUserKey: user => {
+        if (!user || typeof user !== 'object') return undefined
+
+        const { email } = user as { email?: unknown }
+        return typeof email === 'string' ? email : undefined
+      },
+      serviceAccount: {
+        clientEmail: process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL!,
+        privateKey: process.env.GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY!,
+        subject: process.env.GOOGLE_WORKSPACE_ADMIN_EMAIL!,
+      },
+      roleMapping: {
+        'engineering@example.com': ['agents:*', 'workflows:*'],
+        'admins@example.com': ['*'],
+        _default: [],
+      },
+    }),
+  },
+})
+```
+
+> **Info:** Visit [MastraAuthGoogle](https://mastra.ai/reference/auth/google) for all available configuration options.
+
+## Role mapping
+
+The `roleMapping` option maps Google Workspace group email addresses to arrays of Mastra permission strings. Permissions follow a `resource:action` pattern and support wildcards:
+
+```typescript
+const rbac = new MastraRBACGoogle({
+  roleMapping: {
+    // full access to everything
+    'admins@example.com': ['*'],
+
+    // full access to agents and workflows
+    'engineering@example.com': ['agents:*', 'workflows:*'],
+
+    // read-only access
+    'viewers@example.com': ['agents:read', 'workflows:read'],
+
+    // users whose groups don't match any key above
+    _default: [],
+  },
+})
+```
+
+Group email addresses are used as role IDs by default. Use `mapGroupToRoles` if you want to map by group name or another property. The `_default` key assigns permissions to users whose Google Workspace groups don't match any other key.
+
+## Client-side setup
+
+When auth is enabled, requests to Mastra routes require authentication. When SSO is enabled with `GOOGLE_CLIENT_SECRET`, `MastraAuthGoogle` uses Google sign-in and sets an encrypted session cookie after login.
+
+### Cookie session (recommended)
+
+For cross-origin requests (for example, a frontend on `:3000` calling Mastra on `:4111`), enable CORS credentials on the Mastra server:
+
+```typescript
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthGoogle(),
+    cors: {
+      origin: 'http://localhost:3000',
+      credentials: true,
+    },
+  },
+})
+```
+
+Configure the client to include credentials:
+
+```typescript
+import { MastraClient } from '@mastra/client-js'
+
+export const mastraClient = new MastraClient({
+  baseUrl: 'http://localhost:4111',
+  credentials: 'include',
+})
+```
+
+### Bearer token
+
+You can also pass a Google ID token as a Bearer token. Mastra verifies the token against Google's JSON Web Key Set (JWKS) endpoint:
+
+```typescript
+import { MastraClient } from '@mastra/client-js'
+
+export const createMastraClient = (idToken: string) => {
+  return new MastraClient({
+    baseUrl: 'http://localhost:4111',
+    headers: {
+      Authorization: `Bearer ${idToken}`,
+    },
+  })
+}
+```
+
+> **Info:** Visit [Mastra Client SDK](https://mastra.ai/docs/server/mastra-client) for more configuration options.
+
+### Making authenticated requests
+
+**MastraClient**:
+
+```typescript
+import { mastraClient } from '../lib/mastra-client'
+
+const agent = mastraClient.getAgent('weatherAgent')
+const response = await agent.generate('Weather in London')
+console.log(response)
+```
+
+**cURL**:
+
+```bash
+curl -X POST http://localhost:4111/api/agents/weatherAgent/generate \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer <your-google-id-token>" \
+  -d '{
+    "messages": "Weather in London"
+  }'
+```
+
+## Troubleshooting
+
+- **401 after sign-in**: Check that `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, and `GOOGLE_REDIRECT_URI` match the Google Cloud OAuth client.
+- **Workspace users are rejected**: Verify `GOOGLE_ALLOWED_DOMAINS` matches the Google ID token `hd` claim.
+- **Consumer Gmail accounts are rejected**: This is expected when `allowedDomains` is configured because Gmail accounts don't have a Workspace `hd` claim.
+- **RBAC returns default permissions**: No roles were resolved for the user. Verify the user email or custom `getUserKey`, Google group membership, and `roleMapping`. If the Directory API lookup fails, the provider throws an error instead of returning `_default`.
+- **Cookies are not sent cross-origin**: Set `credentials: "include"` in `MastraClient` and configure `server.cors` with your frontend origin and `credentials: true`.
+- **Session lost on restart**: Set `GOOGLE_COOKIE_PASSWORD` to a stable value of at least 32 characters. Without it, an auto-generated key is used in development and changes on each restart.
+
+## Related
+
+- [Auth overview](https://mastra.ai/docs/server/auth)
+- [Composite Auth](https://mastra.ai/docs/server/auth/composite-auth)
+- [MastraAuthGoogle reference](https://mastra.ai/reference/auth/google)

package/.docs/docs/server/auth.md

@@ -15,7 +15,7 @@ Authentication is optional. If no auth is configured, all routes and Studio are
 
 See [Custom API Routes](https://mastra.ai/docs/server/custom-api-routes) for controlling authentication on custom endpoints. Visit the [Studio Auth docs](https://mastra.ai/docs/studio/auth) for more on securing your Studio deployment.
 
-> **Note:** Authentication for Studio is currently supported by the following providers: Simple Auth, JWT, WorkOS, and Better Auth.
+> **Note:** Authentication for Studio is currently supported by the following providers: Simple Auth, JWT, WorkOS, Better Auth, and Google.
 
 ## Available providers
 
@@ -30,6 +30,7 @@ See [Custom API Routes](https://mastra.ai/docs/server/custom-api-routes) for con
 - [Better Auth](https://mastra.ai/docs/server/auth/better-auth)
 - [Clerk](https://mastra.ai/docs/server/auth/clerk)
 - [Firebase](https://mastra.ai/docs/server/auth/firebase)
+- [Google](https://mastra.ai/docs/server/auth/google)
 - [Okta](https://mastra.ai/docs/server/auth/okta)
 - [Supabase](https://mastra.ai/docs/server/auth/supabase)
 - [WorkOS](https://mastra.ai/docs/server/auth/workos)

package/.docs/models/gateways/vercel.md

@@ -1,6 +1,6 @@
 # ![Vercel logo](https://models.dev/logos/vercel.svg)Vercel
 
-Vercel aggregates models from multiple providers with enhanced features like rate limiting and failover. Access 291 models through Mastra's model router.
+Vercel aggregates models from multiple providers with enhanced features like rate limiting and failover. Access 292 models through Mastra's model router.
 
 Learn more in the [Vercel documentation](https://ai-sdk.dev/providers/ai-sdk-providers).
 
@@ -302,6 +302,7 @@ ANTHROPIC_API_KEY=ant-...
 | `xai/grok-build-0.1`                     |
 | `xai/grok-imagine-image`                 |
 | `xai/grok-imagine-video`                 |
+| `xai/grok-imagine-video-1.5`             |
 | `xai/grok-imagine-video-1.5-preview`     |
 | `xai/grok-stt`                           |
 | `xai/grok-tts`                           |

package/.docs/models/index.md

@@ -1,6 +1,6 @@
 # Model Providers
 
-Mastra provides a unified interface for working with LLMs across multiple providers, giving you access to 4544 models from 133 providers through a single API.
+Mastra provides a unified interface for working with LLMs across multiple providers, giving you access to 4540 models from 133 providers through a single API.
 
 ## Features
 

package/.docs/models/providers/baseten.md

@@ -34,7 +34,7 @@ for await (const chunk of stream) {
 
 | Model                                              | Context | Tools | Reasoning | Image | Audio | Video | Input $/1M | Output $/1M |
 | -------------------------------------------------- | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
-| `baseten/deepseek-ai/DeepSeek-V4-Pro`              | 131K    |       |           |       |       |       | $2         | $3          |
+| `baseten/deepseek-ai/DeepSeek-V4-Pro`              | 262K    |       |           |       |       |       | $2         | $3          |
 | `baseten/moonshotai/Kimi-K2.5`                     | 262K    |       |           |       |       |       | $0.60      | $3          |
 | `baseten/moonshotai/Kimi-K2.6`                     | 262K    |       |           |       |       |       | $0.95      | $4          |
 | `baseten/moonshotai/Kimi-K2.7-Code`                | 262K    |       |           |       |       |       | $0.95      | $4          |

package/.docs/models/providers/fireworks-ai.md

@@ -1,6 +1,6 @@
 # ![Fireworks AI logo](https://models.dev/logos/fireworks-ai.svg)Fireworks AI
 
-Access 15 Fireworks AI models through Mastra's model router. Authentication is handled automatically using the `FIREWORKS_API_KEY` environment variable.
+Access 16 Fireworks AI models through Mastra's model router. Authentication is handled automatically using the `FIREWORKS_API_KEY` environment variable.
 
 Learn more in the [Fireworks AI documentation](https://fireworks.ai/docs/).
 
@@ -46,6 +46,7 @@ for await (const chunk of stream) {
 | `fireworks-ai/accounts/fireworks/models/minimax-m3`           | 512K    |       |           |       |       |       | $0.30      | $1          |
 | `fireworks-ai/accounts/fireworks/models/qwen3p7-plus`         | 262K    |       |           |       |       |       | $0.40      | $2          |
 | `fireworks-ai/accounts/fireworks/routers/glm-5p1-fast`        | 203K    |       |           |       |       |       | $3         | $9          |
+| `fireworks-ai/accounts/fireworks/routers/glm-5p2-fast`        | 1.0M    |       |           |       |       |       | $2         | $7          |
 | `fireworks-ai/accounts/fireworks/routers/kimi-k2p6-fast`      | 262K    |       |           |       |       |       | $2         | $8          |
 | `fireworks-ai/accounts/fireworks/routers/kimi-k2p6-turbo`     | 262K    |       |           |       |       |       | $2         | $8          |
 | `fireworks-ai/accounts/fireworks/routers/kimi-k2p7-code-fast` | 262K    |       |           |       |       |       | $2         | $8          |

package/.docs/models/providers/friendli.md

@@ -1,6 +1,6 @@
 # ![Friendli logo](https://models.dev/logos/friendli.svg)Friendli
 
-Access 7 Friendli models through Mastra's model router. Authentication is handled automatically using the `FRIENDLI_TOKEN` environment variable.
+Access 9 Friendli models through Mastra's model router. Authentication is handled automatically using the `FRIENDLI_TOKEN` environment variable.
 
 Learn more in the [Friendli documentation](https://friendli.ai/docs/guides/serverless_endpoints/introduction).
 
@@ -34,6 +34,8 @@ for await (const chunk of stream) {
 
 | Model                                         | Context | Tools | Reasoning | Image | Audio | Video | Input $/1M | Output $/1M |
 | --------------------------------------------- | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
+| `friendli/deepseek-ai/DeepSeek-V3.2`          | 164K    |       |           |       |       |       | $0.50      | $2          |
+| `friendli/google/gemma-4-31B-it`              | 262K    |       |           |       |       |       | $0.14      | $0.40       |
 | `friendli/meta-llama/Llama-3.1-8B-Instruct`   | 131K    |       |           |       |       |       | $0.10      | $0.10       |
 | `friendli/meta-llama/Llama-3.3-70B-Instruct`  | 131K    |       |           |       |       |       | $0.60      | $0.60       |
 | `friendli/MiniMaxAI/MiniMax-M2.5`             | 197K    |       |           |       |       |       | $0.30      | $1          |

package/.docs/models/providers/llmgateway.md

@@ -1,6 +1,6 @@
 # ![LLM Gateway logo](https://models.dev/logos/llmgateway.svg)LLM Gateway
 
-Access 182 LLM Gateway models through Mastra's model router. Authentication is handled automatically using the `LLMGATEWAY_API_KEY` environment variable.
+Access 181 LLM Gateway models through Mastra's model router. Authentication is handled automatically using the `LLMGATEWAY_API_KEY` environment variable.
 
 Learn more in the [LLM Gateway documentation](https://llmgateway.io/docs).
 
@@ -159,7 +159,6 @@ for await (const chunk of stream) {
 | `llmgateway/ministral-8b-2512`                     | 262K    |       |           |       |       |       | $0.15      | $0.15       |
 | `llmgateway/mistral-large-2512`                    | 262K    |       |           |       |       |       | $0.50      | $2          |
 | `llmgateway/mistral-large-latest`                  | 128K    |       |           |       |       |       | $4         | $12         |
-| `llmgateway/mistral-ocr-latest`                    | —       |       |           |       |       |       | —          | —           |
 | `llmgateway/mistral-small-2506`                    | 128K    |       |           |       |       |       | $0.10      | $0.30       |
 | `llmgateway/nemotron-3-ultra-550b`                 | 262K    |       |           |       |       |       | $0.50      | $3          |
 | `llmgateway/o1`                                    | 200K    |       |           |       |       |       | $15        | $60         |

package/.docs/models/providers/nebius.md

@@ -1,6 +1,6 @@
 # ![Nebius Token Factory logo](https://models.dev/logos/nebius.svg)Nebius Token Factory
 
-Access 18 Nebius Token Factory models through Mastra's model router. Authentication is handled automatically using the `NEBIUS_API_KEY` environment variable.
+Access 19 Nebius Token Factory models through Mastra's model router. Authentication is handled automatically using the `NEBIUS_API_KEY` environment variable.
 
 Learn more in the [Nebius Token Factory documentation](https://docs.tokenfactory.nebius.com/).
 
@@ -52,6 +52,7 @@ for await (const chunk of stream) {
 | `nebius/Qwen/Qwen3-Embedding-8B`                 | 33K     |       |           |       |       |       | $0.01      | —           |
 | `nebius/Qwen/Qwen3-Next-80B-A3B-Thinking`        | 128K    |       |           |       |       |       | $0.15      | $1          |
 | `nebius/Qwen/Qwen3.5-397B-A17B`                  | 262K    |       |           |       |       |       | $0.60      | $4          |
+| `nebius/zai-org/GLM-5.2`                         | 432K    |       |           |       |       |       | $1         | $4          |
 
 ## Advanced configuration
 
@@ -81,7 +82,7 @@ const agent = new Agent({
   model: ({ requestContext }) => {
     const useAdvanced = requestContext.task === "complex";
     return useAdvanced
-      ? "nebius/openai/gpt-oss-120b"
+      ? "nebius/zai-org/GLM-5.2"
       : "nebius/MiniMaxAI/MiniMax-M2.5";
   }
 });

package/.docs/models/providers/opencode-go.md

@@ -43,7 +43,7 @@ for await (const chunk of stream) {
 | `opencode-go/mimo-v2.5`         | 1.0M    |       |           |       |       |       | $0.14      | $0.28       |
 | `opencode-go/mimo-v2.5-pro`     | 1.0M    |       |           |       |       |       | $2         | $3          |
 | `opencode-go/minimax-m2.7`      | 205K    |       |           |       |       |       | $0.30      | $1          |
-| `opencode-go/minimax-m3`        | 512K    |       |           |       |       |       | $0.10      | $0.40       |
+| `opencode-go/minimax-m3`        | 1.0M    |       |           |       |       |       | $0.10      | $0.40       |
 | `opencode-go/qwen3.6-plus`      | 1.0M    |       |           |       |       |       | $0.50      | $3          |
 | `opencode-go/qwen3.7-max`       | 1.0M    |       |           |       |       |       | $3         | $8          |
 | `opencode-go/qwen3.7-plus`      | 1.0M    |       |           |       |       |       | $0.40      | $2          |

package/.docs/models/providers/ovhcloud.md

@@ -1,6 +1,6 @@
 # ![OVHcloud AI Endpoints logo](https://models.dev/logos/ovhcloud.svg)OVHcloud AI Endpoints
 
-Access 15 OVHcloud AI Endpoints models through Mastra's model router. Authentication is handled automatically using the `OVHCLOUD_API_KEY` environment variable.
+Access 14 OVHcloud AI Endpoints models through Mastra's model router. Authentication is handled automatically using the `OVHCLOUD_API_KEY` environment variable.
 
 Learn more in the [OVHcloud AI Endpoints documentation](https://www.ovhcloud.com/en/public-cloud/ai-endpoints/catalog//).
 
@@ -36,7 +36,6 @@ for await (const chunk of stream) {
 | ---------------------------------------------- | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
 | `ovhcloud/gpt-oss-120b`                        | 131K    |       |           |       |       |       | $0.09      | $0.47       |
 | `ovhcloud/gpt-oss-20b`                         | 131K    |       |           |       |       |       | $0.05      | $0.18       |
-| `ovhcloud/llama-3.1-8b-instruct`               | 131K    |       |           |       |       |       | $0.11      | $0.11       |
 | `ovhcloud/meta-llama-3_3-70b-instruct`         | 131K    |       |           |       |       |       | $0.74      | $0.74       |
 | `ovhcloud/mistral-7b-instruct-v0.3`            | 66K     |       |           |       |       |       | $0.11      | $0.11       |
 | `ovhcloud/mistral-nemo-instruct-2407`          | 66K     |       |           |       |       |       | $0.14      | $0.14       |

package/.docs/models/providers/scaleway.md

@@ -1,6 +1,6 @@
 # ![Scaleway logo](https://models.dev/logos/scaleway.svg)Scaleway
 
-Access 15 Scaleway models through Mastra's model router. Authentication is handled automatically using the `SCALEWAY_API_KEY` environment variable.
+Access 16 Scaleway models through Mastra's model router. Authentication is handled automatically using the `SCALEWAY_API_KEY` environment variable.
 
 Learn more in the [Scaleway documentation](https://www.scaleway.com/en/docs/generative-apis/).
 
@@ -37,6 +37,7 @@ for await (const chunk of stream) {
 | `scaleway/bge-multilingual-gemma2`             | 8K      |       |           |       |       |       | $0.10      | —           |
 | `scaleway/gemma-3-27b-it`                      | 40K     |       |           |       |       |       | $0.25      | $0.50       |
 | `scaleway/gemma-4-26b-a4b-it`                  | 256K    |       |           |       |       |       | $0.25      | $0.50       |
+| `scaleway/glm-5.2`                             | 256K    |       |           |       |       |       | $2         | $6          |
 | `scaleway/gpt-oss-120b`                        | 128K    |       |           |       |       |       | $0.15      | $0.60       |
 | `scaleway/llama-3.3-70b-instruct`              | 100K    |       |           |       |       |       | $0.90      | $0.90       |
 | `scaleway/mistral-medium-3.5-128b`             | 256K    |       |           |       |       |       | $2         | $8          |

package/.docs/models/providers/togetherai.md

@@ -1,6 +1,6 @@
 # ![Together AI logo](https://models.dev/logos/togetherai.svg)Together AI
 
-Access 24 Together AI models through Mastra's model router. Authentication is handled automatically using the `TOGETHER_API_KEY` environment variable.
+Access 25 Together AI models through Mastra's model router. Authentication is handled automatically using the `TOGETHER_API_KEY` environment variable.
 
 Learn more in the [Together AI documentation](https://docs.together.ai/docs/serverless-models).
 
@@ -56,6 +56,7 @@ for await (const chunk of stream) {
 | `togetherai/Qwen/Qwen3.7-Max`                         | 1.0M    |       |           |       |       |       | $1         | $4          |
 | `togetherai/zai-org/GLM-5`                            | 203K    |       |           |       |       |       | $1         | $3          |
 | `togetherai/zai-org/GLM-5.1`                          | 203K    |       |           |       |       |       | $1         | $4          |
+| `togetherai/zai-org/GLM-5.2`                          | 262K    |       |           |       |       |       | $1         | $4          |
 
 ## Advanced configuration
 
@@ -84,7 +85,7 @@ const agent = new Agent({
   model: ({ requestContext }) => {
     const useAdvanced = requestContext.task === "complex";
     return useAdvanced
-      ? "togetherai/zai-org/GLM-5.1"
+      ? "togetherai/zai-org/GLM-5.2"
       : "togetherai/LiquidAI/LFM2-24B-A2B";
   }
 });

package/.docs/models/providers/xiaomi-token-plan-ams.md

@@ -1,6 +1,6 @@
 # ![Xiaomi Token Plan (Europe) logo](https://models.dev/logos/xiaomi-token-plan-ams.svg)Xiaomi Token Plan (Europe)
 
-Access 8 Xiaomi Token Plan (Europe) models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
+Access 6 Xiaomi Token Plan (Europe) models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
 
 Learn more in the [Xiaomi Token Plan (Europe) documentation](https://platform.xiaomimimo.com/#/docs).
 
@@ -15,7 +15,7 @@ const agent = new Agent({
   id: "my-agent",
   name: "My Agent",
   instructions: "You are a helpful assistant",
-  model: "xiaomi-token-plan-ams/mimo-v2-omni"
+  model: "xiaomi-token-plan-ams/mimo-v2-tts"
 });
 
 // Generate a response
@@ -34,8 +34,6 @@ for await (const chunk of stream) {
 
 | Model                                             | Context | Tools | Reasoning | Image | Audio | Video | Input $/1M | Output $/1M |
 | ------------------------------------------------- | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
-| `xiaomi-token-plan-ams/mimo-v2-omni`              | 262K    |       |           |       |       |       | —          | —           |
-| `xiaomi-token-plan-ams/mimo-v2-pro`               | 1.0M    |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-ams/mimo-v2-tts`               | 8K      |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-ams/mimo-v2.5`                 | 1.0M    |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-ams/mimo-v2.5-pro`             | 1.0M    |       |           |       |       |       | —          | —           |
@@ -53,7 +51,7 @@ const agent = new Agent({
   name: "custom-agent",
   model: {
     url: "https://token-plan-ams.xiaomimimo.com/v1",
-    id: "xiaomi-token-plan-ams/mimo-v2-omni",
+    id: "xiaomi-token-plan-ams/mimo-v2-tts",
     apiKey: process.env.XIAOMI_API_KEY,
     headers: {
       "X-Custom-Header": "value"
@@ -72,7 +70,7 @@ const agent = new Agent({
     const useAdvanced = requestContext.task === "complex";
     return useAdvanced
       ? "xiaomi-token-plan-ams/mimo-v2.5-tts-voicedesign"
-      : "xiaomi-token-plan-ams/mimo-v2-omni";
+      : "xiaomi-token-plan-ams/mimo-v2-tts";
   }
 });
 ```

package/.docs/models/providers/xiaomi-token-plan-cn.md

@@ -1,6 +1,6 @@
 # ![Xiaomi Token Plan (China) logo](https://models.dev/logos/xiaomi-token-plan-cn.svg)Xiaomi Token Plan (China)
 
-Access 8 Xiaomi Token Plan (China) models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
+Access 6 Xiaomi Token Plan (China) models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
 
 Learn more in the [Xiaomi Token Plan (China) documentation](https://platform.xiaomimimo.com/#/docs).
 
@@ -15,7 +15,7 @@ const agent = new Agent({
   id: "my-agent",
   name: "My Agent",
   instructions: "You are a helpful assistant",
-  model: "xiaomi-token-plan-cn/mimo-v2-omni"
+  model: "xiaomi-token-plan-cn/mimo-v2-tts"
 });
 
 // Generate a response
@@ -34,8 +34,6 @@ for await (const chunk of stream) {
 
 | Model                                            | Context | Tools | Reasoning | Image | Audio | Video | Input $/1M | Output $/1M |
 | ------------------------------------------------ | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
-| `xiaomi-token-plan-cn/mimo-v2-omni`              | 262K    |       |           |       |       |       | —          | —           |
-| `xiaomi-token-plan-cn/mimo-v2-pro`               | 1.0M    |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-cn/mimo-v2-tts`               | 8K      |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-cn/mimo-v2.5`                 | 1.0M    |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-cn/mimo-v2.5-pro`             | 1.0M    |       |           |       |       |       | —          | —           |
@@ -53,7 +51,7 @@ const agent = new Agent({
   name: "custom-agent",
   model: {
     url: "https://token-plan-cn.xiaomimimo.com/v1",
-    id: "xiaomi-token-plan-cn/mimo-v2-omni",
+    id: "xiaomi-token-plan-cn/mimo-v2-tts",
     apiKey: process.env.XIAOMI_API_KEY,
     headers: {
       "X-Custom-Header": "value"
@@ -72,7 +70,7 @@ const agent = new Agent({
     const useAdvanced = requestContext.task === "complex";
     return useAdvanced
       ? "xiaomi-token-plan-cn/mimo-v2.5-tts-voicedesign"
-      : "xiaomi-token-plan-cn/mimo-v2-omni";
+      : "xiaomi-token-plan-cn/mimo-v2-tts";
   }
 });
 ```

package/.docs/models/providers/xiaomi-token-plan-sgp.md

@@ -1,6 +1,6 @@
 # ![Xiaomi Token Plan (Singapore) logo](https://models.dev/logos/xiaomi-token-plan-sgp.svg)Xiaomi Token Plan (Singapore)
 
-Access 8 Xiaomi Token Plan (Singapore) models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
+Access 6 Xiaomi Token Plan (Singapore) models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
 
 Learn more in the [Xiaomi Token Plan (Singapore) documentation](https://platform.xiaomimimo.com/#/docs).
 
@@ -15,7 +15,7 @@ const agent = new Agent({
   id: "my-agent",
   name: "My Agent",
   instructions: "You are a helpful assistant",
-  model: "xiaomi-token-plan-sgp/mimo-v2-omni"
+  model: "xiaomi-token-plan-sgp/mimo-v2-tts"
 });
 
 // Generate a response
@@ -34,8 +34,6 @@ for await (const chunk of stream) {
 
 | Model                                             | Context | Tools | Reasoning | Image | Audio | Video | Input $/1M | Output $/1M |
 | ------------------------------------------------- | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
-| `xiaomi-token-plan-sgp/mimo-v2-omni`              | 262K    |       |           |       |       |       | —          | —           |
-| `xiaomi-token-plan-sgp/mimo-v2-pro`               | 1.0M    |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-sgp/mimo-v2-tts`               | 8K      |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-sgp/mimo-v2.5`                 | 1.0M    |       |           |       |       |       | —          | —           |
 | `xiaomi-token-plan-sgp/mimo-v2.5-pro`             | 1.0M    |       |           |       |       |       | —          | —           |
@@ -53,7 +51,7 @@ const agent = new Agent({
   name: "custom-agent",
   model: {
     url: "https://token-plan-sgp.xiaomimimo.com/v1",
-    id: "xiaomi-token-plan-sgp/mimo-v2-omni",
+    id: "xiaomi-token-plan-sgp/mimo-v2-tts",
     apiKey: process.env.XIAOMI_API_KEY,
     headers: {
       "X-Custom-Header": "value"
@@ -72,7 +70,7 @@ const agent = new Agent({
     const useAdvanced = requestContext.task === "complex";
     return useAdvanced
       ? "xiaomi-token-plan-sgp/mimo-v2.5-tts-voicedesign"
-      : "xiaomi-token-plan-sgp/mimo-v2-omni";
+      : "xiaomi-token-plan-sgp/mimo-v2-tts";
   }
 });
 ```

package/.docs/models/providers/xiaomi.md

@@ -1,6 +1,6 @@
 # ![Xiaomi logo](https://models.dev/logos/xiaomi.svg)Xiaomi
 
-Access 6 Xiaomi models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
+Access 3 Xiaomi models through Mastra's model router. Authentication is handled automatically using the `XIAOMI_API_KEY` environment variable.
 
 Learn more in the [Xiaomi documentation](https://platform.xiaomimimo.com/#/docs).
 
@@ -15,7 +15,7 @@ const agent = new Agent({
   id: "my-agent",
   name: "My Agent",
   instructions: "You are a helpful assistant",
-  model: "xiaomi/mimo-v2-flash"
+  model: "xiaomi/mimo-v2.5"
 });
 
 // Generate a response
@@ -34,9 +34,6 @@ for await (const chunk of stream) {
 
 | Model                             | Context | Tools | Reasoning | Image | Audio | Video | Input $/1M | Output $/1M |
 | --------------------------------- | ------- | ----- | --------- | ----- | ----- | ----- | ---------- | ----------- |
-| `xiaomi/mimo-v2-flash`            | 262K    |       |           |       |       |       | $0.10      | $0.30       |
-| `xiaomi/mimo-v2-omni`             | 262K    |       |           |       |       |       | $0.40      | $2          |
-| `xiaomi/mimo-v2-pro`              | 1.0M    |       |           |       |       |       | $1         | $3          |
 | `xiaomi/mimo-v2.5`                | 1.0M    |       |           |       |       |       | $0.40      | $2          |
 | `xiaomi/mimo-v2.5-pro`            | 1.0M    |       |           |       |       |       | $1         | $3          |
 | `xiaomi/mimo-v2.5-pro-ultraspeed` | 1.0M    |       |           |       |       |       | $1         | $3          |
@@ -51,7 +48,7 @@ const agent = new Agent({
   name: "custom-agent",
   model: {
     url: "https://api.xiaomimimo.com/v1",
-    id: "xiaomi/mimo-v2-flash",
+    id: "xiaomi/mimo-v2.5",
     apiKey: process.env.XIAOMI_API_KEY,
     headers: {
       "X-Custom-Header": "value"
@@ -70,7 +67,7 @@ const agent = new Agent({
     const useAdvanced = requestContext.task === "complex";
     return useAdvanced
       ? "xiaomi/mimo-v2.5-pro-ultraspeed"
-      : "xiaomi/mimo-v2-flash";
+      : "xiaomi/mimo-v2.5";
   }
 });
 ```

package/.docs/reference/agents/durable-agent.md

@@ -203,9 +203,13 @@ interface PrepareResult {
 
 **activeTools** (`string[]`): Restricts execution to the named subset of the agent's tools.
 
-**modelSettings** (`object`): Model-specific settings such as temperature.
+**modelSettings** (`object`): Model-specific settings such as temperature. Credential-bearing headers (\`Authorization\`, \`X-Api-Key\`, and similar) are stripped from the serialized snapshot before it crosses process boundaries.
 
-**requireToolApproval** (`boolean`): Require approval for all tool calls, which suspends the run until resumed.
+**stopWhen** (`AgentExecutionOptions['stopWhen']`): Predicate or composition that ends the agentic loop early. The closure rides on the in-process run registry; cross-process resumes degrade to \`maxSteps\` only.
+
+**system** (`string | string[]`): Additional system message appended after the agent instructions and before user messages.
+
+**requireToolApproval** (`boolean | ((args: { toolName: string; args: unknown; requestContext: RequestContext; workspace?: string }) => boolean | Promise<boolean>)`): Require approval for tool calls. Pass \`true\` or \`false\` to gate all or none, or a function for per-call policy. Function-form policies live on the in-process run registry; cross-process resumes fall back to a \`true\` shadow.
 
 **autoResumeSuspendedTools** (`boolean`): Automatically resume tools that suspended, instead of waiting for an external \`resume()\` call.
 
@@ -217,10 +221,26 @@ interface PrepareResult {
 
 **structuredOutput** (`object`): Structured output configuration.
 
-**untilIdle** (`boolean | { maxIdleMs?: number }`): When set, keeps the stream open across background-task continuations until the agent is idle. Pass \`true\` for the default 5-minute idle timeout, or \`{ maxIdleMs }\` to customise. Equivalent to the deprecated \`streamUntilIdle()\` method.
+**untilIdle** (`boolean | { maxIdleMs?: number }`): When set, keeps the stream open across background-task continuations until the agent is idle. Pass \`true\` for the default 5-minute idle timeout, or \`{ maxIdleMs }\` to customise. Equivalent to the deprecated \`streamUntilIdle()\` method. Also supported on \`resume()\`.
+
+**disableBackgroundTasks** (`boolean`): Disable background-task dispatch for this run. Background-eligible tools execute inline instead.
+
+**tracingOptions** (`AgentExecutionOptions['tracingOptions']`): Tracing metadata, tags, trace ID, parent span ID, and \`requestContextKeys\` forwarded to the agent and model spans. Fully JSON-serializable.
+
+**actor** (`AgentExecutionOptions['actor']`): Per-call actor signal forwarded to FGA checks and tool execution.
+
+**transform** (`AgentExecutionOptions['transform']`): Per-invocation tool payload transform policy. The \`transformToolPayload\` closure lives on the in-process run registry; only the JSON-safe \`targets\` shadow is serialized.
+
+**prepareStep** (`AgentExecutionOptions['prepareStep']`): Per-step preparation hook invoked as a \`PrepareStepProcessor\` at the start of every iteration. Closure-only — stored on the in-process run registry. Cross-process resumes lose the hook.
+
+**isTaskComplete** (`AgentExecutionOptions['isTaskComplete']`): Per-call completion policy. Scorer instances and \`onComplete\` live on the in-process run registry; the JSON-safe primitives (\`strategy\`, \`timeout\`, \`parallel\`, \`suppressFeedback\`, \`scorerNames\`) are serialized for cross-process observability.
+
+**delegation** (`AgentExecutionOptions['delegation']`): Sub-agent delegation hooks (\`onDelegationStart\`, \`onDelegationComplete\`, \`messageFilter\`). Callbacks are baked into the sub-agent tool wrappers at prepare time. Cross-process resumes lose the callbacks.
 
 **versions** (`object`): Version overrides for sub-agent delegation.
 
+**abortSignal** (`AbortSignal`): External abort signal. Forwarded to the durable run's internal \`AbortController\`, so either source can cancel the run. Cross-process resumes cannot recover the signal — pass a fresh one to \`resume()\` if you need post-resume abortability.
+
 **onChunk** (`(chunk: ChunkType) => void | Promise<void>`): Called for each streamed chunk.
 
 **onStepFinish** (`(result: AgentStepFinishEventData) => void | Promise<void>`): Called when a step in the agentic loop finishes.
@@ -231,6 +251,10 @@ interface PrepareResult {
 
 **onSuspended** (`(data: AgentSuspendedEventData) => void | Promise<void>`): Called when the run suspends, for example for tool approval.
 
+**onAbort** (`AgentExecutionOptions['onAbort']`): Called when the run is aborted via \`abortSignal\` or \`result.abort()\`.
+
+**onIterationComplete** (`AgentExecutionOptions['onIterationComplete']`): Called after every agentic-loop iteration with the latest \`messageList\`, \`finishReason\`, and \`isFinal\` flag. Observation-only on durable agents: returning \`continue: false\` or feedback does not influence the loop.
+
 `resume()` and `observe()` accept the same lifecycle callbacks (`onChunk`, `onStepFinish`, `onFinish`, `onError`, `onSuspended`). `observe()` also accepts an `offset` to control where replay starts.
 
 ## DurableAgentStreamResult
@@ -245,6 +269,7 @@ interface DurableAgentStreamResult<OUTPUT = undefined> {
   threadId?: string
   resourceId?: string
   cleanup: () => void
+  abort: () => void
 }
 ```
 
@@ -260,6 +285,8 @@ interface DurableAgentStreamResult<OUTPUT = undefined> {
 
 **cleanup** (`() => void`): Unsubscribes from PubSub and clears registry entries for the run. Call it when done with the run.
 
+**abort** (`() => void`): Aborts the run by flipping the internal \`AbortController\`. Surfaces as an \`AbortError\` inside the durable LLM-execution step and fires the \`onAbort\` callback. Safe to call after the run has finished — a no-op in that case.
+
 ## Related
 
 - [`createInngestAgent()`](https://mastra.ai/reference/agents/inngest-agent)

package/.docs/reference/auth/google.md

@@ -0,0 +1,355 @@
+# MastraAuthGoogle & MastraRBACGoogle class
+
+## MastraAuthGoogle class
+
+The `MastraAuthGoogle` class provides authentication for Mastra using Google Workspace. It implements an OAuth 2.0 / OIDC login flow with encrypted session cookies, verifies Google ID tokens, and integrates with the Mastra server using the `auth` option.
+
+### Usage example
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthGoogle({
+      clientId: process.env.GOOGLE_CLIENT_ID,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+      redirectUri: process.env.GOOGLE_REDIRECT_URI,
+      allowedDomains: ['example.com'],
+    }),
+  },
+})
+```
+
+> **Note:** You can omit the constructor parameters if you have the appropriately named environment variables set. In that case, use `new MastraAuthGoogle()` without any arguments.
+
+### Constructor parameters
+
+**clientId** (`string`): Google OAuth client ID. (Default: `process.env.GOOGLE_CLIENT_ID`)
+
+**clientSecret** (`string`): Google OAuth client secret. Required for Studio SSO. (Default: `process.env.GOOGLE_CLIENT_SECRET`)
+
+**redirectUri** (`string`): OAuth redirect URI for the SSO callback. Must match the redirect URI configured in your Google Cloud OAuth client. (Default: `process.env.GOOGLE_REDIRECT_URI`)
+
+**scopes** (`string[]`): OAuth scopes requested during the login flow. (Default: `['openid', 'profile', 'email']`)
+
+**allowedDomains** (`string | string[]`): Allowed Google Workspace hosted domains. Mastra validates these against the verified \`hd\` claim. (Default: `process.env.GOOGLE_ALLOWED_DOMAINS`)
+
+**hostedDomain** (`string`): Hosted-domain login hint passed to Google as \`hd\`. This is a hint only and is not used for authorization. (Default: `process.env.GOOGLE_HOSTED_DOMAIN or the single allowed domain`)
+
+**session** (`GoogleSessionOptions`): Session cookie configuration.
+
+**session.cookieName** (`string`): Name of the session cookie.
+
+**session.cookieMaxAge** (`number`): Cookie max age in seconds.
+
+**session.cookiePassword** (`string`): Password for encrypting session cookies. Must be at least 32 characters. If not set, an auto-generated value is used in development that does not survive restarts.
+
+**session.secureCookies** (`boolean`): Set the \`Secure\` flag on session cookies.
+
+**name** (`string`): Custom name for the auth provider instance. (Default: `'google'`)
+
+### Environment variables
+
+The following environment variables are automatically used when constructor options aren't provided:
+
+**GOOGLE\_CLIENT\_ID** (`string`): Google OAuth client ID from your Google Cloud OAuth client.
+
+**GOOGLE\_CLIENT\_SECRET** (`string`): Google OAuth client secret. Required for the SSO authorization code flow.
+
+**GOOGLE\_REDIRECT\_URI** (`string`): OAuth redirect URI for the SSO callback.
+
+**GOOGLE\_COOKIE\_PASSWORD** (`string`): Password for encrypting session cookies. Must be at least 32 characters.
+
+**GOOGLE\_ALLOWED\_DOMAINS** (`string`): Comma-separated Google Workspace hosted domains to allow.
+
+**GOOGLE\_HOSTED\_DOMAIN** (`string`): Hosted-domain login hint passed to Google during SSO login.
+
+### Authentication flow
+
+`MastraAuthGoogle` authenticates requests in the following order:
+
+1. **Session cookie**: When SSO is enabled, reads the encrypted session cookie and decrypts it. If the session is valid and not expired, the user is authenticated.
+2. **Google ID token fallback**: If no valid session cookie is present, verifies the `Authorization` header token against Google's JWKS endpoint.
+
+After authentication, `authorizeUser` checks that the user has a valid Google user ID, the token-derived expiration has not passed, and the user's verified `hd` claim matches `allowedDomains` when domains are configured.
+
+### Authentication methods
+
+#### `authenticateToken(token, request?)`
+
+Authenticates a Google ID token. When SSO is enabled, this method checks the encrypted session cookie before it verifies the Bearer token.
+
+```typescript
+const user = await auth.authenticateToken(idToken, request)
+```
+
+Returns: `Promise<GoogleUser | null>`
+
+#### `getCurrentUser(request)`
+
+Returns the authenticated user from a session cookie or Bearer Google ID token.
+
+```typescript
+const user = await auth.getCurrentUser(request)
+```
+
+Returns: `Promise<GoogleUser | null>`
+
+#### `authorizeUser(user)`
+
+Returns `true` when the user has an ID, has not expired, and matches `allowedDomains` when domains are configured.
+
+```typescript
+const allowed = auth.authorizeUser(user)
+```
+
+Returns: `boolean`
+
+#### `getUser(userId)`
+
+Returns `null`. Google ID tokens are verified directly, so this provider does not perform user lookup by ID.
+
+```typescript
+const user = await auth.getUser(userId)
+```
+
+Returns: `Promise<GoogleUser | null>`
+
+### `GoogleUser` type
+
+The `GoogleUser` type extends the base `EEUser` interface with Google-specific fields:
+
+**id** (`string`): Mastra user ID. Uses the Google \`sub\` claim.
+
+**googleId** (`string`): Google Account subject identifier.
+
+**email** (`string`): User email address.
+
+**name** (`string`): User display name from Google profile claims.
+
+**avatarUrl** (`string`): URL to the user's Google profile picture.
+
+**hostedDomain** (`string`): Google Workspace hosted domain from the verified \`hd\` claim.
+
+**expiresAt** (`Date`): Verified ID token expiration time, when available.
+
+**emailVerified** (`boolean`): Whether Google reports the email address as verified.
+
+**groups** (`string[]`): Optional pre-resolved Google Workspace group role IDs.
+
+## MastraRBACGoogle class
+
+The `MastraRBACGoogle` class maps Google Workspace groups to Mastra permissions. It fetches user groups from the Google Admin SDK Directory API and resolves them against a configurable role mapping. Use it with `MastraAuthGoogle` or any other auth provider.
+
+> **Note:** RBAC requires a valid Enterprise Edition license. It works without a license in development so you can try it locally, but you'll need a license for production. [Contact sales](https://mastra.ai/contact) for more information.
+
+### Usage example
+
+Use `MastraRBACGoogle` alongside an auth provider by passing it to the `rbac` option:
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthGoogle, MastraRBACGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthGoogle(),
+    rbac: new MastraRBACGoogle({
+      serviceAccount: {
+        clientEmail: process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL!,
+        privateKey: process.env.GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY!,
+        subject: process.env.GOOGLE_WORKSPACE_ADMIN_EMAIL!,
+      },
+      roleMapping: {
+        'admins@example.com': ['*'],
+        'engineering@example.com': ['agents:*', 'workflows:*', 'tools:*'],
+        'viewers@example.com': ['agents:read', 'workflows:read'],
+        _default: [],
+      },
+    }),
+  },
+})
+```
+
+To use Google Workspace RBAC with a different auth provider, pass a `getUserKey` function to resolve the Google Directory API user key from the other provider's user object:
+
+```typescript
+import { Mastra } from '@mastra/core'
+import { MastraAuthAuth0 } from '@mastra/auth-auth0'
+import { MastraRBACGoogle } from '@mastra/auth-google'
+
+export const mastra = new Mastra({
+  server: {
+    auth: new MastraAuthAuth0(),
+    rbac: new MastraRBACGoogle({
+      getUserKey: user => user.email,
+      serviceAccount: {
+        clientEmail: process.env.GOOGLE_SERVICE_ACCOUNT_EMAIL!,
+        privateKey: process.env.GOOGLE_SERVICE_ACCOUNT_PRIVATE_KEY!,
+        subject: process.env.GOOGLE_WORKSPACE_ADMIN_EMAIL!,
+      },
+      roleMapping: {
+        'engineering@example.com': ['agents:*', 'workflows:*'],
+        'admins@example.com': ['*'],
+        _default: [],
+      },
+    }),
+  },
+})
+```
+
+### Constructor parameters
+
+**roleMapping** (`RoleMapping`): Maps Google Workspace group role IDs to arrays of Mastra permission strings. Use \`'\_default'\` to assign permissions to users who do not match any group. Supports wildcards like \`'\*'\` (full access) and \`'agents:\*'\` (all agent actions).
+
+**accessToken** (`string`): Pre-obtained Workspace Directory API access token.
+
+**getAccessToken** (`() => Promise<string> | string`): Callback that returns a Workspace Directory API access token.
+
+**serviceAccount** (`GoogleWorkspaceServiceAccount`): Service account credentials for domain-wide delegated Directory API access.
+
+**serviceAccount.clientEmail** (`string`): Google service account email.
+
+**serviceAccount.privateKey** (`string`): PEM-encoded private key. Escaped \`\n\` values from .env files are supported.
+
+**serviceAccount.privateKeyId** (`string`): Optional private key ID.
+
+**serviceAccount.subject** (`string`): Workspace administrator user to impersonate with domain-wide delegation.
+
+**serviceAccount.scopes** (`string[]`): OAuth scopes for the service account token.
+
+**getUserKey** (`(user: unknown) => string | undefined`): Extract the Directory API \`userKey\` from an authenticated user. Defaults to \`user.email\`.
+
+**mapGroupToRoles** (`(group: GoogleWorkspaceGroup) => string[]`): Map a Google Workspace group to role IDs. Defaults to \`\[group.email]\`.
+
+**cache** (`PermissionCacheOptions`): Configure the LRU cache for group lookups.
+
+**cache.maxSize** (`number`): Maximum number of users to cache.
+
+**cache.ttlMs** (`number`): Time-to-live in milliseconds.
+
+### RBAC methods
+
+#### `getRoles(user)`
+
+Returns Google Workspace group role IDs for a user.
+
+```typescript
+const roles = await rbac.getRoles(user)
+```
+
+Returns: `Promise<string[]>`
+
+#### `getPermissions(user)`
+
+Returns Mastra permissions resolved from Google Workspace groups and `roleMapping`.
+
+```typescript
+const permissions = await rbac.getPermissions(user)
+```
+
+Returns: `Promise<string[]>`
+
+#### `hasPermission(user, permission)`
+
+Checks whether a user has a permission.
+
+```typescript
+const canReadAgents = await rbac.hasPermission(user, 'agents:read')
+```
+
+Returns: `Promise<boolean>`
+
+#### `hasRole(user, role)`
+
+Checks whether a user resolved to a specific Google Workspace group role.
+
+```typescript
+const isAdmin = await rbac.hasRole(user, 'admins@example.com')
+```
+
+Returns: `Promise<boolean>`
+
+#### `hasAllPermissions(user, permissions)`
+
+Checks whether a user has every requested permission.
+
+```typescript
+const canManageAgents = await rbac.hasAllPermissions(user, ['agents:read', 'agents:update'])
+```
+
+Returns: `Promise<boolean>`
+
+#### `hasAnyPermission(user, permissions)`
+
+Checks whether a user has at least one requested permission.
+
+```typescript
+const canReadSomething = await rbac.hasAnyPermission(user, ['agents:read', 'workflows:read'])
+```
+
+Returns: `Promise<boolean>`
+
+#### `getAvailableRoles()`
+
+Returns the role IDs configured in `roleMapping`, excluding `_default`.
+
+```typescript
+const roles = await rbac.getAvailableRoles()
+```
+
+Returns: `Promise<{ id: string; name: string }[]>`
+
+#### `getPermissionsForRole(roleId)`
+
+Returns the permissions configured for a role ID.
+
+```typescript
+const permissions = await rbac.getPermissionsForRole('engineering@example.com')
+```
+
+Returns: `Promise<string[]>`
+
+#### `clearCache()`
+
+Clears all cached Google Workspace group lookups.
+
+```typescript
+rbac.clearCache()
+```
+
+Returns: `void`
+
+#### `clearUserCache(userKey)`
+
+Clears the cached group lookup for one Directory API user key, such as an email address.
+
+```typescript
+rbac.clearUserCache('user@example.com')
+```
+
+Returns: `void`
+
+#### `getCacheStats()`
+
+Returns the current group lookup cache size and maximum size.
+
+```typescript
+const stats = rbac.getCacheStats()
+```
+
+Returns: `{ size: number; maxSize: number }`
+
+### Additional configuration
+
+`MastraRBACGoogle` uses `GET https://admin.googleapis.com/admin/directory/v1/groups?userKey=...` and handles pagination. Provide a service account with domain-wide delegation for production Google Workspace deployments, or pass `accessToken` / `getAccessToken` if your application already manages Google API tokens.
+
+If `user.groups` is already an array, `MastraRBACGoogle` uses that value and does not call the Directory API. An empty `groups` array means the user has no Google group roles and resolves to `_default` permissions when `_default` is configured.
+
+`MastraRBACGoogle` does not automatically read service-account environment variables. Pass service-account credentials through the `serviceAccount` option, or pass `accessToken` / `getAccessToken`.
+
+## Related
+
+[Google auth docs](https://mastra.ai/docs/server/auth/google)

package/.docs/reference/index.md

@@ -45,6 +45,7 @@ The Reference section provides documentation of Mastra's API, including paramete
 - [Better Auth](https://mastra.ai/reference/auth/better-auth)
 - [Clerk](https://mastra.ai/reference/auth/clerk)
 - [Firebase](https://mastra.ai/reference/auth/firebase)
+- [Google](https://mastra.ai/reference/auth/google)
 - [JSON Web Token](https://mastra.ai/reference/auth/jwt)
 - [Okta](https://mastra.ai/reference/auth/okta)
 - [Supabase](https://mastra.ai/reference/auth/supabase)

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @mastra/mcp-docs-server
 
+## 1.2.2
+
+### Patch Changes
+
+- Updated dependencies [[`86623c1`](https://github.com/mastra-ai/mastra/commit/86623c1adf7d22de32cc916dda17f4155184db36), [`023766f`](https://github.com/mastra-ai/mastra/commit/023766f44d59b30a50f3a381e33eddde8ab56c00), [`0200e75`](https://github.com/mastra-ai/mastra/commit/0200e7552d02d4221cd6040bf4eddf189a97a156), [`7c9dd77`](https://github.com/mastra-ai/mastra/commit/7c9dd77bd18cb8dc72797e25f1a0fbdc71a11347), [`7f9ae70`](https://github.com/mastra-ai/mastra/commit/7f9ae70826b047e5a66218f9e92f20e54a2d791f), [`a0509c7`](https://github.com/mastra-ai/mastra/commit/a0509c731a08aa3ed626557c5338126362856f57), [`06e0d63`](https://github.com/mastra-ai/mastra/commit/06e0d63d42bc2a202e18bc091f3781f409f5e6fb), [`bf3fe49`](https://github.com/mastra-ai/mastra/commit/bf3fe49f9467dbbdb8f9eaf74e0f7971ffb19559), [`01caf93`](https://github.com/mastra-ai/mastra/commit/01caf93d71ae2c1e65f49735cafb531975187426), [`438a971`](https://github.com/mastra-ai/mastra/commit/438a9715c8b4398e5eaf8914a1f19dc8a85dc1de), [`9990965`](https://github.com/mastra-ai/mastra/commit/999096571635a83b42ef40841fd7028cfa630779), [`77518cc`](https://github.com/mastra-ai/mastra/commit/77518ccb5bb8cc684875081e64213dc85cffdbee), [`fbeda0c`](https://github.com/mastra-ai/mastra/commit/fbeda0c0f35def07e6837936dd3a003b2b7c5172), [`8a68844`](https://github.com/mastra-ai/mastra/commit/8a688443013816105a09f89c6afa34b5ff13e26d), [`bb2a13b`](https://github.com/mastra-ai/mastra/commit/bb2a13bb4b32e6bb807200fe7b18ae8fa4322118), [`24ceaea`](https://github.com/mastra-ai/mastra/commit/24ceaea0bdd8609cabbab764380608ca6621a194), [`a73cd1a`](https://github.com/mastra-ai/mastra/commit/a73cd1a62a5e4ca023dcc39ba150029f4f1f74c1), [`c0ffa3c`](https://github.com/mastra-ai/mastra/commit/c0ffa3c897ccd326de880df734740a7f0681a18f), [`462a769`](https://github.com/mastra-ai/mastra/commit/462a769da61850862ca1be3d74134d33078ee6a7), [`0504bf5`](https://github.com/mastra-ai/mastra/commit/0504bf5e8cffc571a4b343326178de371e6f859b), [`0b5cc47`](https://github.com/mastra-ai/mastra/commit/0b5cc4726dc18d9a685a27520db39ff1b36bb89a), [`87f38a3`](https://github.com/mastra-ai/mastra/commit/87f38a3de03e24731f2dd6f8ed6a60b6722b85a1), [`d5fa3cd`](https://github.com/mastra-ai/mastra/commit/d5fa3cda1788c3cb93a361a3c6ec47de6ba21e98), [`fe98ef2`](https://github.com/mastra-ai/mastra/commit/fe98ef2e66dbfcbd7d645c88c9ee1e67b458a136), [`6ccf67b`](https://github.com/mastra-ai/mastra/commit/6ccf67bf075753754927a57bc2e1734ba2c820c5), [`793ea0f`](https://github.com/mastra-ai/mastra/commit/793ea0f52f831178837f21c83af6af93bf4ce638), [`825d8de`](https://github.com/mastra-ai/mastra/commit/825d8def9fa64c2bcc3d8dd6b49e09342c3ac5c7), [`507a5c4`](https://github.com/mastra-ai/mastra/commit/507a5c461bdc3136ad80744c0efbb55ce1f18f97), [`5afe423`](https://github.com/mastra-ai/mastra/commit/5afe423e4badf040f1b0d4525183a856fcb8146e), [`307573b`](https://github.com/mastra-ai/mastra/commit/307573b9ff3149b70c79540dbc86f1319b180f29), [`79b3626`](https://github.com/mastra-ai/mastra/commit/79b3626f8d647307eb07c8da14c9073c2699719d), [`c2c1d7b`](https://github.com/mastra-ai/mastra/commit/c2c1d7bb61d2602955f14ed3952f807c2d6eb576), [`86623c1`](https://github.com/mastra-ai/mastra/commit/86623c1adf7d22de32cc916dda17f4155184db36), [`1505c07`](https://github.com/mastra-ai/mastra/commit/1505c07603f6346bae12aa82f140e8b88ffea9ab), [`f328049`](https://github.com/mastra-ai/mastra/commit/f3280498c324afd2a8d36cd828f5b9f94a2dddc1), [`e545228`](https://github.com/mastra-ai/mastra/commit/e54522856934a5dc030b7b6385771e3548020d59), [`3eb852e`](https://github.com/mastra-ai/mastra/commit/3eb852e5435bc908b800193498103dc724f455b0), [`ffa09e7`](https://github.com/mastra-ai/mastra/commit/ffa09e772a5c92270eabe2090fc42d45bd8ec4b7), [`8c9f1c0`](https://github.com/mastra-ai/mastra/commit/8c9f1c0361d89066f9bcd14a2f69e761b01766c8), [`461a7c5`](https://github.com/mastra-ai/mastra/commit/461a7c501449295287f4f0ee4b0b42344f39fcf8), [`4211472`](https://github.com/mastra-ai/mastra/commit/4211472a5a2bd319c60cd2e42d9109c3eef7ac1c), [`9e45902`](https://github.com/mastra-ai/mastra/commit/9e4590208e745055cecca202e2db0e5c65e17d3c), [`5c0df77`](https://github.com/mastra-ai/mastra/commit/5c0df776c40efa420f8c07a2f3ee66010296618e), [`e940f09`](https://github.com/mastra-ai/mastra/commit/e940f099ef5d18b403e6f2b4937e086a4da857b1)]:
+  - @mastra/core@1.47.0
+
+## 1.2.2-alpha.12
+
+### Patch Changes
+
+- Updated dependencies [[`8a68844`](https://github.com/mastra-ai/mastra/commit/8a688443013816105a09f89c6afa34b5ff13e26d)]:
+  - @mastra/core@1.47.0-alpha.7
+
+## 1.2.2-alpha.10
+
+### Patch Changes
+
+- Updated dependencies [[`0200e75`](https://github.com/mastra-ai/mastra/commit/0200e7552d02d4221cd6040bf4eddf189a97a156), [`06e0d63`](https://github.com/mastra-ai/mastra/commit/06e0d63d42bc2a202e18bc091f3781f409f5e6fb), [`438a971`](https://github.com/mastra-ai/mastra/commit/438a9715c8b4398e5eaf8914a1f19dc8a85dc1de), [`77518cc`](https://github.com/mastra-ai/mastra/commit/77518ccb5bb8cc684875081e64213dc85cffdbee), [`bb2a13b`](https://github.com/mastra-ai/mastra/commit/bb2a13bb4b32e6bb807200fe7b18ae8fa4322118), [`a73cd1a`](https://github.com/mastra-ai/mastra/commit/a73cd1a62a5e4ca023dcc39ba150029f4f1f74c1), [`0b5cc47`](https://github.com/mastra-ai/mastra/commit/0b5cc4726dc18d9a685a27520db39ff1b36bb89a), [`87f38a3`](https://github.com/mastra-ai/mastra/commit/87f38a3de03e24731f2dd6f8ed6a60b6722b85a1), [`d5fa3cd`](https://github.com/mastra-ai/mastra/commit/d5fa3cda1788c3cb93a361a3c6ec47de6ba21e98), [`fe98ef2`](https://github.com/mastra-ai/mastra/commit/fe98ef2e66dbfcbd7d645c88c9ee1e67b458a136), [`793ea0f`](https://github.com/mastra-ai/mastra/commit/793ea0f52f831178837f21c83af6af93bf4ce638), [`507a5c4`](https://github.com/mastra-ai/mastra/commit/507a5c461bdc3136ad80744c0efbb55ce1f18f97), [`79b3626`](https://github.com/mastra-ai/mastra/commit/79b3626f8d647307eb07c8da14c9073c2699719d)]:
+  - @mastra/core@1.47.0-alpha.6
+
 ## 1.2.2-alpha.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/mcp-docs-server",
-  "version": "1.2.2-alpha.9",
+  "version": "1.2.2",
   "description": "MCP server for accessing Mastra.ai documentation, changelogs, and news.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,8 +28,8 @@
     "jsdom": "^26.1.0",
     "local-pkg": "^1.1.2",
     "zod": "^4.4.3",
-    "@mastra/core": "1.47.0-alpha.5",
-    "@mastra/mcp": "^1.12.0"
+    "@mastra/mcp": "^1.12.0",
+    "@mastra/core": "1.47.0"
   },
   "devDependencies": {
     "@hono/node-server": "^1.19.11",
@@ -45,9 +45,9 @@
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
     "vitest": "4.1.8",
-    "@internal/lint": "0.0.108",
-    "@internal/types-builder": "0.0.83",
-    "@mastra/core": "1.47.0-alpha.5"
+    "@internal/lint": "0.0.109",
+    "@internal/types-builder": "0.0.84",
+    "@mastra/core": "1.47.0"
   },
   "homepage": "https://mastra.ai",
   "repository": {