@mastra/react 1.7.3-alpha.2 → 1.8.0-alpha.4

package/dist/hooks/auth/index.js

@@ -0,0 +1,474 @@
+import { n as useMastraClient } from "../../mastra-client-context-Bx_g84YB.js";
+import { useMemo } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+//#region src/hooks/auth/types.ts
+/**
+* Type guard to check if capabilities include authenticated user
+*/
+function isAuthenticated(capabilities) {
+	return "user" in capabilities && capabilities.user !== void 0;
+}
+//#endregion
+//#region src/hooks/auth/fetch-with-refresh.ts
+/**
+* Fetch wrapper for the Mastra server API.
+*
+* ⚠️  MIRRORS: `platform/frontend/src/shared/lib/fetch-with-refresh.ts`
+*
+* Both files must stay behaviourally in lockstep — the platform dashboard and
+* the embedded playground both talk to WorkOS-backed auth and both would be
+* vulnerable to the same 429 lockout loop if either regressed. If you change
+* one, change the other in the same PR (or extract to a shared package —
+* currently blocked by the platform/mastra-ai monorepo boundary).
+*
+* ---
+*
+* The server middleware already refreshes the WorkOS session transparently
+* on every protected request. There is no scenario where the client can
+* succeed by calling /auth/refresh after a 401 — that endpoint hits the
+* same broken WorkOS with the same session and would only amplify transient
+* failures into forced logout (PLTFRM-1270).
+*
+* These are pass-throughs today. The names and signatures are preserved for
+* compatibility with existing call sites (`App.tsx`, `use-current-user.ts`).
+* Transient-failure retry belongs one level up — in React Query's `retry`
+* config on individual queries — not in a fetch wrapper that would compound
+* with the query-level retry.
+*/
+async function fetchWithRefresh(_baseUrl, input, init) {
+	return fetch(input, init);
+}
+function createFetchWithRefresh(_baseUrl, _apiPrefix) {
+	return (input, init) => fetch(input, init);
+}
+//#endregion
+//#region src/hooks/auth/get-client-query-key.ts
+const clientQueryKeys = /* @__PURE__ */ new WeakMap();
+let nextClientQueryKey = 0;
+/**
+* Returns a stable, non-sensitive query key for a Mastra client instance.
+* A new client is created whenever its connection options change.
+*/
+function getClientQueryKey(client) {
+	const existingKey = clientQueryKeys.get(client);
+	if (existingKey !== void 0) return existingKey;
+	const queryKey = nextClientQueryKey++;
+	clientQueryKeys.set(client, queryKey);
+	return queryKey;
+}
+//#endregion
+//#region src/hooks/auth/sso-login.ts
+async function makeSSOLoginRequest(client, { redirectUri }) {
+	const { baseUrl = "", apiPrefix, headers: clientHeaders = {} } = client.options;
+	const raw = (apiPrefix || "/api").trim();
+	const prefix = (raw.startsWith("/") ? raw : `/${raw}`).replace(/\/$/, "");
+	const params = new URLSearchParams();
+	if (redirectUri) params.set("redirect_uri", redirectUri);
+	const url = `${baseUrl}${prefix}/auth/sso/login${params.toString() ? `?${params}` : ""}`;
+	const response = await fetch(url, {
+		credentials: "include",
+		headers: {
+			...clientHeaders,
+			"Content-Type": "application/json"
+		}
+	});
+	if (!response.ok) throw new Error(`Failed to initiate SSO login: ${response.status}`);
+	return response.json();
+}
+//#endregion
+//#region src/hooks/auth/use-auth-capabilities.ts
+/**
+* Makes a request to the auth capabilities endpoint.
+* Exported for testing purposes.
+*
+* @internal
+*/
+async function makeAuthCapabilitiesRequest(client) {
+	const { baseUrl = "", headers: clientHeaders = {}, apiPrefix } = client.options;
+	const raw = (apiPrefix || "/api").trim();
+	const prefix = (raw.startsWith("/") ? raw : `/${raw}`).replace(/\/$/, "");
+	const response = await fetch(`${baseUrl}${prefix}/auth/capabilities`, {
+		credentials: "include",
+		headers: {
+			...clientHeaders,
+			"Content-Type": "application/json"
+		}
+	});
+	if (!response.ok) throw new Error(`Failed to fetch auth capabilities: ${response.status}`);
+	return response.json();
+}
+/**
+* Hook to fetch authentication capabilities.
+*
+* Returns server-authoritative capability detection including:
+* - Whether auth is enabled
+* - Login configuration (SSO, credentials, or both)
+* - Current user (if authenticated)
+* - Available capabilities (user awareness, session, SSO, RBAC, ACL, audit)
+* - User access (roles and permissions)
+*
+* @example
+* ```tsx
+* import { useAuthCapabilities } from '@mastra/react/hooks/auth';
+*
+* function AuthStatus() {
+*   const { data: capabilities, isLoading } = useAuthCapabilities();
+*
+*   if (isLoading) return <div>Loading...</div>;
+*   if (!capabilities?.enabled) return <div>Auth not enabled</div>;
+*
+*   if (isAuthenticated(capabilities)) {
+*     return <div>Welcome, {capabilities.user.name}</div>;
+*   }
+*
+*   return <LoginButton config={capabilities.login} />;
+* }
+* ```
+*/
+function useAuthCapabilities({ queryOptions } = {}) {
+	const client = useMastraClient();
+	return useQuery({
+		queryKey: [
+			"auth",
+			"capabilities",
+			getClientQueryKey(client)
+		],
+		queryFn: () => makeAuthCapabilitiesRequest(client),
+		staleTime: 60 * 1e3,
+		retry: false,
+		...queryOptions
+	});
+}
+//#endregion
+//#region src/hooks/auth/use-current-user.ts
+const AUTH_TRANSIENT_MAX_RETRIES = 3;
+const AUTH_TRANSIENT_MAX_BACKOFF_MS = 8e3;
+var CurrentUserError = class extends Error {
+	status;
+	constructor(status) {
+		super(`Failed to fetch current user: ${status}`);
+		this.status = status;
+		this.name = "CurrentUserError";
+	}
+};
+function isUnauthenticatedError(error) {
+	return error instanceof CurrentUserError && error.status === 401;
+}
+/**
+* Hook to fetch the current authenticated user.
+*
+* Returns the current user if authenticated, null otherwise.
+* Includes roles and permissions if RBAC is available.
+*
+* Uses fetchWithRefresh to automatically refresh the session on 401 errors,
+* preventing users from being logged out when the access token expires.
+*
+* @example
+* ```tsx
+* import { useCurrentUser } from '@mastra/react/hooks/auth';
+*
+* function UserMenu() {
+*   const { data: user, isLoading } = useCurrentUser();
+*
+*   if (isLoading) return <Skeleton />;
+*   if (!user) return <LoginButton />;
+*
+*   return (
+*     <Menu>
+*       <Avatar src={user.avatarUrl} />
+*       <span>{user.name || user.email}</span>
+*     </Menu>
+*   );
+* }
+* ```
+*/
+function useCurrentUser({ queryOptions } = {}) {
+	const baseUrl = useMastraClient().options?.baseUrl || "";
+	return useQuery({
+		queryKey: ["auth", "me"],
+		queryFn: async () => {
+			const response = await fetchWithRefresh(baseUrl, `${baseUrl}/api/auth/me`, {
+				credentials: "include",
+				headers: { "Content-Type": "application/json" }
+			});
+			if (!response.ok) throw new CurrentUserError(response.status);
+			return response.json();
+		},
+		staleTime: 60 * 1e3,
+		retry: (failureCount, error) => {
+			if (!(error instanceof CurrentUserError)) return false;
+			if (error.status !== 503) return false;
+			return failureCount < AUTH_TRANSIENT_MAX_RETRIES;
+		},
+		retryDelay: (attemptIndex) => Math.min(AUTH_TRANSIENT_MAX_BACKOFF_MS, 500 * 2 ** attemptIndex),
+		...queryOptions
+	});
+}
+//#endregion
+//#region src/hooks/auth/use-permission-patterns.ts
+const usePermissionPatterns = ({ queryOptions } = {}) => {
+	const client = useMastraClient();
+	const { data: capabilities, isLoading: capabilitiesLoading, error: capabilitiesError } = useAuthCapabilities();
+	const rbacEnabled = !!(capabilities && isAuthenticated(capabilities) && capabilities.capabilities.rbac);
+	const { data, isLoading, error } = useQuery({
+		queryKey: ["permission-patterns", getClientQueryKey(client)],
+		queryFn: () => client.getPermissionPatterns(),
+		enabled: rbacEnabled,
+		retry: false,
+		staleTime: Infinity,
+		...queryOptions
+	});
+	return {
+		patterns: useMemo(() => new Set(data?.patterns ?? []), [data]),
+		isLoading: capabilitiesLoading || rbacEnabled && isLoading,
+		error: capabilitiesError || error
+	};
+};
+//#endregion
+//#region src/hooks/auth/use-credentials-login.ts
+/**
+* Hook to login with email/password credentials.
+*
+* Uses Better Auth's email sign-in endpoint.
+*
+* @example
+* ```tsx
+* import { useCredentialsLogin } from '@mastra/react/hooks/auth';
+*
+* function LoginForm() {
+*   const { mutate: login, isPending, error } = useCredentialsLogin();
+*
+*   const handleSubmit = (e: React.FormEvent<HTMLFormElement>) => {
+*     e.preventDefault();
+*     const formData = new FormData(e.currentTarget);
+*     login({
+*       email: formData.get('email') as string,
+*       password: formData.get('password') as string,
+*     }, {
+*       onSuccess: () => {
+*         window.location.href = '/';
+*       },
+*     });
+*   };
+*
+*   return (
+*     <form onSubmit={handleSubmit}>
+*       <input name="email" type="email" required />
+*       <input name="password" type="password" required />
+*       <button type="submit" disabled={isPending}>
+*         Sign in
+*       </button>
+*       {error && <p>{error.message}</p>}
+*     </form>
+*   );
+* }
+* ```
+*/
+/**
+* Makes a credentials sign-in request.
+* Exported for testing purposes.
+*
+* @internal
+*/
+async function makeCredentialsLoginRequest(client, { email, password }) {
+	const { baseUrl = "", apiPrefix, headers: clientHeaders = {} } = client.options || {};
+	const raw = (apiPrefix ?? "/api").trim();
+	const prefix = (raw === "" ? "" : raw.startsWith("/") ? raw : `/${raw}`).replace(/\/+$/, "");
+	const response = await fetch(`${baseUrl}${prefix}/auth/credentials/sign-in`, {
+		method: "POST",
+		credentials: "include",
+		headers: {
+			...clientHeaders,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			email,
+			password
+		})
+	});
+	const data = await response.json();
+	if (!response.ok) throw new Error(data.message || data.error || "Invalid email or password");
+	return data;
+}
+function useCredentialsLogin({ queryOptions } = {}) {
+	const client = useMastraClient();
+	const queryClient = useQueryClient();
+	return useMutation({
+		mutationFn: ({ email, password }) => makeCredentialsLoginRequest(client, {
+			email,
+			password
+		}),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: ["auth"] });
+		},
+		...queryOptions
+	});
+}
+//#endregion
+//#region src/hooks/auth/use-credentials-signup.ts
+/**
+* Hook to sign up with email/password credentials.
+*
+* Uses Better Auth's email sign-up endpoint.
+*
+* @example
+* ```tsx
+* import { useCredentialsSignUp } from '@mastra/react/hooks/auth';
+*
+* function SignUpForm() {
+*   const { mutate: signUp, isPending, error } = useCredentialsSignUp();
+*
+*   const handleSubmit = (e: React.FormEvent<HTMLFormElement>) => {
+*     e.preventDefault();
+*     const formData = new FormData(e.currentTarget);
+*     signUp({
+*       email: formData.get('email') as string,
+*       password: formData.get('password') as string,
+*       name: formData.get('name') as string,
+*     }, {
+*       onSuccess: () => {
+*         window.location.href = '/';
+*       },
+*     });
+*   };
+*
+*   return (
+*     <form onSubmit={handleSubmit}>
+*       <input name="name" type="text" />
+*       <input name="email" type="email" required />
+*       <input name="password" type="password" required />
+*       <button type="submit" disabled={isPending}>
+*         Sign up
+*       </button>
+*       {error && <p>{error.message}</p>}
+*     </form>
+*   );
+* }
+* ```
+*/
+/**
+* Makes a credentials sign-up request.
+* Exported for testing purposes.
+*
+* @internal
+*/
+async function makeCredentialsSignUpRequest(client, { email, password, name }) {
+	const { baseUrl = "", apiPrefix, headers: clientHeaders = {} } = client.options || {};
+	const raw = (apiPrefix ?? "/api").trim();
+	const prefix = (raw === "" ? "" : raw.startsWith("/") ? raw : `/${raw}`).replace(/\/+$/, "");
+	const response = await fetch(`${baseUrl}${prefix}/auth/credentials/sign-up`, {
+		method: "POST",
+		credentials: "include",
+		headers: {
+			...clientHeaders,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			email,
+			password,
+			name
+		})
+	});
+	const data = await response.json();
+	if (!response.ok) throw new Error(data.message || data.error || "Failed to create account");
+	return data;
+}
+function useCredentialsSignUp({ queryOptions } = {}) {
+	const client = useMastraClient();
+	const queryClient = useQueryClient();
+	return useMutation({
+		mutationFn: ({ email, password, name }) => makeCredentialsSignUpRequest(client, {
+			email,
+			password,
+			name
+		}),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: ["auth"] });
+		},
+		...queryOptions
+	});
+}
+//#endregion
+//#region src/hooks/auth/use-auth-actions.ts
+function useSSOLogin({ queryOptions } = {}) {
+	const client = useMastraClient();
+	return useMutation({
+		mutationFn: ({ redirectUri }) => makeSSOLoginRequest(client, { redirectUri }),
+		...queryOptions
+	});
+}
+/**
+* Hook to logout the current user.
+*
+* Destroys the current session and optionally redirects to
+* the SSO logout URL if available.
+*
+* @example
+* ```tsx
+* import { useLogout } from '@mastra/react/hooks/auth';
+*
+* function LogoutButton({ userId }: { userId: string }) {
+*   const { mutate: logout, isPending } = useLogout();
+*   const queryClient = useQueryClient();
+*
+*   const handleLogout = () => {
+*     logout({ userId }, {
+*       onSuccess: (data) => {
+*         queryClient.invalidateQueries({ queryKey: ['auth'] });
+*         if (data.redirectTo) {
+*           window.location.href = data.redirectTo;
+*         } else {
+*           window.location.reload();
+*         }
+*       },
+*     });
+*   };
+*
+*   return (
+*     <button onClick={handleLogout} disabled={isPending}>
+*       Sign out
+*     </button>
+*   );
+* }
+* ```
+*/
+/**
+* Makes a logout request.
+* Exported for testing purposes.
+*
+* @internal
+*/
+async function makeLogoutRequest(client) {
+	const { baseUrl = "", apiPrefix, headers: clientHeaders = {} } = client.options;
+	const raw = (apiPrefix || "/api").trim();
+	const prefix = (raw.startsWith("/") ? raw : `/${raw}`).replace(/\/$/, "");
+	const response = await fetch(`${baseUrl}${prefix}/auth/logout`, {
+		method: "POST",
+		credentials: "include",
+		headers: {
+			...clientHeaders,
+			"Content-Type": "application/json"
+		}
+	});
+	if (!response.ok) throw new Error(`Failed to logout: ${response.status}`);
+	return response.json();
+}
+function useLogout({ onLoggedOut, queryOptions } = {}) {
+	const client = useMastraClient();
+	const queryClient = useQueryClient();
+	return useMutation({
+		mutationFn: async (variables) => {
+			const response = await makeLogoutRequest(client);
+			await onLoggedOut?.(variables).catch(() => {});
+			return response;
+		},
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: ["auth"] });
+		},
+		...queryOptions
+	});
+}
+//#endregion
+export { CurrentUserError, createFetchWithRefresh, fetchWithRefresh, getClientQueryKey, isAuthenticated, isUnauthenticatedError, makeAuthCapabilitiesRequest, makeCredentialsLoginRequest, makeCredentialsSignUpRequest, makeLogoutRequest, makeSSOLoginRequest, useAuthCapabilities, useCredentialsLogin, useCredentialsSignUp, useCurrentUser, useLogout, usePermissionPatterns, useSSOLogin };
+
+//# sourceMappingURL=index.js.map

package/dist/hooks/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/hooks/auth/types.ts","../../../src/hooks/auth/fetch-with-refresh.ts","../../../src/hooks/auth/get-client-query-key.ts","../../../src/hooks/auth/sso-login.ts","../../../src/hooks/auth/use-auth-capabilities.ts","../../../src/hooks/auth/use-current-user.ts","../../../src/hooks/auth/use-permission-patterns.ts","../../../src/hooks/auth/use-credentials-login.ts","../../../src/hooks/auth/use-credentials-signup.ts","../../../src/hooks/auth/use-auth-actions.ts"],"sourcesContent":["/**\n * Auth types for EE authentication in playground-ui.\n *\n * These types mirror the server schemas from @mastra/server.\n */\n\n/**\n * SSO configuration for login\n */\nexport type SSOConfig = {\n  provider: string;\n  text: string;\n  icon?: string;\n  description?: string;\n  url: string;\n};\n\n/**\n * Login configuration\n */\nexport type LoginConfig = {\n  type: 'sso' | 'credentials' | 'both';\n  /** Whether sign-up is enabled (defaults to true) */\n  signUpEnabled?: boolean;\n  /** Optional description explaining the auth requirement and what credentials to use */\n  description?: string;\n  sso?: SSOConfig;\n} | null;\n\n/**\n * Public capabilities (unauthenticated)\n */\nexport type PublicAuthCapabilities = {\n  enabled: boolean;\n  login: LoginConfig;\n};\n\n/**\n * Authenticated user information\n */\nexport type AuthenticatedUser = {\n  id: string;\n  email?: string;\n  name?: string;\n  avatarUrl?: string;\n};\n\n/**\n * Capability flags\n */\nexport type CapabilityFlags = {\n  user: boolean;\n  session: boolean;\n  sso: boolean;\n  rbac: boolean;\n  acl: boolean;\n};\n\n/**\n * User access information\n */\nexport type UserAccess = {\n  roles: string[];\n  permissions: string[];\n} | null;\n\n/**\n * Authenticated capabilities (extends public)\n */\nexport type AuthenticatedCapabilities = PublicAuthCapabilities & {\n  user: AuthenticatedUser;\n  capabilities: CapabilityFlags;\n  access: UserAccess;\n  /** Available roles in the system (only present for admin users) */\n  availableRoles?: { id: string; name: string }[];\n};\n\n/**\n * Auth capabilities response (union of public and authenticated)\n */\nexport type AuthCapabilities = PublicAuthCapabilities | AuthenticatedCapabilities;\n\n/**\n * Current user response (may be null if not authenticated)\n */\nexport type CurrentUser = {\n  id: string;\n  email?: string;\n  name?: string;\n  avatarUrl?: string;\n  roles?: string[];\n  permissions?: string[];\n} | null;\n\n/**\n * SSO callback response\n */\nexport type SSOCallbackResponse = {\n  success: boolean;\n  user?: AuthenticatedUser;\n  redirectTo?: string;\n};\n\n/**\n * Logout response\n */\nexport type LogoutResponse = {\n  success: boolean;\n  redirectTo?: string;\n};\n\n/**\n * Type guard to check if capabilities include authenticated user\n */\nexport function isAuthenticated(capabilities: AuthCapabilities): capabilities is AuthenticatedCapabilities {\n  return 'user' in capabilities && capabilities.user !== undefined;\n}\n","/**\n * Fetch wrapper for the Mastra server API.\n *\n * ⚠️  MIRRORS: `platform/frontend/src/shared/lib/fetch-with-refresh.ts`\n *\n * Both files must stay behaviourally in lockstep — the platform dashboard and\n * the embedded playground both talk to WorkOS-backed auth and both would be\n * vulnerable to the same 429 lockout loop if either regressed. If you change\n * one, change the other in the same PR (or extract to a shared package —\n * currently blocked by the platform/mastra-ai monorepo boundary).\n *\n * ---\n *\n * The server middleware already refreshes the WorkOS session transparently\n * on every protected request. There is no scenario where the client can\n * succeed by calling /auth/refresh after a 401 — that endpoint hits the\n * same broken WorkOS with the same session and would only amplify transient\n * failures into forced logout (PLTFRM-1270).\n *\n * These are pass-throughs today. The names and signatures are preserved for\n * compatibility with existing call sites (`App.tsx`, `use-current-user.ts`).\n * Transient-failure retry belongs one level up — in React Query's `retry`\n * config on individual queries — not in a fetch wrapper that would compound\n * with the query-level retry.\n */\n\nexport async function fetchWithRefresh(\n  _baseUrl: string,\n  input: RequestInfo | URL,\n  init?: RequestInit,\n): Promise<Response> {\n  return fetch(input, init);\n}\n\nexport function createFetchWithRefresh(_baseUrl?: string, _apiPrefix?: string): typeof fetch {\n  return (input, init) => fetch(input, init);\n}\n","import type { MastraClient } from '@mastra/client-js';\n\nconst clientQueryKeys = new WeakMap<MastraClient, number>();\nlet nextClientQueryKey = 0;\n\n/**\n * Returns a stable, non-sensitive query key for a Mastra client instance.\n * A new client is created whenever its connection options change.\n */\nexport function getClientQueryKey(client: MastraClient) {\n  const existingKey = clientQueryKeys.get(client);\n  if (existingKey !== undefined) return existingKey;\n\n  const queryKey = nextClientQueryKey++;\n  clientQueryKeys.set(client, queryKey);\n  return queryKey;\n}\n","import type { MastraClient } from '@mastra/client-js';\n\nexport type SSOLoginResponse = {\n  url: string;\n};\n\nexport async function makeSSOLoginRequest(\n  client: Pick<MastraClient, 'options'>,\n  { redirectUri }: { redirectUri?: string },\n): Promise<SSOLoginResponse> {\n  const { baseUrl = '', apiPrefix, headers: clientHeaders = {} } = client.options;\n  const raw = (apiPrefix || '/api').trim();\n  const prefix = (raw.startsWith('/') ? raw : `/${raw}`).replace(/\\/$/, '');\n\n  const params = new URLSearchParams();\n  if (redirectUri) {\n    params.set('redirect_uri', redirectUri);\n  }\n\n  const url = `${baseUrl}${prefix}/auth/sso/login${params.toString() ? `?${params}` : ''}`;\n\n  const response = await fetch(url, {\n    credentials: 'include',\n    headers: {\n      ...clientHeaders,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    throw new Error(`Failed to initiate SSO login: ${response.status}`);\n  }\n\n  return response.json();\n}\n","import type { MastraClient } from '@mastra/client-js';\nimport type { UseQueryResult } from '@tanstack/react-query';\nimport { useQuery } from '@tanstack/react-query';\nimport { useMastraClient } from '../../mastra-client-context';\nimport type { MastraQueryOptions } from '../shared/query-options';\n\nimport { getClientQueryKey } from './get-client-query-key';\nimport type { AuthCapabilities } from './types';\n\n/**\n * Makes a request to the auth capabilities endpoint.\n * Exported for testing purposes.\n *\n * @internal\n */\nexport async function makeAuthCapabilitiesRequest(client: MastraClient): Promise<AuthCapabilities> {\n  const { baseUrl = '', headers: clientHeaders = {}, apiPrefix } = client.options;\n  const raw = (apiPrefix || '/api').trim();\n  const prefix = (raw.startsWith('/') ? raw : `/${raw}`).replace(/\\/$/, '');\n\n  const response = await fetch(`${baseUrl}${prefix}/auth/capabilities`, {\n    credentials: 'include',\n    headers: {\n      ...clientHeaders,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    throw new Error(`Failed to fetch auth capabilities: ${response.status}`);\n  }\n\n  return response.json();\n}\n\n/**\n * Hook to fetch authentication capabilities.\n *\n * Returns server-authoritative capability detection including:\n * - Whether auth is enabled\n * - Login configuration (SSO, credentials, or both)\n * - Current user (if authenticated)\n * - Available capabilities (user awareness, session, SSO, RBAC, ACL, audit)\n * - User access (roles and permissions)\n *\n * @example\n * ```tsx\n * import { useAuthCapabilities } from '@mastra/react/hooks/auth';\n *\n * function AuthStatus() {\n *   const { data: capabilities, isLoading } = useAuthCapabilities();\n *\n *   if (isLoading) return <div>Loading...</div>;\n *   if (!capabilities?.enabled) return <div>Auth not enabled</div>;\n *\n *   if (isAuthenticated(capabilities)) {\n *     return <div>Welcome, {capabilities.user.name}</div>;\n *   }\n *\n *   return <LoginButton config={capabilities.login} />;\n * }\n * ```\n */\nexport function useAuthCapabilities<TData = AuthCapabilities>({\n  queryOptions,\n}: { queryOptions?: MastraQueryOptions<AuthCapabilities, TData> } = {}): UseQueryResult<TData, Error> {\n  const client = useMastraClient();\n\n  return useQuery<AuthCapabilities, Error, TData>({\n    queryKey: ['auth', 'capabilities', getClientQueryKey(client)],\n    queryFn: () => makeAuthCapabilitiesRequest(client),\n    staleTime: 60 * 1000, // Cache for 1 minute\n    retry: false, // Don't retry auth requests\n    ...queryOptions,\n  });\n}\n","import type { UseQueryResult } from '@tanstack/react-query';\nimport { useQuery } from '@tanstack/react-query';\nimport { useMastraClient } from '../../mastra-client-context';\nimport type { MastraQueryOptions } from '../shared/query-options';\n\nimport { fetchWithRefresh } from './fetch-with-refresh';\nimport type { CurrentUser } from './types';\n\nconst AUTH_TRANSIENT_MAX_RETRIES = 3;\nconst AUTH_TRANSIENT_MAX_BACKOFF_MS = 8_000;\n\nexport class CurrentUserError extends Error {\n  constructor(public readonly status: number) {\n    super(`Failed to fetch current user: ${status}`);\n    this.name = 'CurrentUserError';\n  }\n}\n\nexport function isUnauthenticatedError(error: unknown): boolean {\n  return error instanceof CurrentUserError && error.status === 401;\n}\n\n/**\n * Hook to fetch the current authenticated user.\n *\n * Returns the current user if authenticated, null otherwise.\n * Includes roles and permissions if RBAC is available.\n *\n * Uses fetchWithRefresh to automatically refresh the session on 401 errors,\n * preventing users from being logged out when the access token expires.\n *\n * @example\n * ```tsx\n * import { useCurrentUser } from '@mastra/react/hooks/auth';\n *\n * function UserMenu() {\n *   const { data: user, isLoading } = useCurrentUser();\n *\n *   if (isLoading) return <Skeleton />;\n *   if (!user) return <LoginButton />;\n *\n *   return (\n *     <Menu>\n *       <Avatar src={user.avatarUrl} />\n *       <span>{user.name || user.email}</span>\n *     </Menu>\n *   );\n * }\n * ```\n */\nexport function useCurrentUser<TData = CurrentUser>({\n  queryOptions,\n}: { queryOptions?: MastraQueryOptions<CurrentUser, TData> } = {}): UseQueryResult<TData, Error> {\n  const client = useMastraClient();\n  const baseUrl = client.options?.baseUrl || '';\n\n  return useQuery<CurrentUser, Error, TData>({\n    queryKey: ['auth', 'me'],\n    queryFn: async () => {\n      const response = await fetchWithRefresh(baseUrl, `${baseUrl}/api/auth/me`, {\n        credentials: 'include',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n      });\n\n      if (!response.ok) {\n        throw new CurrentUserError(response.status);\n      }\n\n      return response.json();\n    },\n    staleTime: 60 * 1000, // Cache for 1 minute\n    // Retry the /api/auth/me query on transient auth-provider failures (HTTP 503)\n    // so the UI stays in `isLoading` instead of flipping to `isError` and\n    // triggering login — that redirect is what fed the WorkOS 429 lockout loop\n    // (PLTFRM-1270). 401 (terminal) still fails fast.\n    retry: (failureCount, error) => {\n      if (!(error instanceof CurrentUserError)) return false;\n      if (error.status !== 503) return false;\n      return failureCount < AUTH_TRANSIENT_MAX_RETRIES;\n    },\n    retryDelay: attemptIndex => Math.min(AUTH_TRANSIENT_MAX_BACKOFF_MS, 500 * 2 ** attemptIndex),\n    ...queryOptions,\n  });\n}\n","import type { MastraClient, PermissionPattern } from '@mastra/client-js';\nimport { useQuery } from '@tanstack/react-query';\nimport { useMemo } from 'react';\nimport { useMastraClient } from '../../mastra-client-context';\nimport type { MastraQueryOptions } from '../shared/query-options';\n\nimport { getClientQueryKey } from './get-client-query-key';\nimport { isAuthenticated } from './types';\nimport { useAuthCapabilities } from './use-auth-capabilities';\n\n/**\n * Fetches the authoritative set of permission patterns from the server\n * (`GET /auth/permission-patterns`).\n *\n * The server owns the permission source of truth (generated from the route\n * registry), so the browser never imports the server-only `@mastra/core/auth/ee`\n * code just to validate hardcoded route-permission literals.\n *\n * The request only fires when RBAC is actually enabled — when auth is off or\n * RBAC isn't configured, route gating is a no-op so the pattern vocabulary is\n * not needed, and we avoid an unnecessary (and potentially 403/401) call.\n */\ntype PermissionPatternsResponse = Awaited<ReturnType<MastraClient['getPermissionPatterns']>>;\n\nexport const usePermissionPatterns = ({\n  queryOptions,\n}: { queryOptions?: MastraQueryOptions<PermissionPatternsResponse> } = {}) => {\n  const client = useMastraClient();\n  const { data: capabilities, isLoading: capabilitiesLoading, error: capabilitiesError } = useAuthCapabilities();\n\n  const rbacEnabled = !!(capabilities && isAuthenticated(capabilities) && capabilities.capabilities.rbac);\n\n  const { data, isLoading, error } = useQuery({\n    queryKey: ['permission-patterns', getClientQueryKey(client)],\n    queryFn: () => client.getPermissionPatterns(),\n    // Only fetch the pattern vocabulary when RBAC gating is in effect.\n    enabled: rbacEnabled,\n    // The endpoint requires auth; on 403/401 we don't want React Query to\n    // thrash with retries (which toggles isLoading and re-triggers redirect\n    // guards). One attempt is enough — gating falls back to the user's\n    // permissions if the pattern set is empty.\n    retry: false,\n    staleTime: Infinity,\n    ...queryOptions,\n  });\n\n  const patterns = useMemo(() => new Set<PermissionPattern>(data?.patterns ?? []), [data]);\n\n  // While capabilities are resolving we don't yet know whether RBAC applies, so\n  // report loading. Once RBAC is ruled out, this hook is never \"loading\".\n  return { patterns, isLoading: capabilitiesLoading || (rbacEnabled && isLoading), error: capabilitiesError || error };\n};\n","import type { MastraClient } from '@mastra/client-js';\nimport { useMutation, useQueryClient } from '@tanstack/react-query';\nimport { useMastraClient } from '../../mastra-client-context';\nimport type { MastraMutationOptions } from '../shared/query-options';\n\nexport type CredentialsLoginRequest = {\n  email: string;\n  password: string;\n};\n\nexport type CredentialsLoginResponse = {\n  user?: {\n    id: string;\n    email: string;\n    name?: string;\n  };\n  error?: string;\n};\n\n/**\n * Hook to login with email/password credentials.\n *\n * Uses Better Auth's email sign-in endpoint.\n *\n * @example\n * ```tsx\n * import { useCredentialsLogin } from '@mastra/react/hooks/auth';\n *\n * function LoginForm() {\n *   const { mutate: login, isPending, error } = useCredentialsLogin();\n *\n *   const handleSubmit = (e: React.FormEvent<HTMLFormElement>) => {\n *     e.preventDefault();\n *     const formData = new FormData(e.currentTarget);\n *     login({\n *       email: formData.get('email') as string,\n *       password: formData.get('password') as string,\n *     }, {\n *       onSuccess: () => {\n *         window.location.href = '/';\n *       },\n *     });\n *   };\n *\n *   return (\n *     <form onSubmit={handleSubmit}>\n *       <input name=\"email\" type=\"email\" required />\n *       <input name=\"password\" type=\"password\" required />\n *       <button type=\"submit\" disabled={isPending}>\n *         Sign in\n *       </button>\n *       {error && <p>{error.message}</p>}\n *     </form>\n *   );\n * }\n * ```\n */\n/**\n * Makes a credentials sign-in request.\n * Exported for testing purposes.\n *\n * @internal\n */\nexport async function makeCredentialsLoginRequest(\n  client: MastraClient,\n  { email, password }: CredentialsLoginRequest,\n): Promise<CredentialsLoginResponse> {\n  const { baseUrl = '', apiPrefix, headers: clientHeaders = {} } = client.options || {};\n  const raw = (apiPrefix ?? '/api').trim();\n  const normalized = raw === '' ? '' : raw.startsWith('/') ? raw : `/${raw}`;\n  const prefix = normalized.replace(/\\/+$/, '');\n\n  // Generic Mastra auth endpoint - works with any credentials provider\n  const response = await fetch(`${baseUrl}${prefix}/auth/credentials/sign-in`, {\n    method: 'POST',\n    credentials: 'include',\n    headers: {\n      ...clientHeaders,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({ email, password }),\n  });\n\n  const data = await response.json();\n\n  if (!response.ok) {\n    throw new Error(data.message || data.error || 'Invalid email or password');\n  }\n\n  return data;\n}\n\nexport function useCredentialsLogin({\n  queryOptions,\n}: { queryOptions?: MastraMutationOptions<CredentialsLoginResponse, CredentialsLoginRequest> } = {}) {\n  const client = useMastraClient();\n  const queryClient = useQueryClient();\n\n  return useMutation<CredentialsLoginResponse, Error, CredentialsLoginRequest>({\n    mutationFn: ({ email, password }) => makeCredentialsLoginRequest(client, { email, password }),\n    onSuccess: () => {\n      // Invalidate auth queries to refetch user state\n      void queryClient.invalidateQueries({ queryKey: ['auth'] });\n    },\n    ...queryOptions,\n  });\n}\n","import type { MastraClient } from '@mastra/client-js';\nimport { useMutation, useQueryClient } from '@tanstack/react-query';\nimport { useMastraClient } from '../../mastra-client-context';\nimport type { MastraMutationOptions } from '../shared/query-options';\n\nexport type CredentialsSignUpRequest = {\n  email: string;\n  password: string;\n  name?: string;\n};\n\nexport type CredentialsSignUpResponse = {\n  user?: {\n    id: string;\n    email: string;\n    name?: string;\n  };\n  error?: string;\n};\n\n/**\n * Hook to sign up with email/password credentials.\n *\n * Uses Better Auth's email sign-up endpoint.\n *\n * @example\n * ```tsx\n * import { useCredentialsSignUp } from '@mastra/react/hooks/auth';\n *\n * function SignUpForm() {\n *   const { mutate: signUp, isPending, error } = useCredentialsSignUp();\n *\n *   const handleSubmit = (e: React.FormEvent<HTMLFormElement>) => {\n *     e.preventDefault();\n *     const formData = new FormData(e.currentTarget);\n *     signUp({\n *       email: formData.get('email') as string,\n *       password: formData.get('password') as string,\n *       name: formData.get('name') as string,\n *     }, {\n *       onSuccess: () => {\n *         window.location.href = '/';\n *       },\n *     });\n *   };\n *\n *   return (\n *     <form onSubmit={handleSubmit}>\n *       <input name=\"name\" type=\"text\" />\n *       <input name=\"email\" type=\"email\" required />\n *       <input name=\"password\" type=\"password\" required />\n *       <button type=\"submit\" disabled={isPending}>\n *         Sign up\n *       </button>\n *       {error && <p>{error.message}</p>}\n *     </form>\n *   );\n * }\n * ```\n */\n/**\n * Makes a credentials sign-up request.\n * Exported for testing purposes.\n *\n * @internal\n */\nexport async function makeCredentialsSignUpRequest(\n  client: MastraClient,\n  { email, password, name }: CredentialsSignUpRequest,\n): Promise<CredentialsSignUpResponse> {\n  const { baseUrl = '', apiPrefix, headers: clientHeaders = {} } = client.options || {};\n  const raw = (apiPrefix ?? '/api').trim();\n  const normalized = raw === '' ? '' : raw.startsWith('/') ? raw : `/${raw}`;\n  const prefix = normalized.replace(/\\/+$/, '');\n\n  // Generic Mastra auth endpoint - works with any credentials provider\n  const response = await fetch(`${baseUrl}${prefix}/auth/credentials/sign-up`, {\n    method: 'POST',\n    credentials: 'include',\n    headers: {\n      ...clientHeaders,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({ email, password, name }),\n  });\n\n  const data = await response.json();\n\n  if (!response.ok) {\n    throw new Error(data.message || data.error || 'Failed to create account');\n  }\n\n  return data;\n}\n\nexport function useCredentialsSignUp({\n  queryOptions,\n}: { queryOptions?: MastraMutationOptions<CredentialsSignUpResponse, CredentialsSignUpRequest> } = {}) {\n  const client = useMastraClient();\n  const queryClient = useQueryClient();\n\n  return useMutation<CredentialsSignUpResponse, Error, CredentialsSignUpRequest>({\n    mutationFn: ({ email, password, name }) => makeCredentialsSignUpRequest(client, { email, password, name }),\n    onSuccess: () => {\n      // Invalidate auth queries to refetch user state\n      void queryClient.invalidateQueries({ queryKey: ['auth'] });\n    },\n    ...queryOptions,\n  });\n}\n","import type { MastraClient } from '@mastra/client-js';\nimport { useMutation, useQueryClient } from '@tanstack/react-query';\nimport { useMastraClient } from '../../mastra-client-context';\nimport type { MastraMutationOptions } from '../shared/query-options';\n\nimport { makeSSOLoginRequest } from './sso-login';\nimport type { LogoutResponse } from './types';\n\n/**\n * Hook to initiate SSO login.\n *\n * Returns mutation to get the SSO login URL and redirect.\n *\n * @example\n * ```tsx\n * import { useSSOLogin } from '@mastra/react/hooks/auth';\n *\n * function SSOLoginButton() {\n *   const { mutate: login, isPending } = useSSOLogin();\n *\n *   const handleClick = () => {\n *     login({ redirectUri: window.location.href }, {\n *       onSuccess: (data) => {\n *         window.location.href = data.url;\n *       },\n *     });\n *   };\n *\n *   return (\n *     <button onClick={handleClick} disabled={isPending}>\n *       Sign in with SSO\n *     </button>\n *   );\n * }\n * ```\n */\ntype SSOLoginResponse = Awaited<ReturnType<typeof makeSSOLoginRequest>>;\n\nexport function useSSOLogin({\n  queryOptions,\n}: { queryOptions?: MastraMutationOptions<SSOLoginResponse, { redirectUri?: string }> } = {}) {\n  const client = useMastraClient();\n\n  return useMutation({\n    mutationFn: ({ redirectUri }: { redirectUri?: string }) => makeSSOLoginRequest(client, { redirectUri }),\n    ...queryOptions,\n  });\n}\n\n/**\n * Hook to logout the current user.\n *\n * Destroys the current session and optionally redirects to\n * the SSO logout URL if available.\n *\n * @example\n * ```tsx\n * import { useLogout } from '@mastra/react/hooks/auth';\n *\n * function LogoutButton({ userId }: { userId: string }) {\n *   const { mutate: logout, isPending } = useLogout();\n *   const queryClient = useQueryClient();\n *\n *   const handleLogout = () => {\n *     logout({ userId }, {\n *       onSuccess: (data) => {\n *         queryClient.invalidateQueries({ queryKey: ['auth'] });\n *         if (data.redirectTo) {\n *           window.location.href = data.redirectTo;\n *         } else {\n *           window.location.reload();\n *         }\n *       },\n *     });\n *   };\n *\n *   return (\n *     <button onClick={handleLogout} disabled={isPending}>\n *       Sign out\n *     </button>\n *   );\n * }\n * ```\n */\n/**\n * Makes a logout request.\n * Exported for testing purposes.\n *\n * @internal\n */\nexport async function makeLogoutRequest(client: Pick<MastraClient, 'options'>): Promise<LogoutResponse> {\n  const { baseUrl = '', apiPrefix, headers: clientHeaders = {} } = client.options;\n  const raw = (apiPrefix || '/api').trim();\n  const prefix = (raw.startsWith('/') ? raw : `/${raw}`).replace(/\\/$/, '');\n\n  const response = await fetch(`${baseUrl}${prefix}/auth/logout`, {\n    method: 'POST',\n    credentials: 'include',\n    headers: {\n      ...clientHeaders,\n      'Content-Type': 'application/json',\n    },\n  });\n\n  if (!response.ok) {\n    throw new Error(`Failed to logout: ${response.status}`);\n  }\n\n  return response.json();\n}\n\nexport interface UseLogoutOptions {\n  /**\n   * Runs once the server has ended the session, before the mutation resolves.\n   * Failures are ignored so cleanup never turns a completed sign-out into an error.\n   */\n  onLoggedOut?: (variables: { userId: string }) => Promise<void>;\n  queryOptions?: MastraMutationOptions<LogoutResponse, { userId: string }>;\n}\n\nexport function useLogout({ onLoggedOut, queryOptions }: UseLogoutOptions = {}) {\n  const client = useMastraClient();\n  const queryClient = useQueryClient();\n\n  return useMutation<LogoutResponse, Error, { userId: string }>({\n    mutationFn: async variables => {\n      const response = await makeLogoutRequest(client);\n      await onLoggedOut?.(variables).catch(() => {});\n      return response;\n    },\n    onSuccess: () => {\n      // Invalidate all auth-related queries\n      void queryClient.invalidateQueries({ queryKey: ['auth'] });\n    },\n    ...queryOptions,\n  });\n}\n"],"mappings":";;;;;;;AAkHA,SAAgB,gBAAgB,cAA2E;CACzG,OAAO,UAAU,gBAAgB,aAAa,SAAS,KAAA;AACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC1FA,eAAsB,iBACpB,UACA,OACA,MACmB;CACnB,OAAO,MAAM,OAAO,IAAI;AAC1B;AAEA,SAAgB,uBAAuB,UAAmB,YAAmC;CAC3F,QAAQ,OAAO,SAAS,MAAM,OAAO,IAAI;AAC3C;;;AClCA,MAAM,kCAAkB,IAAI,QAA8B;AAC1D,IAAI,qBAAqB;;;;;AAMzB,SAAgB,kBAAkB,QAAsB;CACtD,MAAM,cAAc,gBAAgB,IAAI,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GAAW,OAAO;CAEtC,MAAM,WAAW;CACjB,gBAAgB,IAAI,QAAQ,QAAQ;CACpC,OAAO;AACT;;;ACVA,eAAsB,oBACpB,QACA,EAAE,eACyB;CAC3B,MAAM,EAAE,UAAU,IAAI,WAAW,SAAS,gBAAgB,CAAC,MAAM,OAAO;CACxE,MAAM,OAAO,aAAa,OAAA,CAAQ,KAAK;CACvC,MAAM,UAAU,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,MAAA,CAAO,QAAQ,OAAO,EAAE;CAExE,MAAM,SAAS,IAAI,gBAAgB;CACnC,IAAI,aACF,OAAO,IAAI,gBAAgB,WAAW;CAGxC,MAAM,MAAM,GAAG,UAAU,OAAO,iBAAiB,OAAO,SAAS,IAAI,IAAI,WAAW;CAEpF,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,aAAa;EACb,SAAS;GACP,GAAG;GACH,gBAAgB;EAClB;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,iCAAiC,SAAS,QAAQ;CAGpE,OAAO,SAAS,KAAK;AACvB;;;;;;;;;ACnBA,eAAsB,4BAA4B,QAAiD;CACjG,MAAM,EAAE,UAAU,IAAI,SAAS,gBAAgB,CAAC,GAAG,cAAc,OAAO;CACxE,MAAM,OAAO,aAAa,OAAA,CAAQ,KAAK;CACvC,MAAM,UAAU,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,MAAA,CAAO,QAAQ,OAAO,EAAE;CAExE,MAAM,WAAW,MAAM,MAAM,GAAG,UAAU,OAAO,qBAAqB;EACpE,aAAa;EACb,SAAS;GACP,GAAG;GACH,gBAAgB;EAClB;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,sCAAsC,SAAS,QAAQ;CAGzE,OAAO,SAAS,KAAK;AACvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,oBAA8C,EAC5D,iBACkE,CAAC,GAAiC;CACpG,MAAM,SAAS,gBAAgB;CAE/B,OAAO,SAAyC;EAC9C,UAAU;GAAC;GAAQ;GAAgB,kBAAkB,MAAM;EAAC;EAC5D,eAAe,4BAA4B,MAAM;EACjD,WAAW,KAAK;EAChB,OAAO;EACP,GAAG;CACL,CAAC;AACH;;;ACnEA,MAAM,6BAA6B;AACnC,MAAM,gCAAgC;AAEtC,IAAa,mBAAb,cAAsC,MAAM;CACd;CAA5B,YAAY,QAAgC;EAC1C,MAAM,iCAAiC,QAAQ;EADrB,KAAA,SAAA;EAE1B,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,uBAAuB,OAAyB;CAC9D,OAAO,iBAAiB,oBAAoB,MAAM,WAAW;AAC/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,eAAoC,EAClD,iBAC6D,CAAC,GAAiC;CAE/F,MAAM,UADS,gBACM,CAAC,CAAC,SAAS,WAAW;CAE3C,OAAO,SAAoC;EACzC,UAAU,CAAC,QAAQ,IAAI;EACvB,SAAS,YAAY;GACnB,MAAM,WAAW,MAAM,iBAAiB,SAAS,GAAG,QAAQ,eAAe;IACzE,aAAa;IACb,SAAS,EACP,gBAAgB,mBAClB;GACF,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,iBAAiB,SAAS,MAAM;GAG5C,OAAO,SAAS,KAAK;EACvB;EACA,WAAW,KAAK;EAKhB,QAAQ,cAAc,UAAU;GAC9B,IAAI,EAAE,iBAAiB,mBAAmB,OAAO;GACjD,IAAI,MAAM,WAAW,KAAK,OAAO;GACjC,OAAO,eAAe;EACxB;EACA,aAAY,iBAAgB,KAAK,IAAI,+BAA+B,MAAM,KAAK,YAAY;EAC3F,GAAG;CACL,CAAC;AACH;;;AC7DA,MAAa,yBAAyB,EACpC,iBACqE,CAAC,MAAM;CAC5E,MAAM,SAAS,gBAAgB;CAC/B,MAAM,EAAE,MAAM,cAAc,WAAW,qBAAqB,OAAO,sBAAsB,oBAAoB;CAE7G,MAAM,cAAc,CAAC,EAAE,gBAAgB,gBAAgB,YAAY,KAAK,aAAa,aAAa;CAElG,MAAM,EAAE,MAAM,WAAW,UAAU,SAAS;EAC1C,UAAU,CAAC,uBAAuB,kBAAkB,MAAM,CAAC;EAC3D,eAAe,OAAO,sBAAsB;EAE5C,SAAS;EAKT,OAAO;EACP,WAAW;EACX,GAAG;CACL,CAAC;CAMD,OAAO;EAAE,UAJQ,cAAc,IAAI,IAAuB,MAAM,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAItE;EAAG,WAAW,uBAAwB,eAAe;EAAY,OAAO,qBAAqB;CAAM;AACrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACYA,eAAsB,4BACpB,QACA,EAAE,OAAO,YAC0B;CACnC,MAAM,EAAE,UAAU,IAAI,WAAW,SAAS,gBAAgB,CAAC,MAAM,OAAO,WAAW,CAAC;CACpF,MAAM,OAAO,aAAa,OAAA,CAAQ,KAAK;CAEvC,MAAM,UADa,QAAQ,KAAK,KAAK,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,MAAA,CAC3C,QAAQ,QAAQ,EAAE;CAG5C,MAAM,WAAW,MAAM,MAAM,GAAG,UAAU,OAAO,4BAA4B;EAC3E,QAAQ;EACR,aAAa;EACb,SAAS;GACP,GAAG;GACH,gBAAgB;EAClB;EACA,MAAM,KAAK,UAAU;GAAE;GAAO;EAAS,CAAC;CAC1C,CAAC;CAED,MAAM,OAAO,MAAM,SAAS,KAAK;CAEjC,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,KAAK,WAAW,KAAK,SAAS,2BAA2B;CAG3E,OAAO;AACT;AAEA,SAAgB,oBAAoB,EAClC,iBAC+F,CAAC,GAAG;CACnG,MAAM,SAAS,gBAAgB;CAC/B,MAAM,cAAc,eAAe;CAEnC,OAAO,YAAsE;EAC3E,aAAa,EAAE,OAAO,eAAe,4BAA4B,QAAQ;GAAE;GAAO;EAAS,CAAC;EAC5F,iBAAiB;GAEf,YAAiB,kBAAkB,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;EAC3D;EACA,GAAG;CACL,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACxCA,eAAsB,6BACpB,QACA,EAAE,OAAO,UAAU,QACiB;CACpC,MAAM,EAAE,UAAU,IAAI,WAAW,SAAS,gBAAgB,CAAC,MAAM,OAAO,WAAW,CAAC;CACpF,MAAM,OAAO,aAAa,OAAA,CAAQ,KAAK;CAEvC,MAAM,UADa,QAAQ,KAAK,KAAK,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,MAAA,CAC3C,QAAQ,QAAQ,EAAE;CAG5C,MAAM,WAAW,MAAM,MAAM,GAAG,UAAU,OAAO,4BAA4B;EAC3E,QAAQ;EACR,aAAa;EACb,SAAS;GACP,GAAG;GACH,gBAAgB;EAClB;EACA,MAAM,KAAK,UAAU;GAAE;GAAO;GAAU;EAAK,CAAC;CAChD,CAAC;CAED,MAAM,OAAO,MAAM,SAAS,KAAK;CAEjC,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,KAAK,WAAW,KAAK,SAAS,0BAA0B;CAG1E,OAAO;AACT;AAEA,SAAgB,qBAAqB,EACnC,iBACiG,CAAC,GAAG;CACrG,MAAM,SAAS,gBAAgB;CAC/B,MAAM,cAAc,eAAe;CAEnC,OAAO,YAAwE;EAC7E,aAAa,EAAE,OAAO,UAAU,WAAW,6BAA6B,QAAQ;GAAE;GAAO;GAAU;EAAK,CAAC;EACzG,iBAAiB;GAEf,YAAiB,kBAAkB,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;EAC3D;EACA,GAAG;CACL,CAAC;AACH;;;ACvEA,SAAgB,YAAY,EAC1B,iBACwF,CAAC,GAAG;CAC5F,MAAM,SAAS,gBAAgB;CAE/B,OAAO,YAAY;EACjB,aAAa,EAAE,kBAA4C,oBAAoB,QAAQ,EAAE,YAAY,CAAC;EACtG,GAAG;CACL,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,eAAsB,kBAAkB,QAAgE;CACtG,MAAM,EAAE,UAAU,IAAI,WAAW,SAAS,gBAAgB,CAAC,MAAM,OAAO;CACxE,MAAM,OAAO,aAAa,OAAA,CAAQ,KAAK;CACvC,MAAM,UAAU,IAAI,WAAW,GAAG,IAAI,MAAM,IAAI,MAAA,CAAO,QAAQ,OAAO,EAAE;CAExE,MAAM,WAAW,MAAM,MAAM,GAAG,UAAU,OAAO,eAAe;EAC9D,QAAQ;EACR,aAAa;EACb,SAAS;GACP,GAAG;GACH,gBAAgB;EAClB;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,qBAAqB,SAAS,QAAQ;CAGxD,OAAO,SAAS,KAAK;AACvB;AAWA,SAAgB,UAAU,EAAE,aAAa,iBAAmC,CAAC,GAAG;CAC9E,MAAM,SAAS,gBAAgB;CAC/B,MAAM,cAAc,eAAe;CAEnC,OAAO,YAAuD;EAC5D,YAAY,OAAM,cAAa;GAC7B,MAAM,WAAW,MAAM,kBAAkB,MAAM;GAC/C,MAAM,cAAc,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;GAC7C,OAAO;EACT;EACA,iBAAiB;GAEf,YAAiB,kBAAkB,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;EAC3D;EACA,GAAG;CACL,CAAC;AACH"}

package/dist/hooks/auth/sso-login.d.ts

@@ -0,0 +1,8 @@
+import type { MastraClient } from '@mastra/client-js';
+export type SSOLoginResponse = {
+    url: string;
+};
+export declare function makeSSOLoginRequest(client: Pick<MastraClient, 'options'>, { redirectUri }: {
+    redirectUri?: string;
+}): Promise<SSOLoginResponse>;
+//# sourceMappingURL=sso-login.d.ts.map

package/dist/hooks/auth/sso-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-login.d.ts","sourceRoot":"","sources":["../../../src/hooks/auth/sso-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACrC,EAAE,WAAW,EAAE,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAyB3B"}

package/dist/hooks/auth/types.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Auth types for EE authentication in playground-ui.
+ *
+ * These types mirror the server schemas from @mastra/server.
+ */
+/**
+ * SSO configuration for login
+ */
+export type SSOConfig = {
+    provider: string;
+    text: string;
+    icon?: string;
+    description?: string;
+    url: string;
+};
+/**
+ * Login configuration
+ */
+export type LoginConfig = {
+    type: 'sso' | 'credentials' | 'both';
+    /** Whether sign-up is enabled (defaults to true) */
+    signUpEnabled?: boolean;
+    /** Optional description explaining the auth requirement and what credentials to use */
+    description?: string;
+    sso?: SSOConfig;
+} | null;
+/**
+ * Public capabilities (unauthenticated)
+ */
+export type PublicAuthCapabilities = {
+    enabled: boolean;
+    login: LoginConfig;
+};
+/**
+ * Authenticated user information
+ */
+export type AuthenticatedUser = {
+    id: string;
+    email?: string;
+    name?: string;
+    avatarUrl?: string;
+};
+/**
+ * Capability flags
+ */
+export type CapabilityFlags = {
+    user: boolean;
+    session: boolean;
+    sso: boolean;
+    rbac: boolean;
+    acl: boolean;
+};
+/**
+ * User access information
+ */
+export type UserAccess = {
+    roles: string[];
+    permissions: string[];
+} | null;
+/**
+ * Authenticated capabilities (extends public)
+ */
+export type AuthenticatedCapabilities = PublicAuthCapabilities & {
+    user: AuthenticatedUser;
+    capabilities: CapabilityFlags;
+    access: UserAccess;
+    /** Available roles in the system (only present for admin users) */
+    availableRoles?: {
+        id: string;
+        name: string;
+    }[];
+};
+/**
+ * Auth capabilities response (union of public and authenticated)
+ */
+export type AuthCapabilities = PublicAuthCapabilities | AuthenticatedCapabilities;
+/**
+ * Current user response (may be null if not authenticated)
+ */
+export type CurrentUser = {
+    id: string;
+    email?: string;
+    name?: string;
+    avatarUrl?: string;
+    roles?: string[];
+    permissions?: string[];
+} | null;
+/**
+ * SSO callback response
+ */
+export type SSOCallbackResponse = {
+    success: boolean;
+    user?: AuthenticatedUser;
+    redirectTo?: string;
+};
+/**
+ * Logout response
+ */
+export type LogoutResponse = {
+    success: boolean;
+    redirectTo?: string;
+};
+/**
+ * Type guard to check if capabilities include authenticated user
+ */
+export declare function isAuthenticated(capabilities: AuthCapabilities): capabilities is AuthenticatedCapabilities;
+//# sourceMappingURL=types.d.ts.map

package/dist/hooks/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/hooks/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,KAAK,GAAG,aAAa,GAAG,MAAM,CAAC;IACrC,oDAAoD;IACpD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB,GAAG,IAAI,CAAC;AAET;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GAAG,IAAI,CAAC;AAET;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG;IAC/D,IAAI,EAAE,iBAAiB,CAAC;IACxB,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,mEAAmE;IACnE,cAAc,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,GAAG,yBAAyB,CAAC;AAElF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,IAAI,CAAC;AAET;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,gBAAgB,GAAG,YAAY,IAAI,yBAAyB,CAEzG"}