@mastra/server 1.36.0-alpha.0 → 1.36.0-alpha.2

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-server
 description: Documentation for @mastra/server. Use when working with @mastra/server APIs, configuration, or implementation.
 metadata:
   package: "@mastra/server"
-  version: "1.36.0-alpha.0"
+  version: "1.36.0-alpha.2"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.36.0-alpha.0",
+  "version": "1.36.0-alpha.2",
   "package": "@mastra/server",
   "exports": {},
   "modules": {}

package/dist/docs/references/docs-agents-a2a.md

@@ -1,64 +1,126 @@
 # A2A (Agent-to-Agent)
 
-Mastra supports the Agent-to-Agent (A2A) protocol for exposing agents as remote agents that other agents and services can discover, call, and track over time. A2A is useful when an agent needs to cross a network boundary without exposing the remote agent's internal tools, memory, prompts, or implementation.
+Mastra supports the [Agent-to-Agent (A2A) protocol](https://a2a-protocol.org/latest/) for cross-platform multi-agent systems. Use A2A to expose Mastra agents as remote agents, consume remote A2A agents as Mastra subagents, or call A2A endpoints with the JavaScript client SDK.
+
+A2A is an open protocol for delegating work to agents across network, framework, vendor, and language boundaries. A remote agent keeps its own tools, prompts, memory, workflows, and infrastructure private while exposing a protocol endpoint that other systems can discover and call.
 
 ## When to use A2A
 
-- A parent agent should delegate work to a specialized agent owned by another service or team.
-- A remote agent should keep its tools, prompts, memory, workflows, and infrastructure private.
+- A parent agent should delegate work to a specialized remote agent.
+- A remote agent is owned by another service, team, vendor, or runtime.
 - A backend, browser app, or another A2A-compatible system needs programmatic access to a Mastra agent.
 - Long-running remote work needs task IDs, status updates, artifacts, cancellation, resubscription, or push notifications.
 
 ## How A2A works
 
-A2A maps to the roles described in the [A2A core concepts](https://a2a-protocol.org/latest/topics/key-concepts/):
+A2A uses an agent card for discovery. The card is a JSON document served from a well-known URL. It describes the remote agent and includes the execution URL that accepts A2A JSON-RPC requests.
 
-- **User**: The human, service, or process that asks for work.
-- **Client agent**: The caller that discovers a remote agent, sends messages, and listens for task updates.
-- **Remote agent**: The Mastra agent running behind an A2A endpoint.
+When using the default Mastra Server `apiPrefix` of `/api`, an agent registered as `weather-agent` exposes:
 
-Any registered Mastra agent can be called as an A2A remote agent. It keeps using its own instructions, tools, memory, workflows, and server configuration; A2A changes how the agent is reached, not how it's authored.
+- Agent card: `/api/.well-known/weather-agent/agent-card.json`
+- Execution endpoint: `/api/a2a/weather-agent`
 
-The flow is:
+An agent card includes fields like the agent name, description, endpoint URL, provider, capabilities, security metadata, and skills:
 
-1. Register a standard Mastra agent in your `Mastra` instance.
-2. Start Mastra Server or mount Mastra routes into your own server.
-3. Mastra exposes the agent through an agent card at `/.well-known/:agentId/agent-card.json` and an execution endpoint at `/a2a/:agentId`.
-4. A client reads the card, sends A2A JSON-RPC methods such as `message/send`, `message/stream`, `tasks/get`, `tasks/cancel`, or `tasks/resubscribe`, then receives task, artifact, and status events.
+```json
+{
+  "protocolVersion": "0.3.0",
+  "name": "Weather Agent",
+  "description": "Provides weather information.",
+  "url": "https://agent.example.com/api/a2a/weather-agent",
+  "version": "1.0",
+  "provider": {
+    "organization": "Acme",
+    "url": "https://acme.example.com"
+  },
+  "capabilities": {
+    "streaming": true,
+    "pushNotifications": true,
+    "stateTransitionHistory": false
+  },
+  "defaultInputModes": ["text/plain"],
+  "defaultOutputModes": ["text/plain"],
+  "skills": [
+    {
+      "id": "weather",
+      "name": "weather",
+      "description": "Gets weather conditions for a location.",
+      "tags": ["tool"]
+    }
+  ]
+}
+```
 
-Agent cards describe the remote agent's name, description, provider, endpoint URL, capabilities, security metadata, and skills. Capabilities advertise features such as streaming and push notifications. Skills describe what the remote agent can do so callers can decide whether it fits the task.
+A2A represents work as messages and tasks. Messages carry text, file, or structured data parts. Tasks are stateful units of work with IDs and lifecycle states, so clients can follow long-running work, send follow-up turns, cancel work, or resubscribe after a disconnect.
 
-A2A represents work as messages and tasks. Messages carry text, file, or structured data parts. Tasks are stateful units of work with IDs and lifecycle states, so clients can follow long-running work, send follow-up turns, cancel work, or resubscribe after a disconnect. Remote agents can also return artifacts, such as text, files, or structured data, during or after a task.
+## Get started
 
-## Quickstart
+A2A has two common paths in Mastra:
 
-Start with any agent registered in your `Mastra` instance. When Mastra Server runs, the agent is available as a remote A2A agent through its registered ID.
+- Consume a remote A2A agent as a Mastra subagent with `A2AAgent`.
+- Send requests to a Mastra A2A endpoint with `MastraClient.getA2A()`.
 
-For an agent registered as `research-agent`, Mastra exposes:
+Use `A2AAgent` when another Mastra agent should delegate work to a remote agent. Use the client SDK when application code needs to call an A2A-enabled Mastra endpoint directly.
 
-- Agent card: `/.well-known/research-agent/agent-card.json`
-- Execution endpoint: `/a2a/research-agent`
+## Consume A2A agents as subagents
 
-Use `MastraClient.getA2A()` to fetch the agent card and call the remote agent:
+Use `A2AAgent` to wrap a remote A2A agent, then add it to a parent agent with the [supervisor agents](https://mastra.ai/docs/agents/supervisor-agents) pattern. Pass an explicit agent card URL when the remote server hosts multiple agents or uses a custom well-known path.
+
+```typescript
+import { Agent } from '@mastra/core/agent'
+import { A2AAgent } from '@mastra/core/a2a'
+
+const remoteWeatherAgent = new A2AAgent({
+  url: 'https://weather.example.com/api/.well-known/weather-agent/agent-card.json',
+  headers: {
+    Authorization: `Bearer ${process.env.WEATHER_AGENT_TOKEN}`,
+  },
+})
+
+export const supportAgent = new Agent({
+  id: 'support-agent',
+  name: 'Support Agent',
+  instructions: 'Answer user questions and delegate weather questions when needed.',
+  model: 'openai/gpt-5.4',
+  agents: {
+    remoteWeatherAgent,
+  },
+})
+```
+
+If `url` points to a domain, `A2AAgent` fetches the agent card from `/.well-known/agent-card.json`. Use a domain URL for single-agent servers that follow that discovery path. For multi-agent servers, pass the full card URL, such as `https://agent.example.com/api/.well-known/weather-agent/agent-card.json`.
+
+During execution, `A2AAgent`:
+
+- Fetches and caches the remote agent card.
+- Reads the execution URL and capabilities from the card.
+- Calls `message/send` for non-streaming runs or `message/stream` when streaming is supported.
+- Converts remote messages, tasks, artifacts, and status updates into Mastra subagent results.
+- Supports `resumeGenerate()` and `resumeStream()` when the remote task requires follow-up input or resubscription.
+
+If the remote card doesn't advertise streaming support, `A2AAgent.stream()` falls back to the non-streaming generate path and returns a buffered stream result.
+
+## Send requests with the client SDK
+
+Use `MastraClient.getA2A()` when you want application code to call an A2A-enabled Mastra agent. Configure `baseUrl` for the server origin and `apiPrefix` when the server doesn't use the default `/api` prefix.
 
 ```typescript
 import { MastraClient } from '@mastra/client-js'
 
 const client = new MastraClient({
   baseUrl: 'https://agent.example.com',
+  headers: {
+    Authorization: `Bearer ${process.env.AGENT_API_TOKEN}`,
+  },
 })
 
-const a2a = client.getA2A('research-agent')
+const a2a = client.getA2A('weather-agent')
 const card = await a2a.getAgentCard()
 
 console.log(card.name, card.capabilities)
 ```
 
-## Discover and call remote agents
-
-A2A discovery starts with the agent card. The [A2A discovery guide](https://a2a-protocol.org/latest/topics/agent-discovery/) describes well-known URI discovery, registries, and direct configuration. Mastra supports the well-known route for registered agents at `/.well-known/:agentId/agent-card.json`.
-
-Use `sendMessageStream()` to receive task status and artifact updates over Server-Sent Events (SSE):
+Use `sendMessageStream()` to send a message and receive task status and artifact updates over Server-Sent Events (SSE):
 
 ```typescript
 const stream = a2a.sendMessageStream({
@@ -66,7 +128,7 @@ const stream = a2a.sendMessageStream({
     kind: 'message',
     role: 'user',
     messageId: crypto.randomUUID(),
-    parts: [{ kind: 'text', text: 'Summarize this incident report.' }],
+    parts: [{ kind: 'text', text: "What's the weather in Prague?" }],
   },
 })
 
@@ -89,7 +151,26 @@ for await (const event of updates) {
 }
 ```
 
-Agent cards can contain sensitive information, such as internal URLs or private skill descriptions. Protect restricted cards with access controls, and use agent card verification when a client needs to validate that a card came from a trusted source.
+## Configure subagent calls
+
+`A2AAgent` accepts request options for authenticated or constrained environments:
+
+```typescript
+import { A2AAgent } from '@mastra/core/a2a'
+
+const remoteWeatherAgent = new A2AAgent({
+  url: 'https://weather.example.com/api/.well-known/weather-agent/agent-card.json',
+  headers: {
+    Authorization: `Bearer ${process.env.WEATHER_AGENT_TOKEN}`,
+  },
+  retries: 2,
+  backoffMs: 250,
+  maxBackoffMs: 1000,
+  timeoutMs: 30_000,
+})
+```
+
+You can also pass `credentials`, `fetch`, and `abortSignal` when the runtime needs custom fetch behavior or request cancellation.
 
 ## Push notifications
 
@@ -144,67 +225,13 @@ const card = await a2a.getAgentCard({
     },
   },
 })
-```
-
-Use client-side signature verification to enforce trusted keys before calling the remote agent.
-
-## Use remote agents as subagents
-
-Use `A2AAgent` when a Mastra parent agent should call a remote A2A agent as a subagent. Create an `A2AAgent` with a remote agent card URL or single-agent domain, then register it in the parent agent's `agents` map.
-
-```typescript
-import { Agent } from '@mastra/core/agent'
-import { A2AAgent } from '@mastra/core/a2a'
-
-const remoteWeatherAgent = new A2AAgent({
-  url: 'https://weather.example.com',
-})
-
-export const supportAgent = new Agent({
-  id: 'support-agent',
-  name: 'Support Agent',
-  instructions: 'Answer user questions and delegate weather questions when needed.',
-  model: 'openai/gpt-5.4',
-  agents: {
-    remoteWeatherAgent,
-  },
-})
-```
-
-> **Tip:** If `url` points to a domain, `A2AAgent` fetches the agent card from `/.well-known/agent-card.json`. Use this for single-agent servers. For multi-agent servers, pass the explicit card URL, such as `https://agent.example.com/.well-known/:agentId/agent-card.json`. If `url` already ends with `/agent-card.json`, Mastra uses that URL directly. `A2AAgent` doesn't discover agent IDs beyond the URL you provide.
-
-`A2AAgent` implements Mastra's subagent interface. The parent agent can call it like any other subagent, while `A2AAgent` handles the protocol details.
 
-During execution, `A2AAgent`:
-
-- Fetches and caches the remote agent card.
-- Reads the execution URL and capabilities from the card.
-- Calls `message/send` for non-streaming runs or `message/stream` when streaming is supported.
-- Converts remote messages, tasks, artifacts, and status updates into Mastra subagent results.
-- Supports `resumeGenerate()` and `resumeStream()` when the remote task requires follow-up input or resubscription.
-
-If the remote card doesn't advertise streaming support, `A2AAgent.stream()` falls back to the non-streaming generate path and returns a buffered stream result.
-
-## Configure subagent calls
-
-`A2AAgent` accepts request options for authenticated or constrained environments:
-
-```typescript
-import { A2AAgent } from '@mastra/core/a2a'
-
-const remoteWeatherAgent = new A2AAgent({
-  url: 'https://weather.example.com',
-  headers: {
-    Authorization: `Bearer ${process.env.WEATHER_AGENT_TOKEN}`,
-  },
-  retries: 2,
-  backoffMs: 250,
-  maxBackoffMs: 1000,
-  timeoutMs: 30_000,
-})
+if (!card.signatures?.length) {
+  throw new Error('Expected a signed A2A agent card.')
+}
 ```
 
-You can also pass `credentials`, `fetch`, and `abortSignal` when the runtime needs custom fetch behavior or request cancellation.
+Use client-side signature verification when a client must enforce trusted keys before calling the remote agent.
 
 ## Verify subagent cards
 
@@ -214,7 +241,7 @@ Use `verifyAgentCard` when a parent agent should validate a remote agent before
 import { A2AAgent } from '@mastra/core/a2a'
 
 const remoteWeatherAgent = new A2AAgent({
-  url: 'https://weather.example.com/.well-known/agent-card.json',
+  url: 'https://weather.example.com/api/.well-known/weather-agent/agent-card.json',
   verifyAgentCard: {
     verify: async (card, context) => {
       if (card.provider?.organization !== 'Weather Inc') {

package/dist/{observational-memory-SYNXJVL4-CJCHK6QY.cjs → observational-memory-J73GEMRQ-FRFHLHXN.cjs}

@@ -1,101 +1,101 @@
 'use strict';
 
-var chunkZ35VW4BM_cjs = require('./chunk-Z35VW4BM.cjs');
+var chunkIXRARW5C_cjs = require('./chunk-IXRARW5C.cjs');
 var chunk3D55EABW_cjs = require('./chunk-3D55EABW.cjs');
 
 
 
 Object.defineProperty(exports, "ModelByInputTokens", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.ModelByInputTokens; }
+  get: function () { return chunkIXRARW5C_cjs.ModelByInputTokens; }
 });
 Object.defineProperty(exports, "OBSERVER_SYSTEM_PROMPT", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.OBSERVER_SYSTEM_PROMPT; }
+  get: function () { return chunkIXRARW5C_cjs.OBSERVER_SYSTEM_PROMPT; }
 });
 Object.defineProperty(exports, "ObservationalMemory", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.ObservationalMemory; }
+  get: function () { return chunkIXRARW5C_cjs.ObservationalMemory; }
 });
 Object.defineProperty(exports, "ObservationalMemoryProcessor", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.ObservationalMemoryProcessor; }
+  get: function () { return chunkIXRARW5C_cjs.ObservationalMemoryProcessor; }
 });
 Object.defineProperty(exports, "TokenCounter", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.TokenCounter; }
+  get: function () { return chunkIXRARW5C_cjs.TokenCounter; }
 });
 Object.defineProperty(exports, "buildObserverPrompt", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.buildObserverPrompt; }
+  get: function () { return chunkIXRARW5C_cjs.buildObserverPrompt; }
 });
 Object.defineProperty(exports, "buildObserverSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.buildObserverSystemPrompt; }
+  get: function () { return chunkIXRARW5C_cjs.buildObserverSystemPrompt; }
 });
 Object.defineProperty(exports, "combineObservationGroupRanges", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.combineObservationGroupRanges; }
+  get: function () { return chunkIXRARW5C_cjs.combineObservationGroupRanges; }
 });
 Object.defineProperty(exports, "deriveObservationGroupProvenance", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.deriveObservationGroupProvenance; }
+  get: function () { return chunkIXRARW5C_cjs.deriveObservationGroupProvenance; }
 });
 Object.defineProperty(exports, "extractCurrentTask", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.extractCurrentTask; }
+  get: function () { return chunkIXRARW5C_cjs.extractCurrentTask; }
 });
 Object.defineProperty(exports, "formatMessagesForObserver", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.formatMessagesForObserver; }
+  get: function () { return chunkIXRARW5C_cjs.formatMessagesForObserver; }
 });
 Object.defineProperty(exports, "getObservationsAsOf", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.getObservationsAsOf; }
+  get: function () { return chunkIXRARW5C_cjs.getObservationsAsOf; }
 });
 Object.defineProperty(exports, "hasCurrentTaskSection", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.hasCurrentTaskSection; }
+  get: function () { return chunkIXRARW5C_cjs.hasCurrentTaskSection; }
 });
 Object.defineProperty(exports, "injectAnchorIds", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.injectAnchorIds; }
+  get: function () { return chunkIXRARW5C_cjs.injectAnchorIds; }
 });
 Object.defineProperty(exports, "optimizeObservationsForContext", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.optimizeObservationsForContext; }
+  get: function () { return chunkIXRARW5C_cjs.optimizeObservationsForContext; }
 });
 Object.defineProperty(exports, "parseAnchorId", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.parseAnchorId; }
+  get: function () { return chunkIXRARW5C_cjs.parseAnchorId; }
 });
 Object.defineProperty(exports, "parseObservationGroups", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.parseObservationGroups; }
+  get: function () { return chunkIXRARW5C_cjs.parseObservationGroups; }
 });
 Object.defineProperty(exports, "parseObserverOutput", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.parseObserverOutput; }
+  get: function () { return chunkIXRARW5C_cjs.parseObserverOutput; }
 });
 Object.defineProperty(exports, "reconcileObservationGroupsFromReflection", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.reconcileObservationGroupsFromReflection; }
+  get: function () { return chunkIXRARW5C_cjs.reconcileObservationGroupsFromReflection; }
 });
 Object.defineProperty(exports, "renderObservationGroupsForReflection", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.renderObservationGroupsForReflection; }
+  get: function () { return chunkIXRARW5C_cjs.renderObservationGroupsForReflection; }
 });
 Object.defineProperty(exports, "stripEphemeralAnchorIds", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.stripEphemeralAnchorIds; }
+  get: function () { return chunkIXRARW5C_cjs.stripEphemeralAnchorIds; }
 });
 Object.defineProperty(exports, "stripObservationGroups", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.stripObservationGroups; }
+  get: function () { return chunkIXRARW5C_cjs.stripObservationGroups; }
 });
 Object.defineProperty(exports, "wrapInObservationGroup", {
   enumerable: true,
-  get: function () { return chunkZ35VW4BM_cjs.wrapInObservationGroup; }
+  get: function () { return chunkIXRARW5C_cjs.wrapInObservationGroup; }
 });
 Object.defineProperty(exports, "OBSERVATIONAL_MEMORY_DEFAULTS", {
   enumerable: true,
@@ -113,5 +113,5 @@ Object.defineProperty(exports, "OBSERVATION_CONTINUATION_HINT", {
   enumerable: true,
   get: function () { return chunk3D55EABW_cjs.OBSERVATION_CONTINUATION_HINT; }
 });
-//# sourceMappingURL=observational-memory-SYNXJVL4-CJCHK6QY.cjs.map
-//# sourceMappingURL=observational-memory-SYNXJVL4-CJCHK6QY.cjs.map
+//# sourceMappingURL=observational-memory-J73GEMRQ-FRFHLHXN.cjs.map
+//# sourceMappingURL=observational-memory-J73GEMRQ-FRFHLHXN.cjs.map

package/dist/{observational-memory-SYNXJVL4-CJCHK6QY.cjs.map → observational-memory-J73GEMRQ-FRFHLHXN.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"observational-memory-SYNXJVL4-CJCHK6QY.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"observational-memory-J73GEMRQ-FRFHLHXN.cjs"}

package/dist/{observational-memory-SYNXJVL4-ATVV3WOD.js → observational-memory-J73GEMRQ-KNLGLGBD.js}

@@ -1,4 +1,4 @@
-export { ModelByInputTokens, OBSERVER_SYSTEM_PROMPT, ObservationalMemory, ObservationalMemoryProcessor, TokenCounter, buildObserverPrompt, buildObserverSystemPrompt, combineObservationGroupRanges, deriveObservationGroupProvenance, extractCurrentTask, formatMessagesForObserver, getObservationsAsOf, hasCurrentTaskSection, injectAnchorIds, optimizeObservationsForContext, parseAnchorId, parseObservationGroups, parseObserverOutput, reconcileObservationGroupsFromReflection, renderObservationGroupsForReflection, stripEphemeralAnchorIds, stripObservationGroups, wrapInObservationGroup } from './chunk-U2HTITB4.js';
+export { ModelByInputTokens, OBSERVER_SYSTEM_PROMPT, ObservationalMemory, ObservationalMemoryProcessor, TokenCounter, buildObserverPrompt, buildObserverSystemPrompt, combineObservationGroupRanges, deriveObservationGroupProvenance, extractCurrentTask, formatMessagesForObserver, getObservationsAsOf, hasCurrentTaskSection, injectAnchorIds, optimizeObservationsForContext, parseAnchorId, parseObservationGroups, parseObserverOutput, reconcileObservationGroupsFromReflection, renderObservationGroupsForReflection, stripEphemeralAnchorIds, stripObservationGroups, wrapInObservationGroup } from './chunk-UOKSQHJY.js';
 export { OBSERVATIONAL_MEMORY_DEFAULTS, OBSERVATION_CONTEXT_INSTRUCTIONS, OBSERVATION_CONTEXT_PROMPT, OBSERVATION_CONTINUATION_HINT } from './chunk-JMEMSVJ5.js';
-//# sourceMappingURL=observational-memory-SYNXJVL4-ATVV3WOD.js.map
-//# sourceMappingURL=observational-memory-SYNXJVL4-ATVV3WOD.js.map
+//# sourceMappingURL=observational-memory-J73GEMRQ-KNLGLGBD.js.map
+//# sourceMappingURL=observational-memory-J73GEMRQ-KNLGLGBD.js.map

package/dist/{observational-memory-SYNXJVL4-ATVV3WOD.js.map → observational-memory-J73GEMRQ-KNLGLGBD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"observational-memory-SYNXJVL4-ATVV3WOD.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"observational-memory-J73GEMRQ-KNLGLGBD.js"}

package/dist/server/auth/helpers.d.ts

@@ -2,6 +2,7 @@ import type { ISessionProvider } from '@mastra/core/auth';
 import type { Mastra } from '@mastra/core/mastra';
 import type { ApiRoute, MastraAuthConfig, MastraAuthProvider } from '@mastra/core/server';
 import type { HonoRequest } from 'hono';
+export { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants.js';
 /**
  * Check if a route is a registered custom route that requires authentication.
  * Returns true only if the route is explicitly registered with requiresAuth: true.
@@ -42,6 +43,8 @@ export interface AuthMiddlewareContext {
     rawRequest: unknown;
     token: string | null;
     buildAuthorizeContext: () => unknown;
+    /** When true, force authentication even if the path matches a public pattern. */
+    requiresAuth?: boolean;
 }
 export type AuthResult = {
     action: 'next';

package/dist/server/auth/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/auth/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAMxC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OAuCF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,YAAY,QAAQ,EAAE,KACrB;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAuBxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,WAAW,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC/C,YAAY,gBAAgB,EAC5B,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OASF,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC9B,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OAuCF,CAAC;AAQF,eAAO,MAAM,eAAe,GAC1B,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,YAAY,gBAAgB,EAC5B,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OAGF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,EAAE,QAAQ,MAAM,EAAE,YAAY,gBAAgB,KAAG,OAK9F,CAAC;AAiCF,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,OAUlE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,EAAE,UAAU,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,KAAG,OAgBhG,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,MAAM,KAAG,OAU5E,CAAC;AAMF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,cAAc,EAAE;QAAE,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qBAAqB,EAAE,MAAM,OAAO,CAAC;CACtC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAIzG,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,GAAG,WAAW,CAAC;CAChC;AAED,eAAO,MAAM,oBAAoB,GAAU,KAAK,GAAG,OAAO,EAAE,6BAIzD,2BAA2B,KAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAYpD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,gBAAgB,GAAG,kBAAkB,GAChD,UAAU,IAAI,CAAC,gBAAgB,GAAG,kBAAkB,CAAC,GACtD,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,yBAAyB,GAAG,mBAAmB,CAAC,CAM3F;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAU,KAAK,qBAAqB,KAAG,OAAO,CAAC,UAAU,CA2MvF,CAAC;AAGF,eAAO,MAAM,UAAU,GACrB,OAAO,gBAAgB,CAAC,OAAO,CAAC,EAChC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,MAAM,OAAO,KACZ,OAAO,CAAC,OAAO,CA+BjB,CAAC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/server/auth/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAcxC,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnG;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OAuCF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,YAAY,QAAQ,EAAE,KACrB;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAuBxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,WAAW,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC/C,YAAY,gBAAgB,EAC5B,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OASF,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC9B,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OAuCF,CAAC;AAQF,eAAO,MAAM,eAAe,GAC1B,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,YAAY,gBAAgB,EAC5B,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3C,OAGF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,EAAE,QAAQ,MAAM,EAAE,YAAY,gBAAgB,KAAG,OAK9F,CAAC;AAiCF,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,OAUlE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,EAAE,UAAU,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,KAAG,OAgBhG,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,MAAM,KAAG,OAU5E,CAAC;AAMF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,cAAc,EAAE;QAAE,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qBAAqB,EAAE,MAAM,OAAO,CAAC;IACrC,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAIzG,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,GAAG,WAAW,CAAC;CAChC;AAED,eAAO,MAAM,oBAAoB,GAAU,KAAK,GAAG,OAAO,EAAE,6BAIzD,2BAA2B,KAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAYpD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,gBAAgB,GAAG,kBAAkB,GAChD,UAAU,IAAI,CAAC,gBAAgB,GAAG,kBAAkB,CAAC,GACtD,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,yBAAyB,GAAG,mBAAmB,CAAC,CAM3F;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAU,KAAK,qBAAqB,KAAG,OAAO,CAAC,UAAU,CAmOvF,CAAC;AAGF,eAAO,MAAM,UAAU,GACrB,OAAO,gBAAgB,CAAC,OAAO,CAAC,EAChC,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,MAAM,OAAO,KACZ,OAAO,CAAC,OAAO,CA+BjB,CAAC"}

package/dist/server/auth/index.cjs

@@ -1,64 +1,77 @@
 'use strict';
 
-var chunkY5LNMKEY_cjs = require('../../chunk-Y5LNMKEY.cjs');
+var chunk43KD3CRE_cjs = require('../../chunk-43KD3CRE.cjs');
+var chunk65T6KVYX_cjs = require('../../chunk-65T6KVYX.cjs');
 
 
 
 Object.defineProperty(exports, "canAccessPublicly", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.canAccessPublicly; }
+  get: function () { return chunk43KD3CRE_cjs.canAccessPublicly; }
 });
 Object.defineProperty(exports, "checkRules", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.checkRules; }
+  get: function () { return chunk43KD3CRE_cjs.checkRules; }
 });
 Object.defineProperty(exports, "coreAuthMiddleware", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.coreAuthMiddleware; }
+  get: function () { return chunk43KD3CRE_cjs.coreAuthMiddleware; }
 });
 Object.defineProperty(exports, "defaultAuthConfig", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.defaultAuthConfig; }
+  get: function () { return chunk43KD3CRE_cjs.defaultAuthConfig; }
 });
 Object.defineProperty(exports, "findMatchingCustomRoute", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.findMatchingCustomRoute; }
+  get: function () { return chunk43KD3CRE_cjs.findMatchingCustomRoute; }
 });
 Object.defineProperty(exports, "getAuthenticatedUser", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.getAuthenticatedUser; }
+  get: function () { return chunk43KD3CRE_cjs.getAuthenticatedUser; }
 });
 Object.defineProperty(exports, "isCustomRoutePublic", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.isCustomRoutePublic; }
+  get: function () { return chunk43KD3CRE_cjs.isCustomRoutePublic; }
 });
 Object.defineProperty(exports, "isDevPlaygroundRequest", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.isDevPlaygroundRequest; }
+  get: function () { return chunk43KD3CRE_cjs.isDevPlaygroundRequest; }
 });
 Object.defineProperty(exports, "isProtectedCustomRoute", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.isProtectedCustomRoute; }
+  get: function () { return chunk43KD3CRE_cjs.isProtectedCustomRoute; }
 });
 Object.defineProperty(exports, "isProtectedPath", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.isProtectedPath; }
+  get: function () { return chunk43KD3CRE_cjs.isProtectedPath; }
 });
 Object.defineProperty(exports, "matchesOrIncludes", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.matchesOrIncludes; }
+  get: function () { return chunk43KD3CRE_cjs.matchesOrIncludes; }
 });
 Object.defineProperty(exports, "pathMatchesPattern", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.pathMatchesPattern; }
+  get: function () { return chunk43KD3CRE_cjs.pathMatchesPattern; }
 });
 Object.defineProperty(exports, "pathMatchesRule", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.pathMatchesRule; }
+  get: function () { return chunk43KD3CRE_cjs.pathMatchesRule; }
 });
 Object.defineProperty(exports, "supportsSessionRefresh", {
   enumerable: true,
-  get: function () { return chunkY5LNMKEY_cjs.supportsSessionRefresh; }
+  get: function () { return chunk43KD3CRE_cjs.supportsSessionRefresh; }
+});
+Object.defineProperty(exports, "MASTRA_USER_KEY", {
+  enumerable: true,
+  get: function () { return chunk65T6KVYX_cjs.MASTRA_USER_KEY; }
+});
+Object.defineProperty(exports, "MASTRA_USER_PERMISSIONS_KEY", {
+  enumerable: true,
+  get: function () { return chunk65T6KVYX_cjs.MASTRA_USER_PERMISSIONS_KEY; }
+});
+Object.defineProperty(exports, "MASTRA_USER_ROLES_KEY", {
+  enumerable: true,
+  get: function () { return chunk65T6KVYX_cjs.MASTRA_USER_ROLES_KEY; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/server/auth/index.js

@@ -1,3 +1,4 @@
-export { canAccessPublicly, checkRules, coreAuthMiddleware, defaultAuthConfig, findMatchingCustomRoute, getAuthenticatedUser, isCustomRoutePublic, isDevPlaygroundRequest, isProtectedCustomRoute, isProtectedPath, matchesOrIncludes, pathMatchesPattern, pathMatchesRule, supportsSessionRefresh } from '../../chunk-M7DF3D2M.js';
+export { canAccessPublicly, checkRules, coreAuthMiddleware, defaultAuthConfig, findMatchingCustomRoute, getAuthenticatedUser, isCustomRoutePublic, isDevPlaygroundRequest, isProtectedCustomRoute, isProtectedPath, matchesOrIncludes, pathMatchesPattern, pathMatchesRule, supportsSessionRefresh } from '../../chunk-OJNVSXOF.js';
+export { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../../chunk-23S37FLK.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/server/browser-stream/types.d.ts

@@ -22,6 +22,15 @@ export interface BrowserStreamConfig {
      * Returns undefined if no browser is available for this agent.
      */
     getToolset: (agentId: string) => MastraBrowser | undefined;
+    /**
+     * API route prefix for HTTP endpoints (probe and close). Defaults to `/api`.
+     * Should match the prefix the rest of the server is mounted under so clients
+     * configured with a non-default `apiPrefix` can reach these routes.
+     *
+     * The WebSocket upgrade path (`/browser/:agentId/stream`) is not affected by
+     * this prefix.
+     */
+    apiPrefix?: string;
 }
 /**
  * Mouse input message from client to server.

package/dist/server/browser-stream/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/browser-stream/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,aAAa,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,2BAA2B;IAC3B,SAAS,EAAE,cAAc,GAAG,eAAe,GAAG,YAAY,GAAG,YAAY,CAAC;IAC1E,8CAA8C;IAC9C,CAAC,EAAE,MAAM,CAAC;IACV,8CAA8C;IAC9C,CAAC,EAAE,MAAM,CAAC;IACV,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,8BAA8B;IAC9B,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IACxC,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,sBAAsB,EAC1B,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,EAC7C,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/browser-stream/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,aAAa,CAAC;IAC/D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;IAC3D;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,2BAA2B;IAC3B,SAAS,EAAE,cAAc,GAAG,eAAe,GAAG,YAAY,GAAG,YAAY,CAAC;IAC1E,8CAA8C;IAC9C,CAAC,EAAE,MAAM,CAAC;IACV,8CAA8C;IAC9C,CAAC,EAAE,MAAM,CAAC;IACV,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,8BAA8B;IAC9B,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IACxC,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,sBAAsB,EAC1B,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,EAC7C,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD"}

package/dist/server/constants.d.ts

@@ -7,6 +7,9 @@
  */
 export declare const MASTRA_RESOURCE_ID_KEY = "mastra__resourceId";
 export declare const MASTRA_THREAD_ID_KEY = "mastra__threadId";
+export declare const MASTRA_USER_KEY = "mastra__user";
+export declare const MASTRA_USER_PERMISSIONS_KEY = "mastra__userPermissions";
+export declare const MASTRA_USER_ROLES_KEY = "mastra__userRoles";
 export declare const MASTRA_AUTH_TOKEN_KEY = "mastra__authToken";
 export declare const MASTRA_IS_STUDIO_KEY = "mastra__isStudio";
 export declare const MASTRA_CLIENT_TYPE_HEADER = "x-mastra-client-type";

package/dist/server/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/server/constants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AASlD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE3E;AAED,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;CAkBlB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GACzB,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,UAAU,CAAC,GAC5E,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,MAAM,CAAC,GACpE,CAAC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAE3E;;;;;;;GAOG;AAEH,KAAK,sBAAsB,GAAG,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAsB5D;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,oBAAoB,GAAG,SAAS,EAC7C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,CAAC,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACvE,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAmC3F"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/server/constants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAE9C,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAYlD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE3E;AAED,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;CAkBlB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GACzB,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,UAAU,CAAC,GAC5E,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,MAAM,CAAC,GACpE,CAAC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAE3E;;;;;;;GAOG;AAEH,KAAK,sBAAsB,GAAG,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAsB5D;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,oBAAoB,GAAG,SAAS,EAC7C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,CAAC,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACvE,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,OAAO,CAAC;IAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAmC3F"}