@mastra/server 1.36.0-alpha.1 → 1.36.0-alpha.10

package/dist/server/handlers/auth.cjs

@@ -1,48 +1,52 @@
 'use strict';
 
-var chunkL3WM4IWR_cjs = require('../../chunk-L3WM4IWR.cjs');
+var chunkDYXX34YU_cjs = require('../../chunk-DYXX34YU.cjs');
 
 
 
 Object.defineProperty(exports, "AUTH_ROUTES", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.AUTH_ROUTES; }
+  get: function () { return chunkDYXX34YU_cjs.AUTH_ROUTES; }
 });
 Object.defineProperty(exports, "GET_AUTH_CAPABILITIES_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.GET_AUTH_CAPABILITIES_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.GET_AUTH_CAPABILITIES_ROUTE; }
 });
 Object.defineProperty(exports, "GET_CURRENT_USER_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.GET_CURRENT_USER_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.GET_CURRENT_USER_ROUTE; }
+});
+Object.defineProperty(exports, "GET_ROLE_PERMISSIONS_ROUTE", {
+  enumerable: true,
+  get: function () { return chunkDYXX34YU_cjs.GET_ROLE_PERMISSIONS_ROUTE; }
 });
 Object.defineProperty(exports, "GET_SSO_CALLBACK_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.GET_SSO_CALLBACK_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.GET_SSO_CALLBACK_ROUTE; }
 });
 Object.defineProperty(exports, "GET_SSO_LOGIN_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.GET_SSO_LOGIN_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.GET_SSO_LOGIN_ROUTE; }
 });
 Object.defineProperty(exports, "POST_CREDENTIALS_SIGN_IN_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.POST_CREDENTIALS_SIGN_IN_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.POST_CREDENTIALS_SIGN_IN_ROUTE; }
 });
 Object.defineProperty(exports, "POST_CREDENTIALS_SIGN_UP_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.POST_CREDENTIALS_SIGN_UP_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.POST_CREDENTIALS_SIGN_UP_ROUTE; }
 });
 Object.defineProperty(exports, "POST_LOGOUT_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.POST_LOGOUT_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.POST_LOGOUT_ROUTE; }
 });
 Object.defineProperty(exports, "POST_REFRESH_ROUTE", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.POST_REFRESH_ROUTE; }
+  get: function () { return chunkDYXX34YU_cjs.POST_REFRESH_ROUTE; }
 });
 Object.defineProperty(exports, "getPublicOrigin", {
   enumerable: true,
-  get: function () { return chunkL3WM4IWR_cjs.getPublicOrigin; }
+  get: function () { return chunkDYXX34YU_cjs.getPublicOrigin; }
 });
 //# sourceMappingURL=auth.cjs.map
 //# sourceMappingURL=auth.cjs.map

package/dist/server/handlers/auth.d.ts

@@ -7,6 +7,7 @@
  * - Handle OAuth callbacks
  * - Logout users
  */
+import { z } from 'zod/v4';
 /**
  * Get the public-facing origin from a request, respecting reverse proxy headers.
  * Behind a proxy (e.g. edge router), request.url contains the internal hostname,
@@ -71,60 +72,60 @@ export declare const GET_AUTH_CAPABILITIES_ROUTE: import("../server-adapter").Se
         roles: string[];
         permissions: string[];
     } | null;
-}, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-    enabled: import("zod").ZodBoolean;
-    login: import("zod").ZodNullable<import("zod").ZodObject<{
-        type: import("zod").ZodEnum<{
+}, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, z.ZodUnion<readonly [z.ZodObject<{
+    enabled: z.ZodBoolean;
+    login: z.ZodNullable<z.ZodObject<{
+        type: z.ZodEnum<{
             credentials: "credentials";
             sso: "sso";
             both: "both";
         }>;
-        sso: import("zod").ZodOptional<import("zod").ZodObject<{
-            provider: import("zod").ZodString;
-            text: import("zod").ZodString;
-            icon: import("zod").ZodOptional<import("zod").ZodString>;
-            description: import("zod").ZodOptional<import("zod").ZodString>;
-            url: import("zod").ZodString;
-        }, import("zod/v4/core").$strip>>;
-        signUpEnabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
-        description: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>;
-    user: import("zod").ZodObject<{
-        id: import("zod").ZodString;
-        email: import("zod").ZodOptional<import("zod").ZodString>;
-        name: import("zod").ZodOptional<import("zod").ZodString>;
-        avatarUrl: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>;
-    capabilities: import("zod").ZodObject<{
-        user: import("zod").ZodBoolean;
-        session: import("zod").ZodBoolean;
-        sso: import("zod").ZodBoolean;
-        rbac: import("zod").ZodBoolean;
-        acl: import("zod").ZodBoolean;
-    }, import("zod/v4/core").$strip>;
-    access: import("zod").ZodNullable<import("zod").ZodObject<{
-        roles: import("zod").ZodArray<import("zod").ZodString>;
-        permissions: import("zod").ZodArray<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-    enabled: import("zod").ZodBoolean;
-    login: import("zod").ZodNullable<import("zod").ZodObject<{
-        type: import("zod").ZodEnum<{
+        sso: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            text: z.ZodString;
+            icon: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+        }, z.core.$strip>>;
+        signUpEnabled: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatarUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    capabilities: z.ZodObject<{
+        user: z.ZodBoolean;
+        session: z.ZodBoolean;
+        sso: z.ZodBoolean;
+        rbac: z.ZodBoolean;
+        acl: z.ZodBoolean;
+    }, z.core.$strip>;
+    access: z.ZodNullable<z.ZodObject<{
+        roles: z.ZodArray<z.ZodString>;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    enabled: z.ZodBoolean;
+    login: z.ZodNullable<z.ZodObject<{
+        type: z.ZodEnum<{
             credentials: "credentials";
             sso: "sso";
             both: "both";
         }>;
-        sso: import("zod").ZodOptional<import("zod").ZodObject<{
-            provider: import("zod").ZodString;
-            text: import("zod").ZodString;
-            icon: import("zod").ZodOptional<import("zod").ZodString>;
-            description: import("zod").ZodOptional<import("zod").ZodString>;
-            url: import("zod").ZodString;
-        }, import("zod/v4/core").$strip>>;
-        signUpEnabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
-        description: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>]>>, "GET", "/auth/capabilities">;
+        sso: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            text: z.ZodString;
+            icon: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+        }, z.core.$strip>>;
+        signUpEnabled: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>]>>, "GET", "/auth/capabilities">;
 export declare const GET_CURRENT_USER_ROUTE: import("../server-adapter").ServerRoute<{}, {
     id: string;
     email?: string | undefined;
@@ -132,48 +133,59 @@ export declare const GET_CURRENT_USER_ROUTE: import("../server-adapter").ServerR
     avatarUrl?: string | undefined;
     roles?: string[] | undefined;
     permissions?: string[] | undefined;
-} | null, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, import("zod").ZodNullable<import("zod").ZodObject<{
-    id: import("zod").ZodString;
-    email: import("zod").ZodOptional<import("zod").ZodString>;
-    name: import("zod").ZodOptional<import("zod").ZodString>;
-    avatarUrl: import("zod").ZodOptional<import("zod").ZodString>;
-    roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-    permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-}, import("zod/v4/core").$strip>>>, "GET", "/auth/me">;
+} | null, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, z.ZodNullable<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    avatarUrl: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>>>, "GET", "/auth/me">;
 export declare const GET_SSO_LOGIN_ROUTE: import("../server-adapter").ServerRoute<{
     redirect_uri?: string | undefined;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, import("zod").ZodObject<{
-    redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, undefined, undefined>, "GET", "/auth/sso/login">;
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, z.ZodObject<{
+    redirect_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined, undefined>, "GET", "/auth/sso/login">;
 export declare const GET_SSO_CALLBACK_ROUTE: import("../server-adapter").ServerRoute<{
     code: string;
     state?: string | undefined;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, import("zod").ZodObject<{
-    code: import("zod").ZodString;
-    state: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, undefined, undefined>, "GET", "/auth/sso/callback">;
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined, undefined>, "GET", "/auth/sso/callback">;
 export declare const POST_LOGOUT_ROUTE: import("../server-adapter").ServerRoute<{}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, undefined>, "POST", "/auth/logout">;
 export declare const POST_REFRESH_ROUTE: import("../server-adapter").ServerRoute<{}, {
     success: boolean;
-}, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, import("zod").ZodObject<{
-    success: import("zod").ZodBoolean;
-}, import("zod/v4/core").$strip>>, "POST", "/auth/refresh">;
+}, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, z.ZodObject<{
+    success: z.ZodBoolean;
+}, z.core.$strip>>, "POST", "/auth/refresh">;
 export declare const POST_CREDENTIALS_SIGN_IN_ROUTE: import("../server-adapter").ServerRoute<{
     email: string;
     password: string;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, import("zod").ZodObject<{
-    email: import("zod").ZodString;
-    password: import("zod").ZodString;
-}, import("zod/v4/core").$strip>, undefined>, "POST", "/auth/credentials/sign-in">;
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>, undefined>, "POST", "/auth/credentials/sign-in">;
 export declare const POST_CREDENTIALS_SIGN_UP_ROUTE: import("../server-adapter").ServerRoute<{
     email: string;
     password: string;
     name?: string | undefined;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, import("zod").ZodObject<{
-    email: import("zod").ZodString;
-    password: import("zod").ZodString;
-    name: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, undefined>, "POST", "/auth/credentials/sign-up">;
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>, "POST", "/auth/credentials/sign-up">;
+export declare const GET_ROLE_PERMISSIONS_ROUTE: import("../server-adapter").ServerRoute<{
+    roleId: string;
+}, {
+    roleId: string;
+    permissions: string[];
+}, "json", import("../server-adapter").RouteSchemas<z.ZodObject<{
+    roleId: z.ZodString;
+}, z.core.$strip>, undefined, undefined, z.ZodObject<{
+    roleId: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>>, "GET", "/auth/roles/:roleId/permissions">;
 export declare const AUTH_ROUTES: readonly [import("../server-adapter").ServerRoute<{}, {
     enabled: boolean;
     login: {
@@ -219,100 +231,110 @@ export declare const AUTH_ROUTES: readonly [import("../server-adapter").ServerRo
         roles: string[];
         permissions: string[];
     } | null;
-}, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-    enabled: import("zod").ZodBoolean;
-    login: import("zod").ZodNullable<import("zod").ZodObject<{
-        type: import("zod").ZodEnum<{
+}, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, z.ZodUnion<readonly [z.ZodObject<{
+    enabled: z.ZodBoolean;
+    login: z.ZodNullable<z.ZodObject<{
+        type: z.ZodEnum<{
             credentials: "credentials";
             sso: "sso";
             both: "both";
         }>;
-        sso: import("zod").ZodOptional<import("zod").ZodObject<{
-            provider: import("zod").ZodString;
-            text: import("zod").ZodString;
-            icon: import("zod").ZodOptional<import("zod").ZodString>;
-            description: import("zod").ZodOptional<import("zod").ZodString>;
-            url: import("zod").ZodString;
-        }, import("zod/v4/core").$strip>>;
-        signUpEnabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
-        description: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>;
-    user: import("zod").ZodObject<{
-        id: import("zod").ZodString;
-        email: import("zod").ZodOptional<import("zod").ZodString>;
-        name: import("zod").ZodOptional<import("zod").ZodString>;
-        avatarUrl: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>;
-    capabilities: import("zod").ZodObject<{
-        user: import("zod").ZodBoolean;
-        session: import("zod").ZodBoolean;
-        sso: import("zod").ZodBoolean;
-        rbac: import("zod").ZodBoolean;
-        acl: import("zod").ZodBoolean;
-    }, import("zod/v4/core").$strip>;
-    access: import("zod").ZodNullable<import("zod").ZodObject<{
-        roles: import("zod").ZodArray<import("zod").ZodString>;
-        permissions: import("zod").ZodArray<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-    enabled: import("zod").ZodBoolean;
-    login: import("zod").ZodNullable<import("zod").ZodObject<{
-        type: import("zod").ZodEnum<{
+        sso: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            text: z.ZodString;
+            icon: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+        }, z.core.$strip>>;
+        signUpEnabled: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        avatarUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    capabilities: z.ZodObject<{
+        user: z.ZodBoolean;
+        session: z.ZodBoolean;
+        sso: z.ZodBoolean;
+        rbac: z.ZodBoolean;
+        acl: z.ZodBoolean;
+    }, z.core.$strip>;
+    access: z.ZodNullable<z.ZodObject<{
+        roles: z.ZodArray<z.ZodString>;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    enabled: z.ZodBoolean;
+    login: z.ZodNullable<z.ZodObject<{
+        type: z.ZodEnum<{
             credentials: "credentials";
             sso: "sso";
             both: "both";
         }>;
-        sso: import("zod").ZodOptional<import("zod").ZodObject<{
-            provider: import("zod").ZodString;
-            text: import("zod").ZodString;
-            icon: import("zod").ZodOptional<import("zod").ZodString>;
-            description: import("zod").ZodOptional<import("zod").ZodString>;
-            url: import("zod").ZodString;
-        }, import("zod/v4/core").$strip>>;
-        signUpEnabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
-        description: import("zod").ZodOptional<import("zod").ZodString>;
-    }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>]>>, "GET", "/auth/capabilities">, import("../server-adapter").ServerRoute<{}, {
+        sso: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            text: z.ZodString;
+            icon: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+        }, z.core.$strip>>;
+        signUpEnabled: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>]>>, "GET", "/auth/capabilities">, import("../server-adapter").ServerRoute<{}, {
     id: string;
     email?: string | undefined;
     name?: string | undefined;
     avatarUrl?: string | undefined;
     roles?: string[] | undefined;
     permissions?: string[] | undefined;
-} | null, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, import("zod").ZodNullable<import("zod").ZodObject<{
-    id: import("zod").ZodString;
-    email: import("zod").ZodOptional<import("zod").ZodString>;
-    name: import("zod").ZodOptional<import("zod").ZodString>;
-    avatarUrl: import("zod").ZodOptional<import("zod").ZodString>;
-    roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-    permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-}, import("zod/v4/core").$strip>>>, "GET", "/auth/me">, import("../server-adapter").ServerRoute<{
+} | null, "json", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, z.ZodNullable<z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    avatarUrl: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>>>, "GET", "/auth/me">, import("../server-adapter").ServerRoute<{
     redirect_uri?: string | undefined;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, import("zod").ZodObject<{
-    redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, undefined, undefined>, "GET", "/auth/sso/login">, import("../server-adapter").ServerRoute<{
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, z.ZodObject<{
+    redirect_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined, undefined>, "GET", "/auth/sso/login">, import("../server-adapter").ServerRoute<{
     code: string;
     state?: string | undefined;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, import("zod").ZodObject<{
-    code: import("zod").ZodString;
-    state: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, undefined, undefined>, "GET", "/auth/sso/callback">, import("../server-adapter").ServerRoute<{}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, undefined>, "POST", "/auth/logout">, import("../server-adapter").ServerRoute<{}, {
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined, undefined>, "GET", "/auth/sso/callback">, import("../server-adapter").ServerRoute<{}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, undefined>, "POST", "/auth/logout">, import("../server-adapter").ServerRoute<{}, {
     success: boolean;
-}, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, import("zod").ZodObject<{
-    success: import("zod").ZodBoolean;
-}, import("zod/v4/core").$strip>>, "POST", "/auth/refresh">, import("../server-adapter").ServerRoute<{
+}, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, undefined, z.ZodObject<{
+    success: z.ZodBoolean;
+}, z.core.$strip>>, "POST", "/auth/refresh">, import("../server-adapter").ServerRoute<{
     email: string;
     password: string;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, import("zod").ZodObject<{
-    email: import("zod").ZodString;
-    password: import("zod").ZodString;
-}, import("zod/v4/core").$strip>, undefined>, "POST", "/auth/credentials/sign-in">, import("../server-adapter").ServerRoute<{
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>, undefined>, "POST", "/auth/credentials/sign-in">, import("../server-adapter").ServerRoute<{
     email: string;
     password: string;
     name?: string | undefined;
-}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, import("zod").ZodObject<{
-    email: import("zod").ZodString;
-    password: import("zod").ZodString;
-    name: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strip>, undefined>, "POST", "/auth/credentials/sign-up">];
+}, unknown, "datastream-response", import("../server-adapter").RouteSchemas<undefined, undefined, z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>, "POST", "/auth/credentials/sign-up">, import("../server-adapter").ServerRoute<{
+    roleId: string;
+}, {
+    roleId: string;
+    permissions: string[];
+}, "json", import("../server-adapter").RouteSchemas<z.ZodObject<{
+    roleId: z.ZodString;
+}, z.core.$strip>, undefined, undefined, z.ZodObject<{
+    roleId: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>>, "GET", "/auth/roles/:roleId/permissions">];
 //# sourceMappingURL=auth.d.ts.map

package/dist/server/handlers/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8DH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAcxD;AA6BD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEAoEtC,CAAC;AAiBH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;sDA8CjC,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;kFA4E9B,CAAC;AAMH,eAAO,MAAM,sBAAsB;;;;;;qFAiGjC,CAAC;AAMH,eAAO,MAAM,iBAAiB,2LAwD5B,CAAC;AAMH,eAAO,MAAM,kBAAkB;;;;2DAoD7B,CAAC;AAMH,eAAO,MAAM,8BAA8B;;;;;;kFAkDzC,CAAC;AAMH,eAAO,MAAM,8BAA8B;;;;;;;;kFAqDzC,CAAC;AAMH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mFASd,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAoD3B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAcxD;AA6BD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDAoEtC,CAAC;AAiBH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;uCA8CjC,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;mEA4E9B,CAAC;AAMH,eAAO,MAAM,sBAAsB;;;;;;sEAiGjC,CAAC;AAMH,eAAO,MAAM,iBAAiB,2LAwD5B,CAAC;AAMH,eAAO,MAAM,kBAAkB;;;;4CAoD7B,CAAC;AAMH,eAAO,MAAM,8BAA8B;;;;;;mEAkDzC,CAAC;AAMH,eAAO,MAAM,8BAA8B;;;;;;;;mEAqDzC,CAAC;AASH,eAAO,MAAM,0BAA0B;;;;;;;;;;6DAkCrC,CAAC;AAMH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DAUd,CAAC"}

package/dist/server/handlers/auth.js

@@ -1,3 +1,3 @@
-export { AUTH_ROUTES, GET_AUTH_CAPABILITIES_ROUTE, GET_CURRENT_USER_ROUTE, GET_SSO_CALLBACK_ROUTE, GET_SSO_LOGIN_ROUTE, POST_CREDENTIALS_SIGN_IN_ROUTE, POST_CREDENTIALS_SIGN_UP_ROUTE, POST_LOGOUT_ROUTE, POST_REFRESH_ROUTE, getPublicOrigin } from '../../chunk-6IUJAAQ2.js';
+export { AUTH_ROUTES, GET_AUTH_CAPABILITIES_ROUTE, GET_CURRENT_USER_ROUTE, GET_ROLE_PERMISSIONS_ROUTE, GET_SSO_CALLBACK_ROUTE, GET_SSO_LOGIN_ROUTE, POST_CREDENTIALS_SIGN_IN_ROUTE, POST_CREDENTIALS_SIGN_UP_ROUTE, POST_LOGOUT_ROUTE, POST_REFRESH_ROUTE, getPublicOrigin } from '../../chunk-2SMGXJZJ.js';
 //# sourceMappingURL=auth.js.map
 //# sourceMappingURL=auth.js.map

package/dist/server/handlers/authorship.cjs

@@ -0,0 +1,52 @@
+'use strict';
+
+var chunkVX3MJR4P_cjs = require('../../chunk-VX3MJR4P.cjs');
+
+
+
+Object.defineProperty(exports, "assertExecuteAccess", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.assertExecuteAccess; }
+});
+Object.defineProperty(exports, "assertOwnership", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.assertOwnership; }
+});
+Object.defineProperty(exports, "assertReadAccess", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.assertReadAccess; }
+});
+Object.defineProperty(exports, "assertShareAccess", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.assertShareAccess; }
+});
+Object.defineProperty(exports, "assertWriteAccess", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.assertWriteAccess; }
+});
+Object.defineProperty(exports, "getCallerAuthorId", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.getCallerAuthorId; }
+});
+Object.defineProperty(exports, "getCallerPermissions", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.getCallerPermissions; }
+});
+Object.defineProperty(exports, "hasAdminBypass", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.hasAdminBypass; }
+});
+Object.defineProperty(exports, "hasScopedPermission", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.hasScopedPermission; }
+});
+Object.defineProperty(exports, "matchesAuthorFilter", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.matchesAuthorFilter; }
+});
+Object.defineProperty(exports, "resolveAuthorFilter", {
+  enumerable: true,
+  get: function () { return chunkVX3MJR4P_cjs.resolveAuthorFilter; }
+});
+//# sourceMappingURL=authorship.cjs.map
+//# sourceMappingURL=authorship.cjs.map

package/dist/server/handlers/authorship.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"authorship.cjs"}