@mastra/server 1.60.0-alpha.7 → 1.60.0-alpha.9

package/dist/{helpers-TmTGZi8e.cjs.map → helpers-C54OMiDG.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"helpers-TmTGZi8e.cjs","names":["MASTRA_USER_KEY","MASTRA_AUTH_TOKEN_KEY","MASTRA_RESOURCE_ID_KEY","MASTRA_AUTH_MODE_KEY","MASTRA_USER_PERMISSIONS_KEY","MASTRA_USER_ROLES_KEY"],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (!!~ext) pattern += (!!~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return !requiresAuth; // True when route opts out of auth\n    }\n  }\n\n  return false;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (!requiresAuth && canAccessPublicly(path, method, authConfig)) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              user = await authConfig.authenticateToken(cookieValue, adaptToMastraAuthRequest(refreshedRequest));\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        if (resourceId) {\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = ctx.buildAuthorizeContext();\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider = mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAChE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACrE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;;AC/CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAI/C,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,CAAC;CAEZ;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;AAE1C,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IAAI,CAAC,gBAAgB,kBAAkB,MAAM,QAAQ,UAAU,GAC7D,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAEvD,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAC1C,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;OAElE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SACvE,IAAI;GACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;GAC/D,IAAI,WAAW;IACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;IAC5D,IAAI,YAAY;KAKd,iBAAiB,WAAW,kBAAkB,UAAU;KACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;KACZ,IAAI,iBAAiB;MACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;OACnD,QAAQ,WAAW;OACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;MACzC,CAAC;MACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;MAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;MACJ,OAAO,MAAM,WAAW,kBAAkB,aAAa,yBAAyB,gBAAgB,CAAC;KACnG;KACA,IAAI,CAAC,MACH,iBAAiB,KAAA;IAErB;GACF;EACF,SAAS,YAAY;GACnB,iBAAiB,KAAA;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;EACH;EAGF,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAIA,kBAAAA,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAIC,kBAAAA,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GACtD,IAAI,YACF,eAAe,IAAIC,kBAAAA,wBAAwB,UAAU;EAEzD,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAIC,kBAAAA,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cACF,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;QACvG;IACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;IACpE,eAAe,IAAIC,kBAAAA,6BAA6B,WAAW;IAE3D,eAAe,IAAI,mBAAmB,WAAW;IAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;IACxD,eAAe,IAAIC,kBAAAA,uBAAuB,KAAK;IAE/C,eAAe,IAAI,aAAa,KAAK;GACvC;EAEJ,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,IAAI,sBAAsB;EAG/C,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAOnG,IADqB,OAAO,UAAU,CAAC,EAAE,MAEvC,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;MAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAGnG,OAAO;EAAE,QAAQ;EAAS,QAAQ;EAAK,MAAM,EAAE,OAAO,gBAAgB;EAAG,SAAS;CAAe;CAKvG,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}
+{"version":3,"file":"helpers-C54OMiDG.cjs","names":["MASTRA_USER_KEY","MASTRA_AUTH_TOKEN_KEY","MASTRA_RESOURCE_ID_KEY","MASTRA_AUTH_MODE_KEY","MASTRA_USER_PERMISSIONS_KEY","MASTRA_USER_ROLES_KEY"],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (!!~ext) pattern += (!!~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return !requiresAuth; // True when route opts out of auth\n    }\n  }\n\n  return false;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (!requiresAuth && canAccessPublicly(path, method, authConfig)) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              user = await authConfig.authenticateToken(cookieValue, adaptToMastraAuthRequest(refreshedRequest));\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        if (resourceId) {\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = ctx.buildAuthorizeContext();\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider = mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAChE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACrE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;;AC/CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAI/C,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,CAAC;CAEZ;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;AAE1C,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IAAI,CAAC,gBAAgB,kBAAkB,MAAM,QAAQ,UAAU,GAC7D,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAEvD,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAC1C,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;OAElE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SACvE,IAAI;GACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;GAC/D,IAAI,WAAW;IACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;IAC5D,IAAI,YAAY;KAKd,iBAAiB,WAAW,kBAAkB,UAAU;KACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;KACZ,IAAI,iBAAiB;MACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;OACnD,QAAQ,WAAW;OACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;MACzC,CAAC;MACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;MAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;MACJ,OAAO,MAAM,WAAW,kBAAkB,aAAa,yBAAyB,gBAAgB,CAAC;KACnG;KACA,IAAI,CAAC,MACH,iBAAiB,KAAA;IAErB;GACF;EACF,SAAS,YAAY;GACnB,iBAAiB,KAAA;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;EACH;EAGF,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAIA,kBAAAA,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAIC,kBAAAA,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GACtD,IAAI,YACF,eAAe,IAAIC,kBAAAA,wBAAwB,UAAU;EAEzD,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAIC,kBAAAA,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cACF,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;QACvG;IACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;IACpE,eAAe,IAAIC,kBAAAA,6BAA6B,WAAW;IAE3D,eAAe,IAAI,mBAAmB,WAAW;IAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;IACxD,eAAe,IAAIC,kBAAAA,uBAAuB,KAAK;IAE/C,eAAe,IAAI,aAAa,KAAK;GACvC;EAEJ,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,IAAI,sBAAsB;EAG/C,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAOnG,IADqB,OAAO,UAAU,CAAC,EAAE,MAEvC,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;MAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAGnG,OAAO;EAAE,QAAQ;EAAS,QAAQ;EAAK,MAAM,EAAE,OAAO,gBAAgB;EAAG,SAAS;CAAe;CAKvG,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}

package/dist/{helpers-GyeAi5YN.js → helpers-Da9nPOFL.js}

@@ -1,4 +1,4 @@
-import { a as MASTRA_RESOURCE_ID_KEY, c as MASTRA_USER_KEY, l as MASTRA_USER_PERMISSIONS_KEY, n as MASTRA_AUTH_TOKEN_KEY, t as MASTRA_AUTH_MODE_KEY, u as MASTRA_USER_ROLES_KEY } from "./constants-Cp1x-6sJ.js";
+import { a as MASTRA_RESOURCE_ID_KEY, c as MASTRA_USER_KEY, l as MASTRA_USER_PERMISSIONS_KEY, n as MASTRA_AUTH_TOKEN_KEY, t as MASTRA_AUTH_MODE_KEY, u as MASTRA_USER_ROLES_KEY } from "./constants-CutMu4A_.js";
 //#region src/server/auth/defaults.ts
 const defaultAuthConfig = {
 	protected: ["/api/*"],
@@ -370,4 +370,4 @@ const checkRules = async (rules, path, method, user) => {
 //#endregion
 export { getAuthenticatedUser as a, isProtectedCustomRoute as c, pathMatchesPattern as d, pathMatchesRule as f, findMatchingCustomRoute as i, isProtectedPath as l, defaultAuthConfig as m, checkRules as n, isCustomRoutePublic as o, supportsSessionRefresh as p, coreAuthMiddleware as r, isDevPlaygroundRequest as s, canAccessPublicly as t, matchesOrIncludes as u };
 
-//# sourceMappingURL=helpers-GyeAi5YN.js.map
+//# sourceMappingURL=helpers-Da9nPOFL.js.map

package/dist/{helpers-GyeAi5YN.js.map → helpers-Da9nPOFL.js.map}

@@ -1 +1 @@
-{"version":3,"file":"helpers-GyeAi5YN.js","names":[],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (!!~ext) pattern += (!!~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return !requiresAuth; // True when route opts out of auth\n    }\n  }\n\n  return false;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (!requiresAuth && canAccessPublicly(path, method, authConfig)) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              user = await authConfig.authenticateToken(cookieValue, adaptToMastraAuthRequest(refreshedRequest));\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        if (resourceId) {\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = ctx.buildAuthorizeContext();\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider = mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAChE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACrE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;;AC/CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAI/C,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,CAAC;CAEZ;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;AAE1C,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IAAI,CAAC,gBAAgB,kBAAkB,MAAM,QAAQ,UAAU,GAC7D,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAEvD,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAC1C,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;OAElE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SACvE,IAAI;GACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;GAC/D,IAAI,WAAW;IACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;IAC5D,IAAI,YAAY;KAKd,iBAAiB,WAAW,kBAAkB,UAAU;KACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;KACZ,IAAI,iBAAiB;MACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;OACnD,QAAQ,WAAW;OACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;MACzC,CAAC;MACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;MAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;MACJ,OAAO,MAAM,WAAW,kBAAkB,aAAa,yBAAyB,gBAAgB,CAAC;KACnG;KACA,IAAI,CAAC,MACH,iBAAiB,KAAA;IAErB;GACF;EACF,SAAS,YAAY;GACnB,iBAAiB,KAAA;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;EACH;EAGF,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAI,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAI,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GACtD,IAAI,YACF,eAAe,IAAI,wBAAwB,UAAU;EAEzD,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAI,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cACF,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;QACvG;IACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;IACpE,eAAe,IAAI,6BAA6B,WAAW;IAE3D,eAAe,IAAI,mBAAmB,WAAW;IAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;IACxD,eAAe,IAAI,uBAAuB,KAAK;IAE/C,eAAe,IAAI,aAAa,KAAK;GACvC;EAEJ,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,IAAI,sBAAsB;EAG/C,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAOnG,IADqB,OAAO,UAAU,CAAC,EAAE,MAEvC,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;MAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAGnG,OAAO;EAAE,QAAQ;EAAS,QAAQ;EAAK,MAAM,EAAE,OAAO,gBAAgB;EAAG,SAAS;CAAe;CAKvG,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}
+{"version":3,"file":"helpers-Da9nPOFL.js","names":[],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (!!~ext) pattern += (!!~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return !requiresAuth; // True when route opts out of auth\n    }\n  }\n\n  return false;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (!requiresAuth && canAccessPublicly(path, method, authConfig)) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              user = await authConfig.authenticateToken(cookieValue, adaptToMastraAuthRequest(refreshedRequest));\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        if (resourceId) {\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = ctx.buildAuthorizeContext();\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider = mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAChE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACrE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;;AC/CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAI/C,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,CAAC;CAEZ;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;AAE1C,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IAAI,CAAC,gBAAgB,kBAAkB,MAAM,QAAQ,UAAU,GAC7D,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAEvD,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAC1C,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;OAElE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SACvE,IAAI;GACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;GAC/D,IAAI,WAAW;IACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;IAC5D,IAAI,YAAY;KAKd,iBAAiB,WAAW,kBAAkB,UAAU;KACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;KACZ,IAAI,iBAAiB;MACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;OACnD,QAAQ,WAAW;OACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;MACzC,CAAC;MACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;MAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;MACJ,OAAO,MAAM,WAAW,kBAAkB,aAAa,yBAAyB,gBAAgB,CAAC;KACnG;KACA,IAAI,CAAC,MACH,iBAAiB,KAAA;IAErB;GACF;EACF,SAAS,YAAY;GACnB,iBAAiB,KAAA;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;EACH;EAGF,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAI,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAI,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GACtD,IAAI,YACF,eAAe,IAAI,wBAAwB,UAAU;EAEzD,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAI,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cACF,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;QACvG;IACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;IACpE,eAAe,IAAI,6BAA6B,WAAW;IAE3D,eAAe,IAAI,mBAAmB,WAAW;IAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;IACxD,eAAe,IAAI,uBAAuB,KAAK;IAE/C,eAAe,IAAI,aAAa,KAAK;GACvC;EAEJ,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,IAAI,sBAAsB;EAG/C,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAOnG,IADqB,OAAO,UAAU,CAAC,EAAE,MAEvC,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;MAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAGnG,OAAO;EAAE,QAAQ;EAAS,QAAQ;EAAK,MAAM,EAAE,OAAO,gBAAgB;EAAG,SAAS;CAAe;CAKvG,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}

package/dist/{routes-BpOjCX2F.js → routes-iUe0w9eL.js}

@@ -2,7 +2,8 @@ import "./route-builder-YQ_gLIvW.js";
 import { CANCEL_WORKFLOW_RUN_ROUTE, CREATE_WORKFLOW_RUN_ROUTE, DELETE_WORKFLOW_RUN_BY_ID_ROUTE, EXECUTE_WORKFLOW_STEP_ROUTE, GET_WORKFLOW_BY_ID_ROUTE, GET_WORKFLOW_RUN_BY_ID_ROUTE, LIST_WORKFLOWS_ROUTE, LIST_WORKFLOW_RUNS_ROUTE, LIST_WORKFLOW_RUN_COUNTS_ROUTE, OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE, OBSERVE_STREAM_WORKFLOW_ROUTE, RECEIVE_WORKFLOW_EVENT_ROUTE, RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE, RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE, RESTART_ASYNC_WORKFLOW_ROUTE, RESTART_WORKFLOW_ROUTE, RESUME_ASYNC_WORKFLOW_ROUTE, RESUME_NO_WAIT_WORKFLOW_ROUTE, RESUME_STREAM_WORKFLOW_ROUTE, RESUME_WORKFLOW_ROUTE, START_ASYNC_WORKFLOW_ROUTE, START_WORKFLOW_RUN_ROUTE, STREAM_LEGACY_WORKFLOW_ROUTE, STREAM_WORKFLOW_ROUTE, TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE, TIME_TRAVEL_STREAM_WORKFLOW_ROUTE, TIME_TRAVEL_WORKFLOW_ROUTE } from "./server/handlers/workflows.js";
 import { CANCEL_AGENT_BUILDER_ACTION_RUN_ROUTE, CREATE_AGENT_BUILDER_ACTION_RUN_ROUTE, GET_AGENT_BUILDER_ACTION_BY_ID_ROUTE, GET_AGENT_BUILDER_ACTION_RUN_BY_ID_ROUTE, LIST_AGENT_BUILDER_ACTIONS_ROUTE, LIST_AGENT_BUILDER_ACTION_RUNS_ROUTE, OBSERVE_STREAM_AGENT_BUILDER_ACTION_ROUTE, OBSERVE_STREAM_LEGACY_AGENT_BUILDER_ACTION_ROUTE, RESUME_AGENT_BUILDER_ACTION_ROUTE, RESUME_ASYNC_AGENT_BUILDER_ACTION_ROUTE, RESUME_NO_WAIT_AGENT_BUILDER_ACTION_ROUTE, RESUME_STREAM_AGENT_BUILDER_ACTION_ROUTE, START_AGENT_BUILDER_ACTION_RUN_ROUTE, START_ASYNC_AGENT_BUILDER_ACTION_ROUTE, STREAM_AGENT_BUILDER_ACTION_ROUTE, STREAM_LEGACY_AGENT_BUILDER_ACTION_ROUTE } from "./server/handlers/agent-builder.js";
 import { ABORT_AGENT_THREAD_ROUTE, APPROVE_NETWORK_TOOL_CALL_ROUTE, APPROVE_TOOL_CALL_GENERATE_ROUTE, APPROVE_TOOL_CALL_ROUTE, CLONE_AGENT_ROUTE, DECLINE_NETWORK_TOOL_CALL_ROUTE, DECLINE_TOOL_CALL_GENERATE_ROUTE, DECLINE_TOOL_CALL_ROUTE, ENHANCE_INSTRUCTIONS_ROUTE, GENERATE_AGENT_ROUTE, GENERATE_AGENT_VNEXT_ROUTE, GENERATE_LEGACY_ROUTE, GET_AGENT_BY_ID_ROUTE, GET_AGENT_SKILL_ROUTE, GET_PROVIDERS_ROUTE, LIST_AGENTS_ROUTE, LIST_SUSPENDED_RUNS_ROUTE, OBSERVE_AGENT_STREAM_ROUTE, QUEUE_AGENT_MESSAGE_ROUTE, RECOVER_ROUTE, REORDER_AGENT_MODEL_LIST_ROUTE, RESET_AGENT_MODEL_ROUTE, RESUME_STREAM_ROUTE, RESUME_STREAM_UNTIL_IDLE_ROUTE, SEND_AGENT_MESSAGE_ROUTE, SEND_AGENT_SIGNAL_ROUTE, SEND_TOOL_APPROVAL_ROUTE, STREAM_GENERATE_LEGACY_ROUTE, STREAM_GENERATE_ROUTE, STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE, STREAM_NETWORK_ROUTE, STREAM_UI_MESSAGE_DEPRECATED_ROUTE, STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE, STREAM_UNTIL_IDLE_GENERATE_ROUTE, STREAM_VNEXT_DEPRECATED_ROUTE, SUBSCRIBE_AGENT_THREAD_ROUTE, UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE, UPDATE_AGENT_MODEL_ROUTE } from "./server/handlers/agents.js";
-import { n as GET_AGENT_CARD_ROUTE, t as AGENT_EXECUTION_ROUTE } from "./a2a-CUkzkdTZ.js";
+import { READ_AGENT_PLAN_ROUTE } from "./server/handlers/plans.js";
+import { n as GET_AGENT_CARD_ROUTE, t as AGENT_EXECUTION_ROUTE } from "./a2a-B5m54dOP.js";
 import { AUTH_ROUTES } from "./server/handlers/auth.js";
 import { CREATE_CONVERSATION_ROUTE, DELETE_CONVERSATION_ROUTE, GET_CONVERSATION_ITEMS_ROUTE, GET_CONVERSATION_ROUTE } from "./server/handlers/conversations.js";
 import { LIST_LOGS_BY_RUN_ID_ROUTE, LIST_LOGS_ROUTE, LIST_LOG_TRANSPORTS_ROUTE } from "./server/handlers/logs.js";
@@ -20,10 +21,10 @@ import { i as UPSERT_DYNAMIC_WORKFLOW_ROUTE, n as GET_DYNAMIC_WORKFLOW_ROUTE, r
 import { ABORT_AGENT_CONTROLLER_SESSION_ROUTE, AGENT_CONTROLLER_TOOL_APPROVAL_ROUTE, AGENT_CONTROLLER_TOOL_SUSPENSION_ROUTE, CLEAR_AGENT_CONTROLLER_GOAL_ROUTE, CLONE_AGENT_CONTROLLER_THREAD_ROUTE, CREATE_AGENT_CONTROLLER_SESSION_ROUTE, CREATE_AGENT_CONTROLLER_THREAD_ROUTE, DELETE_AGENT_CONTROLLER_THREAD_ROUTE, FOLLOW_UP_AGENT_CONTROLLER_SESSION_ROUTE, GET_AGENT_CONTROLLER_GOAL_ROUTE, GET_AGENT_CONTROLLER_OM_RECORD_ROUTE, GET_AGENT_CONTROLLER_PERMISSIONS_ROUTE, GET_AGENT_CONTROLLER_RESOURCE_IDS_ROUTE, GET_AGENT_CONTROLLER_SESSION_STATE_ROUTE, GET_AGENT_CONTROLLER_WORKSPACE_STATUS_ROUTE, LIST_AGENT_CONTROLLERS_ROUTE, LIST_AGENT_CONTROLLER_ACTIVE_RUNS_ROUTE, LIST_AGENT_CONTROLLER_MODELS_ROUTE, LIST_AGENT_CONTROLLER_MODES_ROUTE, LIST_AGENT_CONTROLLER_THREADS_ROUTE, LIST_AGENT_CONTROLLER_THREAD_MESSAGES_ROUTE, RENAME_AGENT_CONTROLLER_THREAD_ROUTE, SEND_AGENT_CONTROLLER_MESSAGE_ROUTE, SEND_AGENT_CONTROLLER_NOTIFICATION_ROUTE, SET_AGENT_CONTROLLER_CATEGORY_PERMISSION_ROUTE, SET_AGENT_CONTROLLER_GOAL_ROUTE, SET_AGENT_CONTROLLER_RESOURCE_ID_ROUTE, SET_AGENT_CONTROLLER_SESSION_STATE_ROUTE, SET_AGENT_CONTROLLER_TOOL_PERMISSION_ROUTE, STEER_AGENT_CONTROLLER_SESSION_ROUTE, STREAM_AGENT_CONTROLLER_SESSION_ROUTE, SWITCH_AGENT_CONTROLLER_MODEL_ROUTE, SWITCH_AGENT_CONTROLLER_MODE_ROUTE, SWITCH_AGENT_CONTROLLER_THREAD_ROUTE, UPDATE_AGENT_CONTROLLER_GOAL_ROUTE } from "./server/handlers/agent-controller.js";
 import { ACTIVATE_AGENT_VERSION_ROUTE, COMPARE_AGENT_VERSIONS_ROUTE, CREATE_AGENT_VERSION_ROUTE, DELETE_AGENT_VERSION_ROUTE, GET_AGENT_VERSION_ROUTE, LIST_AGENT_VERSIONS_ROUTE, RESTORE_AGENT_VERSION_ROUTE } from "./server/handlers/agent-versions.js";
 import { n as GET_BACKGROUND_TASK_ROUTE, r as LIST_BACKGROUND_TASKS_ROUTE, t as BACKGROUND_TASK_STREAM_ROUTE } from "./background-tasks-BtWM0sZs.js";
-import { a as LIST_BUILDER_REGISTRIES_ROUTE, i as BUILDER_REGISTRY_SEARCH_ROUTE, n as BUILDER_REGISTRY_POPULAR_ROUTE, r as BUILDER_REGISTRY_PREVIEW_ROUTE, t as BUILDER_REGISTRY_INSTALL_ROUTE } from "./builder-registry-B8KyPAOP.js";
-import { i as LIST_CHANNEL_PLATFORMS_ROUTE, n as DISCONNECT_CHANNEL_ROUTE, r as LIST_CHANNEL_INSTALLATIONS_ROUTE, t as CONNECT_CHANNEL_ROUTE } from "./channels-B9yt3a2P.js";
+import { a as LIST_BUILDER_REGISTRIES_ROUTE, i as BUILDER_REGISTRY_SEARCH_ROUTE, n as BUILDER_REGISTRY_POPULAR_ROUTE, r as BUILDER_REGISTRY_PREVIEW_ROUTE, t as BUILDER_REGISTRY_INSTALL_ROUTE } from "./builder-registry-CqLsr39q.js";
+import { i as LIST_CHANNEL_PLATFORMS_ROUTE, n as DISCONNECT_CHANNEL_ROUTE, r as LIST_CHANNEL_INSTALLATIONS_ROUTE, t as CONNECT_CHANNEL_ROUTE } from "./channels-BnFQESMf.js";
 import { ADD_ITEM_ROUTE, BATCH_DELETE_ITEMS_ROUTE, BATCH_INSERT_ITEMS_ROUTE, CLUSTER_FAILURES_ROUTE, COMPARE_EXPERIMENTS_ROUTE, CREATE_DATASET_ROUTE, DELETE_DATASET_ROUTE, DELETE_ITEM_ROUTE, EXPERIMENT_REVIEW_SUMMARY_ROUTE, GENERATE_ITEMS_ROUTE, GET_DATASET_ROUTE, GET_EXPERIMENT_ROUTE, GET_ITEM_ROUTE, GET_ITEM_VERSION_ROUTE, LIST_ALL_EXPERIMENTS_ROUTE, LIST_DATASETS_ROUTE, LIST_DATASET_VERSIONS_ROUTE, LIST_EXPERIMENTS_ROUTE, LIST_EXPERIMENT_RESULTS_ROUTE, LIST_ITEMS_ROUTE, LIST_ITEM_VERSIONS_ROUTE, TRIGGER_EXPERIMENT_ROUTE, UPDATE_DATASET_ROUTE, UPDATE_EXPERIMENT_RESULT_ROUTE, UPDATE_ITEM_ROUTE } from "./server/handlers/datasets.js";
-import { n as GET_EDITOR_BUILDER_SETTINGS_ROUTE, r as GET_INFRASTRUCTURE_STATUS_ROUTE, t as GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE } from "./editor-builder-Byg6wbi6.js";
+import { n as GET_EDITOR_BUILDER_SETTINGS_ROUTE, r as GET_INFRASTRUCTURE_STATUS_ROUTE, t as GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE } from "./editor-builder-EP9FAtQm.js";
 import { ACTIVATE_MCP_CLIENT_VERSION_ROUTE, COMPARE_MCP_CLIENT_VERSIONS_ROUTE, CREATE_MCP_CLIENT_VERSION_ROUTE, DELETE_MCP_CLIENT_VERSION_ROUTE, GET_MCP_CLIENT_VERSION_ROUTE, LIST_MCP_CLIENT_VERSIONS_ROUTE, RESTORE_MCP_CLIENT_VERSION_ROUTE } from "./server/handlers/mcp-client-versions.js";
 import { GET_PROCESSOR_PROVIDER_ROUTE, LIST_PROCESSOR_PROVIDERS_ROUTE } from "./server/handlers/processor-providers.js";
 import { EXECUTE_PROCESSOR_ROUTE, GET_PROCESSOR_BY_ID_ROUTE, LIST_PROCESSORS_ROUTE } from "./server/handlers/processors.js";
@@ -143,6 +144,7 @@ const AGENTS_ROUTES = [
 	UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE,
 	ENHANCE_INSTRUCTIONS_ROUTE,
 	GET_AGENT_TOOL_ROUTE,
+	READ_AGENT_PLAN_ROUTE,
 	GET_AGENT_SKILL_ROUTE,
 	GENERATE_SPEECH_ROUTE,
 	GENERATE_SPEECH_DEPRECATED_ROUTE,
@@ -610,4 +612,4 @@ const SERVER_ROUTES = [
 //#endregion
 export { SERVER_ROUTES as t };
 
-//# sourceMappingURL=routes-BpOjCX2F.js.map
+//# sourceMappingURL=routes-iUe0w9eL.js.map

package/dist/routes-iUe0w9eL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-iUe0w9eL.js","names":[],"sources":["../src/server/server-adapter/routes/a2a.ts","../src/server/server-adapter/routes/agent-builder.ts","../src/server/server-adapter/routes/agent-controller.ts","../src/server/server-adapter/routes/agents.ts","../src/server/server-adapter/routes/background-tasks.ts","../src/server/server-adapter/routes/channels.ts","../src/server/server-adapter/routes/conversations.ts","../src/server/server-adapter/routes/datasets.ts","../src/server/server-adapter/routes/dynamic-workflows.ts","../src/server/server-adapter/routes/editor-builder.ts","../src/server/server-adapter/routes/legacy.ts","../src/server/server-adapter/routes/logs.ts","../src/server/server-adapter/routes/mcp.ts","../src/server/server-adapter/routes/memory.ts","../src/server/server-adapter/routes/observability.ts","../src/server/server-adapter/routes/processor-providers.ts","../src/server/server-adapter/routes/processors.ts","../src/server/server-adapter/routes/responses.ts","../src/server/server-adapter/routes/schedules.ts","../src/server/server-adapter/routes/scorers.ts","../src/server/server-adapter/routes/stored-agents.ts","../src/server/server-adapter/routes/stored-mcp-clients.ts","../src/server/server-adapter/routes/stored-prompt-blocks.ts","../src/server/server-adapter/routes/stored-scorers.ts","../src/server/server-adapter/routes/stored-skills.ts","../src/server/server-adapter/routes/stored-workspaces.ts","../src/server/server-adapter/routes/system.ts","../src/server/server-adapter/routes/tool-providers.ts","../src/server/server-adapter/routes/tools.ts","../src/server/server-adapter/routes/vectors.ts","../src/server/server-adapter/routes/workflows.ts","../src/server/server-adapter/routes/workspace.ts","../src/server/server-adapter/routes/index.ts"],"sourcesContent":["import { GET_AGENT_CARD_ROUTE, AGENT_EXECUTION_ROUTE } from '../../handlers/a2a';\n\nexport const A2A_ROUTES = [GET_AGENT_CARD_ROUTE, AGENT_EXECUTION_ROUTE] as const;\n","import {\n  LIST_AGENT_BUILDER_ACTIONS_ROUTE,\n  GET_AGENT_BUILDER_ACTION_BY_ID_ROUTE,\n  LIST_AGENT_BUILDER_ACTION_RUNS_ROUTE,\n  GET_AGENT_BUILDER_ACTION_RUN_BY_ID_ROUTE,\n  CREATE_AGENT_BUILDER_ACTION_RUN_ROUTE,\n  STREAM_AGENT_BUILDER_ACTION_ROUTE,\n  STREAM_LEGACY_AGENT_BUILDER_ACTION_ROUTE,\n  START_ASYNC_AGENT_BUILDER_ACTION_ROUTE,\n  START_AGENT_BUILDER_ACTION_RUN_ROUTE,\n  OBSERVE_STREAM_AGENT_BUILDER_ACTION_ROUTE,\n  OBSERVE_STREAM_LEGACY_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_ASYNC_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_NO_WAIT_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_STREAM_AGENT_BUILDER_ACTION_ROUTE,\n  CANCEL_AGENT_BUILDER_ACTION_RUN_ROUTE,\n} from '../../handlers/agent-builder';\n\nexport const AGENT_BUILDER_ROUTES = [\n  LIST_AGENT_BUILDER_ACTIONS_ROUTE,\n  GET_AGENT_BUILDER_ACTION_BY_ID_ROUTE,\n  LIST_AGENT_BUILDER_ACTION_RUNS_ROUTE,\n  GET_AGENT_BUILDER_ACTION_RUN_BY_ID_ROUTE,\n  CREATE_AGENT_BUILDER_ACTION_RUN_ROUTE,\n  STREAM_AGENT_BUILDER_ACTION_ROUTE,\n  STREAM_LEGACY_AGENT_BUILDER_ACTION_ROUTE,\n  START_ASYNC_AGENT_BUILDER_ACTION_ROUTE,\n  START_AGENT_BUILDER_ACTION_RUN_ROUTE,\n  OBSERVE_STREAM_AGENT_BUILDER_ACTION_ROUTE,\n  OBSERVE_STREAM_LEGACY_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_ASYNC_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_NO_WAIT_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_AGENT_BUILDER_ACTION_ROUTE,\n  RESUME_STREAM_AGENT_BUILDER_ACTION_ROUTE,\n  CANCEL_AGENT_BUILDER_ACTION_RUN_ROUTE,\n] as const;\n","import {\n  LIST_AGENT_CONTROLLERS_ROUTE,\n  CREATE_AGENT_CONTROLLER_SESSION_ROUTE,\n  GET_AGENT_CONTROLLER_SESSION_STATE_ROUTE,\n  STREAM_AGENT_CONTROLLER_SESSION_ROUTE,\n  SEND_AGENT_CONTROLLER_MESSAGE_ROUTE,\n  STEER_AGENT_CONTROLLER_SESSION_ROUTE,\n  ABORT_AGENT_CONTROLLER_SESSION_ROUTE,\n  AGENT_CONTROLLER_TOOL_APPROVAL_ROUTE,\n  AGENT_CONTROLLER_TOOL_SUSPENSION_ROUTE,\n  SWITCH_AGENT_CONTROLLER_MODE_ROUTE,\n  SWITCH_AGENT_CONTROLLER_MODEL_ROUTE,\n  SWITCH_AGENT_CONTROLLER_THREAD_ROUTE,\n  LIST_AGENT_CONTROLLER_MODES_ROUTE,\n  LIST_AGENT_CONTROLLER_ACTIVE_RUNS_ROUTE,\n  LIST_AGENT_CONTROLLER_THREADS_ROUTE,\n  SEND_AGENT_CONTROLLER_NOTIFICATION_ROUTE,\n  CREATE_AGENT_CONTROLLER_THREAD_ROUTE,\n  DELETE_AGENT_CONTROLLER_THREAD_ROUTE,\n  RENAME_AGENT_CONTROLLER_THREAD_ROUTE,\n  CLONE_AGENT_CONTROLLER_THREAD_ROUTE,\n  LIST_AGENT_CONTROLLER_THREAD_MESSAGES_ROUTE,\n  FOLLOW_UP_AGENT_CONTROLLER_SESSION_ROUTE,\n  LIST_AGENT_CONTROLLER_MODELS_ROUTE,\n  GET_AGENT_CONTROLLER_WORKSPACE_STATUS_ROUTE,\n  GET_AGENT_CONTROLLER_OM_RECORD_ROUTE,\n  SET_AGENT_CONTROLLER_RESOURCE_ID_ROUTE,\n  GET_AGENT_CONTROLLER_RESOURCE_IDS_ROUTE,\n  GET_AGENT_CONTROLLER_GOAL_ROUTE,\n  SET_AGENT_CONTROLLER_GOAL_ROUTE,\n  UPDATE_AGENT_CONTROLLER_GOAL_ROUTE,\n  CLEAR_AGENT_CONTROLLER_GOAL_ROUTE,\n  GET_AGENT_CONTROLLER_PERMISSIONS_ROUTE,\n  SET_AGENT_CONTROLLER_CATEGORY_PERMISSION_ROUTE,\n  SET_AGENT_CONTROLLER_TOOL_PERMISSION_ROUTE,\n  SET_AGENT_CONTROLLER_SESSION_STATE_ROUTE,\n} from '../../handlers/agent-controller';\nimport type { ServerRoute } from '.';\n\n/**\n * Canonical `AgentController` session API, served under `/agent-controller/...`.\n */\nexport const AGENT_CONTROLLER_ROUTES: readonly ServerRoute[] = [\n  LIST_AGENT_CONTROLLERS_ROUTE,\n  LIST_AGENT_CONTROLLER_MODES_ROUTE,\n  LIST_AGENT_CONTROLLER_MODELS_ROUTE,\n  LIST_AGENT_CONTROLLER_ACTIVE_RUNS_ROUTE,\n  CREATE_AGENT_CONTROLLER_SESSION_ROUTE,\n  GET_AGENT_CONTROLLER_SESSION_STATE_ROUTE,\n  LIST_AGENT_CONTROLLER_THREADS_ROUTE,\n  CREATE_AGENT_CONTROLLER_THREAD_ROUTE,\n  DELETE_AGENT_CONTROLLER_THREAD_ROUTE,\n  RENAME_AGENT_CONTROLLER_THREAD_ROUTE,\n  CLONE_AGENT_CONTROLLER_THREAD_ROUTE,\n  LIST_AGENT_CONTROLLER_THREAD_MESSAGES_ROUTE,\n  STREAM_AGENT_CONTROLLER_SESSION_ROUTE,\n  SEND_AGENT_CONTROLLER_MESSAGE_ROUTE,\n  STEER_AGENT_CONTROLLER_SESSION_ROUTE,\n  FOLLOW_UP_AGENT_CONTROLLER_SESSION_ROUTE,\n  ABORT_AGENT_CONTROLLER_SESSION_ROUTE,\n  AGENT_CONTROLLER_TOOL_APPROVAL_ROUTE,\n  AGENT_CONTROLLER_TOOL_SUSPENSION_ROUTE,\n  SWITCH_AGENT_CONTROLLER_MODE_ROUTE,\n  SWITCH_AGENT_CONTROLLER_MODEL_ROUTE,\n  SWITCH_AGENT_CONTROLLER_THREAD_ROUTE,\n  SEND_AGENT_CONTROLLER_NOTIFICATION_ROUTE,\n  GET_AGENT_CONTROLLER_WORKSPACE_STATUS_ROUTE,\n  GET_AGENT_CONTROLLER_OM_RECORD_ROUTE,\n  SET_AGENT_CONTROLLER_RESOURCE_ID_ROUTE,\n  GET_AGENT_CONTROLLER_RESOURCE_IDS_ROUTE,\n  GET_AGENT_CONTROLLER_GOAL_ROUTE,\n  SET_AGENT_CONTROLLER_GOAL_ROUTE,\n  UPDATE_AGENT_CONTROLLER_GOAL_ROUTE,\n  CLEAR_AGENT_CONTROLLER_GOAL_ROUTE,\n  GET_AGENT_CONTROLLER_PERMISSIONS_ROUTE,\n  SET_AGENT_CONTROLLER_CATEGORY_PERMISSION_ROUTE,\n  SET_AGENT_CONTROLLER_TOOL_PERMISSION_ROUTE,\n  SET_AGENT_CONTROLLER_SESSION_STATE_ROUTE,\n];\n","import {\n  // Agent route objects\n  LIST_AGENTS_ROUTE,\n  GET_AGENT_BY_ID_ROUTE,\n  CLONE_AGENT_ROUTE,\n  GENERATE_AGENT_ROUTE,\n  GENERATE_AGENT_VNEXT_ROUTE,\n  STREAM_GENERATE_ROUTE,\n  STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE,\n  OBSERVE_AGENT_STREAM_ROUTE,\n  SEND_AGENT_MESSAGE_ROUTE,\n  QUEUE_AGENT_MESSAGE_ROUTE,\n  SEND_AGENT_SIGNAL_ROUTE,\n  ABORT_AGENT_THREAD_ROUTE,\n  SUBSCRIBE_AGENT_THREAD_ROUTE,\n  GET_PROVIDERS_ROUTE,\n  APPROVE_TOOL_CALL_ROUTE,\n  SEND_TOOL_APPROVAL_ROUTE,\n  LIST_SUSPENDED_RUNS_ROUTE,\n  DECLINE_TOOL_CALL_ROUTE,\n  RESUME_STREAM_ROUTE,\n  RECOVER_ROUTE,\n  APPROVE_TOOL_CALL_GENERATE_ROUTE,\n  DECLINE_TOOL_CALL_GENERATE_ROUTE,\n  STREAM_NETWORK_ROUTE,\n  UPDATE_AGENT_MODEL_ROUTE,\n  RESET_AGENT_MODEL_ROUTE,\n  REORDER_AGENT_MODEL_LIST_ROUTE,\n  UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE,\n  ENHANCE_INSTRUCTIONS_ROUTE,\n  STREAM_VNEXT_DEPRECATED_ROUTE,\n  STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE,\n  STREAM_UI_MESSAGE_DEPRECATED_ROUTE,\n  APPROVE_NETWORK_TOOL_CALL_ROUTE,\n  DECLINE_NETWORK_TOOL_CALL_ROUTE,\n  GET_AGENT_SKILL_ROUTE,\n  STREAM_UNTIL_IDLE_GENERATE_ROUTE,\n  RESUME_STREAM_UNTIL_IDLE_ROUTE,\n} from '../../handlers/agents';\nimport { READ_AGENT_PLAN_ROUTE } from '../../handlers/plans';\nimport { GET_AGENT_TOOL_ROUTE, EXECUTE_AGENT_TOOL_ROUTE } from '../../handlers/tools';\nimport {\n  GET_SPEAKERS_ROUTE,\n  GET_SPEAKERS_DEPRECATED_ROUTE,\n  GENERATE_SPEECH_ROUTE,\n  GENERATE_SPEECH_DEPRECATED_ROUTE,\n  TRANSCRIBE_SPEECH_ROUTE,\n  TRANSCRIBE_SPEECH_DEPRECATED_ROUTE,\n  GET_LISTENER_ROUTE,\n} from '../../handlers/voice';\nimport type { ServerRoute } from '.';\n\nexport const AGENTS_ROUTES: readonly ServerRoute[] = [\n  // ============================================================================\n  // Agent Core Routes\n  // ============================================================================\n  LIST_AGENTS_ROUTE,\n  GET_PROVIDERS_ROUTE,\n  GET_AGENT_BY_ID_ROUTE,\n  CLONE_AGENT_ROUTE,\n\n  // ============================================================================\n  // Voice Routes\n  // ============================================================================\n  GET_SPEAKERS_ROUTE,\n  GET_SPEAKERS_DEPRECATED_ROUTE,\n\n  // ============================================================================\n  // Agent Execution Routes\n  // ============================================================================\n  GENERATE_AGENT_ROUTE,\n  GENERATE_AGENT_VNEXT_ROUTE,\n  STREAM_GENERATE_ROUTE,\n  STREAM_UNTIL_IDLE_GENERATE_ROUTE,\n  STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE,\n\n  // ============================================================================\n  // Resumable Stream Routes\n  // ============================================================================\n  OBSERVE_AGENT_STREAM_ROUTE,\n  SEND_AGENT_MESSAGE_ROUTE,\n  QUEUE_AGENT_MESSAGE_ROUTE,\n  SEND_AGENT_SIGNAL_ROUTE,\n  ABORT_AGENT_THREAD_ROUTE,\n  SUBSCRIBE_AGENT_THREAD_ROUTE,\n\n  // ============================================================================\n  // Tool Routes\n  // ============================================================================\n  EXECUTE_AGENT_TOOL_ROUTE,\n  APPROVE_TOOL_CALL_ROUTE,\n  SEND_TOOL_APPROVAL_ROUTE,\n  LIST_SUSPENDED_RUNS_ROUTE,\n  DECLINE_TOOL_CALL_ROUTE,\n  RESUME_STREAM_ROUTE,\n  RECOVER_ROUTE,\n  APPROVE_TOOL_CALL_GENERATE_ROUTE,\n  DECLINE_TOOL_CALL_GENERATE_ROUTE,\n  APPROVE_NETWORK_TOOL_CALL_ROUTE,\n  DECLINE_NETWORK_TOOL_CALL_ROUTE,\n  RESUME_STREAM_UNTIL_IDLE_ROUTE,\n\n  // ============================================================================\n  // Network Routes\n  // ============================================================================\n  STREAM_NETWORK_ROUTE,\n\n  // ============================================================================\n  // Model Management Routes\n  // ============================================================================\n  UPDATE_AGENT_MODEL_ROUTE,\n  RESET_AGENT_MODEL_ROUTE,\n  REORDER_AGENT_MODEL_LIST_ROUTE,\n  UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE,\n\n  // ============================================================================\n  // Instruction Enhancement Routes\n  // ============================================================================\n  ENHANCE_INSTRUCTIONS_ROUTE,\n\n  // ============================================================================\n  // Agent Tool Routes\n  // ============================================================================\n  GET_AGENT_TOOL_ROUTE,\n  READ_AGENT_PLAN_ROUTE,\n\n  // ============================================================================\n  // Agent Skill Routes\n  // ============================================================================\n  GET_AGENT_SKILL_ROUTE,\n\n  // ============================================================================\n  // Voice/Speech Routes\n  // ============================================================================\n  GENERATE_SPEECH_ROUTE,\n  GENERATE_SPEECH_DEPRECATED_ROUTE,\n  TRANSCRIBE_SPEECH_ROUTE,\n  TRANSCRIBE_SPEECH_DEPRECATED_ROUTE,\n  GET_LISTENER_ROUTE,\n\n  // ============================================================================\n  // Deprecated Routes\n  // ============================================================================\n  STREAM_VNEXT_DEPRECATED_ROUTE,\n  STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE,\n  STREAM_UI_MESSAGE_DEPRECATED_ROUTE,\n];\n\n/**\n * Type-level tuple preserving each agent route's specific schema types.\n * Used by ServerRoutes to build the type-level route map.\n */\nexport type AgentRoutes = readonly [\n  typeof LIST_AGENTS_ROUTE,\n  typeof GET_PROVIDERS_ROUTE,\n  typeof GET_AGENT_BY_ID_ROUTE,\n  typeof CLONE_AGENT_ROUTE,\n  typeof GET_SPEAKERS_ROUTE,\n  typeof GET_SPEAKERS_DEPRECATED_ROUTE,\n  typeof GENERATE_AGENT_ROUTE,\n  typeof GENERATE_AGENT_VNEXT_ROUTE,\n  typeof STREAM_GENERATE_ROUTE,\n  typeof STREAM_UNTIL_IDLE_GENERATE_ROUTE,\n  typeof STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE,\n  typeof SEND_AGENT_MESSAGE_ROUTE,\n  typeof QUEUE_AGENT_MESSAGE_ROUTE,\n  typeof SEND_AGENT_SIGNAL_ROUTE,\n  typeof ABORT_AGENT_THREAD_ROUTE,\n  typeof SUBSCRIBE_AGENT_THREAD_ROUTE,\n  typeof EXECUTE_AGENT_TOOL_ROUTE,\n  typeof APPROVE_TOOL_CALL_ROUTE,\n  typeof SEND_TOOL_APPROVAL_ROUTE,\n  typeof LIST_SUSPENDED_RUNS_ROUTE,\n  typeof DECLINE_TOOL_CALL_ROUTE,\n  typeof RESUME_STREAM_ROUTE,\n  typeof RECOVER_ROUTE,\n  typeof RESUME_STREAM_UNTIL_IDLE_ROUTE,\n  typeof APPROVE_TOOL_CALL_GENERATE_ROUTE,\n  typeof DECLINE_TOOL_CALL_GENERATE_ROUTE,\n  typeof APPROVE_NETWORK_TOOL_CALL_ROUTE,\n  typeof DECLINE_NETWORK_TOOL_CALL_ROUTE,\n  typeof STREAM_NETWORK_ROUTE,\n  typeof UPDATE_AGENT_MODEL_ROUTE,\n  typeof RESET_AGENT_MODEL_ROUTE,\n  typeof REORDER_AGENT_MODEL_LIST_ROUTE,\n  typeof UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE,\n  typeof ENHANCE_INSTRUCTIONS_ROUTE,\n  typeof GET_AGENT_TOOL_ROUTE,\n  typeof READ_AGENT_PLAN_ROUTE,\n  typeof GET_AGENT_SKILL_ROUTE,\n  typeof GENERATE_SPEECH_ROUTE,\n  typeof GENERATE_SPEECH_DEPRECATED_ROUTE,\n  typeof TRANSCRIBE_SPEECH_ROUTE,\n  typeof TRANSCRIBE_SPEECH_DEPRECATED_ROUTE,\n  typeof GET_LISTENER_ROUTE,\n  typeof STREAM_VNEXT_DEPRECATED_ROUTE,\n  typeof STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE,\n  typeof STREAM_UI_MESSAGE_DEPRECATED_ROUTE,\n];\n","import {\n  BACKGROUND_TASK_STREAM_ROUTE,\n  GET_BACKGROUND_TASK_ROUTE,\n  LIST_BACKGROUND_TASKS_ROUTE,\n} from '../../handlers/background-tasks';\nimport type { ServerRoute } from '.';\n\nexport const BACKGROUND_TASK_ROUTES: ServerRoute<any, any, any>[] = [\n  BACKGROUND_TASK_STREAM_ROUTE,\n  LIST_BACKGROUND_TASKS_ROUTE,\n  GET_BACKGROUND_TASK_ROUTE,\n];\n","import {\n  LIST_CHANNEL_PLATFORMS_ROUTE,\n  LIST_CHANNEL_INSTALLATIONS_ROUTE,\n  CONNECT_CHANNEL_ROUTE,\n  DISCONNECT_CHANNEL_ROUTE,\n} from '../../handlers/channels';\n\nexport const CHANNELS_ROUTES = [\n  LIST_CHANNEL_PLATFORMS_ROUTE,\n  LIST_CHANNEL_INSTALLATIONS_ROUTE,\n  CONNECT_CHANNEL_ROUTE,\n  DISCONNECT_CHANNEL_ROUTE,\n] as const;\n","import {\n  CREATE_CONVERSATION_ROUTE,\n  DELETE_CONVERSATION_ROUTE,\n  GET_CONVERSATION_ITEMS_ROUTE,\n  GET_CONVERSATION_ROUTE,\n} from '../../handlers/conversations';\n\nexport const CONVERSATIONS_ROUTES = [\n  CREATE_CONVERSATION_ROUTE,\n  GET_CONVERSATION_ROUTE,\n  GET_CONVERSATION_ITEMS_ROUTE,\n  DELETE_CONVERSATION_ROUTE,\n] as const;\n","import {\n  LIST_DATASETS_ROUTE,\n  CREATE_DATASET_ROUTE,\n  GET_DATASET_ROUTE,\n  UPDATE_DATASET_ROUTE,\n  DELETE_DATASET_ROUTE,\n  LIST_ITEMS_ROUTE,\n  ADD_ITEM_ROUTE,\n  GET_ITEM_ROUTE,\n  UPDATE_ITEM_ROUTE,\n  DELETE_ITEM_ROUTE,\n  LIST_ALL_EXPERIMENTS_ROUTE,\n  EXPERIMENT_REVIEW_SUMMARY_ROUTE,\n  LIST_EXPERIMENTS_ROUTE,\n  TRIGGER_EXPERIMENT_ROUTE,\n  GET_EXPERIMENT_ROUTE,\n  LIST_EXPERIMENT_RESULTS_ROUTE,\n  UPDATE_EXPERIMENT_RESULT_ROUTE,\n  COMPARE_EXPERIMENTS_ROUTE,\n  LIST_DATASET_VERSIONS_ROUTE,\n  LIST_ITEM_VERSIONS_ROUTE,\n  GET_ITEM_VERSION_ROUTE,\n  BATCH_INSERT_ITEMS_ROUTE,\n  BATCH_DELETE_ITEMS_ROUTE,\n  GENERATE_ITEMS_ROUTE,\n  CLUSTER_FAILURES_ROUTE,\n} from '../../handlers/datasets';\n\nexport const DATASETS_ROUTES = [\n  // Dataset CRUD\n  LIST_DATASETS_ROUTE,\n  CREATE_DATASET_ROUTE,\n  GET_DATASET_ROUTE,\n  UPDATE_DATASET_ROUTE,\n  DELETE_DATASET_ROUTE,\n  // Item list and add\n  LIST_ITEMS_ROUTE,\n  ADD_ITEM_ROUTE,\n  // Batch operations - MUST come before item-specific routes to avoid /items/batch matching /items/:itemId\n  BATCH_INSERT_ITEMS_ROUTE,\n  BATCH_DELETE_ITEMS_ROUTE,\n  // Item-specific CRUD (uses :itemId param)\n  GET_ITEM_ROUTE,\n  UPDATE_ITEM_ROUTE,\n  DELETE_ITEM_ROUTE,\n  // Version operations\n  LIST_DATASET_VERSIONS_ROUTE,\n  LIST_ITEM_VERSIONS_ROUTE,\n  GET_ITEM_VERSION_ROUTE,\n  // All experiments (cross-dataset) - MUST come before dataset-scoped experiments\n  LIST_ALL_EXPERIMENTS_ROUTE,\n  // Experiment review summary (cross-dataset) - MUST come before dataset-scoped experiments\n  EXPERIMENT_REVIEW_SUMMARY_ROUTE,\n  // Experiment operations (dataset-scoped)\n  LIST_EXPERIMENTS_ROUTE,\n  TRIGGER_EXPERIMENT_ROUTE,\n  GET_EXPERIMENT_ROUTE,\n  LIST_EXPERIMENT_RESULTS_ROUTE,\n  UPDATE_EXPERIMENT_RESULT_ROUTE,\n  // Analytics\n  COMPARE_EXPERIMENTS_ROUTE,\n  // AI generation\n  GENERATE_ITEMS_ROUTE,\n  // Failure analysis\n  CLUSTER_FAILURES_ROUTE,\n] as const;\n","import {\n  DELETE_DYNAMIC_WORKFLOW_ROUTE,\n  GET_DYNAMIC_WORKFLOW_ROUTE,\n  LIST_DYNAMIC_WORKFLOWS_ROUTE,\n  UPSERT_DYNAMIC_WORKFLOW_ROUTE,\n} from '../../handlers/dynamic-workflows';\nimport type { ServerRoute } from '.';\n\n/**\n * Routes for dynamic workflow definitions: list / get / upsert / delete.\n * Upsert is the path the chat-driven workflow-builder agent (and Studio's\n * future \"Save\" button) uses to persist + live-register a workflow without\n * a server restart.\n */\nexport const DYNAMIC_WORKFLOWS_ROUTES: readonly ServerRoute[] = [\n  LIST_DYNAMIC_WORKFLOWS_ROUTE,\n  UPSERT_DYNAMIC_WORKFLOW_ROUTE,\n  GET_DYNAMIC_WORKFLOW_ROUTE, // After UPSERT (POST) since both are on the same /stored/workflows base\n  DELETE_DYNAMIC_WORKFLOW_ROUTE,\n];\n\nexport type DynamicWorkflowRoutes = readonly [\n  typeof LIST_DYNAMIC_WORKFLOWS_ROUTE,\n  typeof UPSERT_DYNAMIC_WORKFLOW_ROUTE,\n  typeof GET_DYNAMIC_WORKFLOW_ROUTE,\n  typeof DELETE_DYNAMIC_WORKFLOW_ROUTE,\n];\n","import {\n  BUILDER_REGISTRY_INSTALL_ROUTE,\n  BUILDER_REGISTRY_POPULAR_ROUTE,\n  BUILDER_REGISTRY_PREVIEW_ROUTE,\n  BUILDER_REGISTRY_SEARCH_ROUTE,\n  LIST_BUILDER_REGISTRIES_ROUTE,\n} from '../../handlers/builder-registry';\nimport {\n  GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE,\n  GET_EDITOR_BUILDER_SETTINGS_ROUTE,\n  GET_INFRASTRUCTURE_STATUS_ROUTE,\n} from '../../handlers/editor-builder';\n\n/**\n * Editor Builder Routes\n *\n * Routes for agent builder settings, infrastructure status, and external\n * skill registries.\n */\nexport const EDITOR_BUILDER_ROUTES = [\n  GET_EDITOR_BUILDER_SETTINGS_ROUTE,\n  GET_EDITOR_BUILDER_AVAILABLE_MODELS_ROUTE,\n  GET_INFRASTRUCTURE_STATUS_ROUTE,\n  LIST_BUILDER_REGISTRIES_ROUTE,\n  BUILDER_REGISTRY_SEARCH_ROUTE,\n  BUILDER_REGISTRY_POPULAR_ROUTE,\n  BUILDER_REGISTRY_PREVIEW_ROUTE,\n  BUILDER_REGISTRY_INSTALL_ROUTE,\n] as const;\n","/**\n * Legacy routes that are deprecated but still exist in deployer for backward compatibility.\n * These routes should not be used in new code and will be removed in a future version.\n */\n\nimport { GENERATE_LEGACY_ROUTE, STREAM_GENERATE_LEGACY_ROUTE } from '../../handlers/agents';\nimport { STREAM_LEGACY_WORKFLOW_ROUTE, OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE } from '../../handlers/workflows';\n\nexport const LEGACY_ROUTES = [\n  // ============================================================================\n  // Legacy Agent Routes\n  // ============================================================================\n  GENERATE_LEGACY_ROUTE,\n  STREAM_GENERATE_LEGACY_ROUTE,\n\n  // ============================================================================\n  // Legacy Workflow Routes\n  // ============================================================================\n  STREAM_LEGACY_WORKFLOW_ROUTE,\n  OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE,\n] as const;\n","import { LIST_LOG_TRANSPORTS_ROUTE, LIST_LOGS_ROUTE, LIST_LOGS_BY_RUN_ID_ROUTE } from '../../handlers/logs';\n\nexport const LOGS_ROUTES = [LIST_LOG_TRANSPORTS_ROUTE, LIST_LOGS_ROUTE, LIST_LOGS_BY_RUN_ID_ROUTE] as const;\n","import {\n  LIST_MCP_SERVERS_ROUTE,\n  GET_MCP_SERVER_DETAIL_ROUTE,\n  LIST_MCP_SERVER_TOOLS_ROUTE,\n  GET_MCP_SERVER_TOOL_DETAIL_ROUTE,\n  EXECUTE_MCP_SERVER_TOOL_ROUTE,\n  LIST_MCP_SERVER_RESOURCES_ROUTE,\n  READ_MCP_SERVER_RESOURCE_ROUTE,\n  MCP_HTTP_TRANSPORT_ROUTE,\n  MCP_SSE_TRANSPORT_ROUTE,\n  MCP_SSE_MESSAGES_ROUTE,\n} from '../../handlers/mcp';\n\n/**\n * MCP Routes\n *\n * Registry routes provide access to the MCP server registry and tools.\n * Transport routes handle the MCP protocol communication (HTTP and SSE).\n */\nexport const MCP_ROUTES = [\n  // ============================================================================\n  // MCP Server Registry Routes\n  // ============================================================================\n  LIST_MCP_SERVERS_ROUTE,\n  GET_MCP_SERVER_DETAIL_ROUTE,\n\n  // ============================================================================\n  // MCP Server Tool Routes\n  // ============================================================================\n  LIST_MCP_SERVER_TOOLS_ROUTE,\n  GET_MCP_SERVER_TOOL_DETAIL_ROUTE,\n  EXECUTE_MCP_SERVER_TOOL_ROUTE,\n\n  // ============================================================================\n  // MCP Server Resource Routes\n  // ============================================================================\n  LIST_MCP_SERVER_RESOURCES_ROUTE,\n  READ_MCP_SERVER_RESOURCE_ROUTE,\n\n  // ============================================================================\n  // MCP Transport Routes (handled by adapters)\n  // ============================================================================\n  MCP_HTTP_TRANSPORT_ROUTE,\n  MCP_SSE_TRANSPORT_ROUTE,\n  MCP_SSE_MESSAGES_ROUTE,\n] as const;\n","import {\n  GET_MEMORY_STATUS_ROUTE,\n  GET_MEMORY_CONFIG_ROUTE,\n  GET_OBSERVATIONAL_MEMORY_ROUTE,\n  AWAIT_BUFFER_STATUS_ROUTE,\n  LIST_THREADS_ROUTE,\n  GET_THREAD_BY_ID_ROUTE,\n  LIST_MESSAGES_ROUTE,\n  GET_WORKING_MEMORY_ROUTE,\n  SAVE_MESSAGES_ROUTE,\n  CREATE_THREAD_ROUTE,\n  UPDATE_THREAD_ROUTE,\n  DELETE_THREAD_ROUTE,\n  CLONE_THREAD_ROUTE,\n  UPDATE_WORKING_MEMORY_ROUTE,\n  DELETE_MESSAGES_ROUTE,\n  SEARCH_MEMORY_ROUTE,\n  GET_MEMORY_STATUS_NETWORK_ROUTE,\n  LIST_THREADS_NETWORK_ROUTE,\n  GET_THREAD_BY_ID_NETWORK_ROUTE,\n  LIST_MESSAGES_NETWORK_ROUTE,\n  SAVE_MESSAGES_NETWORK_ROUTE,\n  CREATE_THREAD_NETWORK_ROUTE,\n  UPDATE_THREAD_NETWORK_ROUTE,\n  DELETE_THREAD_NETWORK_ROUTE,\n  DELETE_MESSAGES_NETWORK_ROUTE,\n} from '../../handlers/memory';\n\nexport const MEMORY_ROUTES = [\n  GET_MEMORY_STATUS_ROUTE,\n  GET_MEMORY_CONFIG_ROUTE,\n  GET_OBSERVATIONAL_MEMORY_ROUTE,\n  AWAIT_BUFFER_STATUS_ROUTE,\n  LIST_THREADS_ROUTE,\n  GET_THREAD_BY_ID_ROUTE,\n  LIST_MESSAGES_ROUTE,\n  GET_WORKING_MEMORY_ROUTE,\n  SAVE_MESSAGES_ROUTE,\n  CREATE_THREAD_ROUTE,\n  UPDATE_THREAD_ROUTE,\n  DELETE_THREAD_ROUTE,\n  CLONE_THREAD_ROUTE,\n  UPDATE_WORKING_MEMORY_ROUTE,\n  DELETE_MESSAGES_ROUTE,\n  SEARCH_MEMORY_ROUTE,\n  GET_MEMORY_STATUS_NETWORK_ROUTE,\n  LIST_THREADS_NETWORK_ROUTE,\n  GET_THREAD_BY_ID_NETWORK_ROUTE,\n  LIST_MESSAGES_NETWORK_ROUTE,\n  SAVE_MESSAGES_NETWORK_ROUTE,\n  CREATE_THREAD_NETWORK_ROUTE,\n  UPDATE_THREAD_NETWORK_ROUTE,\n  DELETE_THREAD_NETWORK_ROUTE,\n  DELETE_MESSAGES_NETWORK_ROUTE,\n] as const;\n","import {\n  LIST_TRACES_ROUTE,\n  LIST_TRACES_LIGHT_ROUTE,\n  LIST_BRANCHES_ROUTE,\n  GET_BRANCH_ROUTE,\n  GET_TRACE_ROUTE,\n  GET_TRACE_LIGHT_ROUTE,\n  GET_SPAN_ROUTE,\n  GET_TRACE_TRAJECTORY_ROUTE,\n  SCORE_TRACES_ROUTE,\n  LIST_SCORES_BY_SPAN_ROUTE,\n} from '../../handlers/observability';\nimport {\n  LIST_METRICS,\n  LIST_LOGS,\n  LIST_SCORES,\n  CREATE_SCORE,\n  GET_SCORE,\n  GET_SCORE_AGGREGATE,\n  GET_SCORE_BREAKDOWN,\n  GET_SCORE_TIME_SERIES,\n  GET_SCORE_PERCENTILES,\n  LIST_FEEDBACK,\n  CREATE_FEEDBACK,\n  GET_FEEDBACK_AGGREGATE,\n  GET_FEEDBACK_BREAKDOWN,\n  GET_FEEDBACK_TIME_SERIES,\n  GET_FEEDBACK_PERCENTILES,\n  GET_METRIC_AGGREGATE,\n  GET_METRIC_BREAKDOWN,\n  GET_METRIC_TIME_SERIES,\n  GET_METRIC_PERCENTILES,\n  GET_METRIC_NAMES,\n  GET_METRIC_LABEL_KEYS,\n  GET_METRIC_LABEL_VALUES,\n  GET_ENTITY_TYPES,\n  GET_ENTITY_NAMES,\n  GET_SERVICE_NAMES,\n  GET_ENVIRONMENTS,\n  GET_TAGS,\n} from '../../handlers/observability-new-endpoints';\n\nexport const OBSERVABILITY_ROUTES = [\n  // Legacy\n  LIST_TRACES_ROUTE,\n  LIST_TRACES_LIGHT_ROUTE,\n  LIST_BRANCHES_ROUTE,\n  GET_BRANCH_ROUTE,\n  GET_TRACE_ROUTE,\n  GET_TRACE_LIGHT_ROUTE,\n  GET_SPAN_ROUTE,\n  GET_TRACE_TRAJECTORY_ROUTE,\n  SCORE_TRACES_ROUTE,\n  LIST_SCORES_BY_SPAN_ROUTE,\n  // New observability routes\n  LIST_METRICS,\n  LIST_LOGS,\n  LIST_SCORES,\n  CREATE_SCORE,\n  GET_SCORE,\n  GET_SCORE_AGGREGATE,\n  GET_SCORE_BREAKDOWN,\n  GET_SCORE_TIME_SERIES,\n  GET_SCORE_PERCENTILES,\n  LIST_FEEDBACK,\n  CREATE_FEEDBACK,\n  GET_FEEDBACK_AGGREGATE,\n  GET_FEEDBACK_BREAKDOWN,\n  GET_FEEDBACK_TIME_SERIES,\n  GET_FEEDBACK_PERCENTILES,\n  GET_METRIC_AGGREGATE,\n  GET_METRIC_BREAKDOWN,\n  GET_METRIC_TIME_SERIES,\n  GET_METRIC_PERCENTILES,\n  GET_METRIC_NAMES,\n  GET_METRIC_LABEL_KEYS,\n  GET_METRIC_LABEL_VALUES,\n  GET_ENTITY_TYPES,\n  GET_ENTITY_NAMES,\n  GET_SERVICE_NAMES,\n  GET_ENVIRONMENTS,\n  GET_TAGS,\n] as const;\n","import { LIST_PROCESSOR_PROVIDERS_ROUTE, GET_PROCESSOR_PROVIDER_ROUTE } from '../../handlers/processor-providers';\n\nexport const PROCESSOR_PROVIDER_ROUTES = [LIST_PROCESSOR_PROVIDERS_ROUTE, GET_PROCESSOR_PROVIDER_ROUTE] as const;\n","import { LIST_PROCESSORS_ROUTE, GET_PROCESSOR_BY_ID_ROUTE, EXECUTE_PROCESSOR_ROUTE } from '../../handlers/processors';\n\nexport const PROCESSORS_ROUTES = [LIST_PROCESSORS_ROUTE, GET_PROCESSOR_BY_ID_ROUTE, EXECUTE_PROCESSOR_ROUTE] as const;\n","import { CREATE_RESPONSE_ROUTE, DELETE_RESPONSE_ROUTE, GET_RESPONSE_ROUTE } from '../../handlers/responses';\n\nexport const RESPONSES_ROUTES = [CREATE_RESPONSE_ROUTE, GET_RESPONSE_ROUTE, DELETE_RESPONSE_ROUTE] as const;\n","import {\n  CREATE_SCHEDULE_ROUTE,\n  DELETE_SCHEDULE_ROUTE,\n  GET_SCHEDULE_ROUTE,\n  LIST_SCHEDULES_ROUTE,\n  LIST_SCHEDULE_TRIGGERS_ROUTE,\n  PAUSE_SCHEDULE_ROUTE,\n  RESUME_SCHEDULE_ROUTE,\n  RUN_SCHEDULE_ROUTE,\n  UPDATE_SCHEDULE_ROUTE,\n} from '../../handlers/schedules';\nimport type { ServerRoute } from '.';\n\nexport const SCHEDULES_ROUTES: ServerRoute<any, any, any>[] = [\n  LIST_SCHEDULES_ROUTE,\n  GET_SCHEDULE_ROUTE,\n  CREATE_SCHEDULE_ROUTE,\n  UPDATE_SCHEDULE_ROUTE,\n  DELETE_SCHEDULE_ROUTE,\n  LIST_SCHEDULE_TRIGGERS_ROUTE,\n  PAUSE_SCHEDULE_ROUTE,\n  RESUME_SCHEDULE_ROUTE,\n  RUN_SCHEDULE_ROUTE,\n];\n","import {\n  LIST_SCORERS_ROUTE,\n  GET_SCORER_ROUTE,\n  LIST_SCORES_BY_RUN_ID_ROUTE,\n  LIST_SCORES_BY_SCORER_ID_ROUTE,\n  LIST_SCORES_BY_ENTITY_ID_ROUTE,\n  SAVE_SCORE_ROUTE,\n} from '../../handlers/scores';\n\nexport const SCORES_ROUTES = [\n  LIST_SCORERS_ROUTE,\n  GET_SCORER_ROUTE,\n  LIST_SCORES_BY_RUN_ID_ROUTE,\n  LIST_SCORES_BY_SCORER_ID_ROUTE,\n  LIST_SCORES_BY_ENTITY_ID_ROUTE,\n  SAVE_SCORE_ROUTE,\n] as const;\n","import {\n  LIST_AGENT_VERSIONS_ROUTE,\n  CREATE_AGENT_VERSION_ROUTE,\n  GET_AGENT_VERSION_ROUTE,\n  ACTIVATE_AGENT_VERSION_ROUTE,\n  RESTORE_AGENT_VERSION_ROUTE,\n  DELETE_AGENT_VERSION_ROUTE,\n  COMPARE_AGENT_VERSIONS_ROUTE,\n} from '../../handlers/agent-versions';\nimport { FAVORITE_STORED_AGENT_ROUTE, UNFAVORITE_STORED_AGENT_ROUTE } from '../../handlers/stored-agent-favorites';\nimport {\n  LIST_STORED_AGENTS_ROUTE,\n  GET_STORED_AGENT_ROUTE,\n  GET_STORED_AGENT_DEPENDENTS_ROUTE,\n  CREATE_STORED_AGENT_ROUTE,\n  UPDATE_STORED_AGENT_ROUTE,\n  DELETE_STORED_AGENT_ROUTE,\n  PREVIEW_INSTRUCTIONS_ROUTE,\n  EXPORT_STORED_AGENT_ROUTE,\n  OPEN_STORED_AGENT_CHANGE_REQUEST_ROUTE,\n} from '../../handlers/stored-agents';\nimport type { ServerRoute } from '.';\n\n/**\n * Routes for stored agents CRUD operations and version management.\n * These routes provide API access to agent configurations stored in the database,\n * enabling dynamic creation and management of agents via Mastra Studio.\n */\nexport const STORED_AGENTS_ROUTES: readonly ServerRoute[] = [\n  // ============================================================================\n  // Stored Agents CRUD Routes\n  // IMPORTANT: Routes with literal paths (e.g., /preview-instructions) must come\n  // BEFORE routes with path parameters (e.g., /:storedAgentId) to ensure correct matching.\n  // ============================================================================\n  LIST_STORED_AGENTS_ROUTE,\n  PREVIEW_INSTRUCTIONS_ROUTE, // Must be before GET_STORED_AGENT_ROUTE\n  GET_STORED_AGENT_DEPENDENTS_ROUTE, // Must be before GET_STORED_AGENT_ROUTE (longer literal)\n  EXPORT_STORED_AGENT_ROUTE, // Must be before GET_STORED_AGENT_ROUTE\n  OPEN_STORED_AGENT_CHANGE_REQUEST_ROUTE, // Must be before GET_STORED_AGENT_ROUTE\n  GET_STORED_AGENT_ROUTE,\n  CREATE_STORED_AGENT_ROUTE,\n  UPDATE_STORED_AGENT_ROUTE,\n  DELETE_STORED_AGENT_ROUTE,\n\n  // ============================================================================\n  // Agent Versions Routes\n  // IMPORTANT: Routes with literal paths (e.g., /compare) must come BEFORE\n  // routes with path parameters (e.g., /:versionId) to ensure correct matching.\n  // ============================================================================\n  LIST_AGENT_VERSIONS_ROUTE,\n  CREATE_AGENT_VERSION_ROUTE,\n  COMPARE_AGENT_VERSIONS_ROUTE, // Must be before GET_AGENT_VERSION_ROUTE\n  GET_AGENT_VERSION_ROUTE,\n  ACTIVATE_AGENT_VERSION_ROUTE,\n  RESTORE_AGENT_VERSION_ROUTE,\n  DELETE_AGENT_VERSION_ROUTE,\n\n  // ============================================================================\n  // Favorites (EE)\n  // ============================================================================\n  FAVORITE_STORED_AGENT_ROUTE,\n  UNFAVORITE_STORED_AGENT_ROUTE,\n];\n\n/**\n * Type-level tuple preserving each stored agent route's specific schema types.\n * Used by ServerRoutes to build the type-level route map.\n */\nexport type StoredAgentRoutes = readonly [\n  typeof LIST_STORED_AGENTS_ROUTE,\n  typeof PREVIEW_INSTRUCTIONS_ROUTE,\n  typeof GET_STORED_AGENT_DEPENDENTS_ROUTE,\n  typeof EXPORT_STORED_AGENT_ROUTE,\n  typeof OPEN_STORED_AGENT_CHANGE_REQUEST_ROUTE,\n  typeof GET_STORED_AGENT_ROUTE,\n  typeof CREATE_STORED_AGENT_ROUTE,\n  typeof UPDATE_STORED_AGENT_ROUTE,\n  typeof DELETE_STORED_AGENT_ROUTE,\n  typeof LIST_AGENT_VERSIONS_ROUTE,\n  typeof CREATE_AGENT_VERSION_ROUTE,\n  typeof COMPARE_AGENT_VERSIONS_ROUTE,\n  typeof GET_AGENT_VERSION_ROUTE,\n  typeof ACTIVATE_AGENT_VERSION_ROUTE,\n  typeof RESTORE_AGENT_VERSION_ROUTE,\n  typeof DELETE_AGENT_VERSION_ROUTE,\n  typeof FAVORITE_STORED_AGENT_ROUTE,\n  typeof UNFAVORITE_STORED_AGENT_ROUTE,\n];\n","import {\n  LIST_MCP_CLIENT_VERSIONS_ROUTE,\n  CREATE_MCP_CLIENT_VERSION_ROUTE,\n  GET_MCP_CLIENT_VERSION_ROUTE,\n  ACTIVATE_MCP_CLIENT_VERSION_ROUTE,\n  RESTORE_MCP_CLIENT_VERSION_ROUTE,\n  DELETE_MCP_CLIENT_VERSION_ROUTE,\n  COMPARE_MCP_CLIENT_VERSIONS_ROUTE,\n} from '../../handlers/mcp-client-versions';\nimport {\n  LIST_STORED_MCP_CLIENTS_ROUTE,\n  GET_STORED_MCP_CLIENT_ROUTE,\n  CREATE_STORED_MCP_CLIENT_ROUTE,\n  UPDATE_STORED_MCP_CLIENT_ROUTE,\n  DELETE_STORED_MCP_CLIENT_ROUTE,\n} from '../../handlers/stored-mcp-clients';\n\nexport const STORED_MCP_CLIENTS_ROUTES = [\n  // Stored MCP Clients CRUD Routes\n  LIST_STORED_MCP_CLIENTS_ROUTE,\n  GET_STORED_MCP_CLIENT_ROUTE,\n  CREATE_STORED_MCP_CLIENT_ROUTE,\n  UPDATE_STORED_MCP_CLIENT_ROUTE,\n  DELETE_STORED_MCP_CLIENT_ROUTE,\n\n  // MCP Client Versions Routes\n  // IMPORTANT: Routes with literal paths (e.g., /compare) must come BEFORE\n  // routes with path parameters (e.g., /:versionId) to ensure correct matching.\n  LIST_MCP_CLIENT_VERSIONS_ROUTE,\n  CREATE_MCP_CLIENT_VERSION_ROUTE,\n  COMPARE_MCP_CLIENT_VERSIONS_ROUTE,\n  GET_MCP_CLIENT_VERSION_ROUTE,\n  ACTIVATE_MCP_CLIENT_VERSION_ROUTE,\n  RESTORE_MCP_CLIENT_VERSION_ROUTE,\n  DELETE_MCP_CLIENT_VERSION_ROUTE,\n] as const;\n","import {\n  LIST_PROMPT_BLOCK_VERSIONS_ROUTE,\n  CREATE_PROMPT_BLOCK_VERSION_ROUTE,\n  GET_PROMPT_BLOCK_VERSION_ROUTE,\n  ACTIVATE_PROMPT_BLOCK_VERSION_ROUTE,\n  RESTORE_PROMPT_BLOCK_VERSION_ROUTE,\n  DELETE_PROMPT_BLOCK_VERSION_ROUTE,\n  COMPARE_PROMPT_BLOCK_VERSIONS_ROUTE,\n} from '../../handlers/prompt-block-versions';\nimport {\n  LIST_STORED_PROMPT_BLOCKS_ROUTE,\n  GET_STORED_PROMPT_BLOCK_ROUTE,\n  CREATE_STORED_PROMPT_BLOCK_ROUTE,\n  UPDATE_STORED_PROMPT_BLOCK_ROUTE,\n  DELETE_STORED_PROMPT_BLOCK_ROUTE,\n} from '../../handlers/stored-prompt-blocks';\n\nexport const STORED_PROMPT_BLOCKS_ROUTES = [\n  // Stored Prompt Blocks CRUD Routes\n  LIST_STORED_PROMPT_BLOCKS_ROUTE,\n  GET_STORED_PROMPT_BLOCK_ROUTE,\n  CREATE_STORED_PROMPT_BLOCK_ROUTE,\n  UPDATE_STORED_PROMPT_BLOCK_ROUTE,\n  DELETE_STORED_PROMPT_BLOCK_ROUTE,\n\n  // Prompt Block Versions Routes\n  // IMPORTANT: Routes with literal paths (e.g., /compare) must come BEFORE\n  // routes with path parameters (e.g., /:versionId) to ensure correct matching.\n  LIST_PROMPT_BLOCK_VERSIONS_ROUTE,\n  CREATE_PROMPT_BLOCK_VERSION_ROUTE,\n  COMPARE_PROMPT_BLOCK_VERSIONS_ROUTE,\n  GET_PROMPT_BLOCK_VERSION_ROUTE,\n  ACTIVATE_PROMPT_BLOCK_VERSION_ROUTE,\n  RESTORE_PROMPT_BLOCK_VERSION_ROUTE,\n  DELETE_PROMPT_BLOCK_VERSION_ROUTE,\n] as const;\n","import {\n  LIST_SCORER_VERSIONS_ROUTE,\n  CREATE_SCORER_VERSION_ROUTE,\n  GET_SCORER_VERSION_ROUTE,\n  ACTIVATE_SCORER_VERSION_ROUTE,\n  RESTORE_SCORER_VERSION_ROUTE,\n  DELETE_SCORER_VERSION_ROUTE,\n  COMPARE_SCORER_VERSIONS_ROUTE,\n} from '../../handlers/scorer-versions';\nimport {\n  LIST_STORED_SCORERS_ROUTE,\n  GET_STORED_SCORER_ROUTE,\n  CREATE_STORED_SCORER_ROUTE,\n  UPDATE_STORED_SCORER_ROUTE,\n  DELETE_STORED_SCORER_ROUTE,\n} from '../../handlers/stored-scorers';\n\nexport const STORED_SCORERS_ROUTES = [\n  // Stored Scorers CRUD Routes\n  LIST_STORED_SCORERS_ROUTE,\n  GET_STORED_SCORER_ROUTE,\n  CREATE_STORED_SCORER_ROUTE,\n  UPDATE_STORED_SCORER_ROUTE,\n  DELETE_STORED_SCORER_ROUTE,\n\n  // Scorer Versions Routes\n  // IMPORTANT: Routes with literal paths (e.g., /compare) must come BEFORE\n  // routes with path parameters (e.g., /:versionId) to ensure correct matching.\n  LIST_SCORER_VERSIONS_ROUTE,\n  CREATE_SCORER_VERSION_ROUTE,\n  COMPARE_SCORER_VERSIONS_ROUTE,\n  GET_SCORER_VERSION_ROUTE,\n  ACTIVATE_SCORER_VERSION_ROUTE,\n  RESTORE_SCORER_VERSION_ROUTE,\n  DELETE_SCORER_VERSION_ROUTE,\n] as const;\n","import { FAVORITE_STORED_SKILL_ROUTE, UNFAVORITE_STORED_SKILL_ROUTE } from '../../handlers/stored-skill-favorites';\nimport {\n  LIST_STORED_SKILLS_ROUTE,\n  GET_STORED_SKILL_ROUTE,\n  CREATE_STORED_SKILL_ROUTE,\n  UPDATE_STORED_SKILL_ROUTE,\n  DELETE_STORED_SKILL_ROUTE,\n  PUBLISH_STORED_SKILL_ROUTE,\n} from '../../handlers/stored-skills';\n\nexport const STORED_SKILLS_ROUTES = [\n  // Stored Skills CRUD Routes\n  LIST_STORED_SKILLS_ROUTE,\n  GET_STORED_SKILL_ROUTE,\n  CREATE_STORED_SKILL_ROUTE,\n  UPDATE_STORED_SKILL_ROUTE,\n  DELETE_STORED_SKILL_ROUTE,\n  // Publish\n  PUBLISH_STORED_SKILL_ROUTE,\n  // Favorites (EE)\n  FAVORITE_STORED_SKILL_ROUTE,\n  UNFAVORITE_STORED_SKILL_ROUTE,\n] as const;\n","import {\n  LIST_STORED_WORKSPACES_ROUTE,\n  GET_STORED_WORKSPACE_ROUTE,\n  CREATE_STORED_WORKSPACE_ROUTE,\n  UPDATE_STORED_WORKSPACE_ROUTE,\n  DELETE_STORED_WORKSPACE_ROUTE,\n} from '../../handlers/stored-workspaces';\n\nexport const STORED_WORKSPACES_ROUTES = [\n  // Stored Workspaces CRUD Routes\n  LIST_STORED_WORKSPACES_ROUTE,\n  GET_STORED_WORKSPACE_ROUTE,\n  CREATE_STORED_WORKSPACE_ROUTE,\n  UPDATE_STORED_WORKSPACE_ROUTE,\n  DELETE_STORED_WORKSPACE_ROUTE,\n] as const;\n","import { GET_API_SCHEMA_ROUTE, GET_SYSTEM_PACKAGES_ROUTE } from '../../handlers/system';\n\n/**\n * System Routes\n *\n * Routes for system information and diagnostics.\n */\nexport const SYSTEM_ROUTES = [GET_SYSTEM_PACKAGES_ROUTE, GET_API_SCHEMA_ROUTE] as const;\n","import {\n  AUTHORIZE_TOOL_PROVIDER_ROUTE,\n  DISCONNECT_TOOL_PROVIDER_CONNECTION_ROUTE,\n  GET_TOOL_PROVIDER_AUTH_STATUS_ROUTE,\n  GET_TOOL_PROVIDER_CONNECTION_USAGE_ROUTE,\n  GET_TOOL_PROVIDER_HEALTH_ROUTE,\n  GET_TOOL_PROVIDER_TOOL_SCHEMA_ROUTE,\n  LIST_TOOL_PROVIDERS_ROUTE,\n  LIST_TOOL_PROVIDER_CONNECTIONS_ROUTE,\n  LIST_TOOL_PROVIDER_CONNECTION_FIELDS_ROUTE,\n  LIST_TOOL_PROVIDER_TOOLKITS_ROUTE,\n  LIST_TOOL_PROVIDER_TOOLS_ROUTE,\n  TOOL_PROVIDER_CONNECTION_STATUS_ROUTE,\n  UPDATE_TOOL_PROVIDER_CONNECTION_ROUTE,\n} from '../../handlers/tool-providers';\n\nexport const TOOL_PROVIDER_ROUTES = [\n  LIST_TOOL_PROVIDERS_ROUTE,\n  LIST_TOOL_PROVIDER_TOOLKITS_ROUTE,\n  LIST_TOOL_PROVIDER_TOOLS_ROUTE,\n  GET_TOOL_PROVIDER_TOOL_SCHEMA_ROUTE,\n  AUTHORIZE_TOOL_PROVIDER_ROUTE,\n  GET_TOOL_PROVIDER_AUTH_STATUS_ROUTE,\n  TOOL_PROVIDER_CONNECTION_STATUS_ROUTE,\n  LIST_TOOL_PROVIDER_CONNECTIONS_ROUTE,\n  LIST_TOOL_PROVIDER_CONNECTION_FIELDS_ROUTE,\n  DISCONNECT_TOOL_PROVIDER_CONNECTION_ROUTE,\n  UPDATE_TOOL_PROVIDER_CONNECTION_ROUTE,\n  GET_TOOL_PROVIDER_CONNECTION_USAGE_ROUTE,\n  GET_TOOL_PROVIDER_HEALTH_ROUTE,\n] as const;\n","import { LIST_TOOLS_ROUTE, GET_TOOL_BY_ID_ROUTE, EXECUTE_TOOL_ROUTE } from '../../handlers/tools';\n\nexport const TOOLS_ROUTES = [LIST_TOOLS_ROUTE, GET_TOOL_BY_ID_ROUTE, EXECUTE_TOOL_ROUTE] as const;\n","import {\n  UPSERT_VECTORS_ROUTE,\n  CREATE_INDEX_ROUTE,\n  QUERY_VECTORS_ROUTE,\n  LIST_INDEXES_ROUTE,\n  DESCRIBE_INDEX_ROUTE,\n  DELETE_INDEX_ROUTE,\n  LIST_VECTORS_ROUTE,\n  LIST_EMBEDDERS_ROUTE,\n} from '../../handlers/vector';\n\nexport const VECTORS_ROUTES = [\n  UPSERT_VECTORS_ROUTE,\n  CREATE_INDEX_ROUTE,\n  QUERY_VECTORS_ROUTE,\n  LIST_INDEXES_ROUTE,\n  DESCRIBE_INDEX_ROUTE,\n  DELETE_INDEX_ROUTE,\n  LIST_VECTORS_ROUTE,\n  LIST_EMBEDDERS_ROUTE,\n] as const;\n","import {\n  LIST_WORKFLOWS_ROUTE,\n  LIST_WORKFLOW_RUN_COUNTS_ROUTE,\n  GET_WORKFLOW_BY_ID_ROUTE,\n  LIST_WORKFLOW_RUNS_ROUTE,\n  GET_WORKFLOW_RUN_BY_ID_ROUTE,\n  CREATE_WORKFLOW_RUN_ROUTE,\n  STREAM_WORKFLOW_ROUTE,\n  RESUME_STREAM_WORKFLOW_ROUTE,\n  START_ASYNC_WORKFLOW_ROUTE,\n  START_WORKFLOW_RUN_ROUTE,\n  OBSERVE_STREAM_WORKFLOW_ROUTE,\n  RESUME_ASYNC_WORKFLOW_ROUTE,\n  RESUME_NO_WAIT_WORKFLOW_ROUTE,\n  RESUME_WORKFLOW_ROUTE,\n  CANCEL_WORKFLOW_RUN_ROUTE,\n  TIME_TRAVEL_WORKFLOW_ROUTE,\n  TIME_TRAVEL_STREAM_WORKFLOW_ROUTE,\n  RESTART_WORKFLOW_ROUTE,\n  RESTART_ASYNC_WORKFLOW_ROUTE,\n  RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE,\n  RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE,\n  TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE,\n  DELETE_WORKFLOW_RUN_BY_ID_ROUTE,\n  EXECUTE_WORKFLOW_STEP_ROUTE,\n  RECEIVE_WORKFLOW_EVENT_ROUTE,\n} from '../../handlers/workflows';\n\nexport const WORKFLOWS_ROUTES = [\n  LIST_WORKFLOWS_ROUTE,\n  // Static path must register before the parameterized /workflows/:workflowId\n  // route below, or the router would capture \"run-counts\" as a workflowId.\n  LIST_WORKFLOW_RUN_COUNTS_ROUTE,\n  GET_WORKFLOW_BY_ID_ROUTE,\n  LIST_WORKFLOW_RUNS_ROUTE,\n  GET_WORKFLOW_RUN_BY_ID_ROUTE,\n  DELETE_WORKFLOW_RUN_BY_ID_ROUTE,\n  CREATE_WORKFLOW_RUN_ROUTE,\n  STREAM_WORKFLOW_ROUTE,\n  RESUME_STREAM_WORKFLOW_ROUTE,\n  START_ASYNC_WORKFLOW_ROUTE,\n  START_WORKFLOW_RUN_ROUTE,\n  OBSERVE_STREAM_WORKFLOW_ROUTE,\n  RESUME_ASYNC_WORKFLOW_ROUTE,\n  RESUME_NO_WAIT_WORKFLOW_ROUTE,\n  RESUME_WORKFLOW_ROUTE,\n  CANCEL_WORKFLOW_RUN_ROUTE,\n  TIME_TRAVEL_WORKFLOW_ROUTE,\n  TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE,\n  TIME_TRAVEL_STREAM_WORKFLOW_ROUTE,\n  RESTART_WORKFLOW_ROUTE,\n  RESTART_ASYNC_WORKFLOW_ROUTE,\n  RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE,\n  RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE,\n  EXECUTE_WORKFLOW_STEP_ROUTE,\n  RECEIVE_WORKFLOW_EVENT_ROUTE,\n] as const;\n","/**\n * Workspace Routes\n *\n * All routes for workspace operations under /api/workspaces/*\n */\n\nimport {\n  LIST_WORKSPACES_ROUTE,\n  GET_WORKSPACE_ROUTE,\n  WORKSPACE_FS_ROUTES,\n  WORKSPACE_SEARCH_ROUTES,\n  WORKSPACE_SKILLS_ROUTES,\n  WORKSPACE_SKILLS_SH_ROUTES,\n} from '../../handlers/workspace';\n\nexport const WORKSPACE_ROUTES = [\n  // List all workspaces route (at /api/workspaces)\n  LIST_WORKSPACES_ROUTE,\n\n  // Get workspace route (at /api/workspaces/:workspaceId)\n  GET_WORKSPACE_ROUTE,\n\n  // Filesystem routes (at /api/workspaces/:workspaceId/fs/*)\n  ...WORKSPACE_FS_ROUTES,\n\n  // Search routes (at /api/workspaces/:workspaceId/search, /api/workspaces/:workspaceId/index)\n  ...WORKSPACE_SEARCH_ROUTES,\n\n  // Skills routes (search must come before parameterized routes)\n  ...WORKSPACE_SKILLS_ROUTES,\n\n  // skills.sh proxy routes (at /api/workspaces/:workspaceId/skills-sh/*)\n  ...WORKSPACE_SKILLS_SH_ROUTES,\n] as const;\n","import type { Mastra } from '@mastra/core';\nimport type { ToolsInput } from '@mastra/core/agent';\nimport type { FGARouteConfig, MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, ValidationErrorHook } from '@mastra/core/server';\nimport type * as z from 'zod/v4';\nimport type { InMemoryTaskStore } from '../../a2a/store';\nimport type { OpenAPIRoute } from '../openapi-utils';\nimport { A2A_ROUTES } from './a2a';\nimport { AGENT_BUILDER_ROUTES } from './agent-builder';\nimport { AGENT_CONTROLLER_ROUTES } from './agent-controller';\nimport { AGENTS_ROUTES } from './agents';\nimport type { AgentRoutes } from './agents';\nimport { AUTH_ROUTES } from './auth';\nimport { BACKGROUND_TASK_ROUTES } from './background-tasks';\nimport { CHANNELS_ROUTES } from './channels';\nimport { CONVERSATIONS_ROUTES } from './conversations';\nimport { DATASETS_ROUTES } from './datasets';\nimport { DYNAMIC_WORKFLOWS_ROUTES } from './dynamic-workflows';\nimport { EDITOR_BUILDER_ROUTES } from './editor-builder';\nimport { LEGACY_ROUTES } from './legacy';\nimport { LOGS_ROUTES } from './logs';\nimport { MCP_ROUTES } from './mcp';\nimport { MEMORY_ROUTES } from './memory';\nimport { OBSERVABILITY_ROUTES } from './observability';\nimport { PROCESSOR_PROVIDER_ROUTES } from './processor-providers';\nimport { PROCESSORS_ROUTES } from './processors';\nimport { RESPONSES_ROUTES } from './responses';\nimport { SCHEDULES_ROUTES } from './schedules';\nimport { SCORES_ROUTES } from './scorers';\nimport { STORED_AGENTS_ROUTES } from './stored-agents';\nimport type { StoredAgentRoutes } from './stored-agents';\nimport { STORED_MCP_CLIENTS_ROUTES } from './stored-mcp-clients';\nimport { STORED_PROMPT_BLOCKS_ROUTES } from './stored-prompt-blocks';\nimport { STORED_SCORERS_ROUTES } from './stored-scorers';\nimport { STORED_SKILLS_ROUTES } from './stored-skills';\nimport { STORED_WORKSPACES_ROUTES } from './stored-workspaces';\nimport type { MastraStreamReturn } from './stream-types';\nimport { SYSTEM_ROUTES } from './system';\nimport { TOOL_PROVIDER_ROUTES } from './tool-providers';\nimport { TOOLS_ROUTES } from './tools';\nimport { VECTORS_ROUTES } from './vectors';\nimport { WORKFLOWS_ROUTES } from './workflows';\nimport { WORKSPACE_ROUTES } from './workspace';\n\n/**\n * Server context fields that are available to route handlers.\n * These are injected by the server adapters (Express, Hono, etc.)\n * Fields other than `mastra` are optional to allow direct handler testing.\n */\nexport type ServerContext = {\n  mastra: Mastra;\n  requestContext: RequestContext;\n  registeredTools?: ToolsInput;\n  taskStore?: InMemoryTaskStore;\n  abortSignal: AbortSignal;\n  /** The route prefix configured for the server (e.g., '/api') */\n  routePrefix?: string;\n  /** The web-standard Request object for accessing headers, cookies, etc. */\n  request?: Request;\n};\n\n/**\n * Utility type to infer parameters from Zod schemas.\n * Merges path params, query params, and body params into a single type.\n */\nexport type InferParams<\n  TPathSchema extends z.ZodTypeAny | undefined,\n  TQuerySchema extends z.ZodTypeAny | undefined,\n  TBodySchema extends z.ZodTypeAny | undefined,\n> = (TPathSchema extends z.ZodTypeAny ? z.infer<TPathSchema> : {}) &\n  (TQuerySchema extends z.ZodTypeAny ? z.infer<TQuerySchema> : {}) &\n  (TBodySchema extends z.ZodTypeAny ? z.infer<TBodySchema> : {});\n\n/**\n * All supported response types for server routes.\n * - 'json': Standard JSON response\n * - 'stream': Streaming response (SSE or raw stream)\n * - 'datastream-response': Pre-built Response object for data streams\n * - 'mcp-http': MCP Streamable HTTP transport (handled by adapter)\n * - 'mcp-sse': MCP SSE transport (handled by adapter)\n */\nexport type ResponseType = 'stream' | 'json' | 'datastream-response' | 'mcp-http' | 'mcp-sse';\n\nexport type ServerRouteHandler<\n  TParams = Record<string, unknown>,\n  TResponse = unknown,\n  TResponseType extends ResponseType = 'json',\n> = (\n  params: TParams & ServerContext,\n) => Promise<\n  TResponseType extends 'stream'\n    ? MastraStreamReturn\n    : TResponseType extends 'datastream-response'\n      ? Response\n      : TResponse\n>;\n\n/**\n * Phantom type for preserving Zod schema types on routes.\n * Not present at runtime — used only for type-level inference via RouteMap.\n */\nexport interface RouteSchemas<\n  TPathSchema = unknown,\n  TQuerySchema = unknown,\n  TBodySchema = unknown,\n  TResponseSchema = unknown,\n> {\n  readonly pathParams: TPathSchema;\n  readonly queryParams: TQuerySchema;\n  readonly body: TBodySchema;\n  readonly response: TResponseSchema;\n}\n\nexport type ServerRoute<\n  TParams = Record<string, unknown>,\n  TResponse = unknown,\n  TResponseType extends ResponseType = ResponseType,\n  TSchemas extends RouteSchemas = RouteSchemas,\n  TMethod extends string = string,\n  TPath extends string = string,\n> = Omit<ApiRoute, 'handler' | 'createHandler' | 'method' | 'path' | 'openapi'> & {\n  method: TMethod;\n  path: TPath;\n  responseType: TResponseType;\n  streamFormat?: 'sse' | 'stream'; // Only used when responseType is 'stream', defaults to 'stream'\n  sseFlushOnConnect?: boolean;\n  // Method signature is bivariant in params, allowing heterogeneous route arrays\n  // while still preserving specific param types on individual routes.\n  handler(params: TParams & ServerContext): ReturnType<ServerRouteHandler<TParams, TResponse, TResponseType>>;\n  pathParamSchema?: z.ZodSchema;\n  queryParamSchema?: z.ZodSchema;\n  bodySchema?: z.ZodSchema;\n  responseSchema?: z.ZodSchema;\n  openapi?: OpenAPIRoute; // Auto-generated OpenAPI spec for this route\n  maxBodySize?: number; // Optional route-specific body size limit in bytes\n  deprecated?: boolean; // Flag for deprecated routes (used for route parity, skipped in tests)\n  /**\n   * Permission required to access this route (EE feature).\n   * If set, the user must have this permission to access the route.\n   * Uses the format: `resource:action` or `resource:action:resourceId`\n   *\n   * When an array is provided, the user needs ANY ONE of the listed permissions\n   * (logical OR). This is useful for routes that serve multiple resource types,\n   * e.g. a streaming endpoint used by both runtime and stored agents.\n   *\n   * @example\n   * requiresPermission: MastraFGAPermissions.AGENTS_READ\n   * requiresPermission: MastraFGAPermissions.WORKFLOWS_EXECUTE\n   */\n  requiresPermission?: MastraFGAPermissionInput | MastraFGAPermissionInput[];\n  /**\n   * FGA authorization config for this route (EE feature).\n   * If set, the user must have the specified permission on the resource.\n   *\n   * @example\n   * fga: { resourceType: 'agent', resourceIdParam: 'agentId', permission: MastraFGAPermissions.AGENTS_EXECUTE }\n   */\n  fga?: FGARouteConfig;\n  onValidationError?: ValidationErrorHook;\n  /** @internal Phantom type — not present at runtime. Used for type-level schema inference. */\n  readonly __schemas?: TSchemas;\n};\n\nexport const SERVER_ROUTES: readonly ServerRoute[] = [\n  ...AGENTS_ROUTES,\n  ...AUTH_ROUTES,\n  ...WORKFLOWS_ROUTES,\n  ...TOOLS_ROUTES,\n  ...PROCESSORS_ROUTES,\n  ...RESPONSES_ROUTES,\n  ...CONVERSATIONS_ROUTES,\n  ...MEMORY_ROUTES,\n  ...SCORES_ROUTES,\n  ...OBSERVABILITY_ROUTES,\n  ...LOGS_ROUTES,\n  ...VECTORS_ROUTES,\n  ...A2A_ROUTES,\n  ...WORKSPACE_ROUTES,\n  ...LEGACY_ROUTES,\n  ...MCP_ROUTES,\n  ...STORED_AGENTS_ROUTES,\n  ...DYNAMIC_WORKFLOWS_ROUTES,\n  ...STORED_MCP_CLIENTS_ROUTES,\n  ...STORED_PROMPT_BLOCKS_ROUTES,\n  ...STORED_SCORERS_ROUTES,\n  ...STORED_WORKSPACES_ROUTES,\n  ...STORED_SKILLS_ROUTES,\n  ...TOOL_PROVIDER_ROUTES,\n  ...PROCESSOR_PROVIDER_ROUTES,\n  ...SYSTEM_ROUTES,\n  ...DATASETS_ROUTES,\n  ...BACKGROUND_TASK_ROUTES,\n  ...EDITOR_BUILDER_ROUTES,\n  ...AGENT_BUILDER_ROUTES,\n  ...SCHEDULES_ROUTES,\n  ...CHANNELS_ROUTES,\n  ...AGENT_CONTROLLER_ROUTES,\n];\n\n/**\n * Union type of all individual route arrays.\n * Built from the per-domain `as const` tuples to preserve each route's specific schema types.\n */\nexport type ServerRoutes = readonly [\n  ...AgentRoutes,\n  ...typeof AUTH_ROUTES,\n  ...typeof WORKFLOWS_ROUTES,\n  ...typeof TOOLS_ROUTES,\n  ...typeof PROCESSORS_ROUTES,\n  ...typeof RESPONSES_ROUTES,\n  ...typeof CONVERSATIONS_ROUTES,\n  ...typeof MEMORY_ROUTES,\n  ...typeof SCORES_ROUTES,\n  ...typeof OBSERVABILITY_ROUTES,\n  ...typeof LOGS_ROUTES,\n  ...typeof VECTORS_ROUTES,\n  ...typeof A2A_ROUTES,\n  ...typeof AGENT_BUILDER_ROUTES,\n  ...typeof WORKSPACE_ROUTES,\n  ...typeof LEGACY_ROUTES,\n  ...typeof MCP_ROUTES,\n  ...StoredAgentRoutes,\n  ...typeof STORED_MCP_CLIENTS_ROUTES,\n  ...typeof STORED_PROMPT_BLOCKS_ROUTES,\n  ...typeof STORED_SCORERS_ROUTES,\n  ...typeof STORED_WORKSPACES_ROUTES,\n  ...typeof STORED_SKILLS_ROUTES,\n  ...typeof TOOL_PROVIDER_ROUTES,\n  ...typeof PROCESSOR_PROVIDER_ROUTES,\n  ...typeof SYSTEM_ROUTES,\n  ...typeof DATASETS_ROUTES,\n  ...typeof EDITOR_BUILDER_ROUTES,\n  ...typeof CHANNELS_ROUTES,\n];\n\n// Export route builder and OpenAPI utilities\nexport { createRoute, createPublicRoute, pickParams, jsonQueryParam, wrapSchemaForQueryParams } from './route-builder';\nexport { generateOpenAPIDocument } from '../openapi-utils';\n\n// Export permission utilities\nexport { derivePermission, extractResource, deriveAction, getEffectivePermission } from './permissions';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAa,aAAa,CAAC,sBAAsB,qBAAqB;;;ACiBtE,MAAa,uBAAuB;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;ACMA,MAAa,0BAAkD;CAC7D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AC1BA,MAAa,gBAAwC;CAInD;CACA;CACA;CACA;CAKA;CACA;CAKA;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;CAKA;CACA;CACA;CACA;CAKA;CAKA;CACA;CAKA;CAKA;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;AACF;;;AC3IA,MAAa,yBAAuD;CAClE;CACA;CACA;AACF;;;ACJA,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;AACF;;;ACLA,MAAa,uBAAuB;CAClC;CACA;CACA;CACA;AACF;;;ACgBA,MAAa,kBAAkB;CAE7B;CACA;CACA;CACA;CACA;CAEA;CACA;CAEA;CACA;CAEA;CACA;CACA;CAEA;CACA;CACA;CAEA;CAEA;CAEA;CACA;CACA;CACA;CACA;CAEA;CAEA;CAEA;AACF;;;;;;;;;ACnDA,MAAa,2BAAmD;CAC9D;CACA;CACA;CACA;AACF;;;;;;;;;ACAA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;ACpBA,MAAa,gBAAgB;CAI3B;CACA;CAKA;CACA;AACF;;;AClBA,MAAa,cAAc;CAAC;CAA2B;CAAiB;AAAyB;;;;;;;;;ACiBjG,MAAa,aAAa;CAIxB;CACA;CAKA;CACA;CACA;CAKA;CACA;CAKA;CACA;CACA;AACF;;;ACjBA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;ACZA,MAAa,uBAAuB;CAElC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AChFA,MAAa,4BAA4B,CAAC,gCAAgC,4BAA4B;;;ACAtG,MAAa,oBAAoB;CAAC;CAAuB;CAA2B;AAAuB;;;ACA3G,MAAa,mBAAmB;CAAC;CAAuB;CAAoB;AAAqB;;;ACWjG,MAAa,mBAAiD;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;ACdA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;ACYA,MAAa,uBAA+C;CAM1D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAOA;CACA;CACA;CACA;CACA;CACA;CACA;CAKA;CACA;AACF;;;AC7CA,MAAa,4BAA4B;CAEvC;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AClBA,MAAa,8BAA8B;CAEzC;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AClBA,MAAa,wBAAwB;CAEnC;CACA;CACA;CACA;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;ACzBA,MAAa,uBAAuB;CAElC;CACA;CACA;CACA;CACA;CAEA;CAEA;CACA;AACF;;;ACdA,MAAa,2BAA2B;CAEtC;CACA;CACA;CACA;CACA;AACF;;;;;;;;ACRA,MAAa,gBAAgB,CAAC,2BAA2B,oBAAoB;;;ACS7E,MAAa,uBAAuB;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AC5BA,MAAa,eAAe;CAAC;CAAkB;CAAsB;AAAkB;;;ACSvF,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;ACQA,MAAa,mBAAmB;CAC9B;CAGA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;ACzCA,MAAa,mBAAmB;CAE9B;CAGA;CAGA,GAAG;CAGH,GAAG;CAGH,GAAG;CAGH,GAAG;AACL;;;ACmIA,MAAa,gBAAwC;CACnD,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACL"}