@mastra/server 1.79.0 → 1.80.0-alpha.0

package/dist/{helpers-vrqddDd5.js.map → helpers-gCkmhB9x.js.map}

@@ -1 +1 @@
-{"version":3,"file":"helpers-vrqddDd5.js","names":[],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (!!~ext) pattern += (!!~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport { CompositeAuth } from '@mastra/core/server';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { HTTPException } from '../http-exception';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id').\n  // Any matching pattern that requires auth wins over overlapping public patterns.\n  let matchedPublic = false;\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    if (pathMatchesPattern(path, routePattern)) {\n      if (requiresAuth) {\n        return false;\n      }\n      matchedPublic = true;\n    }\n  }\n\n  return matchedPublic;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (\n    !requiresAuth &&\n    (canAccessPublicly(path, method, authConfig) || isCustomRoutePublic(path, method, customRouteAuthConfig))\n  ) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  type ConsumePendingResponseHeadersFn = (request: typeof authRequest) => Record<string, string> | undefined;\n  const mergePendingProviderHeaders = (request: typeof authRequest = authRequest) => {\n    const consume = (authConfig as { consumePendingResponseHeaders?: ConsumePendingResponseHeadersFn })\n      .consumePendingResponseHeaders;\n    if (typeof consume !== 'function') return;\n    let pending: Record<string, string> | undefined;\n    try {\n      pending = consume.call(authConfig, request);\n    } catch {\n      // Forwarding a rotated cookie is best-effort; never fail auth over it.\n      return;\n    }\n    if (!pending) return;\n    refreshHeaders = { ...(refreshHeaders ?? {}), ...pending };\n  };\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n      mergePendingProviderHeaders();\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      let retryHttpError: HTTPException | undefined;\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              try {\n                const retryAuthRequest = adaptToMastraAuthRequest(refreshedRequest);\n                user = await authConfig.authenticateToken(cookieValue, retryAuthRequest);\n                mergePendingProviderHeaders(retryAuthRequest);\n              } catch (retryErr) {\n                retryHttpError = retryErr instanceof HTTPException ? retryErr : undefined;\n                throw retryErr;\n              }\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        // An explicit HTTP error from the retried authenticateToken goes to the outer handler.\n        if (retryHttpError === refreshErr) throw refreshErr;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        // CompositeAuth validates the authenticating provider's mapper. It can\n        // return undefined when that provider never configured a mapper.\n        if (resourceId !== undefined || !(authConfig instanceof CompositeAuth)) {\n          if (typeof resourceId !== 'string' || !resourceId.trim()) {\n            throw new Error('mapUserToResourceId must return a non-empty string for the authenticated user');\n          }\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    // Explicit HTTP errors from auth callbacks keep their status/message; anything else is redacted.\n    // The HTTPException message is sent to the client, so callers must keep it safe (no internal details).\n    if (err instanceof HTTPException && err.status >= 400 && err.status <= 599) {\n      return { action: 'error', status: err.status, body: { error: err.message }, headers: refreshHeaders };\n    }\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = ctx.buildAuthorizeContext();\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider = mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;;;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAChE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACrE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;;AC7CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAK/C,IAAI,gBAAgB;CACpB,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAGF,IAAI,mBAAmB,MAAM,YAAY,GAAG;GAC1C,IAAI,cACF,OAAO;GAET,gBAAgB;EAClB;CACF;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;AAE1C,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IACE,CAAC,iBACA,kBAAkB,MAAM,QAAQ,UAAU,KAAK,oBAAoB,MAAM,QAAQ,qBAAqB,IAEvG,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAGvD,MAAM,+BAA+B,UAA8B,gBAAgB;EACjF,MAAM,UAAW,WACd;EACH,IAAI,OAAO,YAAY,YAAY;EACnC,IAAI;EACJ,IAAI;GACF,UAAU,QAAQ,KAAK,YAAY,OAAO;EAC5C,QAAQ;GAEN;EACF;EACA,IAAI,CAAC,SAAS;EACd,iBAAiB;GAAE,GAAI,kBAAkB,CAAC;GAAI,GAAG;EAAQ;CAC3D;CAEA,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAAY;GACtD,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;GAClE,4BAA4B;EAC9B,OACE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SAAS;GAChF,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;IAC/D,IAAI,WAAW;KACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;KAC5D,IAAI,YAAY;MAKd,iBAAiB,WAAW,kBAAkB,UAAU;MACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;MACZ,IAAI,iBAAiB;OACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;QACnD,QAAQ,WAAW;QACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;OACzC,CAAC;OACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;OAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;OACJ,IAAI;QACF,MAAM,mBAAmB,yBAAyB,gBAAgB;QAClE,OAAO,MAAM,WAAW,kBAAkB,aAAa,gBAAgB;QACvE,4BAA4B,gBAAgB;OAC9C,SAAS,UAAU;QACjB,iBAAiB,oBAAoB,gBAAgB,WAAW,KAAA;QAChE,MAAM;OACR;MACF;MACA,IAAI,CAAC,MACH,iBAAiB,KAAA;KAErB;IACF;GACF,SAAS,YAAY;IACnB,iBAAiB,KAAA;IAEjB,IAAI,mBAAmB,YAAY,MAAM;IACzC,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;GACH;EACF;EAEA,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAI,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAI,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GAGtD,IAAI,eAAe,KAAA,KAAa,EAAE,sBAAsB,gBAAgB;IACtE,IAAI,OAAO,eAAe,YAAY,CAAC,WAAW,KAAK,GACrD,MAAM,IAAI,MAAM,+EAA+E;IAEjG,eAAe,IAAI,wBAAwB,UAAU;GACvD;EACF,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAI,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cAAc;IAChB,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;SACvG;KACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;KACpE,eAAe,IAAI,6BAA6B,WAAW;KAE3D,eAAe,IAAI,mBAAmB,WAAW;KAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;KACxD,eAAe,IAAI,uBAAuB,KAAK;KAE/C,eAAe,IAAI,aAAa,KAAK;IACvC;GACF;EACF,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EAGD,IAAI,eAAe,iBAAiB,IAAI,UAAU,OAAO,IAAI,UAAU,KACrE,OAAO;GAAE,QAAQ;GAAS,QAAQ,IAAI;GAAQ,MAAM,EAAE,OAAO,IAAI,QAAQ;GAAG,SAAS;EAAe;EAEtG,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,IAAI,sBAAsB;EAG/C,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAOnG,IADqB,OAAO,UAAU,CAAC,EAAE,MACvB;EAChB,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;OAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;IAAE,QAAQ;IAAS,QAAQ;IAAK,MAAM,EAAE,OAAO,gBAAgB;IAAG,SAAS;GAAe;EAAA,OAGnG,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG;CAGF,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}
+{"version":3,"file":"helpers-gCkmhB9x.js","names":[],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, !!~o ? o : !!~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (!!~ext) pattern += (!!~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport { CompositeAuth } from '@mastra/core/server';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { HTTPException } from '../http-exception';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id').\n  // Any matching pattern that requires auth wins over overlapping public patterns.\n  let matchedPublic = false;\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    if (pathMatchesPattern(path, routePattern)) {\n      if (requiresAuth) {\n        return false;\n      }\n      matchedPublic = true;\n    }\n  }\n\n  return matchedPublic;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (\n    !requiresAuth &&\n    (canAccessPublicly(path, method, authConfig) || isCustomRoutePublic(path, method, customRouteAuthConfig))\n  ) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  type ConsumePendingResponseHeadersFn = (request: typeof authRequest) => Record<string, string> | undefined;\n  const mergePendingProviderHeaders = (request: typeof authRequest = authRequest) => {\n    const consume = (authConfig as { consumePendingResponseHeaders?: ConsumePendingResponseHeadersFn })\n      .consumePendingResponseHeaders;\n    if (typeof consume !== 'function') return;\n    let pending: Record<string, string> | undefined;\n    try {\n      pending = consume.call(authConfig, request);\n    } catch {\n      // Forwarding a rotated cookie is best-effort; never fail auth over it.\n      return;\n    }\n    if (!pending) return;\n    refreshHeaders = { ...(refreshHeaders ?? {}), ...pending };\n  };\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n      mergePendingProviderHeaders();\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      let retryHttpError: HTTPException | undefined;\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              try {\n                const retryAuthRequest = adaptToMastraAuthRequest(refreshedRequest);\n                user = await authConfig.authenticateToken(cookieValue, retryAuthRequest);\n                mergePendingProviderHeaders(retryAuthRequest);\n              } catch (retryErr) {\n                retryHttpError = retryErr instanceof HTTPException ? retryErr : undefined;\n                throw retryErr;\n              }\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        // An explicit HTTP error from the retried authenticateToken goes to the outer handler.\n        if (retryHttpError === refreshErr) throw refreshErr;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        // CompositeAuth validates the authenticating provider's mapper. It can\n        // return undefined when that provider never configured a mapper.\n        if (resourceId !== undefined || !(authConfig instanceof CompositeAuth)) {\n          if (typeof resourceId !== 'string' || !resourceId.trim()) {\n            throw new Error('mapUserToResourceId must return a non-empty string for the authenticated user');\n          }\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    // Explicit HTTP errors from auth callbacks keep their status/message; anything else is redacted.\n    // The HTTPException message is sent to the client, so callers must keep it safe (no internal details).\n    if (err instanceof HTTPException && err.status >= 400 && err.status <= 599) {\n      return { action: 'error', status: err.status, body: { error: err.message }, headers: refreshHeaders };\n    }\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = ctx.buildAuthorizeContext();\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider =\n      requestContext.get(MASTRA_AUTH_MODE_KEY) === 'studio'\n        ? (mastra.getStudio?.()?.rbac ?? mastra.getServer()?.rbac)\n        : mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;;;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAChE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACrE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;;AC7CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAK/C,IAAI,gBAAgB;CACpB,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAGF,IAAI,mBAAmB,MAAM,YAAY,GAAG;GAC1C,IAAI,cACF,OAAO;GAET,gBAAgB;EAClB;CACF;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;AAE1C,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IACE,CAAC,iBACA,kBAAkB,MAAM,QAAQ,UAAU,KAAK,oBAAoB,MAAM,QAAQ,qBAAqB,IAEvG,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAGvD,MAAM,+BAA+B,UAA8B,gBAAgB;EACjF,MAAM,UAAW,WACd;EACH,IAAI,OAAO,YAAY,YAAY;EACnC,IAAI;EACJ,IAAI;GACF,UAAU,QAAQ,KAAK,YAAY,OAAO;EAC5C,QAAQ;GAEN;EACF;EACA,IAAI,CAAC,SAAS;EACd,iBAAiB;GAAE,GAAI,kBAAkB,CAAC;GAAI,GAAG;EAAQ;CAC3D;CAEA,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAAY;GACtD,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;GAClE,4BAA4B;EAC9B,OACE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SAAS;GAChF,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;IAC/D,IAAI,WAAW;KACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;KAC5D,IAAI,YAAY;MAKd,iBAAiB,WAAW,kBAAkB,UAAU;MACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;MACZ,IAAI,iBAAiB;OACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;QACnD,QAAQ,WAAW;QACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;OACzC,CAAC;OACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;OAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;OACJ,IAAI;QACF,MAAM,mBAAmB,yBAAyB,gBAAgB;QAClE,OAAO,MAAM,WAAW,kBAAkB,aAAa,gBAAgB;QACvE,4BAA4B,gBAAgB;OAC9C,SAAS,UAAU;QACjB,iBAAiB,oBAAoB,gBAAgB,WAAW,KAAA;QAChE,MAAM;OACR;MACF;MACA,IAAI,CAAC,MACH,iBAAiB,KAAA;KAErB;IACF;GACF,SAAS,YAAY;IACnB,iBAAiB,KAAA;IAEjB,IAAI,mBAAmB,YAAY,MAAM;IACzC,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;GACH;EACF;EAEA,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAI,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAI,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GAGtD,IAAI,eAAe,KAAA,KAAa,EAAE,sBAAsB,gBAAgB;IACtE,IAAI,OAAO,eAAe,YAAY,CAAC,WAAW,KAAK,GACrD,MAAM,IAAI,MAAM,+EAA+E;IAEjG,eAAe,IAAI,wBAAwB,UAAU;GACvD;EACF,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAI,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cAAc;IAChB,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;SACvG;KACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;KACpE,eAAe,IAAI,6BAA6B,WAAW;KAE3D,eAAe,IAAI,mBAAmB,WAAW;KAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;KACxD,eAAe,IAAI,uBAAuB,KAAK;KAE/C,eAAe,IAAI,aAAa,KAAK;IACvC;GACF;EACF,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EAGD,IAAI,eAAe,iBAAiB,IAAI,UAAU,OAAO,IAAI,UAAU,KACrE,OAAO;GAAE,QAAQ;GAAS,QAAQ,IAAI;GAAQ,MAAM,EAAE,OAAO,IAAI,QAAQ;GAAG,SAAS;EAAe;EAEtG,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,IAAI,sBAAsB;EAG/C,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAUnG,IAHE,eAAe,IAAA,kBAAwB,MAAM,WACxC,OAAO,YAAY,CAAC,EAAE,QAAQ,OAAO,UAAU,CAAC,EAAE,OACnD,OAAO,UAAU,CAAC,EAAE,MACR;EAChB,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;OAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;IAAE,QAAQ;IAAS,QAAQ;IAAK,MAAM,EAAE,OAAO,gBAAgB;IAAG,SAAS;GAAe;EAAA,OAGnG,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG;CAGF,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}

package/dist/{observability-BBMCMeT-.cjs → observability-C2BZQ2jU.cjs}

@@ -5,13 +5,14 @@ const require_server_handlers_error = require("./server/handlers/error.cjs");
 const require_server_handlers_observability_list_query_schemas = require("./server/handlers/observability-list-query-schemas.cjs");
 const require_server_handlers_observability_shared = require("./server/handlers/observability-shared.cjs");
 const require_server_handlers_observability_storage_schemas = require("./server/handlers/observability-storage-schemas.cjs");
-const require_observability_new_endpoints = require("./observability-new-endpoints-tG3-odLa.cjs");
+const require_observability_new_endpoints = require("./observability-new-endpoints-Drr7q2Dj.cjs");
 let zod_v4 = require("zod/v4");
 let _mastra_core_evals = require("@mastra/core/evals");
 let _mastra_core_evals_scoreTraces = require("@mastra/core/evals/scoreTraces");
 let _mastra_core_storage = require("@mastra/core/storage");
 //#region src/server/handlers/observability.ts
 var observability_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	AGGREGATE_SPANS: () => require_observability_new_endpoints.AGGREGATE_SPANS,
 	AGGREGATE_TRACES: () => require_observability_new_endpoints.AGGREGATE_TRACES,
 	CREATE_FEEDBACK: () => require_observability_new_endpoints.CREATE_FEEDBACK,
 	CREATE_SCORE: () => require_observability_new_endpoints.CREATE_SCORE,
@@ -499,4 +500,4 @@ Object.defineProperty(exports, "observability_exports", {
 	}
 });
 
-//# sourceMappingURL=observability-BBMCMeT-.cjs.map
+//# sourceMappingURL=observability-C2BZQ2jU.cjs.map

package/dist/{observability-BBMCMeT-.cjs.map → observability-C2BZQ2jU.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"observability-BBMCMeT-.cjs","names":["z","dateRangeSchema","tracesFilterSchema","createObservabilityListQuerySchema","tracesOrderBySchema","createRoute","listTracesResponseSchema","pickParams","getObservabilityStore","OBSERVABILITY_LIST_ENDPOINTS","paginationArgsSchema","handleError","listTracesLightResponseSchema","store","branchesFilterSchema","branchesOrderBySchema","listBranchesResponseSchema","getBranchArgsSchema","wrapSchemaForQueryParams","getBranchResponseSchema","HTTPException","getTraceArgsSchema","getTraceResponseSchema","traceSpanSchema","toTraceSpans","getTraceLightResponseSchema","getSpanArgsSchema","getSpanResponseSchema","extractTrajectoryFromTrace","batchDeleteTracesArgsSchema","batchDeleteTracesResponseSchema","scoreTracesRequestSchema","scoreTracesResponseSchema","spanIdsSchema","listScoresResponseSchema","getScoresStore"],"sources":["../src/server/handlers/observability.ts"],"sourcesContent":["import { extractTrajectoryFromTrace, listScoresResponseSchema } from '@mastra/core/evals';\nimport { scoreTraces } from '@mastra/core/evals/scoreTraces';\nimport {\n  tracesFilterSchema,\n  tracesOrderBySchema,\n  spanIdsSchema,\n  listTracesResponseSchema,\n  scoreTracesRequestSchema,\n  scoreTracesResponseSchema,\n  getTraceArgsSchema,\n  getTraceResponseSchema,\n  getTraceLightResponseSchema,\n  getSpanArgsSchema,\n  getSpanResponseSchema,\n  dateRangeSchema,\n  toTraceSpans,\n  traceSpanSchema,\n} from '@mastra/core/storage';\n// `branches*`, `listBranches*`, and `getBranch*` schemas are new in\n// @mastra/core@1.32.0; route them through a shim that tolerates older cores\n// (see ./observability-storage-schemas.ts for full rationale).\nimport { z } from 'zod/v4';\nimport { HTTPException } from '../http-exception';\nimport type { ServerRoute } from '../server-adapter/routes';\nimport { createRoute, pickParams, wrapSchemaForQueryParams } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport { paginationArgsSchema } from './observability-list-query-schemas';\nimport {\n  assertObservabilityDeltaSupported,\n  createObservabilityListQuerySchema,\n  getObservabilityStore,\n  getScoresStore,\n  getStorage,\n  OBSERVABILITY_LIST_ENDPOINTS,\n} from './observability-shared';\nimport {\n  branchesFilterSchema,\n  branchesOrderBySchema,\n  listBranchesResponseSchema,\n  getBranchArgsSchema,\n  getBranchResponseSchema,\n  listTracesLightResponseSchema,\n  batchDeleteTracesArgsSchema,\n  batchDeleteTracesResponseSchema,\n} from './observability-storage-schemas';\n\nexport * from './observability-new-endpoints';\n\n// ============================================================================\n// Legacy Parameter Support (backward compatibility with main branch API)\n// ============================================================================\n\n/**\n * Legacy query parameters from the old API (main branch).\n * These are accepted for backward compatibility and transformed to new format.\n */\nconst legacyQueryParamsSchema = z.object({\n  // Old: dateRange was in pagination, now it's startedAt in filters\n  dateRange: dateRangeSchema.optional(),\n  // Old: name matched span names like \"agent run: 'myAgent'\"\n  name: z.string().optional(),\n  // entityType needs preprocessing to handle legacy 'workflow' value\n  entityType: z.preprocess(val => (val === 'workflow' ? 'workflow_run' : val), z.string().optional()),\n});\n\n/**\n * Transforms legacy query parameters to the new format.\n * - dateRange -> startedAt (if startedAt not already set)\n * - name=\"agent run: 'x'\" -> entityId='x', entityType='agent'\n * - name=\"workflow run: 'x'\" -> entityId='x', entityType='workflow_run'\n * - entityType='workflow' -> entityType='workflow_run' (enum value fix)\n */\nfunction transformLegacyParams(params: Record<string, unknown>): Record<string, unknown> {\n  const result = { ...params };\n\n  // Transform old entityType='workflow' -> 'workflow_run' to support direct handler usage in tests\n  if (result.entityType === 'workflow') {\n    result.entityType = 'workflow_run';\n  }\n\n  // Transform old dateRange -> new startedAt\n  if (params.dateRange && !params.startedAt) {\n    result.startedAt = params.dateRange;\n    delete result.dateRange;\n  }\n\n  // Transform old name -> entityId + entityType\n  // Old format: name matched span names like \"agent run: 'myAgent'\" or \"workflow run: 'myWorkflow'\"\n  if (typeof params.name === 'string' && !params.entityId) {\n    const agentMatch = params.name.match(/^agent run: '([^']+)'$/);\n    const workflowMatch = params.name.match(/^workflow run: '([^']+)'$/);\n\n    if (agentMatch) {\n      result.entityId = agentMatch[1];\n      result.entityType = 'agent';\n    } else if (workflowMatch) {\n      result.entityId = workflowMatch[1];\n      result.entityType = 'workflow_run';\n    }\n    delete result.name;\n  }\n\n  return result;\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\n/** Filter shape shared by the full and lightweight trace list routes. */\nconst tracesListFilterSchema = tracesFilterSchema.extend({\n  ...legacyQueryParamsSchema.shape, // Accept legacy params for backward compatibility\n  entityType: z.preprocess(\n    value => (value === 'workflow' ? 'workflow_run' : value),\n    tracesFilterSchema.shape.entityType,\n  ),\n});\n\nconst listTracesQueryParamSchema = createObservabilityListQuerySchema(tracesListFilterSchema, tracesOrderBySchema);\n\n/** Route: GET /observability/traces - paginated trace listing with filtering and sorting. */\nexport const LIST_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesResponseSchema,\n  summary: 'List traces',\n  description:\n    'Returns a paginated list of traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      // Transform legacy params to new format before processing\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        return await observabilityStore.listTraces({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n      return await observabilityStore.listTraces({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing traces');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/light - paginated lightweight trace listing with filtering and sorting. */\nexport const LIST_TRACES_LIGHT_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/light',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesLightResponseSchema,\n  summary: 'List lightweight traces',\n  description:\n    'Returns a paginated list of lightweight traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n\n      // Every current store answers `listTracesLight` — stores without a dedicated\n      // implementation inherit the base class's projection fallback. This guard is\n      // only for an older `@mastra/core` whose base class predates the method, where\n      // calling it would throw `TypeError: ... is not a function`; there we fall back\n      // to `listTraces` so consumers still get a response.\n      const store = observabilityStore as { listTracesLight?: unknown };\n      const supportsLight = typeof store.listTracesLight === 'function';\n\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        const deltaArgs = {\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        } as const;\n        return supportsLight\n          ? await observabilityStore.listTracesLight(deltaArgs)\n          : await observabilityStore.listTraces(deltaArgs);\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n\n      if (!supportsLight) {\n        return await observabilityStore.listTraces({ filters, pagination, orderBy });\n      }\n      return await observabilityStore.listTracesLight({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing lightweight traces');\n    }\n  },\n});\n\n/** Route: GET /observability/branches - paginated branch-anchor span listing across all traces. */\nexport const LIST_BRANCHES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/branches',\n  responseType: 'json',\n  queryParamSchema: createObservabilityListQuerySchema(branchesFilterSchema, branchesOrderBySchema),\n  responseSchema: listBranchesResponseSchema,\n  summary: 'List trace branches',\n  description:\n    'Returns a paginated list of branch-anchor spans (e.g., AGENT_RUN, WORKFLOW_RUN, TOOL_CALL) across all traces. Unlike listTraces (one row per root-rooted trace), each row here is a single anchor span -- including ones nested under a different root entity. In delta mode, returns only newly listed branch rows matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const filters = pickParams(branchesFilterSchema, params);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.branches);\n        return await observabilityStore.listBranches({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, params);\n      const orderBy = pickParams(branchesOrderBySchema, params);\n      return await observabilityStore.listBranches({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing branches');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/branches/:spanId - retrieve the subtree rooted at a span. */\nexport const GET_BRANCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/branches/:spanId',\n  responseType: 'json',\n  pathParamSchema: getBranchArgsSchema.pick({ traceId: true, spanId: true }),\n  queryParamSchema: wrapSchemaForQueryParams(getBranchArgsSchema.pick({ depth: true })),\n  responseSchema: getBranchResponseSchema,\n  summary: 'Get trace branch by span ID',\n  description:\n    'Returns the subtree of spans rooted at the given span. The optional `depth` query param bounds descendant levels below the anchor (0 = anchor only; omitted = full subtree).',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId, depth }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const branch = await observabilityStore.getBranch({ traceId, spanId, depth });\n\n      if (!branch) {\n        throw new HTTPException(404, { message: `Branch not found for span '${spanId}' in trace '${traceId}'` });\n      }\n\n      return branch;\n    } catch (error) {\n      return handleError(error, 'Error getting branch');\n    }\n  },\n});\n/** Route: GET /observability/traces/:traceId - retrieve a single trace with all spans. */\nexport const GET_TRACE_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceResponseSchema.extend({ spans: z.array(traceSpanSchema) }),\n  summary: 'Get AI trace by ID',\n  description: 'Returns a complete AI trace with all spans by trace ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      // Stored SpanRecords carry no status field; derive it from error/endedAt so\n      // trace-detail spans match the status shown in trace list rows.\n      return { ...trace, spans: toTraceSpans(trace.spans) };\n    } catch (error) {\n      return handleError(error, 'Error getting trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/light - lightweight trace for timeline rendering. */\nexport const GET_TRACE_LIGHT_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/light',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceLightResponseSchema,\n  summary: 'Get lightweight AI trace by ID',\n  description:\n    'Returns a trace with lightweight span data (timeline fields only, excludes input/output/attributes/metadata/tags/links)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTraceLight({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      return trace;\n    } catch (error) {\n      return handleError(error, 'Error getting lightweight trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/spans/:spanId - get a single span with full details. */\nexport const GET_SPAN_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/spans/:spanId',\n  responseType: 'json',\n  pathParamSchema: getSpanArgsSchema,\n  responseSchema: getSpanResponseSchema,\n  summary: 'Get a single span by ID',\n  description: 'Returns a complete span record with all details by trace ID and span ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const span = await observabilityStore.getSpan({ traceId, spanId });\n\n      if (!span) {\n        throw new HTTPException(404, { message: `Span not found` });\n      }\n\n      return span;\n    } catch (error) {\n      return handleError(error, 'Error getting span');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/trajectory - extract trajectory from a trace. */\nexport const GET_TRACE_TRAJECTORY_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/trajectory',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: z.object({\n    steps: z.array(z.unknown()),\n    totalDurationMs: z.number().optional(),\n    rawOutput: z.unknown().optional(),\n    rawWorkflowResult: z.unknown().optional(),\n  }),\n  summary: 'Extract trajectory from trace',\n  description: 'Extracts a structured trajectory (ordered steps) from a trace by analyzing its spans',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      const trajectory = extractTrajectoryFromTrace(trace.spans);\n      return trajectory;\n    } catch (error) {\n      return handleError(error, 'Error extracting trajectory from trace');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/delete - batch delete traces with cross-signal cascade. */\nexport const DELETE_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'POST',\n  path: '/observability/traces/delete',\n  responseType: 'json',\n  bodySchema: batchDeleteTracesArgsSchema.pick({ traceIds: true }),\n  responseSchema: batchDeleteTracesResponseSchema,\n  maxBodySize: 256 * 1024,\n  summary: 'Delete traces',\n  description:\n    'Deletes traces by ID, cascading to all associated data: spans, trace roots/branches, and signal events (scores, feedback, metrics, logs) that reference the deleted traces. Signals without a trace ID are untouched. Experiment traces are deleted like any other trace. On ClickHouse-backed stores, deletes are lightweight and reads may briefly return deleted rows until the delete is fully applied.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceIds }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      await observabilityStore.batchDeleteTraces({ traceIds });\n      return { success: true as const };\n    } catch (error) {\n      return handleError(error, 'Error deleting traces');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/score - score traces using a specified scorer (fire-and-forget). */\nexport const SCORE_TRACES_ROUTE = createRoute({\n  method: 'POST',\n  path: '/observability/traces/score',\n  responseType: 'json',\n  bodySchema: scoreTracesRequestSchema,\n  responseSchema: scoreTracesResponseSchema,\n  summary: 'Score traces',\n  description: 'Scores one or more traces using a specified scorer (fire-and-forget)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      // Validate storage exists before starting background task\n      getStorage(mastra);\n\n      const { scorerName, targets } = params;\n\n      const scorer = mastra.getScorerById(scorerName);\n      if (!scorer) {\n        throw new HTTPException(404, { message: `Scorer '${scorerName}' not found` });\n      }\n\n      scoreTraces({\n        scorerId: scorer.config.id || scorer.config.name,\n        targets,\n        mastra,\n      }).catch(error => {\n        const logger = mastra.getLogger();\n        logger?.error(`Background trace scoring failed: ${error.message}`, error);\n      });\n\n      return {\n        status: 'success',\n        message: `Scoring started for ${targets.length} ${targets.length === 1 ? 'trace' : 'traces'}`,\n        traceCount: targets.length,\n      };\n    } catch (error) {\n      return handleError(error, 'Error processing trace scoring');\n    }\n  },\n});\n\nexport const LIST_SCORES_BY_SPAN_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/:spanId/scores',\n  responseType: 'json',\n  pathParamSchema: spanIdsSchema,\n  // List endpoints accept optional query params; use partial() to allow empty queries.\n  queryParamSchema: wrapSchemaForQueryParams(paginationArgsSchema.partial()),\n  responseSchema: listScoresResponseSchema,\n  summary: 'List scores by span',\n  description: 'Returns all scores for a specific span within a trace',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      const pagination = pickParams(paginationArgsSchema, params);\n      const spanIds = pickParams(spanIdsSchema, params);\n\n      const scoresStore = await getScoresStore(mastra);\n\n      return await scoresStore.listScoresBySpan({\n        ...spanIds,\n        pagination,\n      });\n    } catch (error) {\n      return handleError(error, 'Error getting scores by span');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,0BAA0BA,OAAAA,EAAE,OAAO;CAEvC,WAAWC,qBAAAA,gBAAgB,SAAS;CAEpC,MAAMD,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAE1B,YAAYA,OAAAA,EAAE,YAAW,QAAQ,QAAQ,aAAa,iBAAiB,KAAMA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;;;;;;;;AASD,SAAS,sBAAsB,QAA0D;CACvF,MAAM,SAAS,EAAE,GAAG,OAAO;CAG3B,IAAI,OAAO,eAAe,YACxB,OAAO,aAAa;CAItB,IAAI,OAAO,aAAa,CAAC,OAAO,WAAW;EACzC,OAAO,YAAY,OAAO;EAC1B,OAAO,OAAO;CAChB;CAIA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,UAAU;EACvD,MAAM,aAAa,OAAO,KAAK,MAAM,wBAAwB;EAC7D,MAAM,gBAAgB,OAAO,KAAK,MAAM,2BAA2B;EAEnE,IAAI,YAAY;GACd,OAAO,WAAW,WAAW;GAC7B,OAAO,aAAa;EACtB,OAAO,IAAI,eAAe;GACxB,OAAO,WAAW,cAAc;GAChC,OAAO,aAAa;EACtB;EACA,OAAO,OAAO;CAChB;CAEA,OAAO;AACT;;AAOA,MAAM,yBAAyBE,qBAAAA,mBAAmB,OAAO;CACvD,GAAG,wBAAwB;CAC3B,YAAYF,OAAAA,EAAE,YACZ,UAAU,UAAU,aAAa,iBAAiB,OAClDE,qBAAAA,mBAAmB,MAAM,UAC3B;AACF,CAAC;AAED,MAAM,6BAA6BC,6CAAAA,mCAAmC,wBAAwBC,qBAAAA,mBAAmB;;AAGjH,MAAa,oBAAiCC,sBAAAA,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgBC,qBAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GAEF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAUC,sBAAAA,WAAWL,qBAAAA,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAMM,6CAAAA,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,6CAAA,kCAAkC,oBAAoBC,6CAAAA,6BAA6B,MAAM;IACzF,OAAO,MAAM,mBAAmB,WAAW;KACzC;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAaF,sBAAAA,WAAWG,yDAAAA,sBAAsB,iBAAiB;GACrE,MAAM,UAAUH,sBAAAA,WAAWH,qBAAAA,qBAAqB,iBAAiB;GACjE,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC7E,SAAS,OAAO;GACd,OAAOO,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAGD,MAAa,0BAA0BN,sBAAAA,YAAY;CACjD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgBO,sDAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAUL,sBAAAA,WAAWL,qBAAAA,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAMM,6CAAAA,sBAAsB,MAAM;GAQ7D,MAAM,gBAAgB,OAAOK,mBAAM,oBAAoB;GAEvD,IAAI,SAAS,SAAS;IACpB,6CAAA,kCAAkC,oBAAoBJ,6CAAAA,6BAA6B,MAAM;IACzF,MAAM,YAAY;KAChB;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF;IACA,OAAO,gBACH,MAAM,mBAAmB,gBAAgB,SAAS,IAClD,MAAM,mBAAmB,WAAW,SAAS;GACnD;GAEA,MAAM,aAAaF,sBAAAA,WAAWG,yDAAAA,sBAAsB,iBAAiB;GACrE,MAAM,UAAUH,sBAAAA,WAAWH,qBAAAA,qBAAqB,iBAAiB;GAEjE,IAAI,CAAC,eACH,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;GAE7E,OAAO,MAAM,mBAAmB,gBAAgB;IAAE;IAAS;IAAY;GAAQ,CAAC;EAClF,SAAS,OAAO;GACd,OAAOO,8BAAAA,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;AAGD,MAAa,sBAAsBN,sBAAAA,YAAY;CAC7C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkBF,6CAAAA,mCAAmCW,sDAAAA,sBAAsBC,sDAAAA,qBAAqB;CAChG,gBAAgBC,sDAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,UAAUT,sBAAAA,WAAWO,sDAAAA,sBAAsB,MAAM;GACvD,MAAM,qBAAqB,MAAMN,6CAAAA,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,6CAAA,kCAAkC,oBAAoBC,6CAAAA,6BAA6B,QAAQ;IAC3F,OAAO,MAAM,mBAAmB,aAAa;KAC3C;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAaF,sBAAAA,WAAWG,yDAAAA,sBAAsB,MAAM;GAC1D,MAAM,UAAUH,sBAAAA,WAAWQ,sDAAAA,uBAAuB,MAAM;GACxD,OAAO,MAAM,mBAAmB,aAAa;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC/E,SAAS,OAAO;GACd,OAAOJ,8BAAAA,YAAY,OAAO,wBAAwB;EACpD;CACF;AACF,CAAC;;AAGD,MAAa,mBAAmBN,sBAAAA,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,sDAAAA,oBAAoB,KAAK;EAAE,SAAS;EAAM,QAAQ;CAAK,CAAC;CACzE,kBAAkBC,sBAAAA,yBAAyBD,sDAAAA,oBAAoB,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;CACpF,gBAAgBE,sDAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;EACrD,IAAI;GAEF,MAAM,SAAS,OAAM,MADYX,6CAAAA,sBAAsB,MAAM,EAAA,CACrB,UAAU;IAAE;IAAS;IAAQ;GAAM,CAAC;GAE5E,IAAI,CAAC,QACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,8BAA8B,OAAO,cAAc,QAAQ,GAAG,CAAC;GAGzG,OAAO;EACT,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAED,MAAa,kBAA+BN,sBAAAA,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBgB,qBAAAA;CACjB,gBAAgBC,qBAAAA,uBAAuB,OAAO,EAAE,OAAOtB,OAAAA,EAAE,MAAMuB,qBAAAA,eAAe,EAAE,CAAC;CACjF,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADaf,6CAAAA,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAKlF,OAAO;IAAE,GAAG;IAAO,QAAA,GAAOI,qBAAAA,aAAAA,CAAa,MAAM,KAAK;GAAE;EACtD,SAAS,OAAO;GACd,OAAOb,8BAAAA,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;;AAGD,MAAa,wBAAqCN,sBAAAA,YAAY;CAC5D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBgB,qBAAAA;CACjB,gBAAgBI,qBAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADajB,6CAAAA,sBAAsB,MAAM,EAAA,CACtB,cAAc,EAAE,QAAQ,CAAC;GAEhE,IAAI,CAAC,OACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAGlF,OAAO;EACT,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC;;AAGD,MAAa,iBAA8BN,sBAAAA,YAAY;CACrD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBqB,qBAAAA;CACjB,gBAAgBC,qBAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,aAAa;EAC9C,IAAI;GAEF,MAAM,OAAO,OAAM,MADcnB,6CAAAA,sBAAsB,MAAM,EAAA,CACvB,QAAQ;IAAE;IAAS;GAAO,CAAC;GAEjE,IAAI,CAAC,MACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO;EACT,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;;AAGD,MAAa,6BAA6BN,sBAAAA,YAAY;CACpD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBgB,qBAAAA;CACjB,gBAAgBrB,OAAAA,EAAE,OAAO;EACvB,OAAOA,OAAAA,EAAE,MAAMA,OAAAA,EAAE,QAAQ,CAAC;EAC1B,iBAAiBA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EACrC,WAAWA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EAChC,mBAAmBA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC1C,CAAC;CACD,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADaQ,6CAAAA,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAIlF,QAAA,GADmBQ,mBAAAA,2BAAAA,CAA2B,MAAM,KACpC;EAClB,SAAS,OAAO;GACd,OAAOjB,8BAAAA,YAAY,OAAO,wCAAwC;EACpE;CACF;AACF,CAAC;;AAGD,MAAa,sBAAmCN,sBAAAA,YAAY;CAC1D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAYwB,sDAAAA,4BAA4B,KAAK,EAAE,UAAU,KAAK,CAAC;CAC/D,gBAAgBC,sDAAAA;CAChB,aAAa;CACb,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,eAAe;EACvC,IAAI;GAEF,OAAM,MAD2BtB,6CAAAA,sBAAsB,MAAM,EAAA,CACpC,kBAAkB,EAAE,SAAS,CAAC;GACvD,OAAO,EAAE,SAAS,KAAc;EAClC,SAAS,OAAO;GACd,OAAOG,8BAAAA,YAAY,OAAO,uBAAuB;EACnD;CACF;AACF,CAAC;;AAGD,MAAa,qBAAqBN,sBAAAA,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAY0B,qBAAAA;CACZ,gBAAgBC,qBAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GAEF,6CAAA,WAAW,MAAM;GAEjB,MAAM,EAAE,YAAY,YAAY;GAEhC,MAAM,SAAS,OAAO,cAAc,UAAU;GAC9C,IAAI,CAAC,QACH,MAAM,IAAIZ,uBAAAA,cAAc,KAAK,EAAE,SAAS,WAAW,WAAW,aAAa,CAAC;GAG9E,CAAA,GAAA,+BAAA,YAAA,CAAY;IACV,UAAU,OAAO,OAAO,MAAM,OAAO,OAAO;IAC5C;IACA;GACF,CAAC,CAAC,CAAC,OAAM,UAAS;IAEhB,OADsB,UACjB,CAAC,EAAE,MAAM,oCAAoC,MAAM,WAAW,KAAK;GAC1E,CAAC;GAED,OAAO;IACL,QAAQ;IACR,SAAS,uBAAuB,QAAQ,OAAO,GAAG,QAAQ,WAAW,IAAI,UAAU;IACnF,YAAY,QAAQ;GACtB;EACF,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,gCAAgC;EAC5D;CACF;AACF,CAAC;AAED,MAAa,4BAA4BN,sBAAAA,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB4B,qBAAAA;CAEjB,kBAAkBf,sBAAAA,yBAAyBR,yDAAAA,qBAAqB,QAAQ,CAAC;CACzE,gBAAgBwB,mBAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GACF,MAAM,aAAa3B,sBAAAA,WAAWG,yDAAAA,sBAAsB,MAAM;GAC1D,MAAM,UAAUH,sBAAAA,WAAW0B,qBAAAA,eAAe,MAAM;GAIhD,OAAO,OAAM,MAFaE,6CAAAA,eAAe,MAAM,EAAA,CAEtB,iBAAiB;IACxC,GAAG;IACH;GACF,CAAC;EACH,SAAS,OAAO;GACd,OAAOxB,8BAAAA,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC"}
+{"version":3,"file":"observability-C2BZQ2jU.cjs","names":["z","dateRangeSchema","tracesFilterSchema","createObservabilityListQuerySchema","tracesOrderBySchema","createRoute","listTracesResponseSchema","pickParams","getObservabilityStore","OBSERVABILITY_LIST_ENDPOINTS","paginationArgsSchema","handleError","listTracesLightResponseSchema","store","branchesFilterSchema","branchesOrderBySchema","listBranchesResponseSchema","getBranchArgsSchema","wrapSchemaForQueryParams","getBranchResponseSchema","HTTPException","getTraceArgsSchema","getTraceResponseSchema","traceSpanSchema","toTraceSpans","getTraceLightResponseSchema","getSpanArgsSchema","getSpanResponseSchema","extractTrajectoryFromTrace","batchDeleteTracesArgsSchema","batchDeleteTracesResponseSchema","scoreTracesRequestSchema","scoreTracesResponseSchema","spanIdsSchema","listScoresResponseSchema","getScoresStore"],"sources":["../src/server/handlers/observability.ts"],"sourcesContent":["import { extractTrajectoryFromTrace, listScoresResponseSchema } from '@mastra/core/evals';\nimport { scoreTraces } from '@mastra/core/evals/scoreTraces';\nimport {\n  tracesFilterSchema,\n  tracesOrderBySchema,\n  spanIdsSchema,\n  listTracesResponseSchema,\n  scoreTracesRequestSchema,\n  scoreTracesResponseSchema,\n  getTraceArgsSchema,\n  getTraceResponseSchema,\n  getTraceLightResponseSchema,\n  getSpanArgsSchema,\n  getSpanResponseSchema,\n  dateRangeSchema,\n  toTraceSpans,\n  traceSpanSchema,\n} from '@mastra/core/storage';\n// `branches*`, `listBranches*`, and `getBranch*` schemas are new in\n// @mastra/core@1.32.0; route them through a shim that tolerates older cores\n// (see ./observability-storage-schemas.ts for full rationale).\nimport { z } from 'zod/v4';\nimport { HTTPException } from '../http-exception';\nimport type { ServerRoute } from '../server-adapter/routes';\nimport { createRoute, pickParams, wrapSchemaForQueryParams } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport { paginationArgsSchema } from './observability-list-query-schemas';\nimport {\n  assertObservabilityDeltaSupported,\n  createObservabilityListQuerySchema,\n  getObservabilityStore,\n  getScoresStore,\n  getStorage,\n  OBSERVABILITY_LIST_ENDPOINTS,\n} from './observability-shared';\nimport {\n  branchesFilterSchema,\n  branchesOrderBySchema,\n  listBranchesResponseSchema,\n  getBranchArgsSchema,\n  getBranchResponseSchema,\n  listTracesLightResponseSchema,\n  batchDeleteTracesArgsSchema,\n  batchDeleteTracesResponseSchema,\n} from './observability-storage-schemas';\n\nexport * from './observability-new-endpoints';\n\n// ============================================================================\n// Legacy Parameter Support (backward compatibility with main branch API)\n// ============================================================================\n\n/**\n * Legacy query parameters from the old API (main branch).\n * These are accepted for backward compatibility and transformed to new format.\n */\nconst legacyQueryParamsSchema = z.object({\n  // Old: dateRange was in pagination, now it's startedAt in filters\n  dateRange: dateRangeSchema.optional(),\n  // Old: name matched span names like \"agent run: 'myAgent'\"\n  name: z.string().optional(),\n  // entityType needs preprocessing to handle legacy 'workflow' value\n  entityType: z.preprocess(val => (val === 'workflow' ? 'workflow_run' : val), z.string().optional()),\n});\n\n/**\n * Transforms legacy query parameters to the new format.\n * - dateRange -> startedAt (if startedAt not already set)\n * - name=\"agent run: 'x'\" -> entityId='x', entityType='agent'\n * - name=\"workflow run: 'x'\" -> entityId='x', entityType='workflow_run'\n * - entityType='workflow' -> entityType='workflow_run' (enum value fix)\n */\nfunction transformLegacyParams(params: Record<string, unknown>): Record<string, unknown> {\n  const result = { ...params };\n\n  // Transform old entityType='workflow' -> 'workflow_run' to support direct handler usage in tests\n  if (result.entityType === 'workflow') {\n    result.entityType = 'workflow_run';\n  }\n\n  // Transform old dateRange -> new startedAt\n  if (params.dateRange && !params.startedAt) {\n    result.startedAt = params.dateRange;\n    delete result.dateRange;\n  }\n\n  // Transform old name -> entityId + entityType\n  // Old format: name matched span names like \"agent run: 'myAgent'\" or \"workflow run: 'myWorkflow'\"\n  if (typeof params.name === 'string' && !params.entityId) {\n    const agentMatch = params.name.match(/^agent run: '([^']+)'$/);\n    const workflowMatch = params.name.match(/^workflow run: '([^']+)'$/);\n\n    if (agentMatch) {\n      result.entityId = agentMatch[1];\n      result.entityType = 'agent';\n    } else if (workflowMatch) {\n      result.entityId = workflowMatch[1];\n      result.entityType = 'workflow_run';\n    }\n    delete result.name;\n  }\n\n  return result;\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\n/** Filter shape shared by the full and lightweight trace list routes. */\nconst tracesListFilterSchema = tracesFilterSchema.extend({\n  ...legacyQueryParamsSchema.shape, // Accept legacy params for backward compatibility\n  entityType: z.preprocess(\n    value => (value === 'workflow' ? 'workflow_run' : value),\n    tracesFilterSchema.shape.entityType,\n  ),\n});\n\nconst listTracesQueryParamSchema = createObservabilityListQuerySchema(tracesListFilterSchema, tracesOrderBySchema);\n\n/** Route: GET /observability/traces - paginated trace listing with filtering and sorting. */\nexport const LIST_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesResponseSchema,\n  summary: 'List traces',\n  description:\n    'Returns a paginated list of traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      // Transform legacy params to new format before processing\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        return await observabilityStore.listTraces({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n      return await observabilityStore.listTraces({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing traces');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/light - paginated lightweight trace listing with filtering and sorting. */\nexport const LIST_TRACES_LIGHT_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/light',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesLightResponseSchema,\n  summary: 'List lightweight traces',\n  description:\n    'Returns a paginated list of lightweight traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n\n      // Every current store answers `listTracesLight` — stores without a dedicated\n      // implementation inherit the base class's projection fallback. This guard is\n      // only for an older `@mastra/core` whose base class predates the method, where\n      // calling it would throw `TypeError: ... is not a function`; there we fall back\n      // to `listTraces` so consumers still get a response.\n      const store = observabilityStore as { listTracesLight?: unknown };\n      const supportsLight = typeof store.listTracesLight === 'function';\n\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        const deltaArgs = {\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        } as const;\n        return supportsLight\n          ? await observabilityStore.listTracesLight(deltaArgs)\n          : await observabilityStore.listTraces(deltaArgs);\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n\n      if (!supportsLight) {\n        return await observabilityStore.listTraces({ filters, pagination, orderBy });\n      }\n      return await observabilityStore.listTracesLight({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing lightweight traces');\n    }\n  },\n});\n\n/** Route: GET /observability/branches - paginated branch-anchor span listing across all traces. */\nexport const LIST_BRANCHES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/branches',\n  responseType: 'json',\n  queryParamSchema: createObservabilityListQuerySchema(branchesFilterSchema, branchesOrderBySchema),\n  responseSchema: listBranchesResponseSchema,\n  summary: 'List trace branches',\n  description:\n    'Returns a paginated list of branch-anchor spans (e.g., AGENT_RUN, WORKFLOW_RUN, TOOL_CALL) across all traces. Unlike listTraces (one row per root-rooted trace), each row here is a single anchor span -- including ones nested under a different root entity. In delta mode, returns only newly listed branch rows matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const filters = pickParams(branchesFilterSchema, params);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.branches);\n        return await observabilityStore.listBranches({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, params);\n      const orderBy = pickParams(branchesOrderBySchema, params);\n      return await observabilityStore.listBranches({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing branches');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/branches/:spanId - retrieve the subtree rooted at a span. */\nexport const GET_BRANCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/branches/:spanId',\n  responseType: 'json',\n  pathParamSchema: getBranchArgsSchema.pick({ traceId: true, spanId: true }),\n  queryParamSchema: wrapSchemaForQueryParams(getBranchArgsSchema.pick({ depth: true })),\n  responseSchema: getBranchResponseSchema,\n  summary: 'Get trace branch by span ID',\n  description:\n    'Returns the subtree of spans rooted at the given span. The optional `depth` query param bounds descendant levels below the anchor (0 = anchor only; omitted = full subtree).',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId, depth }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const branch = await observabilityStore.getBranch({ traceId, spanId, depth });\n\n      if (!branch) {\n        throw new HTTPException(404, { message: `Branch not found for span '${spanId}' in trace '${traceId}'` });\n      }\n\n      return branch;\n    } catch (error) {\n      return handleError(error, 'Error getting branch');\n    }\n  },\n});\n/** Route: GET /observability/traces/:traceId - retrieve a single trace with all spans. */\nexport const GET_TRACE_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceResponseSchema.extend({ spans: z.array(traceSpanSchema) }),\n  summary: 'Get AI trace by ID',\n  description: 'Returns a complete AI trace with all spans by trace ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      // Stored SpanRecords carry no status field; derive it from error/endedAt so\n      // trace-detail spans match the status shown in trace list rows.\n      return { ...trace, spans: toTraceSpans(trace.spans) };\n    } catch (error) {\n      return handleError(error, 'Error getting trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/light - lightweight trace for timeline rendering. */\nexport const GET_TRACE_LIGHT_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/light',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceLightResponseSchema,\n  summary: 'Get lightweight AI trace by ID',\n  description:\n    'Returns a trace with lightweight span data (timeline fields only, excludes input/output/attributes/metadata/tags/links)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTraceLight({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      return trace;\n    } catch (error) {\n      return handleError(error, 'Error getting lightweight trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/spans/:spanId - get a single span with full details. */\nexport const GET_SPAN_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/spans/:spanId',\n  responseType: 'json',\n  pathParamSchema: getSpanArgsSchema,\n  responseSchema: getSpanResponseSchema,\n  summary: 'Get a single span by ID',\n  description: 'Returns a complete span record with all details by trace ID and span ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const span = await observabilityStore.getSpan({ traceId, spanId });\n\n      if (!span) {\n        throw new HTTPException(404, { message: `Span not found` });\n      }\n\n      return span;\n    } catch (error) {\n      return handleError(error, 'Error getting span');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/trajectory - extract trajectory from a trace. */\nexport const GET_TRACE_TRAJECTORY_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/trajectory',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: z.object({\n    steps: z.array(z.unknown()),\n    totalDurationMs: z.number().optional(),\n    rawOutput: z.unknown().optional(),\n    rawWorkflowResult: z.unknown().optional(),\n  }),\n  summary: 'Extract trajectory from trace',\n  description: 'Extracts a structured trajectory (ordered steps) from a trace by analyzing its spans',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      const trajectory = extractTrajectoryFromTrace(trace.spans);\n      return trajectory;\n    } catch (error) {\n      return handleError(error, 'Error extracting trajectory from trace');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/delete - batch delete traces with cross-signal cascade. */\nexport const DELETE_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'POST',\n  path: '/observability/traces/delete',\n  responseType: 'json',\n  bodySchema: batchDeleteTracesArgsSchema.pick({ traceIds: true }),\n  responseSchema: batchDeleteTracesResponseSchema,\n  maxBodySize: 256 * 1024,\n  summary: 'Delete traces',\n  description:\n    'Deletes traces by ID, cascading to all associated data: spans, trace roots/branches, and signal events (scores, feedback, metrics, logs) that reference the deleted traces. Signals without a trace ID are untouched. Experiment traces are deleted like any other trace. On ClickHouse-backed stores, deletes are lightweight and reads may briefly return deleted rows until the delete is fully applied.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceIds }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      await observabilityStore.batchDeleteTraces({ traceIds });\n      return { success: true as const };\n    } catch (error) {\n      return handleError(error, 'Error deleting traces');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/score - score traces using a specified scorer (fire-and-forget). */\nexport const SCORE_TRACES_ROUTE = createRoute({\n  method: 'POST',\n  path: '/observability/traces/score',\n  responseType: 'json',\n  bodySchema: scoreTracesRequestSchema,\n  responseSchema: scoreTracesResponseSchema,\n  summary: 'Score traces',\n  description: 'Scores one or more traces using a specified scorer (fire-and-forget)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      // Validate storage exists before starting background task\n      getStorage(mastra);\n\n      const { scorerName, targets } = params;\n\n      const scorer = mastra.getScorerById(scorerName);\n      if (!scorer) {\n        throw new HTTPException(404, { message: `Scorer '${scorerName}' not found` });\n      }\n\n      scoreTraces({\n        scorerId: scorer.config.id || scorer.config.name,\n        targets,\n        mastra,\n      }).catch(error => {\n        const logger = mastra.getLogger();\n        logger?.error(`Background trace scoring failed: ${error.message}`, error);\n      });\n\n      return {\n        status: 'success',\n        message: `Scoring started for ${targets.length} ${targets.length === 1 ? 'trace' : 'traces'}`,\n        traceCount: targets.length,\n      };\n    } catch (error) {\n      return handleError(error, 'Error processing trace scoring');\n    }\n  },\n});\n\nexport const LIST_SCORES_BY_SPAN_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/:spanId/scores',\n  responseType: 'json',\n  pathParamSchema: spanIdsSchema,\n  // List endpoints accept optional query params; use partial() to allow empty queries.\n  queryParamSchema: wrapSchemaForQueryParams(paginationArgsSchema.partial()),\n  responseSchema: listScoresResponseSchema,\n  summary: 'List scores by span',\n  description: 'Returns all scores for a specific span within a trace',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      const pagination = pickParams(paginationArgsSchema, params);\n      const spanIds = pickParams(spanIdsSchema, params);\n\n      const scoresStore = await getScoresStore(mastra);\n\n      return await scoresStore.listScoresBySpan({\n        ...spanIds,\n        pagination,\n      });\n    } catch (error) {\n      return handleError(error, 'Error getting scores by span');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,0BAA0BA,OAAAA,EAAE,OAAO;CAEvC,WAAWC,qBAAAA,gBAAgB,SAAS;CAEpC,MAAMD,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAE1B,YAAYA,OAAAA,EAAE,YAAW,QAAQ,QAAQ,aAAa,iBAAiB,KAAMA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;;;;;;;;AASD,SAAS,sBAAsB,QAA0D;CACvF,MAAM,SAAS,EAAE,GAAG,OAAO;CAG3B,IAAI,OAAO,eAAe,YACxB,OAAO,aAAa;CAItB,IAAI,OAAO,aAAa,CAAC,OAAO,WAAW;EACzC,OAAO,YAAY,OAAO;EAC1B,OAAO,OAAO;CAChB;CAIA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,UAAU;EACvD,MAAM,aAAa,OAAO,KAAK,MAAM,wBAAwB;EAC7D,MAAM,gBAAgB,OAAO,KAAK,MAAM,2BAA2B;EAEnE,IAAI,YAAY;GACd,OAAO,WAAW,WAAW;GAC7B,OAAO,aAAa;EACtB,OAAO,IAAI,eAAe;GACxB,OAAO,WAAW,cAAc;GAChC,OAAO,aAAa;EACtB;EACA,OAAO,OAAO;CAChB;CAEA,OAAO;AACT;;AAOA,MAAM,yBAAyBE,qBAAAA,mBAAmB,OAAO;CACvD,GAAG,wBAAwB;CAC3B,YAAYF,OAAAA,EAAE,YACZ,UAAU,UAAU,aAAa,iBAAiB,OAClDE,qBAAAA,mBAAmB,MAAM,UAC3B;AACF,CAAC;AAED,MAAM,6BAA6BC,6CAAAA,mCAAmC,wBAAwBC,qBAAAA,mBAAmB;;AAGjH,MAAa,oBAAiCC,sBAAAA,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgBC,qBAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GAEF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAUC,sBAAAA,WAAWL,qBAAAA,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAMM,6CAAAA,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,6CAAA,kCAAkC,oBAAoBC,6CAAAA,6BAA6B,MAAM;IACzF,OAAO,MAAM,mBAAmB,WAAW;KACzC;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAaF,sBAAAA,WAAWG,yDAAAA,sBAAsB,iBAAiB;GACrE,MAAM,UAAUH,sBAAAA,WAAWH,qBAAAA,qBAAqB,iBAAiB;GACjE,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC7E,SAAS,OAAO;GACd,OAAOO,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAGD,MAAa,0BAA0BN,sBAAAA,YAAY;CACjD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgBO,sDAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAUL,sBAAAA,WAAWL,qBAAAA,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAMM,6CAAAA,sBAAsB,MAAM;GAQ7D,MAAM,gBAAgB,OAAOK,mBAAM,oBAAoB;GAEvD,IAAI,SAAS,SAAS;IACpB,6CAAA,kCAAkC,oBAAoBJ,6CAAAA,6BAA6B,MAAM;IACzF,MAAM,YAAY;KAChB;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF;IACA,OAAO,gBACH,MAAM,mBAAmB,gBAAgB,SAAS,IAClD,MAAM,mBAAmB,WAAW,SAAS;GACnD;GAEA,MAAM,aAAaF,sBAAAA,WAAWG,yDAAAA,sBAAsB,iBAAiB;GACrE,MAAM,UAAUH,sBAAAA,WAAWH,qBAAAA,qBAAqB,iBAAiB;GAEjE,IAAI,CAAC,eACH,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;GAE7E,OAAO,MAAM,mBAAmB,gBAAgB;IAAE;IAAS;IAAY;GAAQ,CAAC;EAClF,SAAS,OAAO;GACd,OAAOO,8BAAAA,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;AAGD,MAAa,sBAAsBN,sBAAAA,YAAY;CAC7C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkBF,6CAAAA,mCAAmCW,sDAAAA,sBAAsBC,sDAAAA,qBAAqB;CAChG,gBAAgBC,sDAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,UAAUT,sBAAAA,WAAWO,sDAAAA,sBAAsB,MAAM;GACvD,MAAM,qBAAqB,MAAMN,6CAAAA,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,6CAAA,kCAAkC,oBAAoBC,6CAAAA,6BAA6B,QAAQ;IAC3F,OAAO,MAAM,mBAAmB,aAAa;KAC3C;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAaF,sBAAAA,WAAWG,yDAAAA,sBAAsB,MAAM;GAC1D,MAAM,UAAUH,sBAAAA,WAAWQ,sDAAAA,uBAAuB,MAAM;GACxD,OAAO,MAAM,mBAAmB,aAAa;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC/E,SAAS,OAAO;GACd,OAAOJ,8BAAAA,YAAY,OAAO,wBAAwB;EACpD;CACF;AACF,CAAC;;AAGD,MAAa,mBAAmBN,sBAAAA,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBY,sDAAAA,oBAAoB,KAAK;EAAE,SAAS;EAAM,QAAQ;CAAK,CAAC;CACzE,kBAAkBC,sBAAAA,yBAAyBD,sDAAAA,oBAAoB,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;CACpF,gBAAgBE,sDAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;EACrD,IAAI;GAEF,MAAM,SAAS,OAAM,MADYX,6CAAAA,sBAAsB,MAAM,EAAA,CACrB,UAAU;IAAE;IAAS;IAAQ;GAAM,CAAC;GAE5E,IAAI,CAAC,QACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,8BAA8B,OAAO,cAAc,QAAQ,GAAG,CAAC;GAGzG,OAAO;EACT,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAED,MAAa,kBAA+BN,sBAAAA,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBgB,qBAAAA;CACjB,gBAAgBC,qBAAAA,uBAAuB,OAAO,EAAE,OAAOtB,OAAAA,EAAE,MAAMuB,qBAAAA,eAAe,EAAE,CAAC;CACjF,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADaf,6CAAAA,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAKlF,OAAO;IAAE,GAAG;IAAO,QAAA,GAAOI,qBAAAA,aAAAA,CAAa,MAAM,KAAK;GAAE;EACtD,SAAS,OAAO;GACd,OAAOb,8BAAAA,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;;AAGD,MAAa,wBAAqCN,sBAAAA,YAAY;CAC5D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBgB,qBAAAA;CACjB,gBAAgBI,qBAAAA;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADajB,6CAAAA,sBAAsB,MAAM,EAAA,CACtB,cAAc,EAAE,QAAQ,CAAC;GAEhE,IAAI,CAAC,OACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAGlF,OAAO;EACT,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC;;AAGD,MAAa,iBAA8BN,sBAAAA,YAAY;CACrD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBqB,qBAAAA;CACjB,gBAAgBC,qBAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,aAAa;EAC9C,IAAI;GAEF,MAAM,OAAO,OAAM,MADcnB,6CAAAA,sBAAsB,MAAM,EAAA,CACvB,QAAQ;IAAE;IAAS;GAAO,CAAC;GAEjE,IAAI,CAAC,MACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO;EACT,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;;AAGD,MAAa,6BAA6BN,sBAAAA,YAAY;CACpD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiBgB,qBAAAA;CACjB,gBAAgBrB,OAAAA,EAAE,OAAO;EACvB,OAAOA,OAAAA,EAAE,MAAMA,OAAAA,EAAE,QAAQ,CAAC;EAC1B,iBAAiBA,OAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EACrC,WAAWA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EAChC,mBAAmBA,OAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC1C,CAAC;CACD,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADaQ,6CAAAA,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAIY,uBAAAA,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAIlF,QAAA,GADmBQ,mBAAAA,2BAAAA,CAA2B,MAAM,KACpC;EAClB,SAAS,OAAO;GACd,OAAOjB,8BAAAA,YAAY,OAAO,wCAAwC;EACpE;CACF;AACF,CAAC;;AAGD,MAAa,sBAAmCN,sBAAAA,YAAY;CAC1D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAYwB,sDAAAA,4BAA4B,KAAK,EAAE,UAAU,KAAK,CAAC;CAC/D,gBAAgBC,sDAAAA;CAChB,aAAa;CACb,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,eAAe;EACvC,IAAI;GAEF,OAAM,MAD2BtB,6CAAAA,sBAAsB,MAAM,EAAA,CACpC,kBAAkB,EAAE,SAAS,CAAC;GACvD,OAAO,EAAE,SAAS,KAAc;EAClC,SAAS,OAAO;GACd,OAAOG,8BAAAA,YAAY,OAAO,uBAAuB;EACnD;CACF;AACF,CAAC;;AAGD,MAAa,qBAAqBN,sBAAAA,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAY0B,qBAAAA;CACZ,gBAAgBC,qBAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GAEF,6CAAA,WAAW,MAAM;GAEjB,MAAM,EAAE,YAAY,YAAY;GAEhC,MAAM,SAAS,OAAO,cAAc,UAAU;GAC9C,IAAI,CAAC,QACH,MAAM,IAAIZ,uBAAAA,cAAc,KAAK,EAAE,SAAS,WAAW,WAAW,aAAa,CAAC;GAG9E,CAAA,GAAA,+BAAA,YAAA,CAAY;IACV,UAAU,OAAO,OAAO,MAAM,OAAO,OAAO;IAC5C;IACA;GACF,CAAC,CAAC,CAAC,OAAM,UAAS;IAEhB,OADsB,UACjB,CAAC,EAAE,MAAM,oCAAoC,MAAM,WAAW,KAAK;GAC1E,CAAC;GAED,OAAO;IACL,QAAQ;IACR,SAAS,uBAAuB,QAAQ,OAAO,GAAG,QAAQ,WAAW,IAAI,UAAU;IACnF,YAAY,QAAQ;GACtB;EACF,SAAS,OAAO;GACd,OAAOT,8BAAAA,YAAY,OAAO,gCAAgC;EAC5D;CACF;AACF,CAAC;AAED,MAAa,4BAA4BN,sBAAAA,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB4B,qBAAAA;CAEjB,kBAAkBf,sBAAAA,yBAAyBR,yDAAAA,qBAAqB,QAAQ,CAAC;CACzE,gBAAgBwB,mBAAAA;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GACF,MAAM,aAAa3B,sBAAAA,WAAWG,yDAAAA,sBAAsB,MAAM;GAC1D,MAAM,UAAUH,sBAAAA,WAAW0B,qBAAAA,eAAe,MAAM;GAIhD,OAAO,OAAM,MAFaE,6CAAAA,eAAe,MAAM,EAAA,CAEtB,iBAAiB;IACxC,GAAG;IACH;GACF,CAAC;EACH,SAAS,OAAO;GACd,OAAOxB,8BAAAA,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC"}

package/dist/{observability-ZRgRcvoX.js → observability-Dz9jvMJ3.js}

@@ -5,13 +5,14 @@ import { handleError } from "./server/handlers/error.js";
 import { paginationArgsSchema } from "./server/handlers/observability-list-query-schemas.js";
 import { OBSERVABILITY_LIST_ENDPOINTS, assertObservabilityDeltaSupported, createObservabilityListQuerySchema, getObservabilityStore, getScoresStore, getStorage } from "./server/handlers/observability-shared.js";
 import { batchDeleteTracesArgsSchema, batchDeleteTracesResponseSchema, branchesFilterSchema, branchesOrderBySchema, getBranchArgsSchema, getBranchResponseSchema, listBranchesResponseSchema, listTracesLightResponseSchema } from "./server/handlers/observability-storage-schemas.js";
-import { A as LIST_FEEDBACK, C as GET_SCORE_BREAKDOWN, D as GET_TAGS, E as GET_SERVICE_NAMES, F as QUERY_SPANS, I as QUERY_THREADS, L as QUERY_TRACES, M as LIST_METRICS, N as LIST_SCORES, O as GET_TRACE_QUERY_FIELDS, P as NEW_ROUTES, R as UPDATE_FEEDBACK_REVIEW_STATUS, S as GET_SCORE_AGGREGATE, T as GET_SCORE_TIME_SERIES, _ as GET_METRIC_LABEL_VALUES, a as DELETE_SCORES, b as GET_METRIC_TIME_SERIES, c as GET_ENTITY_TYPES, d as GET_FEEDBACK_BREAKDOWN, f as GET_FEEDBACK_PERCENTILES, g as GET_METRIC_LABEL_KEYS, h as GET_METRIC_BREAKDOWN, i as DELETE_FEEDBACK, j as LIST_LOGS, k as GET_TRACE_QUERY_VALUES, l as GET_ENVIRONMENTS, m as GET_METRIC_AGGREGATE, n as CREATE_FEEDBACK, o as GET_CAPABILITIES, p as GET_FEEDBACK_TIME_SERIES, r as CREATE_SCORE, s as GET_ENTITY_NAMES, t as AGGREGATE_TRACES, u as GET_FEEDBACK_AGGREGATE, v as GET_METRIC_NAMES, w as GET_SCORE_PERCENTILES, x as GET_SCORE, y as GET_METRIC_PERCENTILES } from "./observability-new-endpoints-fjoZzEtk.js";
+import { A as GET_TRACE_QUERY_VALUES, C as GET_SCORE_AGGREGATE, D as GET_SERVICE_NAMES, E as GET_SCORE_TIME_SERIES, F as NEW_ROUTES, I as QUERY_SPANS, L as QUERY_THREADS, M as LIST_LOGS, N as LIST_METRICS, O as GET_TAGS, P as LIST_SCORES, R as QUERY_TRACES, S as GET_SCORE, T as GET_SCORE_PERCENTILES, _ as GET_METRIC_LABEL_KEYS, a as DELETE_FEEDBACK, b as GET_METRIC_PERCENTILES, c as GET_ENTITY_NAMES, d as GET_FEEDBACK_AGGREGATE, f as GET_FEEDBACK_BREAKDOWN, g as GET_METRIC_BREAKDOWN, h as GET_METRIC_AGGREGATE, i as CREATE_SCORE, j as LIST_FEEDBACK, k as GET_TRACE_QUERY_FIELDS, l as GET_ENTITY_TYPES, m as GET_FEEDBACK_TIME_SERIES, n as AGGREGATE_TRACES, o as DELETE_SCORES, p as GET_FEEDBACK_PERCENTILES, r as CREATE_FEEDBACK, s as GET_CAPABILITIES, t as AGGREGATE_SPANS, u as GET_ENVIRONMENTS, v as GET_METRIC_LABEL_VALUES, w as GET_SCORE_BREAKDOWN, x as GET_METRIC_TIME_SERIES, y as GET_METRIC_NAMES, z as UPDATE_FEEDBACK_REVIEW_STATUS } from "./observability-new-endpoints-3DlTYf34.js";
 import { z } from "zod/v4";
 import { extractTrajectoryFromTrace, listScoresResponseSchema } from "@mastra/core/evals";
 import { scoreTraces } from "@mastra/core/evals/scoreTraces";
 import { dateRangeSchema, getSpanArgsSchema, getSpanResponseSchema, getTraceArgsSchema, getTraceLightResponseSchema, getTraceResponseSchema, listTracesResponseSchema, scoreTracesRequestSchema, scoreTracesResponseSchema, spanIdsSchema, toTraceSpans, traceSpanSchema, tracesFilterSchema, tracesOrderBySchema } from "@mastra/core/storage";
 //#region src/server/handlers/observability.ts
 var observability_exports = /* @__PURE__ */ __exportAll({
+	AGGREGATE_SPANS: () => AGGREGATE_SPANS,
 	AGGREGATE_TRACES: () => AGGREGATE_TRACES,
 	CREATE_FEEDBACK: () => CREATE_FEEDBACK,
 	CREATE_SCORE: () => CREATE_SCORE,
@@ -428,4 +429,4 @@ const LIST_SCORES_BY_SPAN_ROUTE = createRoute({
 //#endregion
 export { GET_TRACE_ROUTE as a, LIST_SCORES_BY_SPAN_ROUTE as c, SCORE_TRACES_ROUTE as d, observability_exports as f, GET_TRACE_LIGHT_ROUTE as i, LIST_TRACES_LIGHT_ROUTE as l, GET_BRANCH_ROUTE as n, GET_TRACE_TRAJECTORY_ROUTE as o, GET_SPAN_ROUTE as r, LIST_BRANCHES_ROUTE as s, DELETE_TRACES_ROUTE as t, LIST_TRACES_ROUTE as u };
 
-//# sourceMappingURL=observability-ZRgRcvoX.js.map
+//# sourceMappingURL=observability-Dz9jvMJ3.js.map

package/dist/{observability-ZRgRcvoX.js.map → observability-Dz9jvMJ3.js.map}

@@ -1 +1 @@
-{"version":3,"file":"observability-ZRgRcvoX.js","names":["store"],"sources":["../src/server/handlers/observability.ts"],"sourcesContent":["import { extractTrajectoryFromTrace, listScoresResponseSchema } from '@mastra/core/evals';\nimport { scoreTraces } from '@mastra/core/evals/scoreTraces';\nimport {\n  tracesFilterSchema,\n  tracesOrderBySchema,\n  spanIdsSchema,\n  listTracesResponseSchema,\n  scoreTracesRequestSchema,\n  scoreTracesResponseSchema,\n  getTraceArgsSchema,\n  getTraceResponseSchema,\n  getTraceLightResponseSchema,\n  getSpanArgsSchema,\n  getSpanResponseSchema,\n  dateRangeSchema,\n  toTraceSpans,\n  traceSpanSchema,\n} from '@mastra/core/storage';\n// `branches*`, `listBranches*`, and `getBranch*` schemas are new in\n// @mastra/core@1.32.0; route them through a shim that tolerates older cores\n// (see ./observability-storage-schemas.ts for full rationale).\nimport { z } from 'zod/v4';\nimport { HTTPException } from '../http-exception';\nimport type { ServerRoute } from '../server-adapter/routes';\nimport { createRoute, pickParams, wrapSchemaForQueryParams } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport { paginationArgsSchema } from './observability-list-query-schemas';\nimport {\n  assertObservabilityDeltaSupported,\n  createObservabilityListQuerySchema,\n  getObservabilityStore,\n  getScoresStore,\n  getStorage,\n  OBSERVABILITY_LIST_ENDPOINTS,\n} from './observability-shared';\nimport {\n  branchesFilterSchema,\n  branchesOrderBySchema,\n  listBranchesResponseSchema,\n  getBranchArgsSchema,\n  getBranchResponseSchema,\n  listTracesLightResponseSchema,\n  batchDeleteTracesArgsSchema,\n  batchDeleteTracesResponseSchema,\n} from './observability-storage-schemas';\n\nexport * from './observability-new-endpoints';\n\n// ============================================================================\n// Legacy Parameter Support (backward compatibility with main branch API)\n// ============================================================================\n\n/**\n * Legacy query parameters from the old API (main branch).\n * These are accepted for backward compatibility and transformed to new format.\n */\nconst legacyQueryParamsSchema = z.object({\n  // Old: dateRange was in pagination, now it's startedAt in filters\n  dateRange: dateRangeSchema.optional(),\n  // Old: name matched span names like \"agent run: 'myAgent'\"\n  name: z.string().optional(),\n  // entityType needs preprocessing to handle legacy 'workflow' value\n  entityType: z.preprocess(val => (val === 'workflow' ? 'workflow_run' : val), z.string().optional()),\n});\n\n/**\n * Transforms legacy query parameters to the new format.\n * - dateRange -> startedAt (if startedAt not already set)\n * - name=\"agent run: 'x'\" -> entityId='x', entityType='agent'\n * - name=\"workflow run: 'x'\" -> entityId='x', entityType='workflow_run'\n * - entityType='workflow' -> entityType='workflow_run' (enum value fix)\n */\nfunction transformLegacyParams(params: Record<string, unknown>): Record<string, unknown> {\n  const result = { ...params };\n\n  // Transform old entityType='workflow' -> 'workflow_run' to support direct handler usage in tests\n  if (result.entityType === 'workflow') {\n    result.entityType = 'workflow_run';\n  }\n\n  // Transform old dateRange -> new startedAt\n  if (params.dateRange && !params.startedAt) {\n    result.startedAt = params.dateRange;\n    delete result.dateRange;\n  }\n\n  // Transform old name -> entityId + entityType\n  // Old format: name matched span names like \"agent run: 'myAgent'\" or \"workflow run: 'myWorkflow'\"\n  if (typeof params.name === 'string' && !params.entityId) {\n    const agentMatch = params.name.match(/^agent run: '([^']+)'$/);\n    const workflowMatch = params.name.match(/^workflow run: '([^']+)'$/);\n\n    if (agentMatch) {\n      result.entityId = agentMatch[1];\n      result.entityType = 'agent';\n    } else if (workflowMatch) {\n      result.entityId = workflowMatch[1];\n      result.entityType = 'workflow_run';\n    }\n    delete result.name;\n  }\n\n  return result;\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\n/** Filter shape shared by the full and lightweight trace list routes. */\nconst tracesListFilterSchema = tracesFilterSchema.extend({\n  ...legacyQueryParamsSchema.shape, // Accept legacy params for backward compatibility\n  entityType: z.preprocess(\n    value => (value === 'workflow' ? 'workflow_run' : value),\n    tracesFilterSchema.shape.entityType,\n  ),\n});\n\nconst listTracesQueryParamSchema = createObservabilityListQuerySchema(tracesListFilterSchema, tracesOrderBySchema);\n\n/** Route: GET /observability/traces - paginated trace listing with filtering and sorting. */\nexport const LIST_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesResponseSchema,\n  summary: 'List traces',\n  description:\n    'Returns a paginated list of traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      // Transform legacy params to new format before processing\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        return await observabilityStore.listTraces({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n      return await observabilityStore.listTraces({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing traces');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/light - paginated lightweight trace listing with filtering and sorting. */\nexport const LIST_TRACES_LIGHT_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/light',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesLightResponseSchema,\n  summary: 'List lightweight traces',\n  description:\n    'Returns a paginated list of lightweight traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n\n      // Every current store answers `listTracesLight` — stores without a dedicated\n      // implementation inherit the base class's projection fallback. This guard is\n      // only for an older `@mastra/core` whose base class predates the method, where\n      // calling it would throw `TypeError: ... is not a function`; there we fall back\n      // to `listTraces` so consumers still get a response.\n      const store = observabilityStore as { listTracesLight?: unknown };\n      const supportsLight = typeof store.listTracesLight === 'function';\n\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        const deltaArgs = {\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        } as const;\n        return supportsLight\n          ? await observabilityStore.listTracesLight(deltaArgs)\n          : await observabilityStore.listTraces(deltaArgs);\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n\n      if (!supportsLight) {\n        return await observabilityStore.listTraces({ filters, pagination, orderBy });\n      }\n      return await observabilityStore.listTracesLight({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing lightweight traces');\n    }\n  },\n});\n\n/** Route: GET /observability/branches - paginated branch-anchor span listing across all traces. */\nexport const LIST_BRANCHES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/branches',\n  responseType: 'json',\n  queryParamSchema: createObservabilityListQuerySchema(branchesFilterSchema, branchesOrderBySchema),\n  responseSchema: listBranchesResponseSchema,\n  summary: 'List trace branches',\n  description:\n    'Returns a paginated list of branch-anchor spans (e.g., AGENT_RUN, WORKFLOW_RUN, TOOL_CALL) across all traces. Unlike listTraces (one row per root-rooted trace), each row here is a single anchor span -- including ones nested under a different root entity. In delta mode, returns only newly listed branch rows matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const filters = pickParams(branchesFilterSchema, params);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.branches);\n        return await observabilityStore.listBranches({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, params);\n      const orderBy = pickParams(branchesOrderBySchema, params);\n      return await observabilityStore.listBranches({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing branches');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/branches/:spanId - retrieve the subtree rooted at a span. */\nexport const GET_BRANCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/branches/:spanId',\n  responseType: 'json',\n  pathParamSchema: getBranchArgsSchema.pick({ traceId: true, spanId: true }),\n  queryParamSchema: wrapSchemaForQueryParams(getBranchArgsSchema.pick({ depth: true })),\n  responseSchema: getBranchResponseSchema,\n  summary: 'Get trace branch by span ID',\n  description:\n    'Returns the subtree of spans rooted at the given span. The optional `depth` query param bounds descendant levels below the anchor (0 = anchor only; omitted = full subtree).',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId, depth }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const branch = await observabilityStore.getBranch({ traceId, spanId, depth });\n\n      if (!branch) {\n        throw new HTTPException(404, { message: `Branch not found for span '${spanId}' in trace '${traceId}'` });\n      }\n\n      return branch;\n    } catch (error) {\n      return handleError(error, 'Error getting branch');\n    }\n  },\n});\n/** Route: GET /observability/traces/:traceId - retrieve a single trace with all spans. */\nexport const GET_TRACE_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceResponseSchema.extend({ spans: z.array(traceSpanSchema) }),\n  summary: 'Get AI trace by ID',\n  description: 'Returns a complete AI trace with all spans by trace ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      // Stored SpanRecords carry no status field; derive it from error/endedAt so\n      // trace-detail spans match the status shown in trace list rows.\n      return { ...trace, spans: toTraceSpans(trace.spans) };\n    } catch (error) {\n      return handleError(error, 'Error getting trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/light - lightweight trace for timeline rendering. */\nexport const GET_TRACE_LIGHT_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/light',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceLightResponseSchema,\n  summary: 'Get lightweight AI trace by ID',\n  description:\n    'Returns a trace with lightweight span data (timeline fields only, excludes input/output/attributes/metadata/tags/links)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTraceLight({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      return trace;\n    } catch (error) {\n      return handleError(error, 'Error getting lightweight trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/spans/:spanId - get a single span with full details. */\nexport const GET_SPAN_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/spans/:spanId',\n  responseType: 'json',\n  pathParamSchema: getSpanArgsSchema,\n  responseSchema: getSpanResponseSchema,\n  summary: 'Get a single span by ID',\n  description: 'Returns a complete span record with all details by trace ID and span ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const span = await observabilityStore.getSpan({ traceId, spanId });\n\n      if (!span) {\n        throw new HTTPException(404, { message: `Span not found` });\n      }\n\n      return span;\n    } catch (error) {\n      return handleError(error, 'Error getting span');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/trajectory - extract trajectory from a trace. */\nexport const GET_TRACE_TRAJECTORY_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/trajectory',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: z.object({\n    steps: z.array(z.unknown()),\n    totalDurationMs: z.number().optional(),\n    rawOutput: z.unknown().optional(),\n    rawWorkflowResult: z.unknown().optional(),\n  }),\n  summary: 'Extract trajectory from trace',\n  description: 'Extracts a structured trajectory (ordered steps) from a trace by analyzing its spans',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      const trajectory = extractTrajectoryFromTrace(trace.spans);\n      return trajectory;\n    } catch (error) {\n      return handleError(error, 'Error extracting trajectory from trace');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/delete - batch delete traces with cross-signal cascade. */\nexport const DELETE_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'POST',\n  path: '/observability/traces/delete',\n  responseType: 'json',\n  bodySchema: batchDeleteTracesArgsSchema.pick({ traceIds: true }),\n  responseSchema: batchDeleteTracesResponseSchema,\n  maxBodySize: 256 * 1024,\n  summary: 'Delete traces',\n  description:\n    'Deletes traces by ID, cascading to all associated data: spans, trace roots/branches, and signal events (scores, feedback, metrics, logs) that reference the deleted traces. Signals without a trace ID are untouched. Experiment traces are deleted like any other trace. On ClickHouse-backed stores, deletes are lightweight and reads may briefly return deleted rows until the delete is fully applied.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceIds }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      await observabilityStore.batchDeleteTraces({ traceIds });\n      return { success: true as const };\n    } catch (error) {\n      return handleError(error, 'Error deleting traces');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/score - score traces using a specified scorer (fire-and-forget). */\nexport const SCORE_TRACES_ROUTE = createRoute({\n  method: 'POST',\n  path: '/observability/traces/score',\n  responseType: 'json',\n  bodySchema: scoreTracesRequestSchema,\n  responseSchema: scoreTracesResponseSchema,\n  summary: 'Score traces',\n  description: 'Scores one or more traces using a specified scorer (fire-and-forget)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      // Validate storage exists before starting background task\n      getStorage(mastra);\n\n      const { scorerName, targets } = params;\n\n      const scorer = mastra.getScorerById(scorerName);\n      if (!scorer) {\n        throw new HTTPException(404, { message: `Scorer '${scorerName}' not found` });\n      }\n\n      scoreTraces({\n        scorerId: scorer.config.id || scorer.config.name,\n        targets,\n        mastra,\n      }).catch(error => {\n        const logger = mastra.getLogger();\n        logger?.error(`Background trace scoring failed: ${error.message}`, error);\n      });\n\n      return {\n        status: 'success',\n        message: `Scoring started for ${targets.length} ${targets.length === 1 ? 'trace' : 'traces'}`,\n        traceCount: targets.length,\n      };\n    } catch (error) {\n      return handleError(error, 'Error processing trace scoring');\n    }\n  },\n});\n\nexport const LIST_SCORES_BY_SPAN_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/:spanId/scores',\n  responseType: 'json',\n  pathParamSchema: spanIdsSchema,\n  // List endpoints accept optional query params; use partial() to allow empty queries.\n  queryParamSchema: wrapSchemaForQueryParams(paginationArgsSchema.partial()),\n  responseSchema: listScoresResponseSchema,\n  summary: 'List scores by span',\n  description: 'Returns all scores for a specific span within a trace',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      const pagination = pickParams(paginationArgsSchema, params);\n      const spanIds = pickParams(spanIdsSchema, params);\n\n      const scoresStore = await getScoresStore(mastra);\n\n      return await scoresStore.listScoresBySpan({\n        ...spanIds,\n        pagination,\n      });\n    } catch (error) {\n      return handleError(error, 'Error getting scores by span');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,0BAA0B,EAAE,OAAO;CAEvC,WAAW,gBAAgB,SAAS;CAEpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAE1B,YAAY,EAAE,YAAW,QAAQ,QAAQ,aAAa,iBAAiB,KAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;;;;;;;;AASD,SAAS,sBAAsB,QAA0D;CACvF,MAAM,SAAS,EAAE,GAAG,OAAO;CAG3B,IAAI,OAAO,eAAe,YACxB,OAAO,aAAa;CAItB,IAAI,OAAO,aAAa,CAAC,OAAO,WAAW;EACzC,OAAO,YAAY,OAAO;EAC1B,OAAO,OAAO;CAChB;CAIA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,UAAU;EACvD,MAAM,aAAa,OAAO,KAAK,MAAM,wBAAwB;EAC7D,MAAM,gBAAgB,OAAO,KAAK,MAAM,2BAA2B;EAEnE,IAAI,YAAY;GACd,OAAO,WAAW,WAAW;GAC7B,OAAO,aAAa;EACtB,OAAO,IAAI,eAAe;GACxB,OAAO,WAAW,cAAc;GAChC,OAAO,aAAa;EACtB;EACA,OAAO,OAAO;CAChB;CAEA,OAAO;AACT;;AAOA,MAAM,yBAAyB,mBAAmB,OAAO;CACvD,GAAG,wBAAwB;CAC3B,YAAY,EAAE,YACZ,UAAU,UAAU,aAAa,iBAAiB,OAClD,mBAAmB,MAAM,UAC3B;AACF,CAAC;AAED,MAAM,6BAA6B,mCAAmC,wBAAwB,mBAAmB;;AAGjH,MAAa,oBAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GAEF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAU,WAAW,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAM,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,kCAAkC,oBAAoB,6BAA6B,MAAM;IACzF,OAAO,MAAM,mBAAmB,WAAW;KACzC;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAa,WAAW,sBAAsB,iBAAiB;GACrE,MAAM,UAAU,WAAW,qBAAqB,iBAAiB;GACjE,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC7E,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAGD,MAAa,0BAA0B,YAAY;CACjD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAU,WAAW,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAM,sBAAsB,MAAM;GAQ7D,MAAM,gBAAgB,OAAOA,mBAAM,oBAAoB;GAEvD,IAAI,SAAS,SAAS;IACpB,kCAAkC,oBAAoB,6BAA6B,MAAM;IACzF,MAAM,YAAY;KAChB;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF;IACA,OAAO,gBACH,MAAM,mBAAmB,gBAAgB,SAAS,IAClD,MAAM,mBAAmB,WAAW,SAAS;GACnD;GAEA,MAAM,aAAa,WAAW,sBAAsB,iBAAiB;GACrE,MAAM,UAAU,WAAW,qBAAqB,iBAAiB;GAEjE,IAAI,CAAC,eACH,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;GAE7E,OAAO,MAAM,mBAAmB,gBAAgB;IAAE;IAAS;IAAY;GAAQ,CAAC;EAClF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;AAGD,MAAa,sBAAsB,YAAY;CAC7C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB,mCAAmC,sBAAsB,qBAAqB;CAChG,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,UAAU,WAAW,sBAAsB,MAAM;GACvD,MAAM,qBAAqB,MAAM,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,kCAAkC,oBAAoB,6BAA6B,QAAQ;IAC3F,OAAO,MAAM,mBAAmB,aAAa;KAC3C;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAa,WAAW,sBAAsB,MAAM;GAC1D,MAAM,UAAU,WAAW,uBAAuB,MAAM;GACxD,OAAO,MAAM,mBAAmB,aAAa;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC/E,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,wBAAwB;EACpD;CACF;AACF,CAAC;;AAGD,MAAa,mBAAmB,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB,oBAAoB,KAAK;EAAE,SAAS;EAAM,QAAQ;CAAK,CAAC;CACzE,kBAAkB,yBAAyB,oBAAoB,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;CACpF,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;EACrD,IAAI;GAEF,MAAM,SAAS,OAAM,MADY,sBAAsB,MAAM,EAAA,CACrB,UAAU;IAAE;IAAS;IAAQ;GAAM,CAAC;GAE5E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8BAA8B,OAAO,cAAc,QAAQ,GAAG,CAAC;GAGzG,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAED,MAAa,kBAA+B,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB,uBAAuB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,EAAE,CAAC;CACjF,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADa,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAKlF,OAAO;IAAE,GAAG;IAAO,OAAO,aAAa,MAAM,KAAK;GAAE;EACtD,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;;AAGD,MAAa,wBAAqC,YAAY;CAC5D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADa,sBAAsB,MAAM,EAAA,CACtB,cAAc,EAAE,QAAQ,CAAC;GAEhE,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAGlF,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC;;AAGD,MAAa,iBAA8B,YAAY;CACrD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,aAAa;EAC9C,IAAI;GAEF,MAAM,OAAO,OAAM,MADc,sBAAsB,MAAM,EAAA,CACvB,QAAQ;IAAE;IAAS;GAAO,CAAC;GAEjE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;;AAGD,MAAa,6BAA6B,YAAY;CACpD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB,EAAE,OAAO;EACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;EAC1B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;EACrC,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;EAChC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC1C,CAAC;CACD,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADa,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAIlF,OADmB,2BAA2B,MAAM,KACpC;EAClB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,wCAAwC;EACpE;CACF;AACF,CAAC;;AAGD,MAAa,sBAAmC,YAAY;CAC1D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAY,4BAA4B,KAAK,EAAE,UAAU,KAAK,CAAC;CAC/D,gBAAgB;CAChB,aAAa;CACb,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,eAAe;EACvC,IAAI;GAEF,OAAM,MAD2B,sBAAsB,MAAM,EAAA,CACpC,kBAAkB,EAAE,SAAS,CAAC;GACvD,OAAO,EAAE,SAAS,KAAc;EAClC,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,uBAAuB;EACnD;CACF;AACF,CAAC;;AAGD,MAAa,qBAAqB,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GAEF,WAAW,MAAM;GAEjB,MAAM,EAAE,YAAY,YAAY;GAEhC,MAAM,SAAS,OAAO,cAAc,UAAU;GAC9C,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,WAAW,WAAW,aAAa,CAAC;GAG9E,YAAY;IACV,UAAU,OAAO,OAAO,MAAM,OAAO,OAAO;IAC5C;IACA;GACF,CAAC,CAAC,CAAC,OAAM,UAAS;IAEhB,OADsB,UACjB,CAAC,EAAE,MAAM,oCAAoC,MAAM,WAAW,KAAK;GAC1E,CAAC;GAED,OAAO;IACL,QAAQ;IACR,SAAS,uBAAuB,QAAQ,OAAO,GAAG,QAAQ,WAAW,IAAI,UAAU;IACnF,YAAY,QAAQ;GACtB;EACF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,gCAAgC;EAC5D;CACF;AACF,CAAC;AAED,MAAa,4BAA4B,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CAEjB,kBAAkB,yBAAyB,qBAAqB,QAAQ,CAAC;CACzE,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GACF,MAAM,aAAa,WAAW,sBAAsB,MAAM;GAC1D,MAAM,UAAU,WAAW,eAAe,MAAM;GAIhD,OAAO,OAAM,MAFa,eAAe,MAAM,EAAA,CAEtB,iBAAiB;IACxC,GAAG;IACH;GACF,CAAC;EACH,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC"}
+{"version":3,"file":"observability-Dz9jvMJ3.js","names":["store"],"sources":["../src/server/handlers/observability.ts"],"sourcesContent":["import { extractTrajectoryFromTrace, listScoresResponseSchema } from '@mastra/core/evals';\nimport { scoreTraces } from '@mastra/core/evals/scoreTraces';\nimport {\n  tracesFilterSchema,\n  tracesOrderBySchema,\n  spanIdsSchema,\n  listTracesResponseSchema,\n  scoreTracesRequestSchema,\n  scoreTracesResponseSchema,\n  getTraceArgsSchema,\n  getTraceResponseSchema,\n  getTraceLightResponseSchema,\n  getSpanArgsSchema,\n  getSpanResponseSchema,\n  dateRangeSchema,\n  toTraceSpans,\n  traceSpanSchema,\n} from '@mastra/core/storage';\n// `branches*`, `listBranches*`, and `getBranch*` schemas are new in\n// @mastra/core@1.32.0; route them through a shim that tolerates older cores\n// (see ./observability-storage-schemas.ts for full rationale).\nimport { z } from 'zod/v4';\nimport { HTTPException } from '../http-exception';\nimport type { ServerRoute } from '../server-adapter/routes';\nimport { createRoute, pickParams, wrapSchemaForQueryParams } from '../server-adapter/routes/route-builder';\nimport { handleError } from './error';\nimport { paginationArgsSchema } from './observability-list-query-schemas';\nimport {\n  assertObservabilityDeltaSupported,\n  createObservabilityListQuerySchema,\n  getObservabilityStore,\n  getScoresStore,\n  getStorage,\n  OBSERVABILITY_LIST_ENDPOINTS,\n} from './observability-shared';\nimport {\n  branchesFilterSchema,\n  branchesOrderBySchema,\n  listBranchesResponseSchema,\n  getBranchArgsSchema,\n  getBranchResponseSchema,\n  listTracesLightResponseSchema,\n  batchDeleteTracesArgsSchema,\n  batchDeleteTracesResponseSchema,\n} from './observability-storage-schemas';\n\nexport * from './observability-new-endpoints';\n\n// ============================================================================\n// Legacy Parameter Support (backward compatibility with main branch API)\n// ============================================================================\n\n/**\n * Legacy query parameters from the old API (main branch).\n * These are accepted for backward compatibility and transformed to new format.\n */\nconst legacyQueryParamsSchema = z.object({\n  // Old: dateRange was in pagination, now it's startedAt in filters\n  dateRange: dateRangeSchema.optional(),\n  // Old: name matched span names like \"agent run: 'myAgent'\"\n  name: z.string().optional(),\n  // entityType needs preprocessing to handle legacy 'workflow' value\n  entityType: z.preprocess(val => (val === 'workflow' ? 'workflow_run' : val), z.string().optional()),\n});\n\n/**\n * Transforms legacy query parameters to the new format.\n * - dateRange -> startedAt (if startedAt not already set)\n * - name=\"agent run: 'x'\" -> entityId='x', entityType='agent'\n * - name=\"workflow run: 'x'\" -> entityId='x', entityType='workflow_run'\n * - entityType='workflow' -> entityType='workflow_run' (enum value fix)\n */\nfunction transformLegacyParams(params: Record<string, unknown>): Record<string, unknown> {\n  const result = { ...params };\n\n  // Transform old entityType='workflow' -> 'workflow_run' to support direct handler usage in tests\n  if (result.entityType === 'workflow') {\n    result.entityType = 'workflow_run';\n  }\n\n  // Transform old dateRange -> new startedAt\n  if (params.dateRange && !params.startedAt) {\n    result.startedAt = params.dateRange;\n    delete result.dateRange;\n  }\n\n  // Transform old name -> entityId + entityType\n  // Old format: name matched span names like \"agent run: 'myAgent'\" or \"workflow run: 'myWorkflow'\"\n  if (typeof params.name === 'string' && !params.entityId) {\n    const agentMatch = params.name.match(/^agent run: '([^']+)'$/);\n    const workflowMatch = params.name.match(/^workflow run: '([^']+)'$/);\n\n    if (agentMatch) {\n      result.entityId = agentMatch[1];\n      result.entityType = 'agent';\n    } else if (workflowMatch) {\n      result.entityId = workflowMatch[1];\n      result.entityType = 'workflow_run';\n    }\n    delete result.name;\n  }\n\n  return result;\n}\n\n// ============================================================================\n// Route Definitions (new pattern - handlers defined inline with createRoute)\n// ============================================================================\n\n/** Filter shape shared by the full and lightweight trace list routes. */\nconst tracesListFilterSchema = tracesFilterSchema.extend({\n  ...legacyQueryParamsSchema.shape, // Accept legacy params for backward compatibility\n  entityType: z.preprocess(\n    value => (value === 'workflow' ? 'workflow_run' : value),\n    tracesFilterSchema.shape.entityType,\n  ),\n});\n\nconst listTracesQueryParamSchema = createObservabilityListQuerySchema(tracesListFilterSchema, tracesOrderBySchema);\n\n/** Route: GET /observability/traces - paginated trace listing with filtering and sorting. */\nexport const LIST_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesResponseSchema,\n  summary: 'List traces',\n  description:\n    'Returns a paginated list of traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      // Transform legacy params to new format before processing\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        return await observabilityStore.listTraces({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n      return await observabilityStore.listTraces({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing traces');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/light - paginated lightweight trace listing with filtering and sorting. */\nexport const LIST_TRACES_LIGHT_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/light',\n  responseType: 'json',\n  queryParamSchema: listTracesQueryParamSchema,\n  responseSchema: listTracesLightResponseSchema,\n  summary: 'List lightweight traces',\n  description:\n    'Returns a paginated list of lightweight traces with optional filtering and sorting. In delta mode, returns only newly listed traces matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const transformedParams = transformLegacyParams(params);\n\n      const filters = pickParams(tracesFilterSchema, transformedParams);\n      const observabilityStore = await getObservabilityStore(mastra);\n\n      // Every current store answers `listTracesLight` — stores without a dedicated\n      // implementation inherit the base class's projection fallback. This guard is\n      // only for an older `@mastra/core` whose base class predates the method, where\n      // calling it would throw `TypeError: ... is not a function`; there we fall back\n      // to `listTraces` so consumers still get a response.\n      const store = observabilityStore as { listTracesLight?: unknown };\n      const supportsLight = typeof store.listTracesLight === 'function';\n\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.traces);\n        const deltaArgs = {\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        } as const;\n        return supportsLight\n          ? await observabilityStore.listTracesLight(deltaArgs)\n          : await observabilityStore.listTraces(deltaArgs);\n      }\n\n      const pagination = pickParams(paginationArgsSchema, transformedParams);\n      const orderBy = pickParams(tracesOrderBySchema, transformedParams);\n\n      if (!supportsLight) {\n        return await observabilityStore.listTraces({ filters, pagination, orderBy });\n      }\n      return await observabilityStore.listTracesLight({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing lightweight traces');\n    }\n  },\n});\n\n/** Route: GET /observability/branches - paginated branch-anchor span listing across all traces. */\nexport const LIST_BRANCHES_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/branches',\n  responseType: 'json',\n  queryParamSchema: createObservabilityListQuerySchema(branchesFilterSchema, branchesOrderBySchema),\n  responseSchema: listBranchesResponseSchema,\n  summary: 'List trace branches',\n  description:\n    'Returns a paginated list of branch-anchor spans (e.g., AGENT_RUN, WORKFLOW_RUN, TOOL_CALL) across all traces. Unlike listTraces (one row per root-rooted trace), each row here is a single anchor span -- including ones nested under a different root entity. In delta mode, returns only newly listed branch rows matching the filters.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, mode, after, limit, ...params }) => {\n    try {\n      const filters = pickParams(branchesFilterSchema, params);\n      const observabilityStore = await getObservabilityStore(mastra);\n      if (mode === 'delta') {\n        assertObservabilityDeltaSupported(observabilityStore, OBSERVABILITY_LIST_ENDPOINTS.branches);\n        return await observabilityStore.listBranches({\n          mode,\n          filters,\n          after: typeof after === 'string' ? after : undefined,\n          limit,\n        });\n      }\n\n      const pagination = pickParams(paginationArgsSchema, params);\n      const orderBy = pickParams(branchesOrderBySchema, params);\n      return await observabilityStore.listBranches({ filters, pagination, orderBy });\n    } catch (error) {\n      return handleError(error, 'Error listing branches');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/branches/:spanId - retrieve the subtree rooted at a span. */\nexport const GET_BRANCH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/branches/:spanId',\n  responseType: 'json',\n  pathParamSchema: getBranchArgsSchema.pick({ traceId: true, spanId: true }),\n  queryParamSchema: wrapSchemaForQueryParams(getBranchArgsSchema.pick({ depth: true })),\n  responseSchema: getBranchResponseSchema,\n  summary: 'Get trace branch by span ID',\n  description:\n    'Returns the subtree of spans rooted at the given span. The optional `depth` query param bounds descendant levels below the anchor (0 = anchor only; omitted = full subtree).',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId, depth }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const branch = await observabilityStore.getBranch({ traceId, spanId, depth });\n\n      if (!branch) {\n        throw new HTTPException(404, { message: `Branch not found for span '${spanId}' in trace '${traceId}'` });\n      }\n\n      return branch;\n    } catch (error) {\n      return handleError(error, 'Error getting branch');\n    }\n  },\n});\n/** Route: GET /observability/traces/:traceId - retrieve a single trace with all spans. */\nexport const GET_TRACE_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceResponseSchema.extend({ spans: z.array(traceSpanSchema) }),\n  summary: 'Get AI trace by ID',\n  description: 'Returns a complete AI trace with all spans by trace ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      // Stored SpanRecords carry no status field; derive it from error/endedAt so\n      // trace-detail spans match the status shown in trace list rows.\n      return { ...trace, spans: toTraceSpans(trace.spans) };\n    } catch (error) {\n      return handleError(error, 'Error getting trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/light - lightweight trace for timeline rendering. */\nexport const GET_TRACE_LIGHT_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/light',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: getTraceLightResponseSchema,\n  summary: 'Get lightweight AI trace by ID',\n  description:\n    'Returns a trace with lightweight span data (timeline fields only, excludes input/output/attributes/metadata/tags/links)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTraceLight({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      return trace;\n    } catch (error) {\n      return handleError(error, 'Error getting lightweight trace');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/spans/:spanId - get a single span with full details. */\nexport const GET_SPAN_ROUTE: ServerRoute = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/spans/:spanId',\n  responseType: 'json',\n  pathParamSchema: getSpanArgsSchema,\n  responseSchema: getSpanResponseSchema,\n  summary: 'Get a single span by ID',\n  description: 'Returns a complete span record with all details by trace ID and span ID',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId, spanId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const span = await observabilityStore.getSpan({ traceId, spanId });\n\n      if (!span) {\n        throw new HTTPException(404, { message: `Span not found` });\n      }\n\n      return span;\n    } catch (error) {\n      return handleError(error, 'Error getting span');\n    }\n  },\n});\n\n/** Route: GET /observability/traces/:traceId/trajectory - extract trajectory from a trace. */\nexport const GET_TRACE_TRAJECTORY_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/trajectory',\n  responseType: 'json',\n  pathParamSchema: getTraceArgsSchema,\n  responseSchema: z.object({\n    steps: z.array(z.unknown()),\n    totalDurationMs: z.number().optional(),\n    rawOutput: z.unknown().optional(),\n    rawWorkflowResult: z.unknown().optional(),\n  }),\n  summary: 'Extract trajectory from trace',\n  description: 'Extracts a structured trajectory (ordered steps) from a trace by analyzing its spans',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceId }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      const trace = await observabilityStore.getTrace({ traceId });\n\n      if (!trace) {\n        throw new HTTPException(404, { message: `Trace with ID '${traceId}' not found` });\n      }\n\n      const trajectory = extractTrajectoryFromTrace(trace.spans);\n      return trajectory;\n    } catch (error) {\n      return handleError(error, 'Error extracting trajectory from trace');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/delete - batch delete traces with cross-signal cascade. */\nexport const DELETE_TRACES_ROUTE: ServerRoute = createRoute({\n  method: 'POST',\n  path: '/observability/traces/delete',\n  responseType: 'json',\n  bodySchema: batchDeleteTracesArgsSchema.pick({ traceIds: true }),\n  responseSchema: batchDeleteTracesResponseSchema,\n  maxBodySize: 256 * 1024,\n  summary: 'Delete traces',\n  description:\n    'Deletes traces by ID, cascading to all associated data: spans, trace roots/branches, and signal events (scores, feedback, metrics, logs) that reference the deleted traces. Signals without a trace ID are untouched. Experiment traces are deleted like any other trace. On ClickHouse-backed stores, deletes are lightweight and reads may briefly return deleted rows until the delete is fully applied.',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, traceIds }) => {\n    try {\n      const observabilityStore = await getObservabilityStore(mastra);\n      await observabilityStore.batchDeleteTraces({ traceIds });\n      return { success: true as const };\n    } catch (error) {\n      return handleError(error, 'Error deleting traces');\n    }\n  },\n});\n\n/** Route: POST /observability/traces/score - score traces using a specified scorer (fire-and-forget). */\nexport const SCORE_TRACES_ROUTE = createRoute({\n  method: 'POST',\n  path: '/observability/traces/score',\n  responseType: 'json',\n  bodySchema: scoreTracesRequestSchema,\n  responseSchema: scoreTracesResponseSchema,\n  summary: 'Score traces',\n  description: 'Scores one or more traces using a specified scorer (fire-and-forget)',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      // Validate storage exists before starting background task\n      getStorage(mastra);\n\n      const { scorerName, targets } = params;\n\n      const scorer = mastra.getScorerById(scorerName);\n      if (!scorer) {\n        throw new HTTPException(404, { message: `Scorer '${scorerName}' not found` });\n      }\n\n      scoreTraces({\n        scorerId: scorer.config.id || scorer.config.name,\n        targets,\n        mastra,\n      }).catch(error => {\n        const logger = mastra.getLogger();\n        logger?.error(`Background trace scoring failed: ${error.message}`, error);\n      });\n\n      return {\n        status: 'success',\n        message: `Scoring started for ${targets.length} ${targets.length === 1 ? 'trace' : 'traces'}`,\n        traceCount: targets.length,\n      };\n    } catch (error) {\n      return handleError(error, 'Error processing trace scoring');\n    }\n  },\n});\n\nexport const LIST_SCORES_BY_SPAN_ROUTE = createRoute({\n  method: 'GET',\n  path: '/observability/traces/:traceId/:spanId/scores',\n  responseType: 'json',\n  pathParamSchema: spanIdsSchema,\n  // List endpoints accept optional query params; use partial() to allow empty queries.\n  queryParamSchema: wrapSchemaForQueryParams(paginationArgsSchema.partial()),\n  responseSchema: listScoresResponseSchema,\n  summary: 'List scores by span',\n  description: 'Returns all scores for a specific span within a trace',\n  tags: ['Observability'],\n  requiresAuth: true,\n  handler: async ({ mastra, ...params }) => {\n    try {\n      const pagination = pickParams(paginationArgsSchema, params);\n      const spanIds = pickParams(spanIdsSchema, params);\n\n      const scoresStore = await getScoresStore(mastra);\n\n      return await scoresStore.listScoresBySpan({\n        ...spanIds,\n        pagination,\n      });\n    } catch (error) {\n      return handleError(error, 'Error getting scores by span');\n    }\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,0BAA0B,EAAE,OAAO;CAEvC,WAAW,gBAAgB,SAAS;CAEpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAE1B,YAAY,EAAE,YAAW,QAAQ,QAAQ,aAAa,iBAAiB,KAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;;;;;;;;AASD,SAAS,sBAAsB,QAA0D;CACvF,MAAM,SAAS,EAAE,GAAG,OAAO;CAG3B,IAAI,OAAO,eAAe,YACxB,OAAO,aAAa;CAItB,IAAI,OAAO,aAAa,CAAC,OAAO,WAAW;EACzC,OAAO,YAAY,OAAO;EAC1B,OAAO,OAAO;CAChB;CAIA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,UAAU;EACvD,MAAM,aAAa,OAAO,KAAK,MAAM,wBAAwB;EAC7D,MAAM,gBAAgB,OAAO,KAAK,MAAM,2BAA2B;EAEnE,IAAI,YAAY;GACd,OAAO,WAAW,WAAW;GAC7B,OAAO,aAAa;EACtB,OAAO,IAAI,eAAe;GACxB,OAAO,WAAW,cAAc;GAChC,OAAO,aAAa;EACtB;EACA,OAAO,OAAO;CAChB;CAEA,OAAO;AACT;;AAOA,MAAM,yBAAyB,mBAAmB,OAAO;CACvD,GAAG,wBAAwB;CAC3B,YAAY,EAAE,YACZ,UAAU,UAAU,aAAa,iBAAiB,OAClD,mBAAmB,MAAM,UAC3B;AACF,CAAC;AAED,MAAM,6BAA6B,mCAAmC,wBAAwB,mBAAmB;;AAGjH,MAAa,oBAAiC,YAAY;CACxD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GAEF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAU,WAAW,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAM,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,kCAAkC,oBAAoB,6BAA6B,MAAM;IACzF,OAAO,MAAM,mBAAmB,WAAW;KACzC;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAa,WAAW,sBAAsB,iBAAiB;GACrE,MAAM,UAAU,WAAW,qBAAqB,iBAAiB;GACjE,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC7E,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAGD,MAAa,0BAA0B,YAAY;CACjD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,oBAAoB,sBAAsB,MAAM;GAEtD,MAAM,UAAU,WAAW,oBAAoB,iBAAiB;GAChE,MAAM,qBAAqB,MAAM,sBAAsB,MAAM;GAQ7D,MAAM,gBAAgB,OAAOA,mBAAM,oBAAoB;GAEvD,IAAI,SAAS,SAAS;IACpB,kCAAkC,oBAAoB,6BAA6B,MAAM;IACzF,MAAM,YAAY;KAChB;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF;IACA,OAAO,gBACH,MAAM,mBAAmB,gBAAgB,SAAS,IAClD,MAAM,mBAAmB,WAAW,SAAS;GACnD;GAEA,MAAM,aAAa,WAAW,sBAAsB,iBAAiB;GACrE,MAAM,UAAU,WAAW,qBAAqB,iBAAiB;GAEjE,IAAI,CAAC,eACH,OAAO,MAAM,mBAAmB,WAAW;IAAE;IAAS;IAAY;GAAQ,CAAC;GAE7E,OAAO,MAAM,mBAAmB,gBAAgB;IAAE;IAAS;IAAY;GAAQ,CAAC;EAClF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;;AAGD,MAAa,sBAAsB,YAAY;CAC7C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,kBAAkB,mCAAmC,sBAAsB,qBAAqB;CAChG,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,GAAG,aAAa;EAC5D,IAAI;GACF,MAAM,UAAU,WAAW,sBAAsB,MAAM;GACvD,MAAM,qBAAqB,MAAM,sBAAsB,MAAM;GAC7D,IAAI,SAAS,SAAS;IACpB,kCAAkC,oBAAoB,6BAA6B,QAAQ;IAC3F,OAAO,MAAM,mBAAmB,aAAa;KAC3C;KACA;KACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;KAC3C;IACF,CAAC;GACH;GAEA,MAAM,aAAa,WAAW,sBAAsB,MAAM;GAC1D,MAAM,UAAU,WAAW,uBAAuB,MAAM;GACxD,OAAO,MAAM,mBAAmB,aAAa;IAAE;IAAS;IAAY;GAAQ,CAAC;EAC/E,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,wBAAwB;EACpD;CACF;AACF,CAAC;;AAGD,MAAa,mBAAmB,YAAY;CAC1C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB,oBAAoB,KAAK;EAAE,SAAS;EAAM,QAAQ;CAAK,CAAC;CACzE,kBAAkB,yBAAyB,oBAAoB,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC;CACpF,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;EACrD,IAAI;GAEF,MAAM,SAAS,OAAM,MADY,sBAAsB,MAAM,EAAA,CACrB,UAAU;IAAE;IAAS;IAAQ;GAAM,CAAC;GAE5E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8BAA8B,OAAO,cAAc,QAAQ,GAAG,CAAC;GAGzG,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,sBAAsB;EAClD;CACF;AACF,CAAC;;AAED,MAAa,kBAA+B,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB,uBAAuB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,EAAE,CAAC;CACjF,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADa,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAKlF,OAAO;IAAE,GAAG;IAAO,OAAO,aAAa,MAAM,KAAK;GAAE;EACtD,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,qBAAqB;EACjD;CACF;AACF,CAAC;;AAGD,MAAa,wBAAqC,YAAY;CAC5D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADa,sBAAsB,MAAM,EAAA,CACtB,cAAc,EAAE,QAAQ,CAAC;GAEhE,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAGlF,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,iCAAiC;EAC7D;CACF;AACF,CAAC;;AAGD,MAAa,iBAA8B,YAAY;CACrD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,SAAS,aAAa;EAC9C,IAAI;GAEF,MAAM,OAAO,OAAM,MADc,sBAAsB,MAAM,EAAA,CACvB,QAAQ;IAAE;IAAS;GAAO,CAAC;GAEjE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,iBAAiB,CAAC;GAG5D,OAAO;EACT,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,oBAAoB;EAChD;CACF;AACF,CAAC;;AAGD,MAAa,6BAA6B,YAAY;CACpD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,gBAAgB,EAAE,OAAO;EACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;EAC1B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;EACrC,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;EAChC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC1C,CAAC;CACD,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,cAAc;EACtC,IAAI;GAEF,MAAM,QAAQ,OAAM,MADa,sBAAsB,MAAM,EAAA,CACtB,SAAS,EAAE,QAAQ,CAAC;GAE3D,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,kBAAkB,QAAQ,aAAa,CAAC;GAIlF,OADmB,2BAA2B,MAAM,KACpC;EAClB,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,wCAAwC;EACpE;CACF;AACF,CAAC;;AAGD,MAAa,sBAAmC,YAAY;CAC1D,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAY,4BAA4B,KAAK,EAAE,UAAU,KAAK,CAAC;CAC/D,gBAAgB;CAChB,aAAa;CACb,SAAS;CACT,aACE;CACF,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,eAAe;EACvC,IAAI;GAEF,OAAM,MAD2B,sBAAsB,MAAM,EAAA,CACpC,kBAAkB,EAAE,SAAS,CAAC;GACvD,OAAO,EAAE,SAAS,KAAc;EAClC,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,uBAAuB;EACnD;CACF;AACF,CAAC;;AAGD,MAAa,qBAAqB,YAAY;CAC5C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,YAAY;CACZ,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GAEF,WAAW,MAAM;GAEjB,MAAM,EAAE,YAAY,YAAY;GAEhC,MAAM,SAAS,OAAO,cAAc,UAAU;GAC9C,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,WAAW,WAAW,aAAa,CAAC;GAG9E,YAAY;IACV,UAAU,OAAO,OAAO,MAAM,OAAO,OAAO;IAC5C;IACA;GACF,CAAC,CAAC,CAAC,OAAM,UAAS;IAEhB,OADsB,UACjB,CAAC,EAAE,MAAM,oCAAoC,MAAM,WAAW,KAAK;GAC1E,CAAC;GAED,OAAO;IACL,QAAQ;IACR,SAAS,uBAAuB,QAAQ,OAAO,GAAG,QAAQ,WAAW,IAAI,UAAU;IACnF,YAAY,QAAQ;GACtB;EACF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,gCAAgC;EAC5D;CACF;AACF,CAAC;AAED,MAAa,4BAA4B,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CAEjB,kBAAkB,yBAAyB,qBAAqB,QAAQ,CAAC;CACzE,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,eAAe;CACtB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,GAAG,aAAa;EACxC,IAAI;GACF,MAAM,aAAa,WAAW,sBAAsB,MAAM;GAC1D,MAAM,UAAU,WAAW,eAAe,MAAM;GAIhD,OAAO,OAAM,MAFa,eAAe,MAAM,EAAA,CAEtB,iBAAiB;IACxC,GAAG;IACH;GACF,CAAC;EACH,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC"}