@mastra/server 1.81.0-alpha.2 → 1.82.0-alpha.0

package/dist/helpers-DNq3LtLq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers-DNq3LtLq.js","names":[],"sources":["../src/server/auth/defaults.ts","../src/server/auth/path-pattern.ts","../src/server/auth/helpers.ts"],"sourcesContent":["import type { MastraAuthConfig } from '@mastra/core/server';\n\n// Default configuration that can be extended by clients\nexport const defaultAuthConfig: MastraAuthConfig = {\n  protected: ['/api/*'],\n  public: ['/api', '/api/auth/*'],\n  // Simple rule system\n  rules: [\n    // Admin users can do anything\n    {\n      condition: user => {\n        if (typeof user === 'object' && user !== null) {\n          if ('isAdmin' in user) {\n            return !!user.isAdmin;\n          }\n\n          if ('role' in user) {\n            return user.role === 'admin';\n          }\n        }\n        return false;\n      },\n      allow: true,\n    },\n  ],\n};\n","/**\n * Path pattern matching utility\n * Inlined from regexparam v3.0.0 (MIT License)\n * https://github.com/lukeed/regexparam\n *\n * Copyright (c) Luke Edwards <luke.edwards05@gmail.com> (lukeed.com)\n *\n * Permission is hereby granted, free of charge, to any person obtaining a copy\n * of this software and associated documentation files (the \"Software\"), to deal\n * in the Software without restriction, including without limitation the rights\n * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n * copies of the Software, and to permit persons to whom the Software is\n * furnished to do so, subject to the following conditions:\n *\n * The above copyright notice and this permission notice shall be included in all\n * copies or substantial portions of the Software.\n *\n * THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n * SOFTWARE.\n */\n\nexport interface ParsedPattern {\n  keys: string[] | false;\n  pattern: RegExp;\n}\n\n/**\n * Parse a route pattern into a RegExp\n * Supports:\n * - Named parameters: /users/:id\n * - Optional parameters: /users/:id?\n * - Wildcards: /files/*\n * - Mixed patterns: /api/:version/users/:id\n */\nexport function parse(input: string | RegExp, loose?: boolean): ParsedPattern {\n  if (input instanceof RegExp) return { keys: false, pattern: input };\n\n  let c: string;\n  let o: number;\n  let tmp: string | undefined;\n  let ext: number;\n  const keys: string[] = [];\n  let pattern = '';\n  const arr = input.split('/');\n\n  arr[0] || arr.shift();\n\n  while ((tmp = arr.shift())) {\n    c = tmp[0]!;\n    if (c === '*') {\n      keys.push(c);\n      pattern += tmp[1] === '?' ? '(?:/(.*))?' : '/(.*)';\n    } else if (c === ':') {\n      o = tmp.indexOf('?', 1);\n      ext = tmp.indexOf('.', 1);\n      keys.push(tmp.substring(1, ~o ? o : ~ext ? ext : tmp.length));\n      pattern += !!~o && !~ext ? '(?:/([^/]+?))?' : '/([^/]+?)';\n      if (~ext) pattern += (~o ? '?' : '') + '\\\\' + tmp.substring(ext);\n    } else {\n      pattern += '/' + tmp;\n    }\n  }\n\n  return {\n    keys: keys,\n    pattern: new RegExp('^' + pattern + (loose ? '(?=$|/)' : '/?$'), 'i'),\n  };\n}\n\n/**\n * Test if a path matches a pattern\n */\nexport function matchPath(path: string, pattern: string | RegExp): boolean {\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n}\n","import type { ISessionProvider } from '@mastra/core/auth';\nimport type { IRBACProvider, EEUser } from '@mastra/core/auth/ee';\nimport type { Mastra } from '@mastra/core/mastra';\nimport { CompositeAuth } from '@mastra/core/server';\nimport type { ApiRoute, IMastraAuthProvider, MastraAuthConfig, MastraAuthRequest } from '@mastra/core/server';\n\nimport {\n  MASTRA_RESOURCE_ID_KEY,\n  MASTRA_USER_KEY,\n  MASTRA_USER_PERMISSIONS_KEY,\n  MASTRA_USER_ROLES_KEY,\n  MASTRA_AUTH_TOKEN_KEY,\n  MASTRA_AUTH_MODE_KEY,\n} from '../constants';\nimport { HTTPException } from '../http-exception';\nimport { defaultAuthConfig } from './defaults';\nimport { parse } from './path-pattern';\n\n// Re-export request-context key constants so custom middleware can read namespaced\n// auth state without importing internal paths.\nexport { MASTRA_USER_KEY, MASTRA_USER_PERMISSIONS_KEY, MASTRA_USER_ROLES_KEY } from '../constants';\n\n/**\n * Check if a route is a registered custom route that requires authentication.\n * Returns true only if the route is explicitly registered with requiresAuth: true.\n * Returns false if the route is not in the config or has requiresAuth: false.\n */\nexport const isProtectedCustomRoute = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return customRouteAuthConfig.get(exactRouteKey) === true;\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return customRouteAuthConfig.get(allRouteKey) === true;\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id')\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    // Check if path matches the pattern\n    if (pathMatchesPattern(path, routePattern)) {\n      return requiresAuth === true;\n    }\n  }\n\n  return false; // Not in config = not a protected custom route\n};\n\n/**\n * Find a matching custom API route for the given path and method.\n * Returns the matched route and any extracted path parameters.\n */\nexport const findMatchingCustomRoute = (\n  path: string,\n  method: string,\n  apiRoutes?: ApiRoute[],\n): { route: ApiRoute; params: Record<string, string> } | undefined => {\n  if (!apiRoutes) return undefined;\n\n  for (const route of apiRoutes) {\n    if (route.method !== method && route.method !== 'ALL') continue;\n\n    const { keys, pattern: regex } = parse(route.path);\n    const match = regex.exec(path);\n    if (!match) continue;\n\n    const params: Record<string, string> = {};\n    if (keys && keys.length > 0) {\n      for (let i = 0; i < keys.length; i++) {\n        if (match[i + 1] !== undefined) {\n          params[keys[i]!] = match[i + 1]!;\n        }\n      }\n    }\n\n    return { route, params };\n  }\n\n  return undefined;\n};\n\n/**\n * Check if request is from dev playground\n * @param getHeader - Function to get header value from request\n * @param customRouteAuthConfig - Map of custom route auth configurations\n */\nexport const isDevPlaygroundRequest = (\n  path: string,\n  method: string,\n  getHeader: (name: string) => string | undefined,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return (\n    process.env.MASTRA_DEV === 'true' &&\n    // Allow if path doesn't match protected patterns AND is not a protected custom route\n    ((!isAnyMatch(path, method, protectedAccess) && !isProtectedCustomRoute(path, method, customRouteAuthConfig)) ||\n      // Or if has playground header\n      getHeader('x-mastra-dev-playground') === 'true')\n  );\n};\n\nexport const isCustomRoutePublic = (\n  path: string,\n  method: string,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  if (!customRouteAuthConfig) {\n    return false;\n  }\n\n  // Check exact match first (fast path for static routes)\n  const exactRouteKey = `${method}:${path}`;\n  if (customRouteAuthConfig.has(exactRouteKey)) {\n    return !customRouteAuthConfig.get(exactRouteKey); // True when route opts out of auth\n  }\n\n  // Check exact match for ALL method\n  const allRouteKey = `ALL:${path}`;\n  if (customRouteAuthConfig.has(allRouteKey)) {\n    return !customRouteAuthConfig.get(allRouteKey);\n  }\n\n  // Check pattern matches for dynamic routes (e.g., '/users/:id').\n  // Any matching pattern that requires auth wins over overlapping public patterns.\n  let matchedPublic = false;\n  for (const [routeKey, requiresAuth] of customRouteAuthConfig.entries()) {\n    const colonIndex = routeKey.indexOf(':');\n    if (colonIndex === -1) {\n      continue; // Skip malformed keys\n    }\n\n    const routeMethod = routeKey.substring(0, colonIndex);\n    const routePattern = routeKey.substring(colonIndex + 1);\n\n    // Check if method matches (exact match or ALL)\n    if (routeMethod !== method && routeMethod !== 'ALL') {\n      continue;\n    }\n\n    if (pathMatchesPattern(path, routePattern)) {\n      if (requiresAuth) {\n        return false;\n      }\n      matchedPublic = true;\n    }\n  }\n\n  return matchedPublic;\n};\n\n// NOTE: This uses isProtectedCustomRoute (default-allow for unknown paths) rather than\n// !isCustomRoutePublic (default-deny). This is intentional — all registered server and\n// custom routes are auth-checked via registerRoute/checkRouteAuth regardless of this\n// function. The '/api/*' protected pattern exists as a user-facing override mechanism.\n// The old default-deny logic incorrectly blocked non-API paths (e.g. '/', '/agents')\n// which prevented the studio login page from loading in production.\nexport const isProtectedPath = (\n  path: string,\n  method: string,\n  authConfig: MastraAuthConfig,\n  customRouteAuthConfig?: Map<string, boolean>,\n): boolean => {\n  const protectedAccess = [...(defaultAuthConfig.protected || []), ...(authConfig.protected || [])];\n  return isAnyMatch(path, method, protectedAccess) || isProtectedCustomRoute(path, method, customRouteAuthConfig);\n};\n\nexport const canAccessPublicly = (path: string, method: string, authConfig: MastraAuthConfig): boolean => {\n  // Check if this path+method combination is publicly accessible\n  const publicAccess = [...(defaultAuthConfig.public || []), ...(authConfig.public || [])];\n\n  return isAnyMatch(path, method, publicAccess);\n};\n\nconst isAnyMatch = (\n  path: string,\n  method: string,\n  patterns: MastraAuthConfig['protected'] | MastraAuthConfig['public'],\n): boolean => {\n  if (!patterns) {\n    return false;\n  }\n\n  for (const patternPathOrMethod of patterns) {\n    if (patternPathOrMethod instanceof RegExp) {\n      if (patternPathOrMethod.test(path)) {\n        return true;\n      }\n    }\n\n    if (typeof patternPathOrMethod === 'string' && pathMatchesPattern(path, patternPathOrMethod)) {\n      return true;\n    }\n\n    if (Array.isArray(patternPathOrMethod) && patternPathOrMethod.length === 2) {\n      const [pattern, methodOrMethods] = patternPathOrMethod;\n      if (pathMatchesPattern(path, pattern) && matchesOrIncludes(methodOrMethods, method)) {\n        return true;\n      }\n    }\n  }\n\n  return false;\n};\n\nexport const pathMatchesPattern = (path: string, pattern: string): boolean => {\n  // Use regexparam for battle-tested path matching\n  // Supports:\n  // - Exact paths: '/api/users'\n  // - Wildcards: '/api/agents/*' matches '/api/agents/123'\n  // - Path parameters: '/users/:id' matches '/users/123'\n  // - Optional parameters: '/users/:id?' matches '/users' and '/users/123'\n  // - Mixed patterns: '/api/:version/users/:id/profile'\n  const { pattern: regex } = parse(pattern);\n  return regex.test(path);\n};\n\nexport const pathMatchesRule = (path: string, rulePath: string | RegExp | string[] | undefined): boolean => {\n  if (!rulePath) return true; // No path specified means all paths\n\n  if (typeof rulePath === 'string') {\n    return pathMatchesPattern(path, rulePath);\n  }\n\n  if (rulePath instanceof RegExp) {\n    return rulePath.test(path);\n  }\n\n  if (Array.isArray(rulePath)) {\n    return rulePath.some(p => pathMatchesPattern(path, p));\n  }\n\n  return false;\n};\n\nexport const matchesOrIncludes = (values: string | string[], value: string): boolean => {\n  if (typeof values === 'string') {\n    return values === value;\n  }\n\n  if (Array.isArray(values)) {\n    return values.includes(value);\n  }\n\n  return false;\n};\n\n// ── Core auth middleware ──\n// Framework-agnostic auth logic extracted from adapter middlewares.\n// Each adapter builds an AuthMiddlewareContext and delegates to coreAuthMiddleware.\n\nexport interface AuthMiddlewareContext {\n  path: string;\n  method: string;\n  getHeader: (name: string) => string | undefined;\n  mastra: Mastra;\n  authConfig: MastraAuthConfig;\n  customRouteAuthConfig?: Map<string, boolean>;\n  requestContext: { get: (key: string) => unknown; set: (key: string, value: unknown) => void };\n  rawRequest: MastraAuthRequest;\n  token: string | null;\n  buildAuthorizeContext: () => unknown;\n  /** When true, force authentication even if the path matches a public pattern. */\n  requiresAuth?: boolean;\n}\n\nexport type AuthResult =\n  | { action: 'next'; headers?: Record<string, string> }\n  | { action: 'error'; status: number; body: Record<string, unknown>; headers?: Record<string, string> };\n\nconst pass: AuthResult = { action: 'next' };\n\n/**\n * Lets an app's `authorize(path, method, user, context)` read `context.get('requestContext')` and\n * `context.get('mastra')` on every adapter, as it can on Hono, so per-caller values (the Knowledge scope) bind\n * the same way everywhere. Hono and NestJS contexts already answer `get`; Express, Fastify and Koa pass a web\n * Request, Elysia its own context, and adapters with no builder pass nothing.\n */\nconst withAuthorizeVariables = (base: unknown, ctx: AuthMiddlewareContext): unknown => {\n  const variables: Record<string, unknown> = {\n    mastra: ctx.mastra,\n    requestContext: ctx.requestContext,\n    customRouteAuthConfig: ctx.customRouteAuthConfig,\n  };\n  const get = (key: string) => variables[key];\n  if (base === null || base === undefined) {\n    return { get, req: ctx.rawRequest };\n  }\n  if (typeof base === 'object' && typeof (base as { get?: unknown }).get !== 'function') {\n    Object.defineProperty(base, 'get', { value: get, configurable: true });\n  }\n  return base;\n};\n\nconst adaptToMastraAuthRequest = (request: MastraAuthRequest): MastraAuthRequest => {\n  if (!(request instanceof Request)) {\n    return request;\n  }\n\n  return {\n    raw: request,\n    headers: request.headers,\n    header: name => request.headers.get(name) ?? undefined,\n  };\n};\n\nexport interface GetAuthenticatedUserOptions {\n  mastra: Mastra;\n  token: string;\n  request: MastraAuthRequest;\n}\n\nexport const getAuthenticatedUser = async <TUser = unknown>({\n  mastra,\n  token,\n  request,\n}: GetAuthenticatedUserOptions): Promise<TUser | null> => {\n  const normalizedToken = token.replace(/^Bearer\\s+/i, '').trim();\n  if (!normalizedToken) {\n    return null;\n  }\n\n  const authConfig = mastra.getServer()?.auth;\n  if (!authConfig || typeof authConfig.authenticateToken !== 'function') {\n    return null;\n  }\n\n  return (await authConfig.authenticateToken(normalizedToken, request)) as TUser | null;\n};\n\n/**\n * Check if an auth config object supports transparent session refresh.\n * Returns true if the auth provider implements the necessary ISessionProvider methods.\n */\nexport function supportsSessionRefresh(\n  authConfig: MastraAuthConfig | IMastraAuthProvider,\n): authConfig is (MastraAuthConfig | IMastraAuthProvider) &\n  Pick<ISessionProvider, 'refreshSession' | 'getSessionIdFromRequest' | 'getSessionHeaders'> {\n  return (\n    typeof (authConfig as any).getSessionIdFromRequest === 'function' &&\n    typeof (authConfig as any).refreshSession === 'function' &&\n    typeof (authConfig as any).getSessionHeaders === 'function'\n  );\n}\n\n/**\n * Single auth middleware: authenticate → authorize.\n * Skip checks (dev playground, unprotected path, public path) are evaluated once.\n */\nexport const coreAuthMiddleware = async (ctx: AuthMiddlewareContext): Promise<AuthResult> => {\n  const {\n    path,\n    method,\n    getHeader,\n    mastra,\n    authConfig,\n    customRouteAuthConfig,\n    requestContext,\n    rawRequest,\n    token,\n    requiresAuth,\n  } = ctx;\n\n  // ── Skip checks (evaluated once) ──\n\n  // Only bypass auth for dev playground when no real auth provider is configured.\n  // When auth IS configured (has authenticateToken), we need the full auth flow\n  // so user/roles/permissions are set in requestContext.\n  const hasAuthProvider = typeof authConfig.authenticateToken === 'function';\n  if (!hasAuthProvider && isDevPlaygroundRequest(path, method, getHeader, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  if (!isProtectedPath(path, method, authConfig, customRouteAuthConfig)) {\n    return pass;\n  }\n\n  // When a route explicitly requires auth (requiresAuth: true), skip the\n  // public-path bypass so the user is still authenticated and permissions\n  // are injected into the request context.\n  if (\n    !requiresAuth &&\n    (canAccessPublicly(path, method, authConfig) || isCustomRoutePublic(path, method, customRouteAuthConfig))\n  ) {\n    return pass;\n  }\n\n  // ── Authentication ──\n\n  let user: unknown;\n  let refreshHeaders: Record<string, string> | undefined;\n  const authRequest = adaptToMastraAuthRequest(rawRequest);\n\n  type ConsumePendingResponseHeadersFn = (request: typeof authRequest) => Record<string, string> | undefined;\n  const mergePendingProviderHeaders = (request: typeof authRequest = authRequest) => {\n    const consume = (authConfig as { consumePendingResponseHeaders?: ConsumePendingResponseHeadersFn })\n      .consumePendingResponseHeaders;\n    if (typeof consume !== 'function') return;\n    let pending: Record<string, string> | undefined;\n    try {\n      pending = consume.call(authConfig, request);\n    } catch {\n      // Forwarding a rotated cookie is best-effort; never fail auth over it.\n      return;\n    }\n    if (!pending) return;\n    refreshHeaders = { ...(refreshHeaders ?? {}), ...pending };\n  };\n\n  try {\n    if (typeof authConfig.authenticateToken === 'function') {\n      user = await authConfig.authenticateToken(token ?? '', authRequest);\n      mergePendingProviderHeaders();\n    } else {\n      throw new Error('No token verification method configured');\n    }\n\n    // If authentication failed, attempt transparent session refresh before returning 401.\n    // This handles expired access tokens without requiring client-side refresh logic.\n    if (!user && supportsSessionRefresh(authConfig) && rawRequest instanceof Request) {\n      let retryHttpError: HTTPException | undefined;\n      try {\n        const sessionId = authConfig.getSessionIdFromRequest(rawRequest);\n        if (sessionId) {\n          const newSession = await authConfig.refreshSession(sessionId);\n          if (newSession) {\n            // Refresh succeeded — build updated session headers and re-authenticate.\n            // We create a synthetic request with the new session cookie so\n            // authenticateToken (which reads cookies from the request) picks up\n            // the refreshed session instead of the expired one.\n            refreshHeaders = authConfig.getSessionHeaders(newSession);\n            const refreshedCookie = Object.entries(refreshHeaders)\n              .filter(([k]) => k.toLowerCase() === 'set-cookie')\n              .map(([, v]) => v.split(';')[0]) // Extract name=value before attributes\n              .join('; ');\n            if (refreshedCookie) {\n              const refreshedRequest = new Request(rawRequest.url, {\n                method: rawRequest.method,\n                headers: new Headers(rawRequest.headers),\n              });\n              refreshedRequest.headers.set('Cookie', refreshedCookie);\n              // Pass the refreshed cookie value as the token so authenticateToken\n              // picks up the new session instead of the stale original.\n              // Auth providers typically read cookies from the request object, but\n              // some may also inspect the token parameter directly.\n              const cookieValue = refreshedCookie.includes('=')\n                ? refreshedCookie.split('=').slice(1).join('=')\n                : refreshedCookie;\n              try {\n                const retryAuthRequest = adaptToMastraAuthRequest(refreshedRequest);\n                user = await authConfig.authenticateToken(cookieValue, retryAuthRequest);\n                mergePendingProviderHeaders(retryAuthRequest);\n              } catch (retryErr) {\n                retryHttpError = retryErr instanceof HTTPException ? retryErr : undefined;\n                throw retryErr;\n              }\n            }\n            if (!user) {\n              refreshHeaders = undefined;\n            }\n          }\n        }\n      } catch (refreshErr) {\n        refreshHeaders = undefined;\n        // An explicit HTTP error from the retried authenticateToken goes to the outer handler.\n        if (retryHttpError === refreshErr) throw refreshErr;\n        mastra.getLogger()?.debug('Session refresh failed, falling back to 401', {\n          error: refreshErr instanceof Error ? { message: refreshErr.message } : refreshErr,\n        });\n      }\n    }\n\n    if (!user) {\n      return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n    }\n\n    requestContext.set(MASTRA_USER_KEY, user);\n    // Backward-compat: also write the legacy `'user'` key so existing\n    // middleware and integrations that read `requestContext.get('user')`\n    // (including built-in FGA route enforcement, memory handlers, and the\n    // documented public surface) keep working. New code should prefer\n    // `MASTRA_USER_KEY` to avoid collisions with caller-supplied keys.\n    requestContext.set('user', user);\n\n    // Store the raw auth token so downstream code (e.g., editor MCP client\n    // resolution) can forward it when connecting to auth-protected MCP servers.\n    // The token may arrive via Authorization header, apiKey query param, or\n    // cookie (SimpleAuth sets `mastra-token`). Check all sources so the\n    // forwarded value is available regardless of how the user authenticated.\n    let effectiveToken = token;\n    if (!effectiveToken && rawRequest instanceof Request) {\n      const cookieHeader = rawRequest.headers.get('cookie');\n      if (cookieHeader) {\n        const match = cookieHeader.match(/mastra-token=([^;]+)/);\n        if (match?.[1]) effectiveToken = match[1];\n      }\n    }\n    if (effectiveToken) {\n      requestContext.set(MASTRA_AUTH_TOKEN_KEY, effectiveToken);\n    }\n\n    if (typeof authConfig.mapUserToResourceId === 'function') {\n      try {\n        const resourceId = authConfig.mapUserToResourceId(user);\n        // CompositeAuth validates the authenticating provider's mapper. It can\n        // return undefined when that provider never configured a mapper.\n        if (resourceId !== undefined || !(authConfig instanceof CompositeAuth)) {\n          if (typeof resourceId !== 'string' || !resourceId.trim()) {\n            throw new Error('mapUserToResourceId must return a non-empty string for the authenticated user');\n          }\n          requestContext.set(MASTRA_RESOURCE_ID_KEY, resourceId);\n        }\n      } catch (mapError) {\n        mastra.getLogger()?.error('mapUserToResourceId failed', {\n          error: mapError instanceof Error ? { message: mapError.message, stack: mapError.stack } : mapError,\n        });\n        return {\n          action: 'error',\n          status: 500,\n          body: { error: 'Failed to map authenticated user to a resource ID' },\n          headers: refreshHeaders,\n        };\n      }\n    }\n\n    try {\n      // Determine which RBAC provider to use based on auth mode\n      const authMode = requestContext.get(MASTRA_AUTH_MODE_KEY);\n      const serverConfig = mastra.getServer();\n      const studioConfig = mastra.getStudio?.();\n      // Use studio RBAC if this is a studio request, otherwise use server RBAC\n      const rbacProvider = (authMode === 'studio' ? (studioConfig?.rbac ?? serverConfig?.rbac) : serverConfig?.rbac) as\n        | IRBACProvider<EEUser>\n        | undefined;\n\n      if (rbacProvider) {\n        if (!user || typeof user !== 'object' || !('id' in user)) {\n          mastra.getLogger()?.warn('RBAC: authenticated user missing required \"id\" field, skipping permission loading');\n        } else {\n          const permissions = await rbacProvider.getPermissions(user as EEUser);\n          requestContext.set(MASTRA_USER_PERMISSIONS_KEY, permissions);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userPermissions', permissions);\n\n          const roles = await rbacProvider.getRoles(user as EEUser);\n          requestContext.set(MASTRA_USER_ROLES_KEY, roles);\n          // Backward-compat alias for callers reading the legacy key.\n          requestContext.set('userRoles', roles);\n        }\n      }\n    } catch (rbacError) {\n      mastra.getLogger()?.error('RBAC: failed to load user permissions/roles', {\n        error: rbacError instanceof Error ? { message: rbacError.message, stack: rbacError.stack } : rbacError,\n      });\n    }\n  } catch (err) {\n    mastra.getLogger()?.error('Authentication error', {\n      error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n    });\n    // Explicit HTTP errors from auth callbacks keep their status/message; anything else is redacted.\n    // The HTTPException message is sent to the client, so callers must keep it safe (no internal details).\n    if (err instanceof HTTPException && err.status >= 400 && err.status <= 599) {\n      return { action: 'error', status: err.status, body: { error: err.message }, headers: refreshHeaders };\n    }\n    return { action: 'error', status: 401, body: { error: 'Invalid or expired token' }, headers: refreshHeaders };\n  }\n\n  // ── Authorization ──\n\n  if ('authorizeUser' in authConfig && typeof authConfig.authorizeUser === 'function') {\n    try {\n      const isAuthorized = await authConfig.authorizeUser(user, authRequest);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorizeUser', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('authorize' in authConfig && typeof authConfig.authorize === 'function') {\n    try {\n      const authorizeCtx = withAuthorizeVariables(ctx.buildAuthorizeContext(), ctx);\n      const isAuthorized = await authConfig.authorize(path, method, user, authorizeCtx as any);\n\n      if (!isAuthorized) {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    } catch (err) {\n      mastra.getLogger()?.error('Authorization error in authorize', {\n        error: err instanceof Error ? { message: err.message, stack: err.stack } : err,\n        path,\n        method,\n      });\n      return { action: 'error', status: 500, body: { error: 'Authorization error' }, headers: refreshHeaders };\n    }\n  } else if ('rules' in authConfig && authConfig.rules && authConfig.rules.length > 0) {\n    const isAuthorized = await checkRules(authConfig.rules, path, method, user);\n\n    if (!isAuthorized) {\n      return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n    }\n  } else {\n    // No explicit authorization configured (authorizeUser, authorize, or rules)\n    // Check if RBAC is configured - if not, allow authenticated users through\n    // (auth-only mode = authenticated users get full access)\n    const rbacProvider =\n      requestContext.get(MASTRA_AUTH_MODE_KEY) === 'studio'\n        ? (mastra.getStudio?.()?.rbac ?? mastra.getServer()?.rbac)\n        : mastra.getServer()?.rbac;\n    if (rbacProvider) {\n      if (defaultAuthConfig.rules && defaultAuthConfig.rules.length > 0) {\n        const isAuthorized = await checkRules(defaultAuthConfig.rules, path, method, user);\n\n        if (!isAuthorized) {\n          return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n        }\n      } else {\n        return { action: 'error', status: 403, body: { error: 'Access denied' }, headers: refreshHeaders };\n      }\n    }\n  }\n\n  return refreshHeaders ? { action: 'next', headers: refreshHeaders } : pass;\n};\n\n// Check authorization rules\nexport const checkRules = async (\n  rules: MastraAuthConfig['rules'],\n  path: string,\n  method: string,\n  user: unknown,\n): Promise<boolean> => {\n  // Go through rules in order (first match wins)\n  for (const i in rules || []) {\n    const rule = rules?.[i]!;\n    // Check if rule applies to this path\n    if (!pathMatchesRule(path, rule.path)) {\n      continue;\n    }\n\n    // Check if rule applies to this method\n    if (rule.methods && !matchesOrIncludes(rule.methods, method)) {\n      continue;\n    }\n\n    // Rule matches, check conditions\n    const condition = rule.condition;\n    if (typeof condition === 'function') {\n      const allowed = await Promise.resolve()\n        .then(() => condition(user))\n        .catch(() => false);\n\n      if (allowed) {\n        return true;\n      }\n    } else if (rule.allow) {\n      return true;\n    }\n  }\n\n  // No matching rules, deny by default\n  return false;\n};\n"],"mappings":";;;;AAGA,MAAa,oBAAsC;CACjD,WAAW,CAAC,QAAQ;CACpB,QAAQ,CAAC,QAAQ,aAAa;CAE9B,OAAO,CAEL;EACE,YAAW,SAAQ;GACjB,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;IAC7C,IAAI,aAAa,MACf,OAAO,CAAC,CAAC,KAAK;IAGhB,IAAI,UAAU,MACZ,OAAO,KAAK,SAAS;GAEzB;GACA,OAAO;EACT;EACA,OAAO;CACT,CACF;AACF;;;;;;;;;;ACcA,SAAgB,MAAM,OAAwB,OAAgC;CAC5E,IAAI,iBAAiB,QAAQ,OAAO;EAAE,MAAM;EAAO,SAAS;CAAM;CAElE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAU;CACd,MAAM,MAAM,MAAM,MAAM,GAAG;CAE3B,IAAI,MAAM,IAAI,MAAM;CAEpB,OAAQ,MAAM,IAAI,MAAM,GAAI;EAC1B,IAAI,IAAI;EACR,IAAI,MAAM,KAAK;GACb,KAAK,KAAK,CAAC;GACX,WAAW,IAAI,OAAO,MAAM,eAAe;EAC7C,OAAO,IAAI,MAAM,KAAK;GACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;GACtB,MAAM,IAAI,QAAQ,KAAK,CAAC;GACxB,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC;GAC5D,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB;GAC9C,IAAI,CAAC,KAAK,YAAY,CAAC,IAAI,MAAM,MAAM,OAAO,IAAI,UAAU,GAAG;EACjE,OACE,WAAW,MAAM;CAErB;CAEA,OAAO;EACC;EACN,SAAS,IAAI,OAAO,MAAM,WAAW,QAAQ,YAAY,QAAQ,GAAG;CACtE;AACF;;;;;;;AC7CA,MAAa,0BACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,sBAAsB,IAAI,aAAa,MAAM;CAItD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,sBAAsB,IAAI,WAAW,MAAM;CAIpD,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAIF,IAAI,mBAAmB,MAAM,YAAY,GACvC,OAAO,iBAAiB;CAE5B;CAEA,OAAO;AACT;;;;;AAMA,MAAa,2BACX,MACA,QACA,cACoE;CACpE,IAAI,CAAC,WAAW,OAAO,KAAA;CAEvB,KAAK,MAAM,SAAS,WAAW;EAC7B,IAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO;EAEvD,MAAM,EAAE,MAAM,SAAS,UAAU,MAAM,MAAM,IAAI;EACjD,MAAM,QAAQ,MAAM,KAAK,IAAI;EAC7B,IAAI,CAAC,OAAO;EAEZ,MAAM,SAAiC,CAAC;EACxC,IAAI,QAAQ,KAAK,SAAS,GACnB;QAAA,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,MAAM,IAAI,OAAO,KAAA,GACnB,OAAO,KAAK,MAAO,MAAM,IAAI;EAAA;EAKnC,OAAO;GAAE;GAAO;EAAO;CACzB;AAGF;;;;;;AAOA,MAAa,0BACX,MACA,QACA,WACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OACE,QAAQ,IAAI,eAAe,WAEzB,CAAC,WAAW,MAAM,QAAQ,eAAe,KAAK,CAAC,uBAAuB,MAAM,QAAQ,qBAAqB,KAEzG,UAAU,yBAAyB,MAAM;AAE/C;AAEA,MAAa,uBACX,MACA,QACA,0BACY;CACZ,IAAI,CAAC,uBACH,OAAO;CAIT,MAAM,gBAAgB,GAAG,OAAO,GAAG;CACnC,IAAI,sBAAsB,IAAI,aAAa,GACzC,OAAO,CAAC,sBAAsB,IAAI,aAAa;CAIjD,MAAM,cAAc,OAAO;CAC3B,IAAI,sBAAsB,IAAI,WAAW,GACvC,OAAO,CAAC,sBAAsB,IAAI,WAAW;CAK/C,IAAI,gBAAgB;CACpB,KAAK,MAAM,CAAC,UAAU,iBAAiB,sBAAsB,QAAQ,GAAG;EACtE,MAAM,aAAa,SAAS,QAAQ,GAAG;EACvC,IAAI,eAAe,IACjB;EAGF,MAAM,cAAc,SAAS,UAAU,GAAG,UAAU;EACpD,MAAM,eAAe,SAAS,UAAU,aAAa,CAAC;EAGtD,IAAI,gBAAgB,UAAU,gBAAgB,OAC5C;EAGF,IAAI,mBAAmB,MAAM,YAAY,GAAG;GAC1C,IAAI,cACF,OAAO;GAET,gBAAgB;EAClB;CACF;CAEA,OAAO;AACT;AAQA,MAAa,mBACX,MACA,QACA,YACA,0BACY;CACZ,MAAM,kBAAkB,CAAC,GAAI,kBAAkB,aAAa,CAAC,GAAI,GAAI,WAAW,aAAa,CAAC,CAAE;CAChG,OAAO,WAAW,MAAM,QAAQ,eAAe,KAAK,uBAAuB,MAAM,QAAQ,qBAAqB;AAChH;AAEA,MAAa,qBAAqB,MAAc,QAAgB,eAA0C;CAExG,MAAM,eAAe,CAAC,GAAI,kBAAkB,UAAU,CAAC,GAAI,GAAI,WAAW,UAAU,CAAC,CAAE;CAEvF,OAAO,WAAW,MAAM,QAAQ,YAAY;AAC9C;AAEA,MAAM,cACJ,MACA,QACA,aACY;CACZ,IAAI,CAAC,UACH,OAAO;CAGT,KAAK,MAAM,uBAAuB,UAAU;EAC1C,IAAI,+BAA+B,QAC7B;OAAA,oBAAoB,KAAK,IAAI,GAC/B,OAAO;EAAA;EAIX,IAAI,OAAO,wBAAwB,YAAY,mBAAmB,MAAM,mBAAmB,GACzF,OAAO;EAGT,IAAI,MAAM,QAAQ,mBAAmB,KAAK,oBAAoB,WAAW,GAAG;GAC1E,MAAM,CAAC,SAAS,mBAAmB;GACnC,IAAI,mBAAmB,MAAM,OAAO,KAAK,kBAAkB,iBAAiB,MAAM,GAChF,OAAO;EAEX;CACF;CAEA,OAAO;AACT;AAEA,MAAa,sBAAsB,MAAc,YAA6B;CAQ5E,MAAM,EAAE,SAAS,UAAU,MAAM,OAAO;CACxC,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,MAAa,mBAAmB,MAAc,aAA8D;CAC1G,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,OAAO,aAAa,UACtB,OAAO,mBAAmB,MAAM,QAAQ;CAG1C,IAAI,oBAAoB,QACtB,OAAO,SAAS,KAAK,IAAI;CAG3B,IAAI,MAAM,QAAQ,QAAQ,GACxB,OAAO,SAAS,MAAK,MAAK,mBAAmB,MAAM,CAAC,CAAC;CAGvD,OAAO;AACT;AAEA,MAAa,qBAAqB,QAA2B,UAA2B;CACtF,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW;CAGpB,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,OAAO,SAAS,KAAK;CAG9B,OAAO;AACT;AAyBA,MAAM,OAAmB,EAAE,QAAQ,OAAO;;;;;;;AAQ1C,MAAM,0BAA0B,MAAe,QAAwC;CACrF,MAAM,YAAqC;EACzC,QAAQ,IAAI;EACZ,gBAAgB,IAAI;EACpB,uBAAuB,IAAI;CAC7B;CACA,MAAM,OAAO,QAAgB,UAAU;CACvC,IAAI,SAAS,QAAQ,SAAS,KAAA,GAC5B,OAAO;EAAE;EAAK,KAAK,IAAI;CAAW;CAEpC,IAAI,OAAO,SAAS,YAAY,OAAQ,KAA2B,QAAQ,YACzE,OAAO,eAAe,MAAM,OAAO;EAAE,OAAO;EAAK,cAAc;CAAK,CAAC;CAEvE,OAAO;AACT;AAEA,MAAM,4BAA4B,YAAkD;CAClF,IAAI,EAAE,mBAAmB,UACvB,OAAO;CAGT,OAAO;EACL,KAAK;EACL,SAAS,QAAQ;EACjB,SAAQ,SAAQ,QAAQ,QAAQ,IAAI,IAAI,KAAK,KAAA;CAC/C;AACF;AAQA,MAAa,uBAAuB,OAAwB,EAC1D,QACA,OACA,cACwD;CACxD,MAAM,kBAAkB,MAAM,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;CAC9D,IAAI,CAAC,iBACH,OAAO;CAGT,MAAM,aAAa,OAAO,UAAU,CAAC,EAAE;CACvC,IAAI,CAAC,cAAc,OAAO,WAAW,sBAAsB,YACzD,OAAO;CAGT,OAAQ,MAAM,WAAW,kBAAkB,iBAAiB,OAAO;AACrE;;;;;AAMA,SAAgB,uBACd,YAE2F;CAC3F,OACE,OAAQ,WAAmB,4BAA4B,cACvD,OAAQ,WAAmB,mBAAmB,cAC9C,OAAQ,WAAmB,sBAAsB;AAErD;;;;;AAMA,MAAa,qBAAqB,OAAO,QAAoD;CAC3F,MAAM,EACJ,MACA,QACA,WACA,QACA,YACA,uBACA,gBACA,YACA,OACA,iBACE;CAQJ,IAAI,EADoB,OAAO,WAAW,sBAAsB,eACxC,uBAAuB,MAAM,QAAQ,WAAW,YAAY,qBAAqB,GACvG,OAAO;CAGT,IAAI,CAAC,gBAAgB,MAAM,QAAQ,YAAY,qBAAqB,GAClE,OAAO;CAMT,IACE,CAAC,iBACA,kBAAkB,MAAM,QAAQ,UAAU,KAAK,oBAAoB,MAAM,QAAQ,qBAAqB,IAEvG,OAAO;CAKT,IAAI;CACJ,IAAI;CACJ,MAAM,cAAc,yBAAyB,UAAU;CAGvD,MAAM,+BAA+B,UAA8B,gBAAgB;EACjF,MAAM,UAAW,WACd;EACH,IAAI,OAAO,YAAY,YAAY;EACnC,IAAI;EACJ,IAAI;GACF,UAAU,QAAQ,KAAK,YAAY,OAAO;EAC5C,QAAQ;GAEN;EACF;EACA,IAAI,CAAC,SAAS;EACd,iBAAiB;GAAE,GAAI,kBAAkB,CAAC;GAAI,GAAG;EAAQ;CAC3D;CAEA,IAAI;EACF,IAAI,OAAO,WAAW,sBAAsB,YAAY;GACtD,OAAO,MAAM,WAAW,kBAAkB,SAAS,IAAI,WAAW;GAClE,4BAA4B;EAC9B,OACE,MAAM,IAAI,MAAM,yCAAyC;EAK3D,IAAI,CAAC,QAAQ,uBAAuB,UAAU,KAAK,sBAAsB,SAAS;GAChF,IAAI;GACJ,IAAI;IACF,MAAM,YAAY,WAAW,wBAAwB,UAAU;IAC/D,IAAI,WAAW;KACb,MAAM,aAAa,MAAM,WAAW,eAAe,SAAS;KAC5D,IAAI,YAAY;MAKd,iBAAiB,WAAW,kBAAkB,UAAU;MACxD,MAAM,kBAAkB,OAAO,QAAQ,cAAc,CAAC,CACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,MAAM,YAAY,CAAC,CACjD,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAC/B,KAAK,IAAI;MACZ,IAAI,iBAAiB;OACnB,MAAM,mBAAmB,IAAI,QAAQ,WAAW,KAAK;QACnD,QAAQ,WAAW;QACnB,SAAS,IAAI,QAAQ,WAAW,OAAO;OACzC,CAAC;OACD,iBAAiB,QAAQ,IAAI,UAAU,eAAe;OAKtD,MAAM,cAAc,gBAAgB,SAAS,GAAG,IAC5C,gBAAgB,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAC5C;OACJ,IAAI;QACF,MAAM,mBAAmB,yBAAyB,gBAAgB;QAClE,OAAO,MAAM,WAAW,kBAAkB,aAAa,gBAAgB;QACvE,4BAA4B,gBAAgB;OAC9C,SAAS,UAAU;QACjB,iBAAiB,oBAAoB,gBAAgB,WAAW,KAAA;QAChE,MAAM;OACR;MACF;MACA,IAAI,CAAC,MACH,iBAAiB,KAAA;KAErB;IACF;GACF,SAAS,YAAY;IACnB,iBAAiB,KAAA;IAEjB,IAAI,mBAAmB,YAAY,MAAM;IACzC,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,sBAAsB,QAAQ,EAAE,SAAS,WAAW,QAAQ,IAAI,WACzE,CAAC;GACH;EACF;EAEA,IAAI,CAAC,MACH,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;EAG9G,eAAe,IAAI,iBAAiB,IAAI;EAMxC,eAAe,IAAI,QAAQ,IAAI;EAO/B,IAAI,iBAAiB;EACrB,IAAI,CAAC,kBAAkB,sBAAsB,SAAS;GACpD,MAAM,eAAe,WAAW,QAAQ,IAAI,QAAQ;GACpD,IAAI,cAAc;IAChB,MAAM,QAAQ,aAAa,MAAM,sBAAsB;IACvD,IAAI,QAAQ,IAAI,iBAAiB,MAAM;GACzC;EACF;EACA,IAAI,gBACF,eAAe,IAAI,uBAAuB,cAAc;EAG1D,IAAI,OAAO,WAAW,wBAAwB,YAC5C,IAAI;GACF,MAAM,aAAa,WAAW,oBAAoB,IAAI;GAGtD,IAAI,eAAe,KAAA,KAAa,EAAE,sBAAsB,gBAAgB;IACtE,IAAI,OAAO,eAAe,YAAY,CAAC,WAAW,KAAK,GACrD,MAAM,IAAI,MAAM,+EAA+E;IAEjG,eAAe,IAAI,wBAAwB,UAAU;GACvD;EACF,SAAS,UAAU;GACjB,OAAO,UAAU,CAAC,EAAE,MAAM,8BAA8B,EACtD,OAAO,oBAAoB,QAAQ;IAAE,SAAS,SAAS;IAAS,OAAO,SAAS;GAAM,IAAI,SAC5F,CAAC;GACD,OAAO;IACL,QAAQ;IACR,QAAQ;IACR,MAAM,EAAE,OAAO,oDAAoD;IACnE,SAAS;GACX;EACF;EAGF,IAAI;GAEF,MAAM,WAAW,eAAe,IAAI,oBAAoB;GACxD,MAAM,eAAe,OAAO,UAAU;GACtC,MAAM,eAAe,OAAO,YAAY;GAExC,MAAM,eAAgB,aAAa,WAAY,cAAc,QAAQ,cAAc,OAAQ,cAAc;GAIzG,IAAI,cAAc;IAChB,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,QAAQ,OACjD,OAAO,UAAU,CAAC,EAAE,KAAK,qFAAmF;SACvG;KACL,MAAM,cAAc,MAAM,aAAa,eAAe,IAAc;KACpE,eAAe,IAAI,6BAA6B,WAAW;KAE3D,eAAe,IAAI,mBAAmB,WAAW;KAEjD,MAAM,QAAQ,MAAM,aAAa,SAAS,IAAc;KACxD,eAAe,IAAI,uBAAuB,KAAK;KAE/C,eAAe,IAAI,aAAa,KAAK;IACvC;GACF;EACF,SAAS,WAAW;GAClB,OAAO,UAAU,CAAC,EAAE,MAAM,+CAA+C,EACvE,OAAO,qBAAqB,QAAQ;IAAE,SAAS,UAAU;IAAS,OAAO,UAAU;GAAM,IAAI,UAC/F,CAAC;EACH;CACF,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wBAAwB,EAChD,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EAGD,IAAI,eAAe,iBAAiB,IAAI,UAAU,OAAO,IAAI,UAAU,KACrE,OAAO;GAAE,QAAQ;GAAS,QAAQ,IAAI;GAAQ,MAAM,EAAE,OAAO,IAAI,QAAQ;GAAG,SAAS;EAAe;EAEtG,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,2BAA2B;GAAG,SAAS;EAAe;CAC9G;CAIA,IAAI,mBAAmB,cAAc,OAAO,WAAW,kBAAkB,YACvE,IAAI;EAGF,IAAI,CAAC,MAFsB,WAAW,cAAc,MAAM,WAAW,GAGnE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,wCAAwC,EAChE,OAAO,eAAe,QAAQ;GAAE,SAAS,IAAI;GAAS,OAAO,IAAI;EAAM,IAAI,IAC7E,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,eAAe,cAAc,OAAO,WAAW,cAAc,YACtE,IAAI;EACF,MAAM,eAAe,uBAAuB,IAAI,sBAAsB,GAAG,GAAG;EAG5E,IAAI,CAAC,MAFsB,WAAW,UAAU,MAAM,QAAQ,MAAM,YAAmB,GAGrF,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG,SAAS,KAAK;EACZ,OAAO,UAAU,CAAC,EAAE,MAAM,oCAAoC;GAC5D,OAAO,eAAe,QAAQ;IAAE,SAAS,IAAI;IAAS,OAAO,IAAI;GAAM,IAAI;GAC3E;GACA;EACF,CAAC;EACD,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,sBAAsB;GAAG,SAAS;EAAe;CACzG;MACK,IAAI,WAAW,cAAc,WAAW,SAAS,WAAW,MAAM,SAAS,GAG5E;MAAA,CAAC,MAFsB,WAAW,WAAW,OAAO,MAAM,QAAQ,IAAI,GAGxE,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAAA,OAUnG,IAHE,eAAe,IAAA,kBAAwB,MAAM,WACxC,OAAO,YAAY,CAAC,EAAE,QAAQ,OAAO,UAAU,CAAC,EAAE,OACnD,OAAO,UAAU,CAAC,EAAE,MACR;EAChB,IAAI,kBAAkB,SAAS,kBAAkB,MAAM,SAAS,GAG1D;OAAA,CAAC,MAFsB,WAAW,kBAAkB,OAAO,MAAM,QAAQ,IAAI,GAG/E,OAAO;IAAE,QAAQ;IAAS,QAAQ;IAAK,MAAM,EAAE,OAAO,gBAAgB;IAAG,SAAS;GAAe;EAAA,OAGnG,OAAO;GAAE,QAAQ;GAAS,QAAQ;GAAK,MAAM,EAAE,OAAO,gBAAgB;GAAG,SAAS;EAAe;CAErG;CAGF,OAAO,iBAAiB;EAAE,QAAQ;EAAQ,SAAS;CAAe,IAAI;AACxE;AAGA,MAAa,aAAa,OACxB,OACA,MACA,QACA,SACqB;CAErB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;EAC3B,MAAM,OAAO,QAAQ;EAErB,IAAI,CAAC,gBAAgB,MAAM,KAAK,IAAI,GAClC;EAIF,IAAI,KAAK,WAAW,CAAC,kBAAkB,KAAK,SAAS,MAAM,GACzD;EAIF,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,cAAc,YAKnB;OAAA,MAJkB,QAAQ,QAAQ,CAAC,CACpC,WAAW,UAAU,IAAI,CAAC,CAAC,CAC3B,YAAY,KAAK,GAGlB,OAAO;EAAA,OAEJ,IAAI,KAAK,OACd,OAAO;CAEX;CAGA,OAAO;AACT"}

package/dist/knowledge-DykIi0wH.js

@@ -0,0 +1,431 @@
+import { t as HTTPException } from "./http-exception-CzaWkxMl.js";
+import { n as createRoute } from "./route-builder-BxPrwNog.js";
+import { a as MASTRA_KNOWLEDGE_PRINCIPALS_KEY } from "./constants-CXAvBYcz.js";
+import { handleError } from "./server/handlers/error.js";
+import { _ as MastraFGAPermissions, o as getHandlerFGAProvider } from "./utils-B15w-1hm.js";
+import { z } from "zod/v4";
+import * as coreKnowledge from "@mastra/core/knowledge";
+// src/server/schemas/knowledge.ts
+const knowledgePathParams = z.object({ knowledgeKey: z.string().describe("Application key the Knowledge instance is registered under") });
+const knowledgePagePathParams = knowledgePathParams.extend({ pageId: z.string().min(1).max(512).describe("Knowledge page id") });
+const pageId = z.string().min(1).max(512);
+const limit = z.coerce.number().int().min(1).max(100).optional();
+const knowledgeTreeQuerySchema = z.object({
+	parentId: pageId.optional().describe("Page whose children to list; omit for the root scopes"),
+	cursor: z.string().optional(),
+	limit
+});
+const knowledgePageQuerySchema = z.object({
+	noteCursor: z.string().optional(),
+	noteLimit: limit
+});
+const knowledgeGraphQuerySchema = z.object({
+	rootId: pageId.optional().describe("Page to walk from; omit to walk every root scope"),
+	maxPages: z.coerce.number().int().min(1).max(500).optional()
+});
+const scopeIds = z.union([z.string(), z.array(z.string())]).transform((value) => Array.isArray(value) ? value : [value]).pipe(z.array(pageId).max(20));
+const knowledgeSearchQuerySchema = z.object({
+	q: z.string().min(1).max(200).describe("Text to match in page names, synopses, bodies and notes"),
+	scopeId: scopeIds.optional().describe("Only pages within these scopes"),
+	limit
+});
+const knowledgeActivityQuerySchema = z.object({
+	scopeId: pageId.optional(),
+	pageId: pageId.optional(),
+	cursor: z.string().optional(),
+	limit
+});
+const payload = z.record(z.string(), z.unknown());
+const listKnowledgeResponseSchema = z.object({ instances: z.array(z.object({
+	key: z.string(),
+	id: z.string()
+})) });
+const knowledgeTreeResponseSchema = payload;
+const knowledgePageResponseSchema = payload;
+const knowledgeGraphResponseSchema = payload;
+const knowledgeSearchResponseSchema = z.object({ results: z.array(payload) });
+const knowledgeActivityResponseSchema = payload;
+const knowledgeEventsResponseSchema = z.object({
+	kind: z.enum([
+		"scope",
+		"page",
+		"note",
+		"pin"
+	]),
+	op: z.string(),
+	pageId: z.string().optional(),
+	scopeId: z.string().optional(),
+	at: z.string()
+});
+// src/server/handlers/knowledge.ts
+/**
+* Read-only browsing of Knowledge instances registered on Mastra, for Studio. Nothing here writes.
+*
+* What a caller reads depends on whether the app has auth configured (`server.auth` or `studio.auth`):
+* - No auth: probably a local or test project, so the routes read as the instance owner (`'all'`).
+* - Auth: reads are narrowed to what the signed-in caller can read. The app maps the user to Knowledge
+*   principals by setting MASTRA_KNOWLEDGE_PRINCIPALS_KEY in `auth.authorize` (a `string[]`, or `'all'`
+*   for an admin); the instance turns them into a read scope with `readScopeFor`. A caller with no
+*   mapping is refused with 403.
+*
+* On top of that the path derives `knowledge:read` (`GET /knowledge/...`), and with FGA configured each
+* instance is filtered and gated by `knowledge:read` on that instance. The routes are opt-in
+* (KNOWLEDGE_ROUTES); hosts with their own scoping (Factory) do not mount them.
+*/
+function hasAuth(mastra) {
+	return Boolean(mastra.getServer?.()?.auth || mastra.getStudio?.()?.auth);
+}
+async function callerReadScope(mastra, requestContext, instance) {
+	if (!hasAuth(mastra)) return "all";
+	const principals = requestContext?.get(MASTRA_KNOWLEDGE_PRINCIPALS_KEY);
+	if (principals === void 0 || principals === null) throw new HTTPException(403, { message: `Knowledge access is not mapped for this caller. Set request context key "${MASTRA_KNOWLEDGE_PRINCIPALS_KEY}" in auth.authorize.` });
+	if (principals === "all") return "all";
+	if (!Array.isArray(principals) || principals.some((principal) => typeof principal !== "string")) throw new HTTPException(500, { message: `Request context key "${MASTRA_KNOWLEDGE_PRINCIPALS_KEY}" must be a string array or 'all'.` });
+	try {
+		return await instance.readScopeFor(principals);
+	} catch (error) {
+		if (error instanceof Error && error.name === "KnowledgeDeclarationError") throw new HTTPException(500, {
+			message: error.message,
+			cause: error
+		});
+		throw error;
+	}
+}
+async function accessibleInstances(mastra, requestContext, entries) {
+	const fgaProvider = getHandlerFGAProvider(mastra, requestContext);
+	const user = requestContext?.get("user");
+	if (!fgaProvider || !user || typeof user !== "object" || entries.length === 0) return new Set(entries.map((entry) => entry.key));
+	const accessible = await fgaProvider.filterAccessible(user, entries.map((entry) => ({
+		...entry,
+		id: entry.key
+	})), "knowledge", MastraFGAPermissions.KNOWLEDGE_READ);
+	return new Set(accessible.map((entry) => entry.key));
+}
+const pageReaders = coreKnowledge;
+function requirePageReaders() {
+	const { listKnowledgeTreeChildren, readKnowledgePage, readKnowledgePageActivity, readKnowledgePageGraph, searchKnowledgeExplorerPages } = pageReaders;
+	if (!listKnowledgeTreeChildren || !readKnowledgePage || !readKnowledgePageActivity || !readKnowledgePageGraph || !searchKnowledgeExplorerPages) throw new HTTPException(501, { message: "Knowledge browsing needs @mastra/core 1.81.0 or later." });
+	return {
+		listKnowledgeTreeChildren,
+		readKnowledgePage,
+		readKnowledgePageActivity,
+		readKnowledgePageGraph,
+		searchKnowledgeExplorerPages
+	};
+}
+/**
+* The declared grants between the graph's scopes, each with its principal's display label. Grants are
+* newer than the page readers, so a core without them sends none and the graph still loads.
+*/
+async function graphGrants(instance, store, pages, read) {
+	const readGrants = coreKnowledge.readKnowledgeScopeGrants;
+	const scopeGrants = instance.scopeGrants?.bind(instance);
+	if (!readGrants || !scopeGrants) return void 0;
+	return (await readGrants(store, {
+		pages,
+		read,
+		grantsFor: scopeGrants
+	})).map((grant) => {
+		const principalLabel = instance.scopeLabel?.(grant.principal);
+		return principalLabel ? {
+			...grant,
+			principalLabel
+		} : grant;
+	});
+}
+async function resolveStore(mastra, requestContext, knowledgeKey) {
+	const instances = mastra.listKnowledge();
+	const instance = knowledgeKey && Object.hasOwn(instances, knowledgeKey) ? instances[knowledgeKey] : void 0;
+	if (!knowledgeKey || !instance) throw new HTTPException(404, { message: `Knowledge ${knowledgeKey ?? ""} not found` });
+	const fgaProvider = getHandlerFGAProvider(mastra, requestContext);
+	const user = requestContext?.get("user");
+	if (fgaProvider && user && typeof user === "object") {
+		if (!await fgaProvider.check(user, {
+			resource: {
+				type: "knowledge",
+				id: knowledgeKey
+			},
+			permission: MastraFGAPermissions.KNOWLEDGE_READ
+		})) throw new HTTPException(404, { message: `Knowledge ${knowledgeKey} not found` });
+	}
+	const readers = requirePageReaders();
+	const read = await callerReadScope(mastra, requestContext, instance);
+	return {
+		instance,
+		store: await instance.getStorage(),
+		read,
+		readers
+	};
+}
+/**
+* Adds each scope page's declared `displayLabel` with its address's `$params` filled in (`'$orgId policy'`
+* → `'acme policy'`), so the explorer can caption scopes. Scope declarations live in config, not
+* storage, so the readers can't supply it. Older cores without `scopeLabel` send no label.
+*/
+function withDisplayLabel(instance, page) {
+	if (!page.isScope || !page.address) return page;
+	const displayLabel = instance.scopeLabel?.(page.address);
+	return displayLabel ? {
+		...page,
+		displayLabel
+	} : page;
+}
+const LIST_KNOWLEDGE_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge",
+	responseType: "json",
+	responseSchema: listKnowledgeResponseSchema,
+	summary: "List Knowledge instances",
+	description: "Returns the Knowledge instances registered on this Mastra instance, by application key. Without app auth the other Knowledge routes read the whole instance; with auth they read only what the caller's Knowledge principals (MASTRA_KNOWLEDGE_PRINCIPALS_KEY, set in auth.authorize) can read, and refuse an unmapped caller with 403.",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext }) => {
+		try {
+			const all = Object.entries(mastra.listKnowledge()).map(([key, instance]) => ({
+				key,
+				id: instance.id
+			}));
+			const allowed = await accessibleInstances(mastra, requestContext, all);
+			return { instances: all.filter((entry) => allowed.has(entry.key)) };
+		} catch (error) {
+			return handleError(error, "Error listing Knowledge instances");
+		}
+	}
+});
+const GET_KNOWLEDGE_TREE_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge/:knowledgeKey/tree",
+	responseType: "json",
+	pathParamSchema: knowledgePathParams,
+	queryParamSchema: knowledgeTreeQuerySchema,
+	responseSchema: knowledgeTreeResponseSchema,
+	summary: "List one level of the Knowledge page tree",
+	description: "Without parentId, returns the root scopes. With parentId, returns its child scopes (first page only) then its child pages in order, paged with cursor.",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext, knowledgeKey, parentId, cursor, limit }) => {
+		try {
+			const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);
+			const level = await readers.listKnowledgeTreeChildren(store, {
+				parentId: parentId ?? null,
+				read,
+				cursor: cursor || void 0,
+				limit
+			});
+			return {
+				...level,
+				pages: level.pages.map((page) => withDisplayLabel(instance, page))
+			};
+		} catch (error) {
+			return handleError(error, "Error reading Knowledge tree");
+		}
+	}
+});
+const GET_KNOWLEDGE_PAGE_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge/:knowledgeKey/pages/:pageId",
+	responseType: "json",
+	pathParamSchema: knowledgePagePathParams,
+	queryParamSchema: knowledgePageQuerySchema,
+	responseSchema: knowledgePageResponseSchema,
+	summary: "Get a Knowledge page",
+	description: "Returns one page with its ancestors, a page of its notes, its pin, the pages its notes reference and notes elsewhere that mention it; 404 when it does not exist",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext, knowledgeKey, pageId, noteCursor, noteLimit }) => {
+		try {
+			const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);
+			const view = await readers.readKnowledgePage(store, {
+				pageId,
+				read,
+				noteCursor,
+				noteLimit
+			});
+			if (!view) throw new HTTPException(404, { message: "Knowledge page not found" });
+			const label = (page) => withDisplayLabel(instance, page);
+			return {
+				...view,
+				page: label(view.page),
+				ancestors: view.ancestors.map(label),
+				related: view.related.map(label)
+			};
+		} catch (error) {
+			return handleError(error, "Error reading Knowledge page");
+		}
+	}
+});
+const GET_KNOWLEDGE_GRAPH_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge/:knowledgeKey/graph",
+	responseType: "json",
+	pathParamSchema: knowledgePathParams,
+	queryParamSchema: knowledgeGraphQuerySchema,
+	responseSchema: knowledgeGraphResponseSchema,
+	summary: "Get a bounded Knowledge page graph",
+	description: "Returns pages under rootId (or every root scope) breadth-first with parent and mention edges, bounded; truncated is true when a limit stopped it. grants lists the declared access grants onto the scopes shown, from principal scopes the caller can read. 404 when rootId does not exist.",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext, knowledgeKey, rootId, maxPages }) => {
+		try {
+			const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);
+			const graph = await readers.readKnowledgePageGraph(store, {
+				read,
+				rootId: rootId ?? null,
+				...maxPages ? { limits: { maxPages } } : {}
+			});
+			if (!graph) throw new HTTPException(404, { message: "Knowledge page not found" });
+			const grants = await graphGrants(instance, store, graph.pages, read);
+			return {
+				...graph,
+				pages: graph.pages.map((page) => withDisplayLabel(instance, page)),
+				...grants ? { grants } : {}
+			};
+		} catch (error) {
+			return handleError(error, "Error reading Knowledge graph");
+		}
+	}
+});
+const SEARCH_KNOWLEDGE_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge/:knowledgeKey/search",
+	responseType: "json",
+	pathParamSchema: knowledgePathParams,
+	queryParamSchema: knowledgeSearchQuerySchema,
+	responseSchema: knowledgeSearchResponseSchema,
+	summary: "Search Knowledge pages and notes",
+	description: "Returns pages whose name, synopsis or body, and notes whose text, match the query",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext, knowledgeKey, q, scopeId, limit }) => {
+		try {
+			const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);
+			return { results: (await readers.searchKnowledgeExplorerPages(store, {
+				query: q,
+				read,
+				...scopeId?.length ? { scopeIds: scopeId } : {},
+				limit
+			})).map((hit) => ({
+				...hit,
+				page: withDisplayLabel(instance, hit.page)
+			})) };
+		} catch (error) {
+			return handleError(error, "Error searching Knowledge");
+		}
+	}
+});
+const GET_KNOWLEDGE_ACTIVITY_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge/:knowledgeKey/activity",
+	responseType: "json",
+	pathParamSchema: knowledgePathParams,
+	queryParamSchema: knowledgeActivityQuerySchema,
+	responseSchema: knowledgeActivityResponseSchema,
+	summary: "List recent Knowledge activity",
+	description: "Returns a newest-first page of activity, optionally for one scope or one page",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext, knowledgeKey, scopeId, pageId, cursor, limit }) => {
+		try {
+			const { store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);
+			return { ...await readers.readKnowledgePageActivity(store, {
+				read,
+				scopeId,
+				pageId,
+				cursor,
+				limit
+			}) };
+		} catch (error) {
+			return handleError(error, "Error reading Knowledge activity");
+		}
+	}
+});
+const KEEPALIVE_MS = 25e3;
+/**
+* The read scope is resolved when the stream opens. Ending it after this long makes the client reconnect,
+* which resolves the caller's read scope again, so a revoked grant stops receiving changes.
+*/
+const STREAM_MAX_AGE_MS = 3e5;
+/**
+* What a viewer may learn about one change: the ids in it they can read, or nothing when they can read
+* none. A page they can read now, or the scope it is (or was, before a move or merge) in, counts; a
+* deleted page is matched by its scope.
+*/
+async function visibleChange(store, read, event) {
+	const readable = async (id) => id !== void 0 && (read === "all" || await store.getPage({
+		id,
+		read
+	}) !== null);
+	const scopeId = "scopeId" in event ? event.scopeId : void 0;
+	const fromScopeId = "fromScopeId" in event ? event.fromScopeId : void 0;
+	const [page, scope, fromScope] = await Promise.all([
+		readable(event.pageId),
+		readable(scopeId),
+		readable(fromScopeId)
+	]);
+	if (!page && !scope && !fromScope) return null;
+	return {
+		kind: event.kind,
+		op: event.op,
+		...page ? { pageId: event.pageId } : {},
+		...scope ? { scopeId } : {},
+		at: event.at.toISOString()
+	};
+}
+const STREAM_KNOWLEDGE_EVENTS_ROUTE = createRoute({
+	method: "GET",
+	path: "/knowledge/:knowledgeKey/events",
+	responseType: "stream",
+	streamFormat: "sse",
+	sseFlushOnConnect: true,
+	pathParamSchema: knowledgePathParams,
+	responseSchema: knowledgeEventsResponseSchema,
+	summary: "Stream Knowledge changes",
+	description: "Server-Sent Events, one per committed write the caller can read: { kind, op, pageId?, scopeId?, at }. Ids the caller cannot read are left out, and changes they cannot read at all are not sent. Re-read what changed with the other Knowledge routes.",
+	tags: ["Knowledge"],
+	requiresAuth: true,
+	handler: async ({ mastra, requestContext, knowledgeKey, abortSignal }) => {
+		try {
+			const { instance, store, read } = await resolveStore(mastra, requestContext, knowledgeKey);
+			if (typeof instance.onChange !== "function") throw new HTTPException(501, { message: "Knowledge change events need @mastra/core 1.81.0 or later." });
+			const logger = mastra.getLogger();
+			let stop = () => {};
+			return new ReadableStream({
+				start(controller) {
+					let open = true;
+					let queue = Promise.resolve();
+					const unsubscribe = instance.onChange((event) => {
+						queue = queue.then(async () => {
+							const change = await visibleChange(store, read, event).catch((error) => {
+								logger?.error("Error filtering a Knowledge change", { error });
+								return null;
+							});
+							if (open && change) controller.enqueue(change);
+						});
+					});
+					const keepalive = setInterval(() => open && controller.enqueue(": keepalive\n\n"), KEEPALIVE_MS);
+					const expire = setTimeout(() => stop(), STREAM_MAX_AGE_MS);
+					stop = () => {
+						if (!open) return;
+						open = false;
+						clearInterval(keepalive);
+						clearTimeout(expire);
+						unsubscribe();
+						try {
+							controller.close();
+						} catch {}
+					};
+					if (abortSignal?.aborted) stop();
+					else abortSignal?.addEventListener("abort", stop, { once: true });
+				},
+				cancel() {
+					stop();
+				}
+			});
+		} catch (error) {
+			return handleError(error, "Error streaming Knowledge changes");
+		}
+	}
+});
+export { LIST_KNOWLEDGE_ROUTE as a, GET_KNOWLEDGE_TREE_ROUTE as i, GET_KNOWLEDGE_GRAPH_ROUTE as n, SEARCH_KNOWLEDGE_ROUTE as o, GET_KNOWLEDGE_PAGE_ROUTE as r, STREAM_KNOWLEDGE_EVENTS_ROUTE as s, GET_KNOWLEDGE_ACTIVITY_ROUTE as t };
+
+//# sourceMappingURL=knowledge-DykIi0wH.js.map

package/dist/knowledge-DykIi0wH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knowledge-DykIi0wH.js","names":[],"sources":["../src/server/schemas/knowledge.ts","../src/server/handlers/knowledge.ts"],"sourcesContent":["import { z } from 'zod/v4';\n\nexport const knowledgePathParams = z.object({\n  knowledgeKey: z.string().describe('Application key the Knowledge instance is registered under'),\n});\n\nexport const knowledgePagePathParams = knowledgePathParams.extend({\n  pageId: z.string().min(1).max(512).describe('Knowledge page id'),\n});\n\nconst pageId = z.string().min(1).max(512);\nconst limit = z.coerce.number().int().min(1).max(100).optional();\n\nexport const knowledgeTreeQuerySchema = z.object({\n  parentId: pageId.optional().describe('Page whose children to list; omit for the root scopes'),\n  cursor: z.string().optional(),\n  limit,\n});\n\nexport const knowledgePageQuerySchema = z.object({\n  noteCursor: z.string().optional(),\n  noteLimit: limit,\n});\n\nexport const knowledgeGraphQuerySchema = z.object({\n  rootId: pageId.optional().describe('Page to walk from; omit to walk every root scope'),\n  maxPages: z.coerce.number().int().min(1).max(500).optional(),\n});\n\n// A repeated param (`?scopeId=a&scopeId=b`) arrives as an array, a lone one as a string.\nconst scopeIds = z\n  .union([z.string(), z.array(z.string())])\n  .transform(value => (Array.isArray(value) ? value : [value]))\n  .pipe(z.array(pageId).max(20));\n\nexport const knowledgeSearchQuerySchema = z.object({\n  q: z.string().min(1).max(200).describe('Text to match in page names, synopses, bodies and notes'),\n  scopeId: scopeIds.optional().describe('Only pages within these scopes'),\n  limit,\n});\n\nexport const knowledgeActivityQuerySchema = z.object({\n  scopeId: pageId.optional(),\n  pageId: pageId.optional(),\n  cursor: z.string().optional(),\n  limit,\n});\n\n// Payloads come from the @mastra/core/knowledge page readers; the UI package owns their TypeScript shapes.\nconst payload = z.record(z.string(), z.unknown());\n\nexport const listKnowledgeResponseSchema = z.object({\n  instances: z.array(z.object({ key: z.string(), id: z.string() })),\n});\nexport const knowledgeTreeResponseSchema = payload;\nexport const knowledgePageResponseSchema = payload;\nexport const knowledgeGraphResponseSchema = payload;\nexport const knowledgeSearchResponseSchema = z.object({ results: z.array(payload) });\nexport const knowledgeActivityResponseSchema = payload;\nexport const knowledgeEventsResponseSchema = z.object({\n  kind: z.enum(['scope', 'page', 'note', 'pin']),\n  op: z.string(),\n  pageId: z.string().optional(),\n  scopeId: z.string().optional(),\n  at: z.string(),\n});\n","import * as coreKnowledge from '@mastra/core/knowledge';\nimport type { Knowledge, KnowledgeChangeEvent } from '@mastra/core/knowledge';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { KnowledgeReadScope, KnowledgeStorage } from '@mastra/core/storage';\nimport { MASTRA_KNOWLEDGE_PRINCIPALS_KEY } from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\nimport {\n  knowledgeActivityQuerySchema,\n  knowledgeActivityResponseSchema,\n  knowledgeEventsResponseSchema,\n  knowledgeGraphQuerySchema,\n  knowledgeGraphResponseSchema,\n  knowledgePagePathParams,\n  knowledgePageQuerySchema,\n  knowledgePageResponseSchema,\n  knowledgePathParams,\n  knowledgeSearchQuerySchema,\n  knowledgeSearchResponseSchema,\n  knowledgeTreeQuerySchema,\n  knowledgeTreeResponseSchema,\n  listKnowledgeResponseSchema,\n} from '../schemas/knowledge';\nimport { createRoute } from '../server-adapter/routes/route-builder';\n\nimport { handleError } from './error';\nimport { getHandlerFGAProvider } from './utils';\n\n/**\n * Read-only browsing of Knowledge instances registered on Mastra, for Studio. Nothing here writes.\n *\n * What a caller reads depends on whether the app has auth configured (`server.auth` or `studio.auth`):\n * - No auth: probably a local or test project, so the routes read as the instance owner (`'all'`).\n * - Auth: reads are narrowed to what the signed-in caller can read. The app maps the user to Knowledge\n *   principals by setting MASTRA_KNOWLEDGE_PRINCIPALS_KEY in `auth.authorize` (a `string[]`, or `'all'`\n *   for an admin); the instance turns them into a read scope with `readScopeFor`. A caller with no\n *   mapping is refused with 403.\n *\n * On top of that the path derives `knowledge:read` (`GET /knowledge/...`), and with FGA configured each\n * instance is filtered and gated by `knowledge:read` on that instance. The routes are opt-in\n * (KNOWLEDGE_ROUTES); hosts with their own scoping (Factory) do not mount them.\n */\n\nfunction hasAuth(mastra: Mastra): boolean {\n  return Boolean(mastra.getServer?.()?.auth || (mastra as any).getStudio?.()?.auth);\n}\n\nasync function callerReadScope(\n  mastra: Mastra,\n  requestContext: RequestContext | undefined,\n  instance: Knowledge,\n): Promise<KnowledgeReadScope> {\n  if (!hasAuth(mastra)) return 'all';\n\n  const principals = requestContext?.get(MASTRA_KNOWLEDGE_PRINCIPALS_KEY);\n  if (principals === undefined || principals === null) {\n    throw new HTTPException(403, {\n      message: `Knowledge access is not mapped for this caller. Set request context key \"${MASTRA_KNOWLEDGE_PRINCIPALS_KEY}\" in auth.authorize.`,\n    });\n  }\n  if (principals === 'all') return 'all';\n  // The value comes from the app's own authorize code, so a bad one is a host misconfiguration, not a denial.\n  if (!Array.isArray(principals) || principals.some(principal => typeof principal !== 'string')) {\n    throw new HTTPException(500, {\n      message: `Request context key \"${MASTRA_KNOWLEDGE_PRINCIPALS_KEY}\" must be a string array or 'all'.`,\n    });\n  }\n  try {\n    return await instance.readScopeFor(principals);\n  } catch (error) {\n    // A principal that matches no declared scope type: the app's mapping disagrees with its declarations.\n    if (error instanceof Error && error.name === 'KnowledgeDeclarationError') {\n      throw new HTTPException(500, { message: error.message, cause: error });\n    }\n    throw error;\n  }\n}\n\nasync function accessibleInstances(\n  mastra: Mastra,\n  requestContext: RequestContext | undefined,\n  entries: Array<{ id: string; key: string }>,\n): Promise<Set<string>> {\n  const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n  const user = requestContext?.get('user');\n  if (!fgaProvider || !user || typeof user !== 'object' || entries.length === 0) {\n    return new Set(entries.map(entry => entry.key));\n  }\n  // FGA names a Knowledge instance by its registered key, as the route metadata does (`:knowledgeKey`).\n  const accessible: Array<{ id: string; key: string }> = await fgaProvider.filterAccessible(\n    user,\n    entries.map(entry => ({ ...entry, id: entry.key })),\n    'knowledge',\n    MastraFGAPermissions.KNOWLEDGE_READ,\n  );\n  return new Set(accessible.map(entry => entry.key));\n}\n\ntype KnowledgePageReaders = Pick<\n  typeof coreKnowledge,\n  | 'listKnowledgeTreeChildren'\n  | 'readKnowledgePage'\n  | 'readKnowledgePageActivity'\n  | 'readKnowledgePageGraph'\n  | 'searchKnowledgeExplorerPages'\n>;\n\n// The page readers first ship in @mastra/core 1.81.0, above this package's peer floor. A named import\n// of an export an older core lacks fails at ESM link time and takes the whole server down, so they are\n// read off the namespace (as in schedules-workflows-shim.ts) and the routes answer 501 without them.\nconst pageReaders: Partial<KnowledgePageReaders> = coreKnowledge;\n\nfunction requirePageReaders(): KnowledgePageReaders {\n  const {\n    listKnowledgeTreeChildren,\n    readKnowledgePage,\n    readKnowledgePageActivity,\n    readKnowledgePageGraph,\n    searchKnowledgeExplorerPages,\n  } = pageReaders;\n  if (\n    !listKnowledgeTreeChildren ||\n    !readKnowledgePage ||\n    !readKnowledgePageActivity ||\n    !readKnowledgePageGraph ||\n    !searchKnowledgeExplorerPages\n  ) {\n    throw new HTTPException(501, { message: 'Knowledge browsing needs @mastra/core 1.81.0 or later.' });\n  }\n  return {\n    listKnowledgeTreeChildren,\n    readKnowledgePage,\n    readKnowledgePageActivity,\n    readKnowledgePageGraph,\n    searchKnowledgeExplorerPages,\n  };\n}\n\n/**\n * The declared grants between the graph's scopes, each with its principal's display label. Grants are\n * newer than the page readers, so a core without them sends none and the graph still loads.\n */\nasync function graphGrants(\n  instance: Knowledge,\n  store: KnowledgeStorage,\n  pages: readonly coreKnowledge.KnowledgePage[],\n  read: KnowledgeReadScope,\n): Promise<Array<coreKnowledge.KnowledgeGraphScopeGrant & { principalLabel?: string }> | undefined> {\n  const readGrants = (coreKnowledge as Partial<typeof coreKnowledge>).readKnowledgeScopeGrants;\n  const scopeGrants = (instance as Partial<Knowledge>).scopeGrants?.bind(instance);\n  if (!readGrants || !scopeGrants) return undefined;\n  const grants = await readGrants(store, { pages, read, grantsFor: scopeGrants });\n  return grants.map(grant => {\n    const principalLabel = instance.scopeLabel?.(grant.principal);\n    return principalLabel ? { ...grant, principalLabel } : grant;\n  });\n}\n\nasync function resolveStore(\n  mastra: Mastra,\n  requestContext: RequestContext | undefined,\n  knowledgeKey: string | undefined,\n): Promise<{ instance: Knowledge; store: KnowledgeStorage; read: KnowledgeReadScope; readers: KnowledgePageReaders }> {\n  const instances = mastra.listKnowledge();\n  // Own keys only: `constructor` or `__proto__` must not resolve to an Object.prototype member.\n  const instance = knowledgeKey && Object.hasOwn(instances, knowledgeKey) ? instances[knowledgeKey] : undefined;\n  if (!knowledgeKey || !instance)\n    throw new HTTPException(404, { message: `Knowledge ${knowledgeKey ?? ''} not found` });\n\n  // An instance the caller may not read looks the same as one that does not exist.\n  const fgaProvider = getHandlerFGAProvider(mastra, requestContext);\n  const user = requestContext?.get('user');\n  if (fgaProvider && user && typeof user === 'object') {\n    const allowed = await fgaProvider.check(user, {\n      resource: { type: 'knowledge', id: knowledgeKey },\n      permission: MastraFGAPermissions.KNOWLEDGE_READ,\n    });\n    if (!allowed) throw new HTTPException(404, { message: `Knowledge ${knowledgeKey} not found` });\n  }\n  const readers = requirePageReaders();\n  const read = await callerReadScope(mastra, requestContext, instance);\n  return { instance, store: await instance.getStorage(), read, readers };\n}\n\n/**\n * Adds each scope page's declared `displayLabel` with its address's `$params` filled in (`'$orgId policy'`\n * → `'acme policy'`), so the explorer can caption scopes. Scope declarations live in config, not\n * storage, so the readers can't supply it. Older cores without `scopeLabel` send no label.\n */\nfunction withDisplayLabel<T extends { isScope: boolean; address?: string }>(\n  instance: Knowledge,\n  page: T,\n): T & { displayLabel?: string } {\n  if (!page.isScope || !page.address) return page;\n  const displayLabel = instance.scopeLabel?.(page.address);\n  return displayLabel ? { ...page, displayLabel } : page;\n}\n\nexport const LIST_KNOWLEDGE_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge',\n  responseType: 'json',\n  responseSchema: listKnowledgeResponseSchema,\n  summary: 'List Knowledge instances',\n  description:\n    \"Returns the Knowledge instances registered on this Mastra instance, by application key. Without app auth the other Knowledge routes read the whole instance; with auth they read only what the caller's Knowledge principals (MASTRA_KNOWLEDGE_PRINCIPALS_KEY, set in auth.authorize) can read, and refuse an unmapped caller with 403.\",\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext }) => {\n    try {\n      const all = Object.entries(mastra.listKnowledge()).map(([key, instance]) => ({ key, id: instance.id }));\n      const allowed = await accessibleInstances(mastra, requestContext, all);\n      return { instances: all.filter(entry => allowed.has(entry.key)) };\n    } catch (error) {\n      return handleError(error, 'Error listing Knowledge instances');\n    }\n  },\n});\n\nexport const GET_KNOWLEDGE_TREE_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge/:knowledgeKey/tree',\n  responseType: 'json',\n  pathParamSchema: knowledgePathParams,\n  queryParamSchema: knowledgeTreeQuerySchema,\n  responseSchema: knowledgeTreeResponseSchema,\n  summary: 'List one level of the Knowledge page tree',\n  description:\n    'Without parentId, returns the root scopes. With parentId, returns its child scopes (first page only) then its child pages in order, paged with cursor.',\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, knowledgeKey, parentId, cursor, limit }) => {\n    try {\n      const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);\n      const level = await readers.listKnowledgeTreeChildren(store, {\n        parentId: parentId ?? null,\n        read,\n        // An empty `?cursor=` means no cursor, so root scopes are still listed.\n        cursor: cursor || undefined,\n        limit,\n      });\n      return { ...level, pages: level.pages.map(page => withDisplayLabel(instance, page)) };\n    } catch (error) {\n      return handleError(error, 'Error reading Knowledge tree');\n    }\n  },\n});\n\nexport const GET_KNOWLEDGE_PAGE_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge/:knowledgeKey/pages/:pageId',\n  responseType: 'json',\n  pathParamSchema: knowledgePagePathParams,\n  queryParamSchema: knowledgePageQuerySchema,\n  responseSchema: knowledgePageResponseSchema,\n  summary: 'Get a Knowledge page',\n  description:\n    'Returns one page with its ancestors, a page of its notes, its pin, the pages its notes reference and notes elsewhere that mention it; 404 when it does not exist',\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, knowledgeKey, pageId, noteCursor, noteLimit }) => {\n    try {\n      const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);\n      const view = await readers.readKnowledgePage(store, { pageId, read, noteCursor, noteLimit });\n      if (!view) throw new HTTPException(404, { message: 'Knowledge page not found' });\n      const label = <T extends { isScope: boolean; declaration?: string }>(page: T) => withDisplayLabel(instance, page);\n      return {\n        ...view,\n        page: label(view.page),\n        ancestors: view.ancestors.map(label),\n        related: view.related.map(label),\n      };\n    } catch (error) {\n      return handleError(error, 'Error reading Knowledge page');\n    }\n  },\n});\n\nexport const GET_KNOWLEDGE_GRAPH_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge/:knowledgeKey/graph',\n  responseType: 'json',\n  pathParamSchema: knowledgePathParams,\n  queryParamSchema: knowledgeGraphQuerySchema,\n  responseSchema: knowledgeGraphResponseSchema,\n  summary: 'Get a bounded Knowledge page graph',\n  description:\n    'Returns pages under rootId (or every root scope) breadth-first with parent and mention edges, bounded; truncated is true when a limit stopped it. grants lists the declared access grants onto the scopes shown, from principal scopes the caller can read. 404 when rootId does not exist.',\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, knowledgeKey, rootId, maxPages }) => {\n    try {\n      const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);\n      const graph = await readers.readKnowledgePageGraph(store, {\n        read,\n        rootId: rootId ?? null,\n        ...(maxPages ? { limits: { maxPages } } : {}),\n      });\n      if (!graph) throw new HTTPException(404, { message: 'Knowledge page not found' });\n      const grants = await graphGrants(instance, store, graph.pages, read);\n      return {\n        ...graph,\n        pages: graph.pages.map(page => withDisplayLabel(instance, page)),\n        ...(grants ? { grants } : {}),\n      };\n    } catch (error) {\n      return handleError(error, 'Error reading Knowledge graph');\n    }\n  },\n});\n\nexport const SEARCH_KNOWLEDGE_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge/:knowledgeKey/search',\n  responseType: 'json',\n  pathParamSchema: knowledgePathParams,\n  queryParamSchema: knowledgeSearchQuerySchema,\n  responseSchema: knowledgeSearchResponseSchema,\n  summary: 'Search Knowledge pages and notes',\n  description: 'Returns pages whose name, synopsis or body, and notes whose text, match the query',\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, knowledgeKey, q, scopeId, limit }) => {\n    try {\n      const { instance, store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);\n      const results = await readers.searchKnowledgeExplorerPages(store, {\n        query: q,\n        read,\n        ...(scopeId?.length ? { scopeIds: scopeId } : {}),\n        limit,\n      });\n      return { results: results.map(hit => ({ ...hit, page: withDisplayLabel(instance, hit.page) })) };\n    } catch (error) {\n      return handleError(error, 'Error searching Knowledge');\n    }\n  },\n});\n\nexport const GET_KNOWLEDGE_ACTIVITY_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge/:knowledgeKey/activity',\n  responseType: 'json',\n  pathParamSchema: knowledgePathParams,\n  queryParamSchema: knowledgeActivityQuerySchema,\n  responseSchema: knowledgeActivityResponseSchema,\n  summary: 'List recent Knowledge activity',\n  description: 'Returns a newest-first page of activity, optionally for one scope or one page',\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, knowledgeKey, scopeId, pageId, cursor, limit }) => {\n    try {\n      const { store, read, readers } = await resolveStore(mastra, requestContext, knowledgeKey);\n      return { ...(await readers.readKnowledgePageActivity(store, { read, scopeId, pageId, cursor, limit })) };\n    } catch (error) {\n      return handleError(error, 'Error reading Knowledge activity');\n    }\n  },\n});\n\nconst KEEPALIVE_MS = 25_000;\n/**\n * The read scope is resolved when the stream opens. Ending it after this long makes the client reconnect,\n * which resolves the caller's read scope again, so a revoked grant stops receiving changes.\n */\nconst STREAM_MAX_AGE_MS = 5 * 60_000;\n\n/**\n * What a viewer may learn about one change: the ids in it they can read, or nothing when they can read\n * none. A page they can read now, or the scope it is (or was, before a move or merge) in, counts; a\n * deleted page is matched by its scope.\n */\nasync function visibleChange(store: KnowledgeStorage, read: KnowledgeReadScope, event: KnowledgeChangeEvent) {\n  const readable = async (id: string | undefined) =>\n    id !== undefined && (read === 'all' || (await store.getPage({ id, read })) !== null);\n  const scopeId = 'scopeId' in event ? event.scopeId : undefined;\n  const fromScopeId = 'fromScopeId' in event ? event.fromScopeId : undefined;\n  const [page, scope, fromScope] = await Promise.all([\n    readable(event.pageId),\n    readable(scopeId),\n    readable(fromScopeId),\n  ]);\n  if (!page && !scope && !fromScope) return null;\n  return {\n    kind: event.kind,\n    op: event.op,\n    ...(page ? { pageId: event.pageId } : {}),\n    ...(scope ? { scopeId } : {}),\n    at: event.at.toISOString(),\n  };\n}\n\nexport const STREAM_KNOWLEDGE_EVENTS_ROUTE = createRoute({\n  method: 'GET',\n  path: '/knowledge/:knowledgeKey/events',\n  responseType: 'stream',\n  streamFormat: 'sse',\n  sseFlushOnConnect: true,\n  pathParamSchema: knowledgePathParams,\n  responseSchema: knowledgeEventsResponseSchema,\n  summary: 'Stream Knowledge changes',\n  description:\n    'Server-Sent Events, one per committed write the caller can read: { kind, op, pageId?, scopeId?, at }. Ids the caller cannot read are left out, and changes they cannot read at all are not sent. Re-read what changed with the other Knowledge routes.',\n  tags: ['Knowledge'],\n  requiresAuth: true,\n  handler: async ({ mastra, requestContext, knowledgeKey, abortSignal }) => {\n    try {\n      const { instance, store, read } = await resolveStore(mastra, requestContext, knowledgeKey);\n      if (typeof instance.onChange !== 'function') {\n        throw new HTTPException(501, { message: 'Knowledge change events need @mastra/core 1.81.0 or later.' });\n      }\n      const logger = mastra.getLogger();\n      let stop = () => {};\n      return new ReadableStream({\n        start(controller) {\n          let open = true;\n          // Writes are filtered in order so a viewer never sees a later change before an earlier one.\n          let queue = Promise.resolve();\n          const unsubscribe = instance.onChange(event => {\n            queue = queue.then(async () => {\n              const change = await visibleChange(store, read, event).catch(error => {\n                logger?.error('Error filtering a Knowledge change', { error });\n                return null;\n              });\n              if (open && change) controller.enqueue(change);\n            });\n          });\n          const keepalive = setInterval(() => open && controller.enqueue(': keepalive\\n\\n'), KEEPALIVE_MS);\n          const expire = setTimeout(() => stop(), STREAM_MAX_AGE_MS);\n          stop = () => {\n            if (!open) return;\n            open = false;\n            clearInterval(keepalive);\n            clearTimeout(expire);\n            unsubscribe();\n            try {\n              controller.close();\n            } catch {\n              // Already closed\n            }\n          };\n          if (abortSignal?.aborted) stop();\n          else abortSignal?.addEventListener('abort', stop, { once: true });\n        },\n        cancel() {\n          stop();\n        },\n      });\n    } catch (error) {\n      return handleError(error, 'Error streaming Knowledge changes');\n    }\n  },\n});\n"],"mappings":";;;;;;;;AAEA,MAAa,sBAAsB,EAAE,OAAO,EAC1C,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,4DAA4D,EAChG,CAAC;AAED,MAAa,0BAA0B,oBAAoB,OAAO,EAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,mBAAmB,EACjE,CAAC;AAED,MAAM,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACxC,MAAM,QAAQ,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;AAE/D,MAAa,2BAA2B,EAAE,OAAO;CAC/C,UAAU,OAAO,SAAS,CAAC,CAAC,SAAS,uDAAuD;CAC5F,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B;AACF,CAAC;AAED,MAAa,2BAA2B,EAAE,OAAO;CAC/C,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,WAAW;AACb,CAAC;AAED,MAAa,4BAA4B,EAAE,OAAO;CAChD,QAAQ,OAAO,SAAS,CAAC,CAAC,SAAS,kDAAkD;CACrF,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;AAC7D,CAAC;AAGD,MAAM,WAAW,EACd,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CACxC,WAAU,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAE,CAAC,CAC5D,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAE/B,MAAa,6BAA6B,EAAE,OAAO;CACjD,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,yDAAyD;CAChG,SAAS,SAAS,SAAS,CAAC,CAAC,SAAS,gCAAgC;CACtE;AACF,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO;CACnD,SAAS,OAAO,SAAS;CACzB,QAAQ,OAAO,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B;AACF,CAAC;AAGD,MAAM,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAEhD,MAAa,8BAA8B,EAAE,OAAO,EAClD,WAAW,EAAE,MAAM,EAAE,OAAO;CAAE,KAAK,EAAE,OAAO;CAAG,IAAI,EAAE,OAAO;AAAE,CAAC,CAAC,EAClE,CAAC;AACD,MAAa,8BAA8B;AAC3C,MAAa,8BAA8B;AAC3C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,EAAE,CAAC;AACnF,MAAa,kCAAkC;AAC/C,MAAa,gCAAgC,EAAE,OAAO;CACpD,MAAM,EAAE,KAAK;EAAC;EAAS;EAAQ;EAAQ;CAAK,CAAC;CAC7C,IAAI,EAAE,OAAO;CACb,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,IAAI,EAAE,OAAO;AACf,CAAC;;;;;;;;;;;;;;;;ACrBD,SAAS,QAAQ,QAAyB;CACxC,OAAO,QAAQ,OAAO,YAAY,CAAC,EAAE,QAAS,OAAe,YAAY,CAAC,EAAE,IAAI;AAClF;AAEA,eAAe,gBACb,QACA,gBACA,UAC6B;CAC7B,IAAI,CAAC,QAAQ,MAAM,GAAG,OAAO;CAE7B,MAAM,aAAa,gBAAgB,IAAI,+BAA+B;CACtE,IAAI,eAAe,KAAA,KAAa,eAAe,MAC7C,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,4EAA4E,gCAAgC,sBACvH,CAAC;CAEH,IAAI,eAAe,OAAO,OAAO;CAEjC,IAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,MAAK,cAAa,OAAO,cAAc,QAAQ,GAC1F,MAAM,IAAI,cAAc,KAAK,EAC3B,SAAS,wBAAwB,gCAAgC,oCACnE,CAAC;CAEH,IAAI;EACF,OAAO,MAAM,SAAS,aAAa,UAAU;CAC/C,SAAS,OAAO;EAEd,IAAI,iBAAiB,SAAS,MAAM,SAAS,6BAC3C,MAAM,IAAI,cAAc,KAAK;GAAE,SAAS,MAAM;GAAS,OAAO;EAAM,CAAC;EAEvE,MAAM;CACR;AACF;AAEA,eAAe,oBACb,QACA,gBACA,SACsB;CACtB,MAAM,cAAc,sBAAsB,QAAQ,cAAc;CAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,CAAC,eAAe,CAAC,QAAQ,OAAO,SAAS,YAAY,QAAQ,WAAW,GAC1E,OAAO,IAAI,IAAI,QAAQ,KAAI,UAAS,MAAM,GAAG,CAAC;CAGhD,MAAM,aAAiD,MAAM,YAAY,iBACvE,MACA,QAAQ,KAAI,WAAU;EAAE,GAAG;EAAO,IAAI,MAAM;CAAI,EAAE,GAClD,aACA,qBAAqB,cACvB;CACA,OAAO,IAAI,IAAI,WAAW,KAAI,UAAS,MAAM,GAAG,CAAC;AACnD;AAcA,MAAM,cAA6C;AAEnD,SAAS,qBAA2C;CAClD,MAAM,EACJ,2BACA,mBACA,2BACA,wBACA,iCACE;CACJ,IACE,CAAC,6BACD,CAAC,qBACD,CAAC,6BACD,CAAC,0BACD,CAAC,8BAED,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,yDAAyD,CAAC;CAEpG,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF;;;;;AAMA,eAAe,YACb,UACA,OACA,OACA,MACkG;CAClG,MAAM,aAAc,cAAgD;CACpE,MAAM,cAAe,SAAgC,aAAa,KAAK,QAAQ;CAC/E,IAAI,CAAC,cAAc,CAAC,aAAa,OAAO,KAAA;CAExC,QAAO,MADc,WAAW,OAAO;EAAE;EAAO;EAAM,WAAW;CAAY,CAAC,EAAA,CAChE,KAAI,UAAS;EACzB,MAAM,iBAAiB,SAAS,aAAa,MAAM,SAAS;EAC5D,OAAO,iBAAiB;GAAE,GAAG;GAAO;EAAe,IAAI;CACzD,CAAC;AACH;AAEA,eAAe,aACb,QACA,gBACA,cACoH;CACpH,MAAM,YAAY,OAAO,cAAc;CAEvC,MAAM,WAAW,gBAAgB,OAAO,OAAO,WAAW,YAAY,IAAI,UAAU,gBAAgB,KAAA;CACpG,IAAI,CAAC,gBAAgB,CAAC,UACpB,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,aAAa,gBAAgB,GAAG,YAAY,CAAC;CAGvF,MAAM,cAAc,sBAAsB,QAAQ,cAAc;CAChE,MAAM,OAAO,gBAAgB,IAAI,MAAM;CACvC,IAAI,eAAe,QAAQ,OAAO,SAAS,UAKrC;MAAA,CAAC,MAJiB,YAAY,MAAM,MAAM;GAC5C,UAAU;IAAE,MAAM;IAAa,IAAI;GAAa;GAChD,YAAY,qBAAqB;EACnC,CAAC,GACa,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,aAAa,aAAa,YAAY,CAAC;CAAA;CAE/F,MAAM,UAAU,mBAAmB;CACnC,MAAM,OAAO,MAAM,gBAAgB,QAAQ,gBAAgB,QAAQ;CACnE,OAAO;EAAE;EAAU,OAAO,MAAM,SAAS,WAAW;EAAG;EAAM;CAAQ;AACvE;;;;;;AAOA,SAAS,iBACP,UACA,MAC+B;CAC/B,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,SAAS,OAAO;CAC3C,MAAM,eAAe,SAAS,aAAa,KAAK,OAAO;CACvD,OAAO,eAAe;EAAE,GAAG;EAAM;CAAa,IAAI;AACpD;AAEA,MAAa,uBAAuB,YAAY;CAC9C,QAAQ;CACR,MAAM;CACN,cAAc;CACd,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,qBAAqB;EAC7C,IAAI;GACF,MAAM,MAAM,OAAO,QAAQ,OAAO,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe;IAAE;IAAK,IAAI,SAAS;GAAG,EAAE;GACtG,MAAM,UAAU,MAAM,oBAAoB,QAAQ,gBAAgB,GAAG;GACrE,OAAO,EAAE,WAAW,IAAI,QAAO,UAAS,QAAQ,IAAI,MAAM,GAAG,CAAC,EAAE;EAClE,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,mCAAmC;EAC/D;CACF;AACF,CAAC;AAED,MAAa,2BAA2B,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,cAAc,UAAU,QAAQ,YAAY;EACpF,IAAI;GACF,MAAM,EAAE,UAAU,OAAO,MAAM,YAAY,MAAM,aAAa,QAAQ,gBAAgB,YAAY;GAClG,MAAM,QAAQ,MAAM,QAAQ,0BAA0B,OAAO;IAC3D,UAAU,YAAY;IACtB;IAEA,QAAQ,UAAU,KAAA;IAClB;GACF,CAAC;GACD,OAAO;IAAE,GAAG;IAAO,OAAO,MAAM,MAAM,KAAI,SAAQ,iBAAiB,UAAU,IAAI,CAAC;GAAE;EACtF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC;AAED,MAAa,2BAA2B,YAAY;CAClD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,cAAc,QAAQ,YAAY,gBAAgB;EAC1F,IAAI;GACF,MAAM,EAAE,UAAU,OAAO,MAAM,YAAY,MAAM,aAAa,QAAQ,gBAAgB,YAAY;GAClG,MAAM,OAAO,MAAM,QAAQ,kBAAkB,OAAO;IAAE;IAAQ;IAAM;IAAY;GAAU,CAAC;GAC3F,IAAI,CAAC,MAAM,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;GAC/E,MAAM,SAA+D,SAAY,iBAAiB,UAAU,IAAI;GAChH,OAAO;IACL,GAAG;IACH,MAAM,MAAM,KAAK,IAAI;IACrB,WAAW,KAAK,UAAU,IAAI,KAAK;IACnC,SAAS,KAAK,QAAQ,IAAI,KAAK;GACjC;EACF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,8BAA8B;EAC1D;CACF;AACF,CAAC;AAED,MAAa,4BAA4B,YAAY;CACnD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,cAAc,QAAQ,eAAe;EAC7E,IAAI;GACF,MAAM,EAAE,UAAU,OAAO,MAAM,YAAY,MAAM,aAAa,QAAQ,gBAAgB,YAAY;GAClG,MAAM,QAAQ,MAAM,QAAQ,uBAAuB,OAAO;IACxD;IACA,QAAQ,UAAU;IAClB,GAAI,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC;GAC7C,CAAC;GACD,IAAI,CAAC,OAAO,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,2BAA2B,CAAC;GAChF,MAAM,SAAS,MAAM,YAAY,UAAU,OAAO,MAAM,OAAO,IAAI;GACnE,OAAO;IACL,GAAG;IACH,OAAO,MAAM,MAAM,KAAI,SAAQ,iBAAiB,UAAU,IAAI,CAAC;IAC/D,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC7B;EACF,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,+BAA+B;EAC3D;CACF;AACF,CAAC;AAED,MAAa,yBAAyB,YAAY;CAChD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,cAAc,GAAG,SAAS,YAAY;EAC9E,IAAI;GACF,MAAM,EAAE,UAAU,OAAO,MAAM,YAAY,MAAM,aAAa,QAAQ,gBAAgB,YAAY;GAOlG,OAAO,EAAE,UAAS,MANI,QAAQ,6BAA6B,OAAO;IAChE,OAAO;IACP;IACA,GAAI,SAAS,SAAS,EAAE,UAAU,QAAQ,IAAI,CAAC;IAC/C;GACF,CAAC,EAAA,CACyB,KAAI,SAAQ;IAAE,GAAG;IAAK,MAAM,iBAAiB,UAAU,IAAI,IAAI;GAAE,EAAE,EAAE;EACjG,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,2BAA2B;EACvD;CACF;AACF,CAAC;AAED,MAAa,+BAA+B,YAAY;CACtD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,gBAAgB;CAChB,SAAS;CACT,aAAa;CACb,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,cAAc,SAAS,QAAQ,QAAQ,YAAY;EAC3F,IAAI;GACF,MAAM,EAAE,OAAO,MAAM,YAAY,MAAM,aAAa,QAAQ,gBAAgB,YAAY;GACxF,OAAO,EAAE,GAAI,MAAM,QAAQ,0BAA0B,OAAO;IAAE;IAAM;IAAS;IAAQ;IAAQ;GAAM,CAAC,EAAG;EACzG,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,kCAAkC;EAC9D;CACF;AACF,CAAC;AAED,MAAM,eAAe;;;;;AAKrB,MAAM,oBAAoB;;;;;;AAO1B,eAAe,cAAc,OAAyB,MAA0B,OAA6B;CAC3G,MAAM,WAAW,OAAO,OACtB,OAAO,KAAA,MAAc,SAAS,SAAU,MAAM,MAAM,QAAQ;EAAE;EAAI;CAAK,CAAC,MAAO;CACjF,MAAM,UAAU,aAAa,QAAQ,MAAM,UAAU,KAAA;CACrD,MAAM,cAAc,iBAAiB,QAAQ,MAAM,cAAc,KAAA;CACjE,MAAM,CAAC,MAAM,OAAO,aAAa,MAAM,QAAQ,IAAI;EACjD,SAAS,MAAM,MAAM;EACrB,SAAS,OAAO;EAChB,SAAS,WAAW;CACtB,CAAC;CACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,OAAO;CAC1C,OAAO;EACL,MAAM,MAAM;EACZ,IAAI,MAAM;EACV,GAAI,OAAO,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EACvC,GAAI,QAAQ,EAAE,QAAQ,IAAI,CAAC;EAC3B,IAAI,MAAM,GAAG,YAAY;CAC3B;AACF;AAEA,MAAa,gCAAgC,YAAY;CACvD,QAAQ;CACR,MAAM;CACN,cAAc;CACd,cAAc;CACd,mBAAmB;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,SAAS;CACT,aACE;CACF,MAAM,CAAC,WAAW;CAClB,cAAc;CACd,SAAS,OAAO,EAAE,QAAQ,gBAAgB,cAAc,kBAAkB;EACxE,IAAI;GACF,MAAM,EAAE,UAAU,OAAO,SAAS,MAAM,aAAa,QAAQ,gBAAgB,YAAY;GACzF,IAAI,OAAO,SAAS,aAAa,YAC/B,MAAM,IAAI,cAAc,KAAK,EAAE,SAAS,6DAA6D,CAAC;GAExG,MAAM,SAAS,OAAO,UAAU;GAChC,IAAI,aAAa,CAAC;GAClB,OAAO,IAAI,eAAe;IACxB,MAAM,YAAY;KAChB,IAAI,OAAO;KAEX,IAAI,QAAQ,QAAQ,QAAQ;KAC5B,MAAM,cAAc,SAAS,UAAS,UAAS;MAC7C,QAAQ,MAAM,KAAK,YAAY;OAC7B,MAAM,SAAS,MAAM,cAAc,OAAO,MAAM,KAAK,CAAC,CAAC,OAAM,UAAS;QACpE,QAAQ,MAAM,sCAAsC,EAAE,MAAM,CAAC;QAC7D,OAAO;OACT,CAAC;OACD,IAAI,QAAQ,QAAQ,WAAW,QAAQ,MAAM;MAC/C,CAAC;KACH,CAAC;KACD,MAAM,YAAY,kBAAkB,QAAQ,WAAW,QAAQ,iBAAiB,GAAG,YAAY;KAC/F,MAAM,SAAS,iBAAiB,KAAK,GAAG,iBAAiB;KACzD,aAAa;MACX,IAAI,CAAC,MAAM;MACX,OAAO;MACP,cAAc,SAAS;MACvB,aAAa,MAAM;MACnB,YAAY;MACZ,IAAI;OACF,WAAW,MAAM;MACnB,QAAQ,CAER;KACF;KACA,IAAI,aAAa,SAAS,KAAK;UAC1B,aAAa,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;IAClE;IACA,SAAS;KACP,KAAK;IACP;GACF,CAAC;EACH,SAAS,OAAO;GACd,OAAO,YAAY,OAAO,mCAAmC;EAC/D;CACF;AACF,CAAC"}