@mastra/auth - npm Package Compare versions

Comparing version 1.1.1 to 1.1.2-alpha.0

CHANGELOG.md

 # @mastra/auth
 
+## 1.1.2-alpha.0
+
+### Patch Changes
+
+- Fixed a TypeScript error where auth provider instances (for example `new MastraAuthWorkos()`) could not be assigned to `server.auth` or `studio.auth`, failing with `Property '#private' is missing` (#18682). ([#18796](https://github.com/mastra-ai/mastra/pull/18796))
+
+  Auth providers are now typed with a new structural `IMastraAuthProvider` interface (exported from `@mastra/core/server` and `@mastra/auth`), so provider packages no longer need a shared class identity with `@mastra/core`. `CompositeAuth` also accepts any `IMastraAuthProvider` implementation. No code changes are required:
+
+  ```typescript
+  import { Mastra } from '@mastra/core';
+  import { MastraAuthWorkos } from '@mastra/auth-workos';
+
+  // Previously failed to compile with TS2322, now works without casts
+  export const mastra = new Mastra({
+    server: {
+      auth: new MastraAuthWorkos(),
+    },
+  });
+  ```
+
 ## 1.1.1
@@ -4,0 +24,0 @@

dist/_types/@inter...e/interfaces/permissions.generated.d.ts

@@ -13,3 +13,3 @@ /**
  */
-export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
+export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "heartbeats", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
 /**
@@ -74,2 +74,4 @@ * Resource type union.
     readonly 'experiments:*': "experiments:*";
+    /** Full access to heartbeats */
+    readonly 'heartbeats:*': "heartbeats:*";
     /** Full access to infrastructure */
@@ -163,2 +165,10 @@ readonly 'infrastructure:*': "infrastructure:*";
     readonly 'experiments:read': "experiments:read";
+    /** Delete heartbeats */
+    readonly 'heartbeats:delete': "heartbeats:delete";
+    /** Execute heartbeats */
+    readonly 'heartbeats:execute': "heartbeats:execute";
+    /** View heartbeats */
+    readonly 'heartbeats:read': "heartbeats:read";
+    /** Create and modify heartbeats */
+    readonly 'heartbeats:write': "heartbeats:write";
     /** View infrastructure */
@@ -309,3 +319,3 @@ readonly 'infrastructure:read': "infrastructure:read";
  */
-export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
+export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "heartbeats:delete", "heartbeats:execute", "heartbeats:read", "heartbeats:write", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
 /**
@@ -366,2 +376,10 @@ * Specific permission type (e.g., 'agents:read', 'workflows:execute').
     readonly EXPERIMENTS_READ: "experiments:read";
+    /** Delete heartbeats */
+    readonly HEARTBEATS_DELETE: "heartbeats:delete";
+    /** Execute heartbeats */
+    readonly HEARTBEATS_EXECUTE: "heartbeats:execute";
+    /** View heartbeats */
+    readonly HEARTBEATS_READ: "heartbeats:read";
+    /** Create and modify heartbeats */
+    readonly HEARTBEATS_WRITE: "heartbeats:write";
     /** View infrastructure */
@@ -368,0 +386,0 @@ readonly INFRASTRUCTURE_READ: "infrastructure:read";

dist/_types/@internal_auth/dist/provider/index.d.ts

@@ -17,6 +17,43 @@ import { MastraBase } from '../_types/@internal_core/dist/base/index.d.ts';
 }
-export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {
+/**
+ * Structural description of the public surface of a `MastraAuthProvider`.
+ *
+ * Auth provider packages bundle their own copy of the `MastraAuthProvider`
+ * declaration, so provider class types cannot be compared nominally across
+ * package boundaries — `#private`/`protected` members would make otherwise
+ * identical copies mutually unassignable. Positions that accept user-supplied
+ * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface
+ * instead of the class.
+ *
+ * Note: methods intentionally use method syntax (not property syntax) so they
+ * are checked bivariantly — providers with a narrower `TUser` must remain
+ * assignable to `IMastraAuthProvider<unknown>`.
+ */
+export interface IMastraAuthProvider<TUser = unknown> {
+    name?: string;
+    /**
+     * Protected paths for the auth provider
+     */
     protected?: MastraAuthConfig['protected'];
+    /**
+     * Public paths for the auth provider
+     */
     public?: MastraAuthConfig['public'];
+    /**
+     * Authenticate a token and return the payload
+     */
+    authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;
+    /**
+     * Authorize a user for a path and method
+     */
+    authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;
+    /**
+     * Map an authenticated user to a memory resource id
+     */
     mapUserToResourceId?(user: TUser): string | undefined | null;
+}
+export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {
+    protected?: MastraAuthConfig['protected'];
+    public?: MastraAuthConfig['public'];
+    mapUserToResourceId?(user: TUser): string | undefined | null;
     constructor(options?: MastraAuthProviderOptions<TUser>);
@@ -43,3 +80,3 @@ /**
     private authenticatedProviderByPrimitive;
-    constructor(providers: MastraAuthProvider[]);
+    constructor(providers: IMastraAuthProvider[]);
     private findProvider;
@@ -46,0 +83,0 @@ private rememberAuthenticatedProvider;

dist/docs/assets/SOURCE_MAP.json

 {
-  "version": "1.1.1",
+  "version": "1.1.2-alpha.0",
   "package": "@mastra/auth",
@@ -4,0 +4,0 @@ "exports": {},

dist/docs/referenc...ocs-server-auth-custom-auth-provider.md

@@ -0,1 +1,3 @@
+> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
+
 # Custom auth provider
@@ -2,0 +4,0 @@

dist/docs/references/docs-server-auth-jwt.md

@@ -0,1 +1,3 @@
+> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
+
 # JSON Web Token
@@ -2,0 +4,0 @@

dist/docs/references/docs-server-auth.md

@@ -0,1 +1,3 @@
+> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
+
 # Auth overview
@@ -2,0 +4,0 @@

dist/docs/references/reference-auth-jwt.md

@@ -0,1 +1,3 @@
+> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
+
 # MastraJwtAuth class
@@ -2,0 +4,0 @@

dist/docs/SKILL.md

@@ -6,3 +6,3 @@ ---
   package: "@mastra/auth"
-  version: "1.1.1"
+  version: "1.1.2-alpha.0"
 ---
@@ -9,0 +9,0 @@

dist/index.cjs

@@ -188,3 +188,3 @@ 'use strict';
 
-// ../_internals/auth/dist/chunk-XG6GH2VJ.js
+// ../_internals/auth/dist/chunk-7GLKLOU3.js
 var MastraAuthProvider = class extends MastraBase {
@@ -191,0 +191,0 @@ protected;

dist/index.cjs.map

@@ -1,1 +0,1 @@
-{"version":3,"sources":["../src/utils.ts","../../_internal-core/src/logger/index.ts","../../_internal-core/src/base/MastraBase.ts","../../_internals/auth/src/provider/index.ts","../src/jwt.ts"],"names":["jwt","jwksClient"],"mappings":";;;;;;;;;;;AAKA,eAAsB,YAAY,WAAA,EAAqB;AACrD,EAAA,MAAM,UAAUA,oBAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAC1D,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAO,OAAA,CAAQ,YAAY,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,uBAAuB,CAAA;AACpG,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,KAAK,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAChE,EAAA,OAAO,QAAQ,OAAA,CAAQ,GAAA;AACzB;AAEA,eAAsB,UAAA,CAAW,aAAqB,MAAA,EAAgB;AACpE,EAAA,MAAM,UAAUA,oBAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,OAAOA,oBAAA,CAAI,MAAA,CAAO,WAAA,EAAa,MAAM,CAAA;AACvC;AAEA,eAAsB,UAAA,CAAW,aAAqB,OAAA,EAAiB;AACrE,EAAA,MAAM,UAAUA,oBAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,MAAM,MAAA,GAASC,2BAAA,CAAW,EAAE,OAAA,EAAS,CAAA;AACrC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,OAAO,GAAG,CAAA;AACzD,EAAA,MAAM,UAAA,GAAa,IAAI,YAAA,EAAa;AACpC,EAAA,OAAOD,oBAAA,CAAI,MAAA,CAAO,WAAA,EAAa,UAAU,CAAA;AAC3C;;;AChCO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACtBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAW;AACpE,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;AC9DA,SAAS,IAAI,KAAA,EAAoC;AAC/C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,eAAe,OAAA,EAA+B;AACrD,EAAA,MAAM,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,IAAK,GAAA,CAAI,QAAQ,EAAE,CAAA;AAC7C,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,KAAA,EAAO,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxB,IAAA,EAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,IACtB,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,OAAO;AAAA,GACrF;AACF;AAEO,IAAM,aAAA,GAAN,cAA4B,kBAAA,CAAqD;AAAA,EAC5E,MAAA;AAAA,EACF,OAAA;AAAA,EAER,YAAY,OAAA,EAAgC;AAC1C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,OAAO,CAAA;AAEtC,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,IAAI,eAAA,IAAmB,EAAA;AAEhE,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,SAAS,OAAA,IAAW,cAAA;AACnC,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,kBAAkB,KAAA,EAAiC;AACvD,IAAA,OAAOA,oBAAAA,CAAI,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,IAAA,EAAe;AACjC,IAAA,OAAO,CAAC,CAAC,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,eAAe,OAAA,EAAwC;AAC3D,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,MAAM,KAAA,GAAQ,UAAA,EAAY,WAAA,EAAY,CAAE,UAAA,CAAW,SAAS,CAAA,GAAI,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAC7F,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAChD,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,OAAO,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAA,EAAuC;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["import jwt from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\nexport type JwtPayload = jwt.JwtPayload;\n\nexport async function decodeToken(accessToken: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n  return decoded;\n}\n\nexport function getTokenIssuer(decoded: jwt.JwtPayload | null) {\n  if (!decoded) throw new Error('Invalid token');\n  if (!decoded.payload || typeof decoded.payload !== 'object') throw new Error('Invalid token payload');\n  if (!decoded.payload.iss) throw new Error('Invalid token header');\n  return decoded.payload.iss;\n}\n\nexport async function verifyHmac(accessToken: string, secret: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  return jwt.verify(accessToken, secret) as jwt.JwtPayload;\n}\n\nexport async function verifyJwks(accessToken: string, jwksUri: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  const client = jwksClient({ jwksUri });\n  const key = await client.getSigningKey(decoded.header.kid);\n  const signingKey = key.getPublicKey();\n  return jwt.verify(accessToken, signingKey) as jwt.JwtPayload;\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n  AGENT: 'AGENT',\n  OBSERVABILITY: 'OBSERVABILITY',\n  AUTH: 'AUTH',\n  BROWSER: 'BROWSER',\n  NETWORK: 'NETWORK',\n  WORKFLOW: 'WORKFLOW',\n  LLM: 'LLM',\n  TTS: 'TTS',\n  VOICE: 'VOICE',\n  VECTOR: 'VECTOR',\n  BUNDLER: 'BUNDLER',\n  DEPLOYER: 'DEPLOYER',\n  MEMORY: 'MEMORY',\n  STORAGE: 'STORAGE',\n  EMBEDDINGS: 'EMBEDDINGS',\n  MCP_SERVER: 'MCP_SERVER',\n  SERVER_CACHE: 'SERVER_CACHE',\n  SERVER: 'SERVER',\n  WORKSPACE: 'WORKSPACE',\n  CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n  DEBUG: 'debug',\n  INFO: 'info',\n  WARN: 'warn',\n  ERROR: 'error',\n  NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n  runId?: string;\n  msg: string;\n  level: LogLevel;\n  time: Date;\n  pid: number;\n  hostname: string;\n  name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n  constructor(opts: any = {}) {\n    super({ ...opts, objectMode: true });\n  }\n\n  async listLogsByRunId(_args: {\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogs(_args?: {\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    returnPaginationResults?: boolean;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n}\n\nexport const createCustomTransport = (\n  stream: Transform,\n  listLogs?: LoggerTransport['listLogs'],\n  listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n  let transport = stream as LoggerTransport;\n  if (listLogs) {\n    transport.listLogs = listLogs;\n  }\n  if (listLogsByRunId) {\n    transport.listLogsByRunId = listLogsByRunId;\n  }\n  return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n  debug(message: string, ...args: any[]): void;\n  info(message: string, ...args: any[]): void;\n  warn(message: string, ...args: any[]): void;\n  error(message: string, ...args: any[]): void;\n  trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n  getTransports(): Map<string, LoggerTransport>;\n  listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n  listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n  protected name: string;\n  protected level: LogLevel;\n  protected transports: Map<string, LoggerTransport>;\n\n  constructor(\n    options: {\n      name?: string;\n      level?: LogLevel;\n      transports?: Record<string, LoggerTransport>;\n    } = {},\n  ) {\n    this.name = options.name || 'Mastra';\n    this.level = options.level || LogLevel.ERROR;\n    this.transports = new Map(Object.entries(options.transports || {}));\n  }\n\n  abstract debug(message: string, ...args: any[]): void;\n  abstract info(message: string, ...args: any[]): void;\n  abstract warn(message: string, ...args: any[]): void;\n  abstract error(message: string, ...args: any[]): void;\n\n  getTransports() {\n    return this.transports;\n  }\n\n  trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n  async listLogs(\n    transportId: string,\n    params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    if (!transportId || !this.transports.has(transportId)) {\n      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports.get(transportId)!.listLogs?.(params) ?? {\n        logs: [],\n        total: 0,\n        page: params?.page ?? 1,\n        perPage: params?.perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n\n  async listLogsByRunId({\n    transportId,\n    runId,\n    fromDate,\n    toDate,\n    logLevel,\n    filters,\n    page,\n    perPage,\n  }: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    if (!transportId || !this.transports.has(transportId) || !runId) {\n      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports\n        .get(transportId)!\n        .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n        logs: [],\n        total: 0,\n        page: page ?? 1,\n        perPage: perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n}\n\nexport type LogFilterContext = {\n  component?: RegisteredLogger;\n  level: LogLevel;\n  message: string;\n  args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n  name?: string;\n  level?: LogLevel;\n  component?: RegisteredLogger;\n  filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n  protected component?: RegisteredLogger;\n  protected filter?: LogFilter;\n\n  constructor(options: ConsoleLoggerOptions = {}) {\n    super(options);\n    this.component = options.component;\n    this.filter = options.filter;\n  }\n\n  child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n    const component =\n      typeof componentOrBindings === 'string'\n        ? componentOrBindings\n        : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n    return new ConsoleLogger({\n      name: this.name,\n      level: this.level,\n      component,\n      filter: this.filter,\n    });\n  }\n\n  private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n    if (!this.filter) return true;\n    try {\n      return this.filter({ component: this.component, level, message, args });\n    } catch (e) {\n      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n      return true;\n    }\n  }\n\n  private prefix(): string {\n    return this.component ? `[${this.component}] ` : '';\n  }\n\n  debug(message: string, ...args: any[]): void {\n    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  info(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.INFO, message, args)\n    ) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  warn(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.WARN, message, args)\n    ) {\n      console.warn(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  error(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.ERROR ||\n        this.level === LogLevel.WARN ||\n        this.level === LogLevel.INFO ||\n        this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.ERROR, message, args)\n    ) {\n      console.error(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  async listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n  }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n  component: RegisteredLogger = RegisteredLogger.LLM;\n  protected logger: IMastraLogger;\n  name?: string;\n  #rawConfig?: Record<string, unknown>;\n\n  constructor({\n    component,\n    name,\n    rawConfig,\n  }: {\n    component?: RegisteredLogger;\n    name?: string;\n    rawConfig?: Record<string, unknown>;\n  }) {\n    this.component = component || RegisteredLogger.LLM;\n    this.name = name;\n    this.#rawConfig = rawConfig;\n    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n  }\n\n  /**\n   * Returns the raw storage configuration this primitive was created from,\n   * or undefined if it was created from code.\n   */\n  toRawConfig(): Record<string, unknown> | undefined {\n    return this.#rawConfig;\n  }\n\n  /**\n   * Sets the raw storage configuration for this primitive.\n   * @internal\n   */\n  __setRawConfig(rawConfig: Record<string, unknown>): void {\n    this.#rawConfig = rawConfig;\n  }\n\n  /**\n   * Set the logger for the agent\n   * @param logger\n   */\n  __setLogger(logger: IMastraLogger) {\n    this.logger =\n      'child' in logger && typeof (logger as any).child === 'function'\n        ? (logger as any).child({ component: this.component })\n        : logger;\n  }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n  CredentialsResult,\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n  User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n  name?: string;\n  authorizeUser?: AuthorizeUserFn<TUser>;\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {\n  public protected?: MastraAuthConfig['protected'];\n  public public?: MastraAuthConfig['public'];\n  public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n  constructor(options?: MastraAuthProviderOptions<TUser>) {\n    super({ component: 'AUTH', name: options?.name });\n\n    if (options?.authorizeUser) {\n      this.authorizeUser = options.authorizeUser.bind(this);\n    }\n\n    this.protected = options?.protected;\n    this.public = options?.public;\n    this.mapUserToResourceId = options?.mapUserToResourceId;\n  }\n\n  /**\n   * Authenticate a token and return the payload\n   * @param token - The token to authenticate\n   * @param request - The request\n   * @returns The payload\n   */\n  abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n  /**\n   * Authorize a user for a path and method\n   * @param user - The user to authorize\n   * @param request - The request\n   * @returns The authorization result\n   */\n  abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n  protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n    if (opts?.authorizeUser) {\n      this.authorizeUser = opts.authorizeUser.bind(this);\n    }\n    if (opts?.mapUserToResourceId) {\n      this.mapUserToResourceId = opts.mapUserToResourceId;\n    }\n    if (opts?.protected) {\n      this.protected = opts.protected;\n    }\n    if (opts?.public) {\n      this.public = opts.public;\n    }\n  }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).getLoginUrl === 'function' &&\n    typeof (p as any).handleCallback === 'function'\n  );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).validateSession === 'function' &&\n    typeof (p as any).createSession === 'function'\n  );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n  return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n  return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n  extends MastraAuthProvider\n  implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n  private providers: MastraAuthProvider[];\n  private authenticatedProviderByObject = new WeakMap<object, MastraAuthProvider>();\n  private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, MastraAuthProvider>();\n\n  constructor(providers: MastraAuthProvider[]) {\n    const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n    const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n    super({\n      public: combinedPublic,\n      protected: combinedProtected,\n    });\n\n    this.providers = providers;\n    if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n      this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n    }\n\n    // Null out interface methods when no inner provider supports them.\n    // This ensures duck-typing checks (typeof auth.method === 'function')\n    // accurately reflect the composite's actual capabilities — preventing\n    // Studio from showing login options that no provider can handle.\n    if (!providers.some(isSSOProvider)) {\n      this.getLoginUrl = undefined as any;\n      this.handleCallback = undefined as any;\n      this.getLoginButtonConfig = undefined as any;\n    }\n    if (!providers.some(isSessionProvider)) {\n      this.createSession = undefined as any;\n      this.validateSession = undefined as any;\n      this.getSessionIdFromRequest = undefined as any;\n    }\n    if (!providers.some(isUserProvider)) {\n      this.getCurrentUser = undefined as any;\n      this.getUser = undefined as any;\n      this.getUsers = undefined as any;\n    }\n    // Proxy credentials provider methods if any inner provider supports them.\n    const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is MastraAuthProvider) as any;\n    if (credProvider) {\n      (this as any).signIn = credProvider.signIn.bind(credProvider);\n      if (typeof credProvider.signUp === 'function') {\n        (this as any).signUp = credProvider.signUp.bind(credProvider);\n      }\n      if (typeof credProvider.requestPasswordReset === 'function') {\n        (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n      }\n      if (typeof credProvider.resetPassword === 'function') {\n        (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n      }\n      (this as any).isSignUpEnabled =\n        typeof credProvider.isSignUpEnabled === 'function'\n          ? credProvider.isSignUpEnabled.bind(credProvider)\n          : () => true;\n    } else {\n      (this as any).signIn = undefined;\n      (this as any).signUp = undefined;\n      (this as any).requestPasswordReset = undefined;\n      (this as any).resetPassword = undefined;\n      (this as any).isSignUpEnabled = undefined;\n    }\n  }\n\n  // Find first provider implementing an interface\n  private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n    return this.providers.find(check) as T | undefined;\n  }\n\n  private rememberAuthenticatedProvider(user: unknown, provider: MastraAuthProvider): void {\n    if (isObjectLike(user)) {\n      this.authenticatedProviderByObject.set(user, provider);\n      return;\n    }\n\n    this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n  }\n\n  private takeAuthenticatedProvider(user: unknown): MastraAuthProvider | undefined {\n    if (isObjectLike(user)) {\n      const provider = this.authenticatedProviderByObject.get(user);\n      this.authenticatedProviderByObject.delete(user);\n      return provider;\n    }\n\n    const primitiveUser = user as PrimitiveAuthUser;\n    const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n    this.authenticatedProviderByPrimitive.delete(primitiveUser);\n    return provider;\n  }\n\n  private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n    const provider = this.takeAuthenticatedProvider(user);\n    return provider?.mapUserToResourceId?.(user);\n  }\n\n  // ============================================================================\n  // License Exemption Markers\n  // Expose these if any underlying provider has them\n  // ============================================================================\n\n  /**\n   * True if any provider is MastraCloudAuth (exempt from license requirement).\n   */\n  get isMastraCloudAuth(): boolean {\n    return this.providers.some(\n      p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n    );\n  }\n\n  /**\n   * True if any provider is SimpleAuth (exempt from license requirement).\n   */\n  get isSimpleAuth(): boolean {\n    return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n    for (const provider of this.providers) {\n      try {\n        const user = await provider.authenticateToken(token, request);\n        if (user) {\n          this.rememberAuthenticatedProvider(user, provider);\n          return user;\n        }\n      } catch {\n        // ignore error, try next provider\n      }\n    }\n    return null;\n  }\n\n  async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n    for (const provider of this.providers) {\n      const authorized = await provider.authorizeUser(user, request);\n      if (authorized) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  // ============================================================================\n  // ISSOProvider Implementation\n  // ============================================================================\n\n  /**\n   * Forward cookie header to SSO provider for PKCE validation.\n   * Called by auth handler before handleCallback().\n   */\n  setCallbackCookieHeader(cookieHeader: string | null): void {\n    const sso = this.findProvider(isSSOProvider);\n    if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n      (sso as any).setCallbackCookieHeader(cookieHeader);\n    }\n  }\n\n  getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.getLoginUrl(redirectUri, state);\n  }\n\n  getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n    const sso = this.findProvider(isSSOProvider);\n    return sso?.getLoginCookies?.(redirectUri, state);\n  }\n\n  async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n  }\n\n  getLoginButtonConfig(): SSOLoginConfig {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) return { provider: 'unknown', text: 'Sign in' };\n    return sso.getLoginButtonConfig();\n  }\n\n  async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n    // Try each SSO provider until one returns a logout URL\n    for (const provider of this.providers) {\n      if (isSSOProvider(provider) && provider.getLogoutUrl) {\n        try {\n          const url = await provider.getLogoutUrl(redirectUri, request);\n          if (url) return url;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // ISessionProvider Implementation\n  // ============================================================================\n\n  async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n    const session = this.findProvider(isSessionProvider);\n    if (!session) throw new Error('No session provider configured in CompositeAuth');\n    return session.createSession(userId, metadata);\n  }\n\n  async validateSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one validates\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.validateSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async destroySession(sessionId: string): Promise<void> {\n    // Destroy session on ALL providers (user may have sessions in multiple stores)\n    const destroyPromises: Promise<void>[] = [];\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        destroyPromises.push(\n          provider.destroySession(sessionId).catch(() => {\n            // Ignore errors, session may not exist in this provider\n          }),\n        );\n      }\n    }\n    await Promise.all(destroyPromises);\n  }\n\n  async refreshSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one refreshes\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.refreshSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionIdFromRequest(request: Request): string | null {\n    // Try each session provider until one finds a session ID\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const sessionId = provider.getSessionIdFromRequest(request);\n          if (sessionId) return sessionId;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionHeaders(session: Session): Record<string, string> {\n    // Intentionally uses only the first session provider: a session is created by one\n    // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n    // no stale cookies remain.\n    const sessionProvider = this.findProvider(isSessionProvider);\n    return sessionProvider?.getSessionHeaders(session) ?? {};\n  }\n\n  getClearSessionHeaders(): Record<string, string> {\n    // Merge clear headers from ALL providers to ensure no stale session cookies remain\n    const headers: Record<string, string> = {};\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const providerHeaders = provider.getClearSessionHeaders();\n          Object.assign(headers, providerHeaders);\n        } catch {\n          // Ignore errors\n        }\n      }\n    }\n    return headers;\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // Try each provider until one returns a user (like authenticateToken)\n  // ============================================================================\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getCurrentUser(request);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUser(userId: string): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getUser(userId);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<User | null>> {\n    return Promise.all(userIds.map(userId => this.getUser(userId)));\n  }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n  /**\n   * Valid tokens to authenticate against\n   */\n  tokens: TokenToUser<TUser>;\n  /**\n   * Headers to check for authentication\n   * @default ['Authorization', 'X-Playground-Access']\n   */\n  headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n  /**\n   * Marker to exempt SimpleAuth from EE license requirement.\n   * SimpleAuth is for development/testing and should work without a license.\n   */\n  readonly isSimpleAuth = true;\n\n  private tokens: TokenToUser<TUser>;\n  private headers: string[];\n  private users: TUser[];\n  private userById: Map<string, TUser>;\n\n  constructor(options: SimpleAuthOptions<TUser>) {\n    super(options);\n    this.tokens = options.tokens;\n    this.users = Object.values(this.tokens);\n    this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n    this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n  }\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n    const requestTokens = this.getTokensFromHeaders(token, request);\n\n    for (const requestToken of requestTokens) {\n      const tokenToUser = this.tokens[requestToken];\n      if (tokenToUser) {\n        return tokenToUser;\n      }\n    }\n\n    return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n  }\n\n  async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n    return this.users.includes(user);\n  }\n\n  /** Get current user from request headers or cookie. */\n  async getCurrentUser(request: Request): Promise<TUser | null> {\n    // Check headers first\n    for (const headerName of this.headers) {\n      const headerValue = request.headers.get(headerName);\n      if (headerValue) {\n        const token = this.stripBearerPrefix(headerValue);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n\n    return this.getUserFromCookie(request.headers.get('Cookie'));\n  }\n\n  private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n    if (!cookieHeader) return null;\n\n    const cookies = cookieHeader.split(';').map(c => c.trim());\n    for (const cookie of cookies) {\n      if (cookie.startsWith('mastra-token=')) {\n        const token = cookie.slice('mastra-token='.length);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Get user by ID. */\n  async getUser(userId: string): Promise<TUser | null> {\n    return this.userById.get(userId) ?? null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n    return userIds.map(userId => this.userById.get(userId) ?? null);\n  }\n\n  /**\n   * Sign in with token (passed as password field).\n   * The email field is ignored - only the token matters.\n   */\n  async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n    const token = password;\n    const user = this.tokens[token];\n\n    if (!user) {\n      throw new Error('Invalid token');\n    }\n\n    // Set cookie so the token persists across requests\n    const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n    return {\n      user,\n      token,\n      cookies: [cookie],\n    };\n  }\n\n  async signUp(): Promise<CredentialsResult<TUser>> {\n    throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n  }\n\n  isSignUpEnabled(): boolean {\n    return false;\n  }\n\n  /**\n   * Get headers to clear the session cookie on logout.\n   * Partial ISessionProvider implementation for logout support.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    return {\n      'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    };\n  }\n\n  private stripBearerPrefix(token: string): string {\n    return token.startsWith('Bearer ') ? token.slice(7) : token;\n  }\n\n  private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n    const tokens = [token];\n    for (const headerName of this.headers) {\n      const headerValue = getRequestHeader(request, headerName);\n      if (headerValue) {\n        tokens.push(this.stripBearerPrefix(headerValue));\n      }\n    }\n    return tokens;\n  }\n}\n","import type { User, IUserProvider } from '@internal/auth';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\n\nimport jwt from 'jsonwebtoken';\n\ntype JwtUser = jwt.JwtPayload;\n\ninterface MastraJwtAuthOptions extends MastraAuthProviderOptions<JwtUser> {\n  secret?: string;\n  mapUser?: (payload: JwtUser) => User | null;\n}\n\nfunction str(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction defaultMapUser(payload: JwtUser): User | null {\n  const id = str(payload.sub) || str(payload.id);\n  if (!id) {\n    return null;\n  }\n  return {\n    id,\n    email: str(payload.email),\n    name: str(payload.name),\n    avatarUrl: str(payload.avatarUrl) || str(payload.avatar_url) || str(payload.picture),\n  };\n}\n\nexport class MastraJwtAuth extends MastraAuthProvider<JwtUser> implements IUserProvider {\n  protected secret: string;\n  private mapUser: (payload: JwtUser) => User | null;\n\n  constructor(options?: MastraJwtAuthOptions) {\n    super({ name: options?.name ?? 'jwt' });\n\n    this.secret = options?.secret ?? process.env.JWT_AUTH_SECRET ?? '';\n\n    if (!this.secret) {\n      throw new Error('JWT auth secret is required');\n    }\n\n    this.mapUser = options?.mapUser ?? defaultMapUser;\n    this.registerOptions(options);\n  }\n\n  async authenticateToken(token: string): Promise<JwtUser> {\n    return jwt.verify(token, this.secret) as JwtUser;\n  }\n\n  async authorizeUser(user: JwtUser) {\n    return !!user;\n  }\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    const authHeader = request.headers.get('authorization');\n    const token = authHeader?.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null;\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      const allowed = await this.authorizeUser(payload);\n      if (!allowed) return null;\n      return this.mapUser(payload);\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(_userId: string): Promise<User | null> {\n    return null;\n  }\n}\n"]}
+{"version":3,"sources":["../src/utils.ts","../../_internal-core/src/logger/index.ts","../../_internal-core/src/base/MastraBase.ts","../../_internals/auth/src/provider/index.ts","../src/jwt.ts"],"names":["jwt","jwksClient"],"mappings":";;;;;;;;;;;AAKA,eAAsB,YAAY,WAAA,EAAqB;AACrD,EAAA,MAAM,UAAUA,oBAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAC1D,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAO,OAAA,CAAQ,YAAY,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,uBAAuB,CAAA;AACpG,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,KAAK,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAChE,EAAA,OAAO,QAAQ,OAAA,CAAQ,GAAA;AACzB;AAEA,eAAsB,UAAA,CAAW,aAAqB,MAAA,EAAgB;AACpE,EAAA,MAAM,UAAUA,oBAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,OAAOA,oBAAA,CAAI,MAAA,CAAO,WAAA,EAAa,MAAM,CAAA;AACvC;AAEA,eAAsB,UAAA,CAAW,aAAqB,OAAA,EAAiB;AACrE,EAAA,MAAM,UAAUA,oBAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,MAAM,MAAA,GAASC,2BAAA,CAAW,EAAE,OAAA,EAAS,CAAA;AACrC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,OAAO,GAAG,CAAA;AACzD,EAAA,MAAM,UAAA,GAAa,IAAI,YAAA,EAAa;AACpC,EAAA,OAAOD,oBAAA,CAAI,MAAA,CAAO,WAAA,EAAa,UAAU,CAAA;AAC3C;;;AChCO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACgBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAiD;AAC1G,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;ACpGA,SAAS,IAAI,KAAA,EAAoC;AAC/C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,eAAe,OAAA,EAA+B;AACrD,EAAA,MAAM,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,IAAK,GAAA,CAAI,QAAQ,EAAE,CAAA;AAC7C,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,KAAA,EAAO,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxB,IAAA,EAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,IACtB,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,OAAO;AAAA,GACrF;AACF;AAEO,IAAM,aAAA,GAAN,cAA4B,kBAAA,CAAqD;AAAA,EAC5E,MAAA;AAAA,EACF,OAAA;AAAA,EAER,YAAY,OAAA,EAAgC;AAC1C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,OAAO,CAAA;AAEtC,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,IAAI,eAAA,IAAmB,EAAA;AAEhE,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,SAAS,OAAA,IAAW,cAAA;AACnC,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,kBAAkB,KAAA,EAAiC;AACvD,IAAA,OAAOA,oBAAAA,CAAI,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,IAAA,EAAe;AACjC,IAAA,OAAO,CAAC,CAAC,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,eAAe,OAAA,EAAwC;AAC3D,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,MAAM,KAAA,GAAQ,UAAA,EAAY,WAAA,EAAY,CAAE,UAAA,CAAW,SAAS,CAAA,GAAI,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAC7F,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAChD,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,OAAO,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAA,EAAuC;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["import jwt from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\nexport type JwtPayload = jwt.JwtPayload;\n\nexport async function decodeToken(accessToken: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n  return decoded;\n}\n\nexport function getTokenIssuer(decoded: jwt.JwtPayload | null) {\n  if (!decoded) throw new Error('Invalid token');\n  if (!decoded.payload || typeof decoded.payload !== 'object') throw new Error('Invalid token payload');\n  if (!decoded.payload.iss) throw new Error('Invalid token header');\n  return decoded.payload.iss;\n}\n\nexport async function verifyHmac(accessToken: string, secret: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  return jwt.verify(accessToken, secret) as jwt.JwtPayload;\n}\n\nexport async function verifyJwks(accessToken: string, jwksUri: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  const client = jwksClient({ jwksUri });\n  const key = await client.getSigningKey(decoded.header.kid);\n  const signingKey = key.getPublicKey();\n  return jwt.verify(accessToken, signingKey) as jwt.JwtPayload;\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n  AGENT: 'AGENT',\n  OBSERVABILITY: 'OBSERVABILITY',\n  AUTH: 'AUTH',\n  BROWSER: 'BROWSER',\n  NETWORK: 'NETWORK',\n  WORKFLOW: 'WORKFLOW',\n  LLM: 'LLM',\n  TTS: 'TTS',\n  VOICE: 'VOICE',\n  VECTOR: 'VECTOR',\n  BUNDLER: 'BUNDLER',\n  DEPLOYER: 'DEPLOYER',\n  MEMORY: 'MEMORY',\n  STORAGE: 'STORAGE',\n  EMBEDDINGS: 'EMBEDDINGS',\n  MCP_SERVER: 'MCP_SERVER',\n  SERVER_CACHE: 'SERVER_CACHE',\n  SERVER: 'SERVER',\n  WORKSPACE: 'WORKSPACE',\n  CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n  DEBUG: 'debug',\n  INFO: 'info',\n  WARN: 'warn',\n  ERROR: 'error',\n  NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n  runId?: string;\n  msg: string;\n  level: LogLevel;\n  time: Date;\n  pid: number;\n  hostname: string;\n  name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n  constructor(opts: any = {}) {\n    super({ ...opts, objectMode: true });\n  }\n\n  async listLogsByRunId(_args: {\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogs(_args?: {\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    returnPaginationResults?: boolean;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n}\n\nexport const createCustomTransport = (\n  stream: Transform,\n  listLogs?: LoggerTransport['listLogs'],\n  listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n  let transport = stream as LoggerTransport;\n  if (listLogs) {\n    transport.listLogs = listLogs;\n  }\n  if (listLogsByRunId) {\n    transport.listLogsByRunId = listLogsByRunId;\n  }\n  return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n  debug(message: string, ...args: any[]): void;\n  info(message: string, ...args: any[]): void;\n  warn(message: string, ...args: any[]): void;\n  error(message: string, ...args: any[]): void;\n  trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n  getTransports(): Map<string, LoggerTransport>;\n  listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n  listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n  protected name: string;\n  protected level: LogLevel;\n  protected transports: Map<string, LoggerTransport>;\n\n  constructor(\n    options: {\n      name?: string;\n      level?: LogLevel;\n      transports?: Record<string, LoggerTransport>;\n    } = {},\n  ) {\n    this.name = options.name || 'Mastra';\n    this.level = options.level || LogLevel.ERROR;\n    this.transports = new Map(Object.entries(options.transports || {}));\n  }\n\n  abstract debug(message: string, ...args: any[]): void;\n  abstract info(message: string, ...args: any[]): void;\n  abstract warn(message: string, ...args: any[]): void;\n  abstract error(message: string, ...args: any[]): void;\n\n  getTransports() {\n    return this.transports;\n  }\n\n  trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n  async listLogs(\n    transportId: string,\n    params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    if (!transportId || !this.transports.has(transportId)) {\n      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports.get(transportId)!.listLogs?.(params) ?? {\n        logs: [],\n        total: 0,\n        page: params?.page ?? 1,\n        perPage: params?.perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n\n  async listLogsByRunId({\n    transportId,\n    runId,\n    fromDate,\n    toDate,\n    logLevel,\n    filters,\n    page,\n    perPage,\n  }: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    if (!transportId || !this.transports.has(transportId) || !runId) {\n      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports\n        .get(transportId)!\n        .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n        logs: [],\n        total: 0,\n        page: page ?? 1,\n        perPage: perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n}\n\nexport type LogFilterContext = {\n  component?: RegisteredLogger;\n  level: LogLevel;\n  message: string;\n  args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n  name?: string;\n  level?: LogLevel;\n  component?: RegisteredLogger;\n  filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n  protected component?: RegisteredLogger;\n  protected filter?: LogFilter;\n\n  constructor(options: ConsoleLoggerOptions = {}) {\n    super(options);\n    this.component = options.component;\n    this.filter = options.filter;\n  }\n\n  child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n    const component =\n      typeof componentOrBindings === 'string'\n        ? componentOrBindings\n        : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n    return new ConsoleLogger({\n      name: this.name,\n      level: this.level,\n      component,\n      filter: this.filter,\n    });\n  }\n\n  private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n    if (!this.filter) return true;\n    try {\n      return this.filter({ component: this.component, level, message, args });\n    } catch (e) {\n      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n      return true;\n    }\n  }\n\n  private prefix(): string {\n    return this.component ? `[${this.component}] ` : '';\n  }\n\n  debug(message: string, ...args: any[]): void {\n    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  info(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.INFO, message, args)\n    ) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  warn(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.WARN, message, args)\n    ) {\n      console.warn(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  error(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.ERROR ||\n        this.level === LogLevel.WARN ||\n        this.level === LogLevel.INFO ||\n        this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.ERROR, message, args)\n    ) {\n      console.error(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  async listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n  }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n  component: RegisteredLogger = RegisteredLogger.LLM;\n  protected logger: IMastraLogger;\n  name?: string;\n  #rawConfig?: Record<string, unknown>;\n\n  constructor({\n    component,\n    name,\n    rawConfig,\n  }: {\n    component?: RegisteredLogger;\n    name?: string;\n    rawConfig?: Record<string, unknown>;\n  }) {\n    this.component = component || RegisteredLogger.LLM;\n    this.name = name;\n    this.#rawConfig = rawConfig;\n    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n  }\n\n  /**\n   * Returns the raw storage configuration this primitive was created from,\n   * or undefined if it was created from code.\n   */\n  toRawConfig(): Record<string, unknown> | undefined {\n    return this.#rawConfig;\n  }\n\n  /**\n   * Sets the raw storage configuration for this primitive.\n   * @internal\n   */\n  __setRawConfig(rawConfig: Record<string, unknown>): void {\n    this.#rawConfig = rawConfig;\n  }\n\n  /**\n   * Set the logger for the agent\n   * @param logger\n   */\n  __setLogger(logger: IMastraLogger) {\n    this.logger =\n      'child' in logger && typeof (logger as any).child === 'function'\n        ? (logger as any).child({ component: this.component })\n        : logger;\n  }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n  CredentialsResult,\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n  User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n  name?: string;\n  authorizeUser?: AuthorizeUserFn<TUser>;\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n}\n\n/**\n * Structural description of the public surface of a `MastraAuthProvider`.\n *\n * Auth provider packages bundle their own copy of the `MastraAuthProvider`\n * declaration, so provider class types cannot be compared nominally across\n * package boundaries — `#private`/`protected` members would make otherwise\n * identical copies mutually unassignable. Positions that accept user-supplied\n * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface\n * instead of the class.\n *\n * Note: methods intentionally use method syntax (not property syntax) so they\n * are checked bivariantly — providers with a narrower `TUser` must remain\n * assignable to `IMastraAuthProvider<unknown>`.\n */\nexport interface IMastraAuthProvider<TUser = unknown> {\n  name?: string;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n  /**\n   * Authenticate a token and return the payload\n   */\n  authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n  /**\n   * Authorize a user for a path and method\n   */\n  authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n  /**\n   * Map an authenticated user to a memory resource id\n   */\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {\n  public protected?: MastraAuthConfig['protected'];\n  public public?: MastraAuthConfig['public'];\n  public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n  constructor(options?: MastraAuthProviderOptions<TUser>) {\n    super({ component: 'AUTH', name: options?.name });\n\n    if (options?.authorizeUser) {\n      this.authorizeUser = options.authorizeUser.bind(this);\n    }\n\n    this.protected = options?.protected;\n    this.public = options?.public;\n    this.mapUserToResourceId = options?.mapUserToResourceId;\n  }\n\n  /**\n   * Authenticate a token and return the payload\n   * @param token - The token to authenticate\n   * @param request - The request\n   * @returns The payload\n   */\n  abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n  /**\n   * Authorize a user for a path and method\n   * @param user - The user to authorize\n   * @param request - The request\n   * @returns The authorization result\n   */\n  abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n  protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n    if (opts?.authorizeUser) {\n      this.authorizeUser = opts.authorizeUser.bind(this);\n    }\n    if (opts?.mapUserToResourceId) {\n      this.mapUserToResourceId = opts.mapUserToResourceId;\n    }\n    if (opts?.protected) {\n      this.protected = opts.protected;\n    }\n    if (opts?.public) {\n      this.public = opts.public;\n    }\n  }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).getLoginUrl === 'function' &&\n    typeof (p as any).handleCallback === 'function'\n  );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).validateSession === 'function' &&\n    typeof (p as any).createSession === 'function'\n  );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n  return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n  return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n  extends MastraAuthProvider\n  implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n  private providers: IMastraAuthProvider[];\n  private authenticatedProviderByObject = new WeakMap<object, IMastraAuthProvider>();\n  private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, IMastraAuthProvider>();\n\n  constructor(providers: IMastraAuthProvider[]) {\n    const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n    const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n    super({\n      public: combinedPublic,\n      protected: combinedProtected,\n    });\n\n    this.providers = providers;\n    if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n      this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n    }\n\n    // Null out interface methods when no inner provider supports them.\n    // This ensures duck-typing checks (typeof auth.method === 'function')\n    // accurately reflect the composite's actual capabilities — preventing\n    // Studio from showing login options that no provider can handle.\n    if (!providers.some(isSSOProvider)) {\n      this.getLoginUrl = undefined as any;\n      this.handleCallback = undefined as any;\n      this.getLoginButtonConfig = undefined as any;\n    }\n    if (!providers.some(isSessionProvider)) {\n      this.createSession = undefined as any;\n      this.validateSession = undefined as any;\n      this.getSessionIdFromRequest = undefined as any;\n    }\n    if (!providers.some(isUserProvider)) {\n      this.getCurrentUser = undefined as any;\n      this.getUser = undefined as any;\n      this.getUsers = undefined as any;\n    }\n    // Proxy credentials provider methods if any inner provider supports them.\n    const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is IMastraAuthProvider) as any;\n    if (credProvider) {\n      (this as any).signIn = credProvider.signIn.bind(credProvider);\n      if (typeof credProvider.signUp === 'function') {\n        (this as any).signUp = credProvider.signUp.bind(credProvider);\n      }\n      if (typeof credProvider.requestPasswordReset === 'function') {\n        (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n      }\n      if (typeof credProvider.resetPassword === 'function') {\n        (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n      }\n      (this as any).isSignUpEnabled =\n        typeof credProvider.isSignUpEnabled === 'function'\n          ? credProvider.isSignUpEnabled.bind(credProvider)\n          : () => true;\n    } else {\n      (this as any).signIn = undefined;\n      (this as any).signUp = undefined;\n      (this as any).requestPasswordReset = undefined;\n      (this as any).resetPassword = undefined;\n      (this as any).isSignUpEnabled = undefined;\n    }\n  }\n\n  // Find first provider implementing an interface\n  private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n    return this.providers.find(check) as T | undefined;\n  }\n\n  private rememberAuthenticatedProvider(user: unknown, provider: IMastraAuthProvider): void {\n    if (isObjectLike(user)) {\n      this.authenticatedProviderByObject.set(user, provider);\n      return;\n    }\n\n    this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n  }\n\n  private takeAuthenticatedProvider(user: unknown): IMastraAuthProvider | undefined {\n    if (isObjectLike(user)) {\n      const provider = this.authenticatedProviderByObject.get(user);\n      this.authenticatedProviderByObject.delete(user);\n      return provider;\n    }\n\n    const primitiveUser = user as PrimitiveAuthUser;\n    const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n    this.authenticatedProviderByPrimitive.delete(primitiveUser);\n    return provider;\n  }\n\n  private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n    const provider = this.takeAuthenticatedProvider(user);\n    return provider?.mapUserToResourceId?.(user);\n  }\n\n  // ============================================================================\n  // License Exemption Markers\n  // Expose these if any underlying provider has them\n  // ============================================================================\n\n  /**\n   * True if any provider is MastraCloudAuth (exempt from license requirement).\n   */\n  get isMastraCloudAuth(): boolean {\n    return this.providers.some(\n      p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n    );\n  }\n\n  /**\n   * True if any provider is SimpleAuth (exempt from license requirement).\n   */\n  get isSimpleAuth(): boolean {\n    return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n    for (const provider of this.providers) {\n      try {\n        const user = await provider.authenticateToken(token, request);\n        if (user) {\n          this.rememberAuthenticatedProvider(user, provider);\n          return user;\n        }\n      } catch {\n        // ignore error, try next provider\n      }\n    }\n    return null;\n  }\n\n  async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n    for (const provider of this.providers) {\n      const authorized = await provider.authorizeUser(user, request);\n      if (authorized) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  // ============================================================================\n  // ISSOProvider Implementation\n  // ============================================================================\n\n  /**\n   * Forward cookie header to SSO provider for PKCE validation.\n   * Called by auth handler before handleCallback().\n   */\n  setCallbackCookieHeader(cookieHeader: string | null): void {\n    const sso = this.findProvider(isSSOProvider);\n    if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n      (sso as any).setCallbackCookieHeader(cookieHeader);\n    }\n  }\n\n  getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.getLoginUrl(redirectUri, state);\n  }\n\n  getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n    const sso = this.findProvider(isSSOProvider);\n    return sso?.getLoginCookies?.(redirectUri, state);\n  }\n\n  async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n  }\n\n  getLoginButtonConfig(): SSOLoginConfig {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) return { provider: 'unknown', text: 'Sign in' };\n    return sso.getLoginButtonConfig();\n  }\n\n  async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n    // Try each SSO provider until one returns a logout URL\n    for (const provider of this.providers) {\n      if (isSSOProvider(provider) && provider.getLogoutUrl) {\n        try {\n          const url = await provider.getLogoutUrl(redirectUri, request);\n          if (url) return url;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // ISessionProvider Implementation\n  // ============================================================================\n\n  async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n    const session = this.findProvider(isSessionProvider);\n    if (!session) throw new Error('No session provider configured in CompositeAuth');\n    return session.createSession(userId, metadata);\n  }\n\n  async validateSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one validates\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.validateSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async destroySession(sessionId: string): Promise<void> {\n    // Destroy session on ALL providers (user may have sessions in multiple stores)\n    const destroyPromises: Promise<void>[] = [];\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        destroyPromises.push(\n          provider.destroySession(sessionId).catch(() => {\n            // Ignore errors, session may not exist in this provider\n          }),\n        );\n      }\n    }\n    await Promise.all(destroyPromises);\n  }\n\n  async refreshSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one refreshes\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.refreshSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionIdFromRequest(request: Request): string | null {\n    // Try each session provider until one finds a session ID\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const sessionId = provider.getSessionIdFromRequest(request);\n          if (sessionId) return sessionId;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionHeaders(session: Session): Record<string, string> {\n    // Intentionally uses only the first session provider: a session is created by one\n    // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n    // no stale cookies remain.\n    const sessionProvider = this.findProvider(isSessionProvider);\n    return sessionProvider?.getSessionHeaders(session) ?? {};\n  }\n\n  getClearSessionHeaders(): Record<string, string> {\n    // Merge clear headers from ALL providers to ensure no stale session cookies remain\n    const headers: Record<string, string> = {};\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const providerHeaders = provider.getClearSessionHeaders();\n          Object.assign(headers, providerHeaders);\n        } catch {\n          // Ignore errors\n        }\n      }\n    }\n    return headers;\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // Try each provider until one returns a user (like authenticateToken)\n  // ============================================================================\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getCurrentUser(request);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUser(userId: string): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getUser(userId);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<User | null>> {\n    return Promise.all(userIds.map(userId => this.getUser(userId)));\n  }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n  /**\n   * Valid tokens to authenticate against\n   */\n  tokens: TokenToUser<TUser>;\n  /**\n   * Headers to check for authentication\n   * @default ['Authorization', 'X-Playground-Access']\n   */\n  headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n  /**\n   * Marker to exempt SimpleAuth from EE license requirement.\n   * SimpleAuth is for development/testing and should work without a license.\n   */\n  readonly isSimpleAuth = true;\n\n  private tokens: TokenToUser<TUser>;\n  private headers: string[];\n  private users: TUser[];\n  private userById: Map<string, TUser>;\n\n  constructor(options: SimpleAuthOptions<TUser>) {\n    super(options);\n    this.tokens = options.tokens;\n    this.users = Object.values(this.tokens);\n    this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n    this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n  }\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n    const requestTokens = this.getTokensFromHeaders(token, request);\n\n    for (const requestToken of requestTokens) {\n      const tokenToUser = this.tokens[requestToken];\n      if (tokenToUser) {\n        return tokenToUser;\n      }\n    }\n\n    return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n  }\n\n  async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n    return this.users.includes(user);\n  }\n\n  /** Get current user from request headers or cookie. */\n  async getCurrentUser(request: Request): Promise<TUser | null> {\n    // Check headers first\n    for (const headerName of this.headers) {\n      const headerValue = request.headers.get(headerName);\n      if (headerValue) {\n        const token = this.stripBearerPrefix(headerValue);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n\n    return this.getUserFromCookie(request.headers.get('Cookie'));\n  }\n\n  private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n    if (!cookieHeader) return null;\n\n    const cookies = cookieHeader.split(';').map(c => c.trim());\n    for (const cookie of cookies) {\n      if (cookie.startsWith('mastra-token=')) {\n        const token = cookie.slice('mastra-token='.length);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Get user by ID. */\n  async getUser(userId: string): Promise<TUser | null> {\n    return this.userById.get(userId) ?? null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n    return userIds.map(userId => this.userById.get(userId) ?? null);\n  }\n\n  /**\n   * Sign in with token (passed as password field).\n   * The email field is ignored - only the token matters.\n   */\n  async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n    const token = password;\n    const user = this.tokens[token];\n\n    if (!user) {\n      throw new Error('Invalid token');\n    }\n\n    // Set cookie so the token persists across requests\n    const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n    return {\n      user,\n      token,\n      cookies: [cookie],\n    };\n  }\n\n  async signUp(): Promise<CredentialsResult<TUser>> {\n    throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n  }\n\n  isSignUpEnabled(): boolean {\n    return false;\n  }\n\n  /**\n   * Get headers to clear the session cookie on logout.\n   * Partial ISessionProvider implementation for logout support.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    return {\n      'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    };\n  }\n\n  private stripBearerPrefix(token: string): string {\n    return token.startsWith('Bearer ') ? token.slice(7) : token;\n  }\n\n  private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n    const tokens = [token];\n    for (const headerName of this.headers) {\n      const headerValue = getRequestHeader(request, headerName);\n      if (headerValue) {\n        tokens.push(this.stripBearerPrefix(headerValue));\n      }\n    }\n    return tokens;\n  }\n}\n","import type { User, IUserProvider } from '@internal/auth';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\n\nimport jwt from 'jsonwebtoken';\n\ntype JwtUser = jwt.JwtPayload;\n\ninterface MastraJwtAuthOptions extends MastraAuthProviderOptions<JwtUser> {\n  secret?: string;\n  mapUser?: (payload: JwtUser) => User | null;\n}\n\nfunction str(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction defaultMapUser(payload: JwtUser): User | null {\n  const id = str(payload.sub) || str(payload.id);\n  if (!id) {\n    return null;\n  }\n  return {\n    id,\n    email: str(payload.email),\n    name: str(payload.name),\n    avatarUrl: str(payload.avatarUrl) || str(payload.avatar_url) || str(payload.picture),\n  };\n}\n\nexport class MastraJwtAuth extends MastraAuthProvider<JwtUser> implements IUserProvider {\n  protected secret: string;\n  private mapUser: (payload: JwtUser) => User | null;\n\n  constructor(options?: MastraJwtAuthOptions) {\n    super({ name: options?.name ?? 'jwt' });\n\n    this.secret = options?.secret ?? process.env.JWT_AUTH_SECRET ?? '';\n\n    if (!this.secret) {\n      throw new Error('JWT auth secret is required');\n    }\n\n    this.mapUser = options?.mapUser ?? defaultMapUser;\n    this.registerOptions(options);\n  }\n\n  async authenticateToken(token: string): Promise<JwtUser> {\n    return jwt.verify(token, this.secret) as JwtUser;\n  }\n\n  async authorizeUser(user: JwtUser) {\n    return !!user;\n  }\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    const authHeader = request.headers.get('authorization');\n    const token = authHeader?.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null;\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      const allowed = await this.authorizeUser(payload);\n      if (!allowed) return null;\n      return this.mapUser(payload);\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(_userId: string): Promise<User | null> {\n    return null;\n  }\n}\n"]}

dist/index.d.ts

 export * from './utils.js';
 export * from './jwt.js';
+export type { IMastraAuthProvider } from './_types/@internal_auth/dist/provider/index.d.ts';
 //# sourceMappingURL=index.d.ts.map

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

dist/index.js

@@ -181,3 +181,3 @@ import jwt from 'jsonwebtoken';
 
-// ../_internals/auth/dist/chunk-XG6GH2VJ.js
+// ../_internals/auth/dist/chunk-7GLKLOU3.js
 var MastraAuthProvider = class extends MastraBase {
@@ -184,0 +184,0 @@ protected;

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"sources":["../src/utils.ts","../../_internal-core/src/logger/index.ts","../../_internal-core/src/base/MastraBase.ts","../../_internals/auth/src/provider/index.ts","../src/jwt.ts"],"names":["jwt"],"mappings":";;;;AAKA,eAAsB,YAAY,WAAA,EAAqB;AACrD,EAAA,MAAM,UAAU,GAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAC1D,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAO,OAAA,CAAQ,YAAY,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,uBAAuB,CAAA;AACpG,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,KAAK,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAChE,EAAA,OAAO,QAAQ,OAAA,CAAQ,GAAA;AACzB;AAEA,eAAsB,UAAA,CAAW,aAAqB,MAAA,EAAgB;AACpE,EAAA,MAAM,UAAU,GAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,OAAO,GAAA,CAAI,MAAA,CAAO,WAAA,EAAa,MAAM,CAAA;AACvC;AAEA,eAAsB,UAAA,CAAW,aAAqB,OAAA,EAAiB;AACrE,EAAA,MAAM,UAAU,GAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,EAAE,OAAA,EAAS,CAAA;AACrC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,OAAO,GAAG,CAAA;AACzD,EAAA,MAAM,UAAA,GAAa,IAAI,YAAA,EAAa;AACpC,EAAA,OAAO,GAAA,CAAI,MAAA,CAAO,WAAA,EAAa,UAAU,CAAA;AAC3C;;;AChCO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACtBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAW;AACpE,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;AC9DA,SAAS,IAAI,KAAA,EAAoC;AAC/C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,eAAe,OAAA,EAA+B;AACrD,EAAA,MAAM,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,IAAK,GAAA,CAAI,QAAQ,EAAE,CAAA;AAC7C,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,KAAA,EAAO,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxB,IAAA,EAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,IACtB,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,OAAO;AAAA,GACrF;AACF;AAEO,IAAM,aAAA,GAAN,cAA4B,kBAAA,CAAqD;AAAA,EAC5E,MAAA;AAAA,EACF,OAAA;AAAA,EAER,YAAY,OAAA,EAAgC;AAC1C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,OAAO,CAAA;AAEtC,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,IAAI,eAAA,IAAmB,EAAA;AAEhE,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,SAAS,OAAA,IAAW,cAAA;AACnC,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,kBAAkB,KAAA,EAAiC;AACvD,IAAA,OAAOA,GAAAA,CAAI,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,IAAA,EAAe;AACjC,IAAA,OAAO,CAAC,CAAC,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,eAAe,OAAA,EAAwC;AAC3D,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,MAAM,KAAA,GAAQ,UAAA,EAAY,WAAA,EAAY,CAAE,UAAA,CAAW,SAAS,CAAA,GAAI,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAC7F,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAChD,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,OAAO,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAA,EAAuC;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["import jwt from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\nexport type JwtPayload = jwt.JwtPayload;\n\nexport async function decodeToken(accessToken: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n  return decoded;\n}\n\nexport function getTokenIssuer(decoded: jwt.JwtPayload | null) {\n  if (!decoded) throw new Error('Invalid token');\n  if (!decoded.payload || typeof decoded.payload !== 'object') throw new Error('Invalid token payload');\n  if (!decoded.payload.iss) throw new Error('Invalid token header');\n  return decoded.payload.iss;\n}\n\nexport async function verifyHmac(accessToken: string, secret: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  return jwt.verify(accessToken, secret) as jwt.JwtPayload;\n}\n\nexport async function verifyJwks(accessToken: string, jwksUri: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  const client = jwksClient({ jwksUri });\n  const key = await client.getSigningKey(decoded.header.kid);\n  const signingKey = key.getPublicKey();\n  return jwt.verify(accessToken, signingKey) as jwt.JwtPayload;\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n  AGENT: 'AGENT',\n  OBSERVABILITY: 'OBSERVABILITY',\n  AUTH: 'AUTH',\n  BROWSER: 'BROWSER',\n  NETWORK: 'NETWORK',\n  WORKFLOW: 'WORKFLOW',\n  LLM: 'LLM',\n  TTS: 'TTS',\n  VOICE: 'VOICE',\n  VECTOR: 'VECTOR',\n  BUNDLER: 'BUNDLER',\n  DEPLOYER: 'DEPLOYER',\n  MEMORY: 'MEMORY',\n  STORAGE: 'STORAGE',\n  EMBEDDINGS: 'EMBEDDINGS',\n  MCP_SERVER: 'MCP_SERVER',\n  SERVER_CACHE: 'SERVER_CACHE',\n  SERVER: 'SERVER',\n  WORKSPACE: 'WORKSPACE',\n  CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n  DEBUG: 'debug',\n  INFO: 'info',\n  WARN: 'warn',\n  ERROR: 'error',\n  NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n  runId?: string;\n  msg: string;\n  level: LogLevel;\n  time: Date;\n  pid: number;\n  hostname: string;\n  name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n  constructor(opts: any = {}) {\n    super({ ...opts, objectMode: true });\n  }\n\n  async listLogsByRunId(_args: {\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogs(_args?: {\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    returnPaginationResults?: boolean;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n}\n\nexport const createCustomTransport = (\n  stream: Transform,\n  listLogs?: LoggerTransport['listLogs'],\n  listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n  let transport = stream as LoggerTransport;\n  if (listLogs) {\n    transport.listLogs = listLogs;\n  }\n  if (listLogsByRunId) {\n    transport.listLogsByRunId = listLogsByRunId;\n  }\n  return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n  debug(message: string, ...args: any[]): void;\n  info(message: string, ...args: any[]): void;\n  warn(message: string, ...args: any[]): void;\n  error(message: string, ...args: any[]): void;\n  trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n  getTransports(): Map<string, LoggerTransport>;\n  listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n  listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n  protected name: string;\n  protected level: LogLevel;\n  protected transports: Map<string, LoggerTransport>;\n\n  constructor(\n    options: {\n      name?: string;\n      level?: LogLevel;\n      transports?: Record<string, LoggerTransport>;\n    } = {},\n  ) {\n    this.name = options.name || 'Mastra';\n    this.level = options.level || LogLevel.ERROR;\n    this.transports = new Map(Object.entries(options.transports || {}));\n  }\n\n  abstract debug(message: string, ...args: any[]): void;\n  abstract info(message: string, ...args: any[]): void;\n  abstract warn(message: string, ...args: any[]): void;\n  abstract error(message: string, ...args: any[]): void;\n\n  getTransports() {\n    return this.transports;\n  }\n\n  trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n  async listLogs(\n    transportId: string,\n    params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    if (!transportId || !this.transports.has(transportId)) {\n      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports.get(transportId)!.listLogs?.(params) ?? {\n        logs: [],\n        total: 0,\n        page: params?.page ?? 1,\n        perPage: params?.perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n\n  async listLogsByRunId({\n    transportId,\n    runId,\n    fromDate,\n    toDate,\n    logLevel,\n    filters,\n    page,\n    perPage,\n  }: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    if (!transportId || !this.transports.has(transportId) || !runId) {\n      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports\n        .get(transportId)!\n        .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n        logs: [],\n        total: 0,\n        page: page ?? 1,\n        perPage: perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n}\n\nexport type LogFilterContext = {\n  component?: RegisteredLogger;\n  level: LogLevel;\n  message: string;\n  args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n  name?: string;\n  level?: LogLevel;\n  component?: RegisteredLogger;\n  filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n  protected component?: RegisteredLogger;\n  protected filter?: LogFilter;\n\n  constructor(options: ConsoleLoggerOptions = {}) {\n    super(options);\n    this.component = options.component;\n    this.filter = options.filter;\n  }\n\n  child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n    const component =\n      typeof componentOrBindings === 'string'\n        ? componentOrBindings\n        : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n    return new ConsoleLogger({\n      name: this.name,\n      level: this.level,\n      component,\n      filter: this.filter,\n    });\n  }\n\n  private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n    if (!this.filter) return true;\n    try {\n      return this.filter({ component: this.component, level, message, args });\n    } catch (e) {\n      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n      return true;\n    }\n  }\n\n  private prefix(): string {\n    return this.component ? `[${this.component}] ` : '';\n  }\n\n  debug(message: string, ...args: any[]): void {\n    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  info(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.INFO, message, args)\n    ) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  warn(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.WARN, message, args)\n    ) {\n      console.warn(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  error(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.ERROR ||\n        this.level === LogLevel.WARN ||\n        this.level === LogLevel.INFO ||\n        this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.ERROR, message, args)\n    ) {\n      console.error(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  async listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n  }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n  component: RegisteredLogger = RegisteredLogger.LLM;\n  protected logger: IMastraLogger;\n  name?: string;\n  #rawConfig?: Record<string, unknown>;\n\n  constructor({\n    component,\n    name,\n    rawConfig,\n  }: {\n    component?: RegisteredLogger;\n    name?: string;\n    rawConfig?: Record<string, unknown>;\n  }) {\n    this.component = component || RegisteredLogger.LLM;\n    this.name = name;\n    this.#rawConfig = rawConfig;\n    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n  }\n\n  /**\n   * Returns the raw storage configuration this primitive was created from,\n   * or undefined if it was created from code.\n   */\n  toRawConfig(): Record<string, unknown> | undefined {\n    return this.#rawConfig;\n  }\n\n  /**\n   * Sets the raw storage configuration for this primitive.\n   * @internal\n   */\n  __setRawConfig(rawConfig: Record<string, unknown>): void {\n    this.#rawConfig = rawConfig;\n  }\n\n  /**\n   * Set the logger for the agent\n   * @param logger\n   */\n  __setLogger(logger: IMastraLogger) {\n    this.logger =\n      'child' in logger && typeof (logger as any).child === 'function'\n        ? (logger as any).child({ component: this.component })\n        : logger;\n  }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n  CredentialsResult,\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n  User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n  name?: string;\n  authorizeUser?: AuthorizeUserFn<TUser>;\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {\n  public protected?: MastraAuthConfig['protected'];\n  public public?: MastraAuthConfig['public'];\n  public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n  constructor(options?: MastraAuthProviderOptions<TUser>) {\n    super({ component: 'AUTH', name: options?.name });\n\n    if (options?.authorizeUser) {\n      this.authorizeUser = options.authorizeUser.bind(this);\n    }\n\n    this.protected = options?.protected;\n    this.public = options?.public;\n    this.mapUserToResourceId = options?.mapUserToResourceId;\n  }\n\n  /**\n   * Authenticate a token and return the payload\n   * @param token - The token to authenticate\n   * @param request - The request\n   * @returns The payload\n   */\n  abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n  /**\n   * Authorize a user for a path and method\n   * @param user - The user to authorize\n   * @param request - The request\n   * @returns The authorization result\n   */\n  abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n  protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n    if (opts?.authorizeUser) {\n      this.authorizeUser = opts.authorizeUser.bind(this);\n    }\n    if (opts?.mapUserToResourceId) {\n      this.mapUserToResourceId = opts.mapUserToResourceId;\n    }\n    if (opts?.protected) {\n      this.protected = opts.protected;\n    }\n    if (opts?.public) {\n      this.public = opts.public;\n    }\n  }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).getLoginUrl === 'function' &&\n    typeof (p as any).handleCallback === 'function'\n  );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).validateSession === 'function' &&\n    typeof (p as any).createSession === 'function'\n  );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n  return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n  return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n  extends MastraAuthProvider\n  implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n  private providers: MastraAuthProvider[];\n  private authenticatedProviderByObject = new WeakMap<object, MastraAuthProvider>();\n  private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, MastraAuthProvider>();\n\n  constructor(providers: MastraAuthProvider[]) {\n    const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n    const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n    super({\n      public: combinedPublic,\n      protected: combinedProtected,\n    });\n\n    this.providers = providers;\n    if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n      this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n    }\n\n    // Null out interface methods when no inner provider supports them.\n    // This ensures duck-typing checks (typeof auth.method === 'function')\n    // accurately reflect the composite's actual capabilities — preventing\n    // Studio from showing login options that no provider can handle.\n    if (!providers.some(isSSOProvider)) {\n      this.getLoginUrl = undefined as any;\n      this.handleCallback = undefined as any;\n      this.getLoginButtonConfig = undefined as any;\n    }\n    if (!providers.some(isSessionProvider)) {\n      this.createSession = undefined as any;\n      this.validateSession = undefined as any;\n      this.getSessionIdFromRequest = undefined as any;\n    }\n    if (!providers.some(isUserProvider)) {\n      this.getCurrentUser = undefined as any;\n      this.getUser = undefined as any;\n      this.getUsers = undefined as any;\n    }\n    // Proxy credentials provider methods if any inner provider supports them.\n    const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is MastraAuthProvider) as any;\n    if (credProvider) {\n      (this as any).signIn = credProvider.signIn.bind(credProvider);\n      if (typeof credProvider.signUp === 'function') {\n        (this as any).signUp = credProvider.signUp.bind(credProvider);\n      }\n      if (typeof credProvider.requestPasswordReset === 'function') {\n        (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n      }\n      if (typeof credProvider.resetPassword === 'function') {\n        (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n      }\n      (this as any).isSignUpEnabled =\n        typeof credProvider.isSignUpEnabled === 'function'\n          ? credProvider.isSignUpEnabled.bind(credProvider)\n          : () => true;\n    } else {\n      (this as any).signIn = undefined;\n      (this as any).signUp = undefined;\n      (this as any).requestPasswordReset = undefined;\n      (this as any).resetPassword = undefined;\n      (this as any).isSignUpEnabled = undefined;\n    }\n  }\n\n  // Find first provider implementing an interface\n  private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n    return this.providers.find(check) as T | undefined;\n  }\n\n  private rememberAuthenticatedProvider(user: unknown, provider: MastraAuthProvider): void {\n    if (isObjectLike(user)) {\n      this.authenticatedProviderByObject.set(user, provider);\n      return;\n    }\n\n    this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n  }\n\n  private takeAuthenticatedProvider(user: unknown): MastraAuthProvider | undefined {\n    if (isObjectLike(user)) {\n      const provider = this.authenticatedProviderByObject.get(user);\n      this.authenticatedProviderByObject.delete(user);\n      return provider;\n    }\n\n    const primitiveUser = user as PrimitiveAuthUser;\n    const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n    this.authenticatedProviderByPrimitive.delete(primitiveUser);\n    return provider;\n  }\n\n  private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n    const provider = this.takeAuthenticatedProvider(user);\n    return provider?.mapUserToResourceId?.(user);\n  }\n\n  // ============================================================================\n  // License Exemption Markers\n  // Expose these if any underlying provider has them\n  // ============================================================================\n\n  /**\n   * True if any provider is MastraCloudAuth (exempt from license requirement).\n   */\n  get isMastraCloudAuth(): boolean {\n    return this.providers.some(\n      p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n    );\n  }\n\n  /**\n   * True if any provider is SimpleAuth (exempt from license requirement).\n   */\n  get isSimpleAuth(): boolean {\n    return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n    for (const provider of this.providers) {\n      try {\n        const user = await provider.authenticateToken(token, request);\n        if (user) {\n          this.rememberAuthenticatedProvider(user, provider);\n          return user;\n        }\n      } catch {\n        // ignore error, try next provider\n      }\n    }\n    return null;\n  }\n\n  async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n    for (const provider of this.providers) {\n      const authorized = await provider.authorizeUser(user, request);\n      if (authorized) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  // ============================================================================\n  // ISSOProvider Implementation\n  // ============================================================================\n\n  /**\n   * Forward cookie header to SSO provider for PKCE validation.\n   * Called by auth handler before handleCallback().\n   */\n  setCallbackCookieHeader(cookieHeader: string | null): void {\n    const sso = this.findProvider(isSSOProvider);\n    if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n      (sso as any).setCallbackCookieHeader(cookieHeader);\n    }\n  }\n\n  getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.getLoginUrl(redirectUri, state);\n  }\n\n  getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n    const sso = this.findProvider(isSSOProvider);\n    return sso?.getLoginCookies?.(redirectUri, state);\n  }\n\n  async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n  }\n\n  getLoginButtonConfig(): SSOLoginConfig {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) return { provider: 'unknown', text: 'Sign in' };\n    return sso.getLoginButtonConfig();\n  }\n\n  async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n    // Try each SSO provider until one returns a logout URL\n    for (const provider of this.providers) {\n      if (isSSOProvider(provider) && provider.getLogoutUrl) {\n        try {\n          const url = await provider.getLogoutUrl(redirectUri, request);\n          if (url) return url;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // ISessionProvider Implementation\n  // ============================================================================\n\n  async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n    const session = this.findProvider(isSessionProvider);\n    if (!session) throw new Error('No session provider configured in CompositeAuth');\n    return session.createSession(userId, metadata);\n  }\n\n  async validateSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one validates\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.validateSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async destroySession(sessionId: string): Promise<void> {\n    // Destroy session on ALL providers (user may have sessions in multiple stores)\n    const destroyPromises: Promise<void>[] = [];\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        destroyPromises.push(\n          provider.destroySession(sessionId).catch(() => {\n            // Ignore errors, session may not exist in this provider\n          }),\n        );\n      }\n    }\n    await Promise.all(destroyPromises);\n  }\n\n  async refreshSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one refreshes\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.refreshSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionIdFromRequest(request: Request): string | null {\n    // Try each session provider until one finds a session ID\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const sessionId = provider.getSessionIdFromRequest(request);\n          if (sessionId) return sessionId;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionHeaders(session: Session): Record<string, string> {\n    // Intentionally uses only the first session provider: a session is created by one\n    // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n    // no stale cookies remain.\n    const sessionProvider = this.findProvider(isSessionProvider);\n    return sessionProvider?.getSessionHeaders(session) ?? {};\n  }\n\n  getClearSessionHeaders(): Record<string, string> {\n    // Merge clear headers from ALL providers to ensure no stale session cookies remain\n    const headers: Record<string, string> = {};\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const providerHeaders = provider.getClearSessionHeaders();\n          Object.assign(headers, providerHeaders);\n        } catch {\n          // Ignore errors\n        }\n      }\n    }\n    return headers;\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // Try each provider until one returns a user (like authenticateToken)\n  // ============================================================================\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getCurrentUser(request);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUser(userId: string): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getUser(userId);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<User | null>> {\n    return Promise.all(userIds.map(userId => this.getUser(userId)));\n  }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n  /**\n   * Valid tokens to authenticate against\n   */\n  tokens: TokenToUser<TUser>;\n  /**\n   * Headers to check for authentication\n   * @default ['Authorization', 'X-Playground-Access']\n   */\n  headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n  /**\n   * Marker to exempt SimpleAuth from EE license requirement.\n   * SimpleAuth is for development/testing and should work without a license.\n   */\n  readonly isSimpleAuth = true;\n\n  private tokens: TokenToUser<TUser>;\n  private headers: string[];\n  private users: TUser[];\n  private userById: Map<string, TUser>;\n\n  constructor(options: SimpleAuthOptions<TUser>) {\n    super(options);\n    this.tokens = options.tokens;\n    this.users = Object.values(this.tokens);\n    this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n    this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n  }\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n    const requestTokens = this.getTokensFromHeaders(token, request);\n\n    for (const requestToken of requestTokens) {\n      const tokenToUser = this.tokens[requestToken];\n      if (tokenToUser) {\n        return tokenToUser;\n      }\n    }\n\n    return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n  }\n\n  async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n    return this.users.includes(user);\n  }\n\n  /** Get current user from request headers or cookie. */\n  async getCurrentUser(request: Request): Promise<TUser | null> {\n    // Check headers first\n    for (const headerName of this.headers) {\n      const headerValue = request.headers.get(headerName);\n      if (headerValue) {\n        const token = this.stripBearerPrefix(headerValue);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n\n    return this.getUserFromCookie(request.headers.get('Cookie'));\n  }\n\n  private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n    if (!cookieHeader) return null;\n\n    const cookies = cookieHeader.split(';').map(c => c.trim());\n    for (const cookie of cookies) {\n      if (cookie.startsWith('mastra-token=')) {\n        const token = cookie.slice('mastra-token='.length);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Get user by ID. */\n  async getUser(userId: string): Promise<TUser | null> {\n    return this.userById.get(userId) ?? null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n    return userIds.map(userId => this.userById.get(userId) ?? null);\n  }\n\n  /**\n   * Sign in with token (passed as password field).\n   * The email field is ignored - only the token matters.\n   */\n  async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n    const token = password;\n    const user = this.tokens[token];\n\n    if (!user) {\n      throw new Error('Invalid token');\n    }\n\n    // Set cookie so the token persists across requests\n    const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n    return {\n      user,\n      token,\n      cookies: [cookie],\n    };\n  }\n\n  async signUp(): Promise<CredentialsResult<TUser>> {\n    throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n  }\n\n  isSignUpEnabled(): boolean {\n    return false;\n  }\n\n  /**\n   * Get headers to clear the session cookie on logout.\n   * Partial ISessionProvider implementation for logout support.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    return {\n      'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    };\n  }\n\n  private stripBearerPrefix(token: string): string {\n    return token.startsWith('Bearer ') ? token.slice(7) : token;\n  }\n\n  private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n    const tokens = [token];\n    for (const headerName of this.headers) {\n      const headerValue = getRequestHeader(request, headerName);\n      if (headerValue) {\n        tokens.push(this.stripBearerPrefix(headerValue));\n      }\n    }\n    return tokens;\n  }\n}\n","import type { User, IUserProvider } from '@internal/auth';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\n\nimport jwt from 'jsonwebtoken';\n\ntype JwtUser = jwt.JwtPayload;\n\ninterface MastraJwtAuthOptions extends MastraAuthProviderOptions<JwtUser> {\n  secret?: string;\n  mapUser?: (payload: JwtUser) => User | null;\n}\n\nfunction str(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction defaultMapUser(payload: JwtUser): User | null {\n  const id = str(payload.sub) || str(payload.id);\n  if (!id) {\n    return null;\n  }\n  return {\n    id,\n    email: str(payload.email),\n    name: str(payload.name),\n    avatarUrl: str(payload.avatarUrl) || str(payload.avatar_url) || str(payload.picture),\n  };\n}\n\nexport class MastraJwtAuth extends MastraAuthProvider<JwtUser> implements IUserProvider {\n  protected secret: string;\n  private mapUser: (payload: JwtUser) => User | null;\n\n  constructor(options?: MastraJwtAuthOptions) {\n    super({ name: options?.name ?? 'jwt' });\n\n    this.secret = options?.secret ?? process.env.JWT_AUTH_SECRET ?? '';\n\n    if (!this.secret) {\n      throw new Error('JWT auth secret is required');\n    }\n\n    this.mapUser = options?.mapUser ?? defaultMapUser;\n    this.registerOptions(options);\n  }\n\n  async authenticateToken(token: string): Promise<JwtUser> {\n    return jwt.verify(token, this.secret) as JwtUser;\n  }\n\n  async authorizeUser(user: JwtUser) {\n    return !!user;\n  }\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    const authHeader = request.headers.get('authorization');\n    const token = authHeader?.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null;\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      const allowed = await this.authorizeUser(payload);\n      if (!allowed) return null;\n      return this.mapUser(payload);\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(_userId: string): Promise<User | null> {\n    return null;\n  }\n}\n"]}
+{"version":3,"sources":["../src/utils.ts","../../_internal-core/src/logger/index.ts","../../_internal-core/src/base/MastraBase.ts","../../_internals/auth/src/provider/index.ts","../src/jwt.ts"],"names":["jwt"],"mappings":";;;;AAKA,eAAsB,YAAY,WAAA,EAAqB;AACrD,EAAA,MAAM,UAAU,GAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAC1D,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAO,OAAA,CAAQ,YAAY,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,uBAAuB,CAAA;AACpG,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,KAAK,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAChE,EAAA,OAAO,QAAQ,OAAA,CAAQ,GAAA;AACzB;AAEA,eAAsB,UAAA,CAAW,aAAqB,MAAA,EAAgB;AACpE,EAAA,MAAM,UAAU,GAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,OAAO,GAAA,CAAI,MAAA,CAAO,WAAA,EAAa,MAAM,CAAA;AACvC;AAEA,eAAsB,UAAA,CAAW,aAAqB,OAAA,EAAiB;AACrE,EAAA,MAAM,UAAU,GAAA,CAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,MAAM,CAAA;AAE1D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,eAAe,CAAA;AAE7C,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,EAAE,OAAA,EAAS,CAAA;AACrC,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,OAAO,GAAG,CAAA;AACzD,EAAA,MAAM,UAAA,GAAa,IAAI,YAAA,EAAa;AACpC,EAAA,OAAO,GAAA,CAAI,MAAA,CAAO,WAAA,EAAa,UAAU,CAAA;AAC3C;;;AChCO,IAAM,gBAAA,GAAmB;EAO9B,GAAA,EAAK,KAcP,CAAA;AAIO,IAAM,QAAA,GAAW;EACtB,KAAA,EAAO,OAAA;EACP,IAAA,EAAM,MAAA;EACN,IAAA,EAAM,MAAA;EACN,KAAA,EAAO,OAET,CAAA;AAsGO,IAAe,eAAf,MAAqD;AAChD,EAAA,IAAA;AACA,EAAA,KAAA;AACA,EAAA,UAAA;EAEV,WAAA,CACE,OAAA,GAII,EAAA,EACJ;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,IAAA,IAAQ,QAAA;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,QAAA,CAAS,KAAA;AACvC,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,QAAQ,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAC,CAAA;AACpE,EAAA;EAOA,aAAA,GAAgB;AACd,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;AAEA,EAAA,cAAA,CAAe,QAAe,SAAA,EAAqC;AAAC,EAAA;EAEpE,MAAM,QAAA,CACJ,aACA,MAAA,EAQA;AACA,IAAA,IAAI,CAAC,WAAA,IAAe,CAAC,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,EAAG;AACrD,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,MAAA,EAAQ,IAAA,IAAQ,GAAG,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClG,IAAA;AAEA,IAAA,OACE,KAAK,UAAA,CAAW,GAAA,CAAI,WAAW,CAAA,CAAG,QAAA,GAAW,MAAM,CAAA,IAAK;AACtD,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,QAAQ,IAAA,IAAQ,CAAA;AACtB,MAAA,OAAA,EAAS,QAAQ,OAAA,IAAW,GAAA;MAC5B,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AAEA,EAAA,MAAM,eAAA,CAAgB;AACpB,IAAA,WAAA;AACA,IAAA,KAAA;AACA,IAAA,QAAA;AACA,IAAA,MAAA;AACA,IAAA,QAAA;AACA,IAAA,OAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAUC;AACD,IAAA,IAAI,CAAC,eAAe,CAAC,IAAA,CAAK,WAAW,GAAA,CAAI,WAAW,CAAA,IAAK,CAAC,KAAA,EAAO;AAC/D,MAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,IAAA,IAAQ,CAAA,EAAG,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAClF,IAAA;AAEA,IAAA,OACE,IAAA,CAAK,UAAA,CACF,GAAA,CAAI,WAAW,EACf,eAAA,GAAkB,EAAE,KAAA,EAAO,QAAA,EAAU,QAAQ,QAAA,EAAU,OAAA,EAAS,IAAA,EAAM,OAAA,EAAS,CAAA,IAAK;AACrF,MAAA,IAAA,EAAM,EAAA;MACN,KAAA,EAAO,CAAA;AACP,MAAA,IAAA,EAAM,IAAA,IAAQ,CAAA;AACd,MAAA,OAAA,EAAS,OAAA,IAAW,GAAA;MACpB,OAAA,EAAS;AAAA,KAAA;AAGf,EAAA;AACF,CAAA;AAkBO,IAAM,aAAA,GAAN,MAAM,cAAA,SAAsB,YAAA,CAAa;AACpC,EAAA,SAAA;AACA,EAAA,MAAA;EAEV,WAAA,CAAY,OAAA,GAAgC,EAAA,EAAI;AAC9C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACxB,EAAA;AAEA,EAAA,KAAA,CAAM,mBAAA,EAAgF;AACpF,IAAA,MAAM,YACJ,OAAO,mBAAA,KAAwB,WAC3B,mBAAA,GACE,mBAAA,EAAqB,aAAkC,IAAA,CAAK,SAAA;AACpE,IAAA,OAAO,IAAI,cAAA,CAAc;AACvB,MAAA,IAAA,EAAM,IAAA,CAAK,IAAA;AACX,MAAA,KAAA,EAAO,IAAA,CAAK,KAAA;AACZ,MAAA,SAAA;AACA,MAAA,MAAA,EAAQ,IAAA,CAAK;KACd,CAAA;AACH,EAAA;EAEQ,SAAA,CAAU,KAAA,EAAiB,SAAiB,IAAA,EAA0B;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,OAAO,IAAA;AACzB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,OAAO,EAAE,SAAA,EAAW,KAAK,SAAA,EAAW,KAAA,EAAO,OAAA,EAAS,IAAA,EAAM,CAAA;AACxE,IAAA,CAAA,CAAA,OAAS,CAAA,EAAG;AACV,MAAA,OAAA,CAAQ,MAAM,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAS,CAAA,OAAA,EAAU,KAAK,KAAK,CAAC,CAAA;AACxF,MAAA,OAAO,IAAA;AACT,IAAA;AACF,EAAA;EAEQ,MAAA,GAAiB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAA,GAAY,CAAA,CAAA,EAAI,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,GAAO,EAAA;AACnD,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,KAAA,IAAS,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAAG;AAClF,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IAAQ,KAAK,KAAA,KAAU,QAAA,CAAS,KAAA,KACzD,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,IAAA,CAAK,YAAoB,IAAA,EAAmB;AAC1C,IAAA,IAAA,CACG,KAAK,KAAA,KAAU,QAAA,CAAS,QAAQ,IAAA,CAAK,KAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,UACzF,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,OAAA,EAAS,IAAI,CAAA,EAC3C;AACA,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACpD,IAAA;AACF,EAAA;AAEA,EAAA,KAAA,CAAM,YAAoB,IAAA,EAAmB;AAC3C,IAAA,IAAA,CACG,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,IACvB,KAAK,KAAA,KAAU,QAAA,CAAS,IAAA,IACxB,IAAA,CAAK,KAAA,KAAU,QAAA,CAAS,QACxB,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,KAC1B,IAAA,CAAK,UAAU,QAAA,CAAS,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA,EAC5C;AACA,MAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,IAAA,CAAK,MAAA,EAAQ,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,GAAG,IAAI,CAAA;AACrD,IAAA;AACF,EAAA;EAEA,MAAM,QAAA,CACJ,cACA,OAAA,EAQA;AACA,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,GAAG,OAAA,EAAS,OAAA,EAAS,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AACpG,EAAA;AAEA,EAAA,MAAM,gBAAgB,KAAA,EASnB;AACD,IAAA,OAAO,EAAE,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,EAAG,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,GAAG,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,GAAA,EAAK,SAAS,KAAA,EAAA;AAC9F,EAAA;AACF,CAAA;;;AClVO,IAAM,aAAN,MAAiB;AACtB,EAAA,SAAA,GAA8B,gBAAA,CAAiB,GAAA;AACrC,EAAA,MAAA;AACV,EAAA,IAAA;AACA,EAAA,UAAA;EAEA,WAAA,CAAY;AACV,IAAA,SAAA;AACA,IAAA,IAAA;AACA,IAAA;GAAA,EAKC;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,aAAa,gBAAA,CAAiB,GAAA;AAC/C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,aAAA,CAAc,EAAE,IAAA,EAAM,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,GAAA,EAAM,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,CAAA;AAC9E,EAAA;;;;;EAMA,WAAA,GAAmD;AACjD,IAAA,OAAO,IAAA,CAAK,UAAA;AACd,EAAA;;;;;AAMA,EAAA,cAAA,CAAe,SAAA,EAA0C;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AACpB,EAAA;;;;;AAMA,EAAA,WAAA,CAAY,MAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,MAAA,GACH,OAAA,IAAW,MAAA,IAAU,OAAQ,OAAe,KAAA,KAAU,UAAA,GACjD,MAAA,CAAe,KAAA,CAAM,EAAE,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,CAAA,GACnD,MAAA;AACR,EAAA;AACF,CAAA;;;ACgBO,IAAe,kBAAA,GAAf,cAA2D,UAAA,CAAiD;AAC1G,EAAA,SAAA;AACA,EAAA,MAAA;AAGP,EAAA,WAAA,CAAY,OAAA,EAA4C;AACtD,IAAA,KAAA,CAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAEhD,IAAA,IAAI,SAAS,aAAA,EAAe;AAC1B,MAAA,IAAA,CAAK,aAAA,GAAgB,OAAA,CAAQ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACtD,IAAA;AAEA,IAAA,IAAA,CAAK,YAAY,OAAA,EAAS,SAAA;AAC1B,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,sBAAsB,OAAA,EAAS,mBAAA;AACtC,EAAA;AAkBU,EAAA,eAAA,CAAgB,IAAA,EAAyC;AACjE,IAAA,IAAI,MAAM,aAAA,EAAe;AACvB,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,IAAA;AACA,IAAA,IAAI,MAAM,mBAAA,EAAqB;AAC7B,MAAA,IAAA,CAAK,sBAAsB,IAAA,CAAK,mBAAA;AAClC,IAAA;AACA,IAAA,IAAI,MAAM,SAAA,EAAW;AACnB,MAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AACxB,IAAA;AACA,IAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,MAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACrB,IAAA;AACF,EAAA;AACF,CAAA;ACpGA,SAAS,IAAI,KAAA,EAAoC;AAC/C,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,MAAA;AAC7C;AAEA,SAAS,eAAe,OAAA,EAA+B;AACrD,EAAA,MAAM,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,IAAK,GAAA,CAAI,QAAQ,EAAE,CAAA;AAC7C,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,KAAA,EAAO,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxB,IAAA,EAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,IACtB,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,OAAO;AAAA,GACrF;AACF;AAEO,IAAM,aAAA,GAAN,cAA4B,kBAAA,CAAqD;AAAA,EAC5E,MAAA;AAAA,EACF,OAAA;AAAA,EAER,YAAY,OAAA,EAAgC;AAC1C,IAAA,KAAA,CAAM,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,IAAQ,OAAO,CAAA;AAEtC,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,IAAI,eAAA,IAAmB,EAAA;AAEhE,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,OAAA,GAAU,SAAS,OAAA,IAAW,cAAA;AACnC,IAAA,IAAA,CAAK,gBAAgB,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,kBAAkB,KAAA,EAAiC;AACvD,IAAA,OAAOA,GAAAA,CAAI,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,cAAc,IAAA,EAAe;AACjC,IAAA,OAAO,CAAC,CAAC,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,eAAe,OAAA,EAAwC;AAC3D,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,IAAA,MAAM,KAAA,GAAQ,UAAA,EAAY,WAAA,EAAY,CAAE,UAAA,CAAW,SAAS,CAAA,GAAI,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK,GAAI,IAAA;AAC7F,IAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AAEnB,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,KAAK,CAAA;AAClD,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAChD,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,OAAO,IAAA,CAAK,QAAQ,OAAO,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAA,EAAuC;AACnD,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["import jwt from 'jsonwebtoken';\nimport jwksClient from 'jwks-rsa';\n\nexport type JwtPayload = jwt.JwtPayload;\n\nexport async function decodeToken(accessToken: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n  return decoded;\n}\n\nexport function getTokenIssuer(decoded: jwt.JwtPayload | null) {\n  if (!decoded) throw new Error('Invalid token');\n  if (!decoded.payload || typeof decoded.payload !== 'object') throw new Error('Invalid token payload');\n  if (!decoded.payload.iss) throw new Error('Invalid token header');\n  return decoded.payload.iss;\n}\n\nexport async function verifyHmac(accessToken: string, secret: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  return jwt.verify(accessToken, secret) as jwt.JwtPayload;\n}\n\nexport async function verifyJwks(accessToken: string, jwksUri: string) {\n  const decoded = jwt.decode(accessToken, { complete: true });\n\n  if (!decoded) throw new Error('Invalid token');\n\n  const client = jwksClient({ jwksUri });\n  const key = await client.getSigningKey(decoded.header.kid);\n  const signingKey = key.getPublicKey();\n  return jwt.verify(accessToken, signingKey) as jwt.JwtPayload;\n}\n","import { Transform } from 'node:stream';\n\nexport const RegisteredLogger = {\n  AGENT: 'AGENT',\n  OBSERVABILITY: 'OBSERVABILITY',\n  AUTH: 'AUTH',\n  BROWSER: 'BROWSER',\n  NETWORK: 'NETWORK',\n  WORKFLOW: 'WORKFLOW',\n  LLM: 'LLM',\n  TTS: 'TTS',\n  VOICE: 'VOICE',\n  VECTOR: 'VECTOR',\n  BUNDLER: 'BUNDLER',\n  DEPLOYER: 'DEPLOYER',\n  MEMORY: 'MEMORY',\n  STORAGE: 'STORAGE',\n  EMBEDDINGS: 'EMBEDDINGS',\n  MCP_SERVER: 'MCP_SERVER',\n  SERVER_CACHE: 'SERVER_CACHE',\n  SERVER: 'SERVER',\n  WORKSPACE: 'WORKSPACE',\n  CHANNEL: 'CHANNEL',\n} as const;\n\nexport type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];\n\nexport const LogLevel = {\n  DEBUG: 'debug',\n  INFO: 'info',\n  WARN: 'warn',\n  ERROR: 'error',\n  NONE: 'silent',\n} as const;\n\nexport type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];\n\nexport interface BaseLogMessage {\n  runId?: string;\n  msg: string;\n  level: LogLevel;\n  time: Date;\n  pid: number;\n  hostname: string;\n  name: string;\n}\n\nexport abstract class LoggerTransport extends Transform {\n  constructor(opts: any = {}) {\n    super({ ...opts, objectMode: true });\n  }\n\n  async listLogsByRunId(_args: {\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogs(_args?: {\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    returnPaginationResults?: boolean;\n    page?: number;\n    perPage?: number;\n  }): Promise<{\n    logs: BaseLogMessage[];\n    total: number;\n    page: number;\n    perPage: number;\n    hasMore: boolean;\n  }> {\n    return { logs: [], total: 0, page: _args?.page ?? 1, perPage: _args?.perPage ?? 100, hasMore: false };\n  }\n}\n\nexport const createCustomTransport = (\n  stream: Transform,\n  listLogs?: LoggerTransport['listLogs'],\n  listLogsByRunId?: LoggerTransport['listLogsByRunId'],\n) => {\n  let transport = stream as LoggerTransport;\n  if (listLogs) {\n    transport.listLogs = listLogs;\n  }\n  if (listLogsByRunId) {\n    transport.listLogsByRunId = listLogsByRunId;\n  }\n  return transport as LoggerTransport;\n};\n\nexport interface IMastraLogger {\n  debug(message: string, ...args: any[]): void;\n  info(message: string, ...args: any[]): void;\n  warn(message: string, ...args: any[]): void;\n  error(message: string, ...args: any[]): void;\n  trackException(error: Error, metadata?: Record<string, unknown>): void;\n\n  getTransports(): Map<string, LoggerTransport>;\n  listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n  listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }): Promise<{ logs: BaseLogMessage[]; total: number; page: number; perPage: number; hasMore: boolean }>;\n}\n\nexport abstract class MastraLogger implements IMastraLogger {\n  protected name: string;\n  protected level: LogLevel;\n  protected transports: Map<string, LoggerTransport>;\n\n  constructor(\n    options: {\n      name?: string;\n      level?: LogLevel;\n      transports?: Record<string, LoggerTransport>;\n    } = {},\n  ) {\n    this.name = options.name || 'Mastra';\n    this.level = options.level || LogLevel.ERROR;\n    this.transports = new Map(Object.entries(options.transports || {}));\n  }\n\n  abstract debug(message: string, ...args: any[]): void;\n  abstract info(message: string, ...args: any[]): void;\n  abstract warn(message: string, ...args: any[]): void;\n  abstract error(message: string, ...args: any[]): void;\n\n  getTransports() {\n    return this.transports;\n  }\n\n  trackException(_error: Error, _metadata?: Record<string, unknown>) {}\n\n  async listLogs(\n    transportId: string,\n    params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    if (!transportId || !this.transports.has(transportId)) {\n      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports.get(transportId)!.listLogs?.(params) ?? {\n        logs: [],\n        total: 0,\n        page: params?.page ?? 1,\n        perPage: params?.perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n\n  async listLogsByRunId({\n    transportId,\n    runId,\n    fromDate,\n    toDate,\n    logLevel,\n    filters,\n    page,\n    perPage,\n  }: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    if (!transportId || !this.transports.has(transportId) || !runId) {\n      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };\n    }\n\n    return (\n      this.transports\n        .get(transportId)!\n        .listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {\n        logs: [],\n        total: 0,\n        page: page ?? 1,\n        perPage: perPage ?? 100,\n        hasMore: false,\n      }\n    );\n  }\n}\n\nexport type LogFilterContext = {\n  component?: RegisteredLogger;\n  level: LogLevel;\n  message: string;\n  args: unknown[];\n};\n\nexport type LogFilter = (ctx: LogFilterContext) => boolean;\n\nexport interface ConsoleLoggerOptions {\n  name?: string;\n  level?: LogLevel;\n  component?: RegisteredLogger;\n  filter?: LogFilter;\n}\n\nexport class ConsoleLogger extends MastraLogger {\n  protected component?: RegisteredLogger;\n  protected filter?: LogFilter;\n\n  constructor(options: ConsoleLoggerOptions = {}) {\n    super(options);\n    this.component = options.component;\n    this.filter = options.filter;\n  }\n\n  child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger {\n    const component =\n      typeof componentOrBindings === 'string'\n        ? componentOrBindings\n        : ((componentOrBindings?.component as RegisteredLogger) ?? this.component);\n    return new ConsoleLogger({\n      name: this.name,\n      level: this.level,\n      component,\n      filter: this.filter,\n    });\n  }\n\n  private shouldLog(level: LogLevel, message: string, args: unknown[]): boolean {\n    if (!this.filter) return true;\n    try {\n      return this.filter({ component: this.component, level, message, args });\n    } catch (e) {\n      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);\n      return true;\n    }\n  }\n\n  private prefix(): string {\n    return this.component ? `[${this.component}] ` : '';\n  }\n\n  debug(message: string, ...args: any[]): void {\n    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  info(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.INFO, message, args)\n    ) {\n      console.info(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  warn(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.WARN, message, args)\n    ) {\n      console.warn(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  error(message: string, ...args: any[]): void {\n    if (\n      (this.level === LogLevel.ERROR ||\n        this.level === LogLevel.WARN ||\n        this.level === LogLevel.INFO ||\n        this.level === LogLevel.DEBUG) &&\n      this.shouldLog(LogLevel.ERROR, message, args)\n    ) {\n      console.error(`${this.prefix()}${message}`, ...args);\n    }\n  }\n\n  async listLogs(\n    _transportId: string,\n    _params?: {\n      fromDate?: Date;\n      toDate?: Date;\n      logLevel?: LogLevel;\n      filters?: Record<string, any>;\n      page?: number;\n      perPage?: number;\n    },\n  ) {\n    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };\n  }\n\n  async listLogsByRunId(_args: {\n    transportId: string;\n    runId: string;\n    fromDate?: Date;\n    toDate?: Date;\n    logLevel?: LogLevel;\n    filters?: Record<string, any>;\n    page?: number;\n    perPage?: number;\n  }) {\n    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };\n  }\n}\n","import type { IMastraLogger } from '../logger';\nimport { ConsoleLogger, RegisteredLogger } from '../logger';\n\nexport class MastraBase {\n  component: RegisteredLogger = RegisteredLogger.LLM;\n  protected logger: IMastraLogger;\n  name?: string;\n  #rawConfig?: Record<string, unknown>;\n\n  constructor({\n    component,\n    name,\n    rawConfig,\n  }: {\n    component?: RegisteredLogger;\n    name?: string;\n    rawConfig?: Record<string, unknown>;\n  }) {\n    this.component = component || RegisteredLogger.LLM;\n    this.name = name;\n    this.#rawConfig = rawConfig;\n    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });\n  }\n\n  /**\n   * Returns the raw storage configuration this primitive was created from,\n   * or undefined if it was created from code.\n   */\n  toRawConfig(): Record<string, unknown> | undefined {\n    return this.#rawConfig;\n  }\n\n  /**\n   * Sets the raw storage configuration for this primitive.\n   * @internal\n   */\n  __setRawConfig(rawConfig: Record<string, unknown>): void {\n    this.#rawConfig = rawConfig;\n  }\n\n  /**\n   * Set the logger for the agent\n   * @param logger\n   */\n  __setLogger(logger: IMastraLogger) {\n    this.logger =\n      'child' in logger && typeof (logger as any).child === 'function'\n        ? (logger as any).child({ component: this.component })\n        : logger;\n  }\n}\n","import { MastraBase } from '@internal/core/base';\nimport type {\n  CredentialsResult,\n  ISSOProvider,\n  ISessionProvider,\n  IUserProvider,\n  Session,\n  SSOCallbackResult,\n  SSOLoginConfig,\n  User,\n} from '..';\nimport type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types';\nimport { getRequestHeader } from '../types';\n\nexport interface MastraAuthProviderOptions<TUser = unknown> {\n  name?: string;\n  authorizeUser?: AuthorizeUserFn<TUser>;\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n}\n\n/**\n * Structural description of the public surface of a `MastraAuthProvider`.\n *\n * Auth provider packages bundle their own copy of the `MastraAuthProvider`\n * declaration, so provider class types cannot be compared nominally across\n * package boundaries — `#private`/`protected` members would make otherwise\n * identical copies mutually unassignable. Positions that accept user-supplied\n * providers (e.g. `server.auth`, `CompositeAuth`) accept this interface\n * instead of the class.\n *\n * Note: methods intentionally use method syntax (not property syntax) so they\n * are checked bivariantly — providers with a narrower `TUser` must remain\n * assignable to `IMastraAuthProvider<unknown>`.\n */\nexport interface IMastraAuthProvider<TUser = unknown> {\n  name?: string;\n  /**\n   * Protected paths for the auth provider\n   */\n  protected?: MastraAuthConfig['protected'];\n  /**\n   * Public paths for the auth provider\n   */\n  public?: MastraAuthConfig['public'];\n  /**\n   * Authenticate a token and return the payload\n   */\n  authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n  /**\n   * Authorize a user for a path and method\n   */\n  authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n  /**\n   * Map an authenticated user to a memory resource id\n   */\n  mapUserToResourceId?(user: TUser): string | undefined | null;\n}\n\nexport abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {\n  public protected?: MastraAuthConfig['protected'];\n  public public?: MastraAuthConfig['public'];\n  public mapUserToResourceId?(user: TUser): string | undefined | null;\n\n  constructor(options?: MastraAuthProviderOptions<TUser>) {\n    super({ component: 'AUTH', name: options?.name });\n\n    if (options?.authorizeUser) {\n      this.authorizeUser = options.authorizeUser.bind(this);\n    }\n\n    this.protected = options?.protected;\n    this.public = options?.public;\n    this.mapUserToResourceId = options?.mapUserToResourceId;\n  }\n\n  /**\n   * Authenticate a token and return the payload\n   * @param token - The token to authenticate\n   * @param request - The request\n   * @returns The payload\n   */\n  abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;\n\n  /**\n   * Authorize a user for a path and method\n   * @param user - The user to authorize\n   * @param request - The request\n   * @returns The authorization result\n   */\n  abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;\n\n  protected registerOptions(opts?: MastraAuthProviderOptions<TUser>) {\n    if (opts?.authorizeUser) {\n      this.authorizeUser = opts.authorizeUser.bind(this);\n    }\n    if (opts?.mapUserToResourceId) {\n      this.mapUserToResourceId = opts.mapUserToResourceId;\n    }\n    if (opts?.protected) {\n      this.protected = opts.protected;\n    }\n    if (opts?.public) {\n      this.public = opts.public;\n    }\n  }\n}\n\ntype PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | undefined;\n\n// Type guards for interface detection\nfunction isSSOProvider(p: unknown): p is ISSOProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).getLoginUrl === 'function' &&\n    typeof (p as any).handleCallback === 'function'\n  );\n}\n\nfunction isSessionProvider(p: unknown): p is ISessionProvider {\n  return (\n    p !== null &&\n    typeof p === 'object' &&\n    typeof (p as any).validateSession === 'function' &&\n    typeof (p as any).createSession === 'function'\n  );\n}\n\nfunction isUserProvider(p: unknown): p is IUserProvider {\n  return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';\n}\nfunction isCredentialsProvider(p: unknown): boolean {\n  return p !== null && typeof p === 'object' && typeof (p as any).signIn === 'function';\n}\n\nfunction isObjectLike(value: unknown): value is object {\n  return (typeof value === 'object' && value !== null) || typeof value === 'function';\n}\n\nexport class CompositeAuth\n  extends MastraAuthProvider\n  implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User>\n{\n  private providers: IMastraAuthProvider[];\n  private authenticatedProviderByObject = new WeakMap<object, IMastraAuthProvider>();\n  private authenticatedProviderByPrimitive = new Map<PrimitiveAuthUser, IMastraAuthProvider>();\n\n  constructor(providers: IMastraAuthProvider[]) {\n    const combinedPublic = providers.flatMap(provider => provider.public ?? []);\n    const combinedProtected = providers.flatMap(provider => provider.protected ?? []);\n\n    super({\n      public: combinedPublic,\n      protected: combinedProtected,\n    });\n\n    this.providers = providers;\n    if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {\n      this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);\n    }\n\n    // Null out interface methods when no inner provider supports them.\n    // This ensures duck-typing checks (typeof auth.method === 'function')\n    // accurately reflect the composite's actual capabilities — preventing\n    // Studio from showing login options that no provider can handle.\n    if (!providers.some(isSSOProvider)) {\n      this.getLoginUrl = undefined as any;\n      this.handleCallback = undefined as any;\n      this.getLoginButtonConfig = undefined as any;\n    }\n    if (!providers.some(isSessionProvider)) {\n      this.createSession = undefined as any;\n      this.validateSession = undefined as any;\n      this.getSessionIdFromRequest = undefined as any;\n    }\n    if (!providers.some(isUserProvider)) {\n      this.getCurrentUser = undefined as any;\n      this.getUser = undefined as any;\n      this.getUsers = undefined as any;\n    }\n    // Proxy credentials provider methods if any inner provider supports them.\n    const credProvider = this.findProvider(isCredentialsProvider as (p: unknown) => p is IMastraAuthProvider) as any;\n    if (credProvider) {\n      (this as any).signIn = credProvider.signIn.bind(credProvider);\n      if (typeof credProvider.signUp === 'function') {\n        (this as any).signUp = credProvider.signUp.bind(credProvider);\n      }\n      if (typeof credProvider.requestPasswordReset === 'function') {\n        (this as any).requestPasswordReset = credProvider.requestPasswordReset.bind(credProvider);\n      }\n      if (typeof credProvider.resetPassword === 'function') {\n        (this as any).resetPassword = credProvider.resetPassword.bind(credProvider);\n      }\n      (this as any).isSignUpEnabled =\n        typeof credProvider.isSignUpEnabled === 'function'\n          ? credProvider.isSignUpEnabled.bind(credProvider)\n          : () => true;\n    } else {\n      (this as any).signIn = undefined;\n      (this as any).signUp = undefined;\n      (this as any).requestPasswordReset = undefined;\n      (this as any).resetPassword = undefined;\n      (this as any).isSignUpEnabled = undefined;\n    }\n  }\n\n  // Find first provider implementing an interface\n  private findProvider<T>(check: (p: unknown) => p is T): T | undefined {\n    return this.providers.find(check) as T | undefined;\n  }\n\n  private rememberAuthenticatedProvider(user: unknown, provider: IMastraAuthProvider): void {\n    if (isObjectLike(user)) {\n      this.authenticatedProviderByObject.set(user, provider);\n      return;\n    }\n\n    this.authenticatedProviderByPrimitive.set(user as PrimitiveAuthUser, provider);\n  }\n\n  private takeAuthenticatedProvider(user: unknown): IMastraAuthProvider | undefined {\n    if (isObjectLike(user)) {\n      const provider = this.authenticatedProviderByObject.get(user);\n      this.authenticatedProviderByObject.delete(user);\n      return provider;\n    }\n\n    const primitiveUser = user as PrimitiveAuthUser;\n    const provider = this.authenticatedProviderByPrimitive.get(primitiveUser);\n    this.authenticatedProviderByPrimitive.delete(primitiveUser);\n    return provider;\n  }\n\n  private mapAuthenticatedUserToResourceId(user: unknown): string | undefined | null {\n    const provider = this.takeAuthenticatedProvider(user);\n    return provider?.mapUserToResourceId?.(user);\n  }\n\n  // ============================================================================\n  // License Exemption Markers\n  // Expose these if any underlying provider has them\n  // ============================================================================\n\n  /**\n   * True if any provider is MastraCloudAuth (exempt from license requirement).\n   */\n  get isMastraCloudAuth(): boolean {\n    return this.providers.some(\n      p => 'isMastraCloudAuth' in p && (p as { isMastraCloudAuth: boolean }).isMastraCloudAuth === true,\n    );\n  }\n\n  /**\n   * True if any provider is SimpleAuth (exempt from license requirement).\n   */\n  get isSimpleAuth(): boolean {\n    return this.providers.some(p => 'isSimpleAuth' in p && (p as { isSimpleAuth: boolean }).isSimpleAuth === true);\n  }\n\n  // ============================================================================\n  // MastraAuthProvider Implementation\n  // ============================================================================\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null> {\n    for (const provider of this.providers) {\n      try {\n        const user = await provider.authenticateToken(token, request);\n        if (user) {\n          this.rememberAuthenticatedProvider(user, provider);\n          return user;\n        }\n      } catch {\n        // ignore error, try next provider\n      }\n    }\n    return null;\n  }\n\n  async authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean> {\n    for (const provider of this.providers) {\n      const authorized = await provider.authorizeUser(user, request);\n      if (authorized) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  // ============================================================================\n  // ISSOProvider Implementation\n  // ============================================================================\n\n  /**\n   * Forward cookie header to SSO provider for PKCE validation.\n   * Called by auth handler before handleCallback().\n   */\n  setCallbackCookieHeader(cookieHeader: string | null): void {\n    const sso = this.findProvider(isSSOProvider);\n    if (sso && typeof (sso as any).setCallbackCookieHeader === 'function') {\n      (sso as any).setCallbackCookieHeader(cookieHeader);\n    }\n  }\n\n  getLoginUrl(redirectUri: string, state: string): string | Promise<string> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.getLoginUrl(redirectUri, state);\n  }\n\n  getLoginCookies(redirectUri: string, state: string): string[] | undefined {\n    const sso = this.findProvider(isSSOProvider);\n    return sso?.getLoginCookies?.(redirectUri, state);\n  }\n\n  async handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>> {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) throw new Error('No SSO provider configured in CompositeAuth');\n    return sso.handleCallback(code, state) as Promise<SSOCallbackResult<User>>;\n  }\n\n  getLoginButtonConfig(): SSOLoginConfig {\n    const sso = this.findProvider(isSSOProvider);\n    if (!sso) return { provider: 'unknown', text: 'Sign in' };\n    return sso.getLoginButtonConfig();\n  }\n\n  async getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null> {\n    // Try each SSO provider until one returns a logout URL\n    for (const provider of this.providers) {\n      if (isSSOProvider(provider) && provider.getLogoutUrl) {\n        try {\n          const url = await provider.getLogoutUrl(redirectUri, request);\n          if (url) return url;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  // ============================================================================\n  // ISessionProvider Implementation\n  // ============================================================================\n\n  async createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session> {\n    const session = this.findProvider(isSessionProvider);\n    if (!session) throw new Error('No session provider configured in CompositeAuth');\n    return session.createSession(userId, metadata);\n  }\n\n  async validateSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one validates\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.validateSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async destroySession(sessionId: string): Promise<void> {\n    // Destroy session on ALL providers (user may have sessions in multiple stores)\n    const destroyPromises: Promise<void>[] = [];\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        destroyPromises.push(\n          provider.destroySession(sessionId).catch(() => {\n            // Ignore errors, session may not exist in this provider\n          }),\n        );\n      }\n    }\n    await Promise.all(destroyPromises);\n  }\n\n  async refreshSession(sessionId: string): Promise<Session | null> {\n    // Try each session provider until one refreshes\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const session = await provider.refreshSession(sessionId);\n          if (session) return session;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionIdFromRequest(request: Request): string | null {\n    // Try each session provider until one finds a session ID\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const sessionId = provider.getSessionIdFromRequest(request);\n          if (sessionId) return sessionId;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  getSessionHeaders(session: Session): Record<string, string> {\n    // Intentionally uses only the first session provider: a session is created by one\n    // provider, so we only set its cookie. clearSession clears ALL providers to ensure\n    // no stale cookies remain.\n    const sessionProvider = this.findProvider(isSessionProvider);\n    return sessionProvider?.getSessionHeaders(session) ?? {};\n  }\n\n  getClearSessionHeaders(): Record<string, string> {\n    // Merge clear headers from ALL providers to ensure no stale session cookies remain\n    const headers: Record<string, string> = {};\n    for (const provider of this.providers) {\n      if (isSessionProvider(provider)) {\n        try {\n          const providerHeaders = provider.getClearSessionHeaders();\n          Object.assign(headers, providerHeaders);\n        } catch {\n          // Ignore errors\n        }\n      }\n    }\n    return headers;\n  }\n\n  // ============================================================================\n  // IUserProvider Implementation\n  // Try each provider until one returns a user (like authenticateToken)\n  // ============================================================================\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getCurrentUser(request);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUser(userId: string): Promise<User | null> {\n    for (const provider of this.providers) {\n      if (isUserProvider(provider)) {\n        try {\n          const user = await provider.getUser(userId);\n          if (user) return user;\n        } catch {\n          // Try next provider\n        }\n      }\n    }\n    return null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<User | null>> {\n    return Promise.all(userIds.map(userId => this.getUser(userId)));\n  }\n}\n\nconst DEFAULT_HEADERS = ['Authorization', 'X-Playground-Access'];\n\ntype TokenToUser<TUser> = Record<string, TUser>;\n\nexport interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {\n  /**\n   * Valid tokens to authenticate against\n   */\n  tokens: TokenToUser<TUser>;\n  /**\n   * Headers to check for authentication\n   * @default ['Authorization', 'X-Playground-Access']\n   */\n  headers?: string | string[];\n}\n\nexport class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {\n  /**\n   * Marker to exempt SimpleAuth from EE license requirement.\n   * SimpleAuth is for development/testing and should work without a license.\n   */\n  readonly isSimpleAuth = true;\n\n  private tokens: TokenToUser<TUser>;\n  private headers: string[];\n  private users: TUser[];\n  private userById: Map<string, TUser>;\n\n  constructor(options: SimpleAuthOptions<TUser>) {\n    super(options);\n    this.tokens = options.tokens;\n    this.users = Object.values(this.tokens);\n    this.headers = [...DEFAULT_HEADERS].concat(options.headers || []);\n    this.userById = new Map(this.users.map(u => [String((u as any)?.id), u]));\n  }\n\n  async authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null> {\n    const requestTokens = this.getTokensFromHeaders(token, request);\n\n    for (const requestToken of requestTokens) {\n      const tokenToUser = this.tokens[requestToken];\n      if (tokenToUser) {\n        return tokenToUser;\n      }\n    }\n\n    return this.getUserFromCookie(getRequestHeader(request, 'Cookie'));\n  }\n\n  async authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean> {\n    return this.users.includes(user);\n  }\n\n  /** Get current user from request headers or cookie. */\n  async getCurrentUser(request: Request): Promise<TUser | null> {\n    // Check headers first\n    for (const headerName of this.headers) {\n      const headerValue = request.headers.get(headerName);\n      if (headerValue) {\n        const token = this.stripBearerPrefix(headerValue);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n\n    return this.getUserFromCookie(request.headers.get('Cookie'));\n  }\n\n  private getUserFromCookie(cookieHeader: string | null | undefined): TUser | null {\n    if (!cookieHeader) return null;\n\n    const cookies = cookieHeader.split(';').map(c => c.trim());\n    for (const cookie of cookies) {\n      if (cookie.startsWith('mastra-token=')) {\n        const token = cookie.slice('mastra-token='.length);\n        const user = this.tokens[token];\n        if (user) {\n          return user;\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Get user by ID. */\n  async getUser(userId: string): Promise<TUser | null> {\n    return this.userById.get(userId) ?? null;\n  }\n\n  async getUsers(userIds: string[]): Promise<Array<TUser | null>> {\n    return userIds.map(userId => this.userById.get(userId) ?? null);\n  }\n\n  /**\n   * Sign in with token (passed as password field).\n   * The email field is ignored - only the token matters.\n   */\n  async signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>> {\n    const token = password;\n    const user = this.tokens[token];\n\n    if (!user) {\n      throw new Error('Invalid token');\n    }\n\n    // Set cookie so the token persists across requests\n    const cookie = `mastra-token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;\n\n    return {\n      user,\n      token,\n      cookies: [cookie],\n    };\n  }\n\n  async signUp(): Promise<CredentialsResult<TUser>> {\n    throw new Error('Sign up is not supported with SimpleAuth. Use pre-configured tokens.');\n  }\n\n  isSignUpEnabled(): boolean {\n    return false;\n  }\n\n  /**\n   * Get headers to clear the session cookie on logout.\n   * Partial ISessionProvider implementation for logout support.\n   */\n  getClearSessionHeaders(): Record<string, string> {\n    return {\n      'Set-Cookie': 'mastra-token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',\n    };\n  }\n\n  private stripBearerPrefix(token: string): string {\n    return token.startsWith('Bearer ') ? token.slice(7) : token;\n  }\n\n  private getTokensFromHeaders(token: string, request: MastraAuthRequest): string[] {\n    const tokens = [token];\n    for (const headerName of this.headers) {\n      const headerValue = getRequestHeader(request, headerName);\n      if (headerValue) {\n        tokens.push(this.stripBearerPrefix(headerValue));\n      }\n    }\n    return tokens;\n  }\n}\n","import type { User, IUserProvider } from '@internal/auth';\nimport { MastraAuthProvider } from '@internal/auth/provider';\nimport type { MastraAuthProviderOptions } from '@internal/auth/provider';\n\nimport jwt from 'jsonwebtoken';\n\ntype JwtUser = jwt.JwtPayload;\n\ninterface MastraJwtAuthOptions extends MastraAuthProviderOptions<JwtUser> {\n  secret?: string;\n  mapUser?: (payload: JwtUser) => User | null;\n}\n\nfunction str(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction defaultMapUser(payload: JwtUser): User | null {\n  const id = str(payload.sub) || str(payload.id);\n  if (!id) {\n    return null;\n  }\n  return {\n    id,\n    email: str(payload.email),\n    name: str(payload.name),\n    avatarUrl: str(payload.avatarUrl) || str(payload.avatar_url) || str(payload.picture),\n  };\n}\n\nexport class MastraJwtAuth extends MastraAuthProvider<JwtUser> implements IUserProvider {\n  protected secret: string;\n  private mapUser: (payload: JwtUser) => User | null;\n\n  constructor(options?: MastraJwtAuthOptions) {\n    super({ name: options?.name ?? 'jwt' });\n\n    this.secret = options?.secret ?? process.env.JWT_AUTH_SECRET ?? '';\n\n    if (!this.secret) {\n      throw new Error('JWT auth secret is required');\n    }\n\n    this.mapUser = options?.mapUser ?? defaultMapUser;\n    this.registerOptions(options);\n  }\n\n  async authenticateToken(token: string): Promise<JwtUser> {\n    return jwt.verify(token, this.secret) as JwtUser;\n  }\n\n  async authorizeUser(user: JwtUser) {\n    return !!user;\n  }\n\n  async getCurrentUser(request: Request): Promise<User | null> {\n    const authHeader = request.headers.get('authorization');\n    const token = authHeader?.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null;\n    if (!token) return null;\n\n    try {\n      const payload = await this.authenticateToken(token);\n      const allowed = await this.authorizeUser(payload);\n      if (!allowed) return null;\n      return this.mapUser(payload);\n    } catch {\n      return null;\n    }\n  }\n\n  async getUser(_userId: string): Promise<User | null> {\n    return null;\n  }\n}\n"]}

package.json

 {
   "name": "@mastra/auth",
-  "version": "1.1.1",
+  "version": "1.1.2-alpha.0",
   "description": "",
@@ -41,5 +41,5 @@ "type": "module",
     "vitest": "4.1.8",
-    "@internal/auth": "0.0.1",
-    "@internal/lint": "0.0.109",
-    "@internal/types-builder": "0.0.84"
+    "@internal/lint": "0.0.110",
+    "@internal/auth": "0.0.2",
+    "@internal/types-builder": "0.0.85"
   },
@@ -46,0 +46,0 @@ "homepage": "https://mastra.ai",

New alerts

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Improved metrics

Total package byte prevSize

246643

2.8%

Lines of code

3318

1.72%

Worsened metrics

Number of low quality alerts

1

Infinity%

No dependency changes