// src/auth/ee/interfaces/permissions.generated.ts
var RESOURCES = [
  "a2a",
  "agent-builder",
  "agents",
  "background-tasks",
  "channels",
  "datasets",
  "embedders",
  "experiments",
  "logs",
  "mcp",
  "memory",
  "observability",
  "processor-providers",
  "processors",
  "scores",
  "stored",
  "stored-agents",
  "system",
  "tool-providers",
  "tools",
  "vector",
  "vectors",
  "workflows",
  "workspaces"
];
var ACTIONS = ["create", "delete", "execute", "read", "write"];
var PERMISSION_PATTERNS = {
  /** Full access to all resources and actions */
  "*": "*",
  /** create all resources */
  "*:create": "*:create",
  /** Delete all resources */
  "*:delete": "*:delete",
  /** Execute all resources */
  "*:execute": "*:execute",
  /** View all resources */
  "*:read": "*:read",
  /** Create and modify all resources */
  "*:write": "*:write",
  /** Full access to agent-to-agent communication */
  "a2a:*": "a2a:*",
  /** Full access to agent builder */
  "agent-builder:*": "agent-builder:*",
  /** Full access to agents */
  "agents:*": "agents:*",
  /** Full access to background-tasks */
  "background-tasks:*": "background-tasks:*",
  /** Full access to channels */
  "channels:*": "channels:*",
  /** Full access to datasets */
  "datasets:*": "datasets:*",
  /** Full access to embedders */
  "embedders:*": "embedders:*",
  /** Full access to experiments */
  "experiments:*": "experiments:*",
  /** Full access to logs */
  "logs:*": "logs:*",
  /** Full access to MCP servers */
  "mcp:*": "mcp:*",
  /** Full access to memory and threads */
  "memory:*": "memory:*",
  /** Full access to traces and spans */
  "observability:*": "observability:*",
  /** Full access to processor-providers */
  "processor-providers:*": "processor-providers:*",
  /** Full access to processors */
  "processors:*": "processors:*",
  /** Full access to evaluation scores */
  "scores:*": "scores:*",
  /** Full access to stored */
  "stored:*": "stored:*",
  /** Full access to stored agents */
  "stored-agents:*": "stored-agents:*",
  /** Full access to system info */
  "system:*": "system:*",
  /** Full access to tool-providers */
  "tool-providers:*": "tool-providers:*",
  /** Full access to tools */
  "tools:*": "tools:*",
  /** Full access to vector stores */
  "vector:*": "vector:*",
  /** Full access to vectors */
  "vectors:*": "vectors:*",
  /** Full access to workflows */
  "workflows:*": "workflows:*",
  /** Full access to workspaces */
  "workspaces:*": "workspaces:*",
  /** View agent-to-agent communication */
  "a2a:read": "a2a:read",
  /** Create and modify agent-to-agent communication */
  "a2a:write": "a2a:write",
  /** Execute agent builder */
  "agent-builder:execute": "agent-builder:execute",
  /** View agent builder */
  "agent-builder:read": "agent-builder:read",
  /** Create and modify agent builder */
  "agent-builder:write": "agent-builder:write",
  /** create agents */
  "agents:create": "agents:create",
  /** Delete agents */
  "agents:delete": "agents:delete",
  /** Execute agents */
  "agents:execute": "agents:execute",
  /** View agents */
  "agents:read": "agents:read",
  /** Create and modify agents */
  "agents:write": "agents:write",
  /** View background-tasks */
  "background-tasks:read": "background-tasks:read",
  /** View channels */
  "channels:read": "channels:read",
  /** Create and modify channels */
  "channels:write": "channels:write",
  /** Delete datasets */
  "datasets:delete": "datasets:delete",
  /** Execute datasets */
  "datasets:execute": "datasets:execute",
  /** View datasets */
  "datasets:read": "datasets:read",
  /** Create and modify datasets */
  "datasets:write": "datasets:write",
  /** View embedders */
  "embedders:read": "embedders:read",
  /** View experiments */
  "experiments:read": "experiments:read",
  /** View logs */
  "logs:read": "logs:read",
  /** Execute MCP servers */
  "mcp:execute": "mcp:execute",
  /** View MCP servers */
  "mcp:read": "mcp:read",
  /** Create and modify MCP servers */
  "mcp:write": "mcp:write",
  /** Delete memory and threads */
  "memory:delete": "memory:delete",
  /** Execute memory and threads */
  "memory:execute": "memory:execute",
  /** View memory and threads */
  "memory:read": "memory:read",
  /** Create and modify memory and threads */
  "memory:write": "memory:write",
  /** View traces and spans */
  "observability:read": "observability:read",
  /** Create and modify traces and spans */
  "observability:write": "observability:write",
  /** View processor-providers */
  "processor-providers:read": "processor-providers:read",
  /** Execute processors */
  "processors:execute": "processors:execute",
  /** View processors */
  "processors:read": "processors:read",
  /** View evaluation scores */
  "scores:read": "scores:read",
  /** Create and modify evaluation scores */
  "scores:write": "scores:write",
  /** Delete stored agents */
  "stored-agents:delete": "stored-agents:delete",
  /** View stored agents */
  "stored-agents:read": "stored-agents:read",
  /** Create and modify stored agents */
  "stored-agents:write": "stored-agents:write",
  /** Delete stored */
  "stored:delete": "stored:delete",
  /** View stored */
  "stored:read": "stored:read",
  /** Create and modify stored */
  "stored:write": "stored:write",
  /** View system info */
  "system:read": "system:read",
  /** View tool-providers */
  "tool-providers:read": "tool-providers:read",
  /** Execute tools */
  "tools:execute": "tools:execute",
  /** View tools */
  "tools:read": "tools:read",
  /** Delete vector stores */
  "vector:delete": "vector:delete",
  /** Execute vector stores */
  "vector:execute": "vector:execute",
  /** View vector stores */
  "vector:read": "vector:read",
  /** Create and modify vector stores */
  "vector:write": "vector:write",
  /** View vectors */
  "vectors:read": "vectors:read",
  /** Delete workflows */
  "workflows:delete": "workflows:delete",
  /** Execute workflows */
  "workflows:execute": "workflows:execute",
  /** View workflows */
  "workflows:read": "workflows:read",
  /** Create and modify workflows */
  "workflows:write": "workflows:write",
  /** Delete workspaces */
  "workspaces:delete": "workspaces:delete",
  /** View workspaces */
  "workspaces:read": "workspaces:read",
  /** Create and modify workspaces */
  "workspaces:write": "workspaces:write"
};
var PERMISSIONS = [
  "a2a:read",
  "a2a:write",
  "agent-builder:execute",
  "agent-builder:read",
  "agent-builder:write",
  "agents:create",
  "agents:delete",
  "agents:execute",
  "agents:read",
  "agents:write",
  "background-tasks:read",
  "channels:read",
  "channels:write",
  "datasets:delete",
  "datasets:execute",
  "datasets:read",
  "datasets:write",
  "embedders:read",
  "experiments:read",
  "logs:read",
  "mcp:execute",
  "mcp:read",
  "mcp:write",
  "memory:delete",
  "memory:execute",
  "memory:read",
  "memory:write",
  "observability:read",
  "observability:write",
  "processor-providers:read",
  "processors:execute",
  "processors:read",
  "scores:read",
  "scores:write",
  "stored-agents:delete",
  "stored-agents:read",
  "stored-agents:write",
  "stored:delete",
  "stored:read",
  "stored:write",
  "system:read",
  "tool-providers:read",
  "tools:execute",
  "tools:read",
  "vector:delete",
  "vector:execute",
  "vector:read",
  "vector:write",
  "vectors:read",
  "workflows:delete",
  "workflows:execute",
  "workflows:read",
  "workflows:write",
  "workspaces:delete",
  "workspaces:read",
  "workspaces:write"
];
function isValidPermissionPattern(pattern) {
  return pattern in PERMISSION_PATTERNS;
}
function validatePermissions(permissions) {
  return permissions.every(isValidPermissionPattern);
}

// src/auth/ee/license.ts
var cachedLicense = null;
var cacheTimestamp = 0;
var CACHE_TTL = 60 * 1e3;
function validateLicense(licenseKey) {
  const key = licenseKey ?? process.env["MASTRA_EE_LICENSE"];
  if (!key) {
    return { valid: false };
  }
  if (key.length < 32) {
    return { valid: false };
  }
  return {
    valid: true,
    features: ["user", "session", "sso", "rbac", "acl"],
    tier: "enterprise"
  };
}
function isLicenseValid() {
  const now = Date.now();
  if (cachedLicense && now - cacheTimestamp < CACHE_TTL) {
    return cachedLicense.valid;
  }
  cachedLicense = validateLicense();
  cacheTimestamp = now;
  if (!cachedLicense.valid && process.env["MASTRA_EE_LICENSE"]) {
    console.warn("[mastra/auth-ee] Invalid or expired EE license. EE features are disabled.");
  }
  return cachedLicense.valid;
}
var isEELicenseValid = isLicenseValid;
function isFeatureEnabled(feature) {
  if (!isLicenseValid()) {
    return false;
  }
  if (!cachedLicense?.features) {
    return true;
  }
  return cachedLicense.features.includes(feature);
}
function isDevEnvironment() {
  return process.env["MASTRA_DEV"] === "true" || process.env["MASTRA_DEV"] === "1" || process.env["NODE_ENV"] !== "production" && process.env["NODE_ENV"] !== "prod";
}
function isEEEnabled() {
  if (isDevEnvironment()) {
    return true;
  }
  return isLicenseValid();
}

// src/auth/ee/capabilities.ts
function isAuthenticated(caps) {
  return "user" in caps && caps.user !== null;
}
function implementsInterface(auth, method) {
  return auth !== null && typeof auth === "object" && method in auth;
}
function isMastraCloudAuth(auth) {
  if (!auth || typeof auth !== "object") return false;
  return "isMastraCloudAuth" in auth && auth.isMastraCloudAuth === true;
}
function isSimpleAuth(auth) {
  if (!auth || typeof auth !== "object") return false;
  return "isSimpleAuth" in auth && auth.isSimpleAuth === true;
}
async function buildCapabilities(auth, request, options) {
  if (!auth) {
    return { enabled: false, login: null };
  }
  const hasLicense = isLicenseValid();
  const isCloud = isMastraCloudAuth(auth);
  const isSimple = isSimpleAuth(auth);
  const isDev = isDevEnvironment();
  const isLicensedOrCloud = hasLicense || isCloud || isSimple || isDev;
  let login = null;
  const hasSSO = implementsInterface(auth, "getLoginUrl") && isLicensedOrCloud;
  const hasCredentials = implementsInterface(auth, "signIn") && isLicensedOrCloud;
  const raw = (options?.apiPrefix || "/api").trim();
  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
  const prefix = withSlash.endsWith("/") ? withSlash.slice(0, -1) : withSlash;
  const ssoLoginUrl = `${prefix}/auth/sso/login`;
  let signUpEnabled = true;
  if (implementsInterface(auth, "signIn")) {
    const credentialsProvider = auth;
    if (typeof credentialsProvider.isSignUpEnabled === "function") {
      signUpEnabled = credentialsProvider.isSignUpEnabled();
    }
  }
  if (hasSSO && hasCredentials) {
    const ssoConfig = auth.getLoginButtonConfig();
    login = {
      type: "both",
      signUpEnabled,
      description: ssoConfig.description,
      sso: {
        ...ssoConfig,
        url: ssoLoginUrl
      }
    };
  } else if (hasSSO) {
    const ssoConfig = auth.getLoginButtonConfig();
    login = {
      type: "sso",
      description: ssoConfig.description,
      sso: {
        ...ssoConfig,
        url: ssoLoginUrl
      }
    };
  } else if (hasCredentials) {
    login = {
      type: "credentials",
      signUpEnabled
    };
  }
  let user = null;
  if (implementsInterface(auth, "getCurrentUser") && isLicensedOrCloud) {
    try {
      user = await auth.getCurrentUser(request);
    } catch {
      user = null;
    }
  }
  if (!user) {
    return { enabled: true, login };
  }
  const rbacProvider = options?.rbac;
  const hasRBAC = !!rbacProvider && isLicensedOrCloud;
  const capabilities = {
    user: implementsInterface(auth, "getCurrentUser") && isLicensedOrCloud,
    session: implementsInterface(auth, "createSession") && isLicensedOrCloud,
    sso: implementsInterface(auth, "getLoginUrl") && isLicensedOrCloud,
    rbac: hasRBAC,
    acl: implementsInterface(auth, "canAccess") && isLicensedOrCloud
  };
  let access = null;
  if (hasRBAC && rbacProvider) {
    try {
      const roles = await rbacProvider.getRoles(user);
      const permissions = await rbacProvider.getPermissions(user);
      access = { roles, permissions };
    } catch {
      access = null;
    }
  }
  return {
    enabled: true,
    login,
    user: {
      id: user.id,
      email: user.email,
      name: user.name,
      avatarUrl: user.avatarUrl
    },
    capabilities,
    access
  };
}

// src/auth/ee/defaults/roles.ts
var DEFAULT_ROLES = [
  {
    id: "owner",
    name: "Owner",
    description: "Full access to all features and settings",
    permissions: ["*"]
  },
  {
    id: "admin",
    name: "Admin",
    description: "Manage agents, workflows, and team members",
    permissions: [
      "*:read",
      "*:write",
      "*:execute"
      // Note: admins cannot delete resources
    ]
  },
  {
    id: "member",
    name: "Member",
    description: "Execute agents and workflows",
    permissions: ["*:read", "*:execute"]
  },
  {
    id: "viewer",
    name: "Viewer",
    description: "Read-only access",
    permissions: ["*:read"]
  }
];
function getDefaultRole(roleId) {
  return DEFAULT_ROLES.find((role) => role.id === roleId);
}
function resolvePermissions(roleIds, roles = DEFAULT_ROLES) {
  const permissions = /* @__PURE__ */ new Set();
  const visited = /* @__PURE__ */ new Set();
  function resolveRole(roleId) {
    if (visited.has(roleId)) return;
    visited.add(roleId);
    const role = roles.find((r) => r.id === roleId);
    if (!role) return;
    for (const permission of role.permissions) {
      permissions.add(permission);
    }
    if (role.inherits) {
      for (const inheritedRoleId of role.inherits) {
        resolveRole(inheritedRoleId);
      }
    }
  }
  for (const roleId of roleIds) {
    resolveRole(roleId);
  }
  return Array.from(permissions);
}
function matchesPermission(userPermission, requiredPermission) {
  if (userPermission === "*") {
    return true;
  }
  const grantedParts = userPermission.split(":");
  const requiredParts = requiredPermission.split(":");
  if (grantedParts.length < 2 || requiredParts.length < 2) {
    return userPermission === requiredPermission;
  }
  const [grantedResource, grantedAction, grantedId] = grantedParts;
  const [requiredResource, requiredAction, requiredId] = requiredParts;
  if (grantedResource === "*") {
    if (grantedAction === "*") {
      if (grantedId === void 0) {
        return true;
      }
      return grantedId === requiredId;
    }
    if (grantedAction !== requiredAction) {
      return false;
    }
    if (grantedId === void 0) {
      return true;
    }
    return grantedId === requiredId;
  }
  if (grantedResource !== requiredResource) {
    return false;
  }
  if (grantedAction === "*") {
    if (grantedId === void 0) {
      return true;
    }
    return grantedId === requiredId;
  }
  if (grantedAction !== requiredAction) {
    return false;
  }
  if (grantedId === void 0) {
    return true;
  }
  return grantedId === requiredId;
}
function hasPermission(userPermissions, requiredPermission) {
  return userPermissions.some((p) => matchesPermission(p, requiredPermission));
}
function resolvePermissionsFromMapping(roles, mapping) {
  const permissions = /* @__PURE__ */ new Set();
  const defaultPerms = mapping["_default"] ?? [];
  for (const role of roles) {
    const rolePerms = mapping[role];
    if (rolePerms) {
      for (const perm of rolePerms) {
        permissions.add(perm);
      }
    } else {
      for (const perm of defaultPerms) {
        permissions.add(perm);
      }
    }
  }
  return Array.from(permissions);
}

// src/auth/ee/defaults/rbac/static.ts
var StaticRBACProvider = class {
  roles;
  _roleMapping;
  getUserRolesFn;
  permissionCache = /* @__PURE__ */ new Map();
  /** Expose roleMapping for middleware access */
  get roleMapping() {
    return this._roleMapping;
  }
  constructor(options) {
    if ("roles" in options && options.roles) {
      this.roles = options.roles;
    }
    if ("roleMapping" in options && options.roleMapping) {
      this._roleMapping = options.roleMapping;
    }
    this.getUserRolesFn = options.getUserRoles;
  }
  async getRoles(user) {
    const roleIds = await this.getUserRolesFn(user);
    return roleIds;
  }
  async hasRole(user, role) {
    const roles = await this.getRoles(user);
    return roles.includes(role);
  }
  async getPermissions(user) {
    const roleIds = await this.getRoles(user);
    const cacheKey = roleIds.sort().join(",");
    const cached = this.permissionCache.get(cacheKey);
    if (cached) return cached;
    let permissions;
    if (this._roleMapping) {
      permissions = resolvePermissionsFromMapping(roleIds, this._roleMapping);
    } else if (this.roles) {
      permissions = resolvePermissions(roleIds, this.roles);
    } else {
      permissions = [];
    }
    this.permissionCache.set(cacheKey, permissions);
    return permissions;
  }
  async hasPermission(user, permission) {
    const permissions = await this.getPermissions(user);
    return permissions.some((p) => matchesPermission(p, permission));
  }
  async hasAllPermissions(user, permissions) {
    const userPermissions = await this.getPermissions(user);
    return permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));
  }
  async hasAnyPermission(user, permissions) {
    const userPermissions = await this.getPermissions(user);
    return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
  }
  /**
   * Clear the permission cache.
   */
  clearCache() {
    this.permissionCache.clear();
  }
  /**
   * Get all role definitions.
   * Only available when using role definitions mode (not role mapping).
   */
  getRoleDefinitions() {
    return this.roles ?? [];
  }
  /**
   * Get a specific role definition.
   * Only available when using role definitions mode (not role mapping).
   */
  getRoleDefinition(roleId) {
    return this.roles?.find((r) => r.id === roleId);
  }
};
/**
 * EE Authentication Interfaces
 *
 * Enterprise interfaces for RBAC, ACL, and advanced authorization.
 *
 * @license Mastra Enterprise License - see ee/LICENSE
 * @packageDocumentation
 */
/**
 * RBAC provider implementations.
 *
 * @license Mastra Enterprise License - see ee/LICENSE
 */
/**
 * Default implementations for EE authentication.
 *
 * @license Mastra Enterprise License - see ee/LICENSE
 */
/**
 * @mastra/core/auth/ee
 *
 * Enterprise authentication capabilities for Mastra.
 * This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
 *
 * @license Mastra Enterprise License - see ee/LICENSE
 * @packageDocumentation
 */

export { ACTIONS, DEFAULT_ROLES, PERMISSIONS, PERMISSION_PATTERNS, RESOURCES, StaticRBACProvider, buildCapabilities, getDefaultRole, hasPermission, isAuthenticated, isDevEnvironment, isEEEnabled, isEELicenseValid, isFeatureEnabled, isLicenseValid, isValidPermissionPattern, matchesPermission, resolvePermissions, resolvePermissionsFromMapping, validateLicense, validatePermissions };
//# sourceMappingURL=index.js.map
//# sourceMappingURL=index.js.map