@mastra/libsql 1.0.0-beta.12 → 1.0.0-beta.13

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @mastra/libsql
 
+## 1.0.0-beta.13
+
+### Patch Changes
+
+- Added new `listThreads` method for flexible thread filtering across all storage adapters. ([#11832](https://github.com/mastra-ai/mastra/pull/11832))
+
+  **New Features**
+  - Filter threads by `resourceId`, `metadata`, or both (with AND logic for metadata key-value pairs)
+  - All filter parameters are optional, allowing you to list all threads or filter as needed
+  - Full pagination and sorting support
+
+  **Example Usage**
+
+  ```typescript
+  // List all threads
+  const allThreads = await memory.listThreads({});
+
+  // Filter by resourceId only
+  const userThreads = await memory.listThreads({
+    filter: { resourceId: 'user-123' },
+  });
+
+  // Filter by metadata only
+  const supportThreads = await memory.listThreads({
+    filter: { metadata: { category: 'support' } },
+  });
+
+  // Filter by both with pagination
+  const filteredThreads = await memory.listThreads({
+    filter: {
+      resourceId: 'user-123',
+      metadata: { priority: 'high', status: 'open' },
+    },
+    orderBy: { field: 'updatedAt', direction: 'DESC' },
+    page: 0,
+    perPage: 20,
+  });
+  ```
+
+  **Security Improvements**
+  - Added validation to prevent SQL injection via malicious metadata keys
+  - Added pagination parameter validation to prevent integer overflow attacks
+
+- Updated dependencies [[`ed3e3dd`](https://github.com/mastra-ai/mastra/commit/ed3e3ddec69d564fe2b125e083437f76331f1283), [`6833c69`](https://github.com/mastra-ai/mastra/commit/6833c69607418d257750bbcdd84638993d343539), [`47b1c16`](https://github.com/mastra-ai/mastra/commit/47b1c16a01c7ffb6765fe1e499b49092f8b7eba3), [`3a76a80`](https://github.com/mastra-ai/mastra/commit/3a76a80284cb71a0faa975abb3d4b2a9631e60cd), [`8538a0d`](https://github.com/mastra-ai/mastra/commit/8538a0d232619bf55dad7ddc2a8b0ca77c679a87), [`9312dcd`](https://github.com/mastra-ai/mastra/commit/9312dcd1c6f5b321929e7d382e763d95fdc030f5)]:
+  - @mastra/core@1.0.0-beta.25
+
 ## 1.0.0-beta.12
 
 ### Minor Changes

package/dist/docs/README.md

@@ -36,4 +36,4 @@ docs/
 ## Version
 
 Package: @mastra/libsql
-Version: 1.0.0-beta.12
+Version: 1.0.0-beta.13

package/dist/docs/SKILL.md

@@ -5,7 +5,7 @@ description: Documentation for @mastra/libsql. Includes links to type definition
 
 # @mastra/libsql Documentation
 
-> **Version**: 1.0.0-beta.12
+> **Version**: 1.0.0-beta.13
 > **Package**: @mastra/libsql
 
 ## Quick Navigation

package/dist/docs/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-beta.12",
+  "version": "1.0.0-beta.13",
   "package": "@mastra/libsql",
   "exports": {},
   "modules": {}

package/dist/docs/agents/01-agent-memory.md

@@ -90,6 +90,9 @@ export const memoryAgent = new Agent({
 });
 ```
 
+> **Mastra Cloud Store limitation**
+Agent-level storage is not supported when using [Mastra Cloud Store](https://mastra.ai/docs/v1/mastra-cloud/deployment#using-mastra-cloud-store). If you use Mastra Cloud Store, configure storage on the Mastra instance instead. This limitation does not apply if you bring your own database.
+
 ## Message history
 
 Include a `memory` object with both `resource` and `thread` to track message history during agent calls.
@@ -122,6 +125,9 @@ const response = await memoryAgent.generate("What's my favorite color?", {
 });
 ```
 
+> **Note:**
+Each thread has an owner (`resourceId`) that cannot be changed after creation. Avoid reusing the same thread ID for threads with different owners, as this will cause errors when querying.
+
 To learn more about memory see the [Memory](../memory/overview) documentation.
 
 ## Using `RequestContext`

package/dist/docs/agents/03-agent-approval.md

@@ -64,6 +64,67 @@ const handleDecline = async () => {
 };
 ```
 
+## Tool approval with generate()
+
+Tool approval also works with the `generate()` method for non-streaming use cases. When using `generate()` with `requireToolApproval: true`, the method returns immediately when a tool requires approval instead of executing it.
+
+### How it works
+
+When a tool requires approval during a `generate()` call, the response includes:
+
+- `finishReason: 'suspended'` - indicates the agent is waiting for approval
+- `suspendPayload` - contains tool call details (`toolCallId`, `toolName`, `args`)
+- `runId` - needed to approve or decline the tool call
+
+### Approving tool calls
+
+To approve a tool call with `generate()`, use the `approveToolCallGenerate` method:
+
+```typescript
+const output = await agent.generate("Find user John", {
+  requireToolApproval: true,
+});
+
+if (output.finishReason === "suspended") {
+  console.log("Tool requires approval:", output.suspendPayload.toolName);
+  console.log("Arguments:", output.suspendPayload.args);
+
+  // Approve the tool call and get the final result
+  const result = await agent.approveToolCallGenerate({
+    runId: output.runId,
+    toolCallId: output.suspendPayload.toolCallId,
+  });
+
+  console.log("Final result:", result.text);
+}
+```
+
+### Declining tool calls
+
+To decline a tool call, use the `declineToolCallGenerate` method:
+
+```typescript
+if (output.finishReason === "suspended") {
+  const result = await agent.declineToolCallGenerate({
+    runId: output.runId,
+    toolCallId: output.suspendPayload.toolCallId,
+  });
+
+  // Agent will respond acknowledging the declined tool
+  console.log(result.text);
+}
+```
+
+### Stream vs Generate comparison
+
+| Aspect | `stream()` | `generate()` |
+|--------|-----------|--------------|
+| Response type | Streaming chunks | Complete response |
+| Approval detection | `tool-call-approval` chunk | `finishReason: 'suspended'` |
+| Approve method | `approveToolCall({ runId })` | `approveToolCallGenerate({ runId, toolCallId })` |
+| Decline method | `declineToolCall({ runId })` | `declineToolCallGenerate({ runId, toolCallId })` |
+| Result | Stream to iterate | Full output object |
+
 ## Tool-level approval
 
 There are two types of tool call approval. The first uses `requireApproval`, which is a property on the tool definition, while `requireToolApproval` is a parameter passed to `agent.stream()`. The second uses `suspend` and lets the agent provide context or confirmation prompts so the user can decide whether the tool call should continue.

package/dist/docs/memory/02-storage.md

@@ -115,6 +115,9 @@ export const agent = new Agent({
 
 This is useful when different agents need to store data in separate databases for security, compliance, or organizational reasons.
 
+> **Mastra Cloud Store limitation**
+Agent-level storage is not supported when using [Mastra Cloud Store](https://mastra.ai/docs/v1/mastra-cloud/deployment#using-mastra-cloud-store). If you use Mastra Cloud Store, configure storage on the Mastra instance instead. This limitation does not apply if you bring your own database.
+
 ## Threads and resources
 
 Mastra organizes memory into threads using two identifiers:
@@ -136,6 +139,21 @@ const stream = await agent.stream("message for agent", {
 > **Note:**
 [Studio](https://mastra.ai/docs/v1/getting-started/studio) automatically generates a thread and resource ID for you. Remember to  to pass these explicitly when calling `stream` or `generate` yourself.
 
+### Thread and resource relationship
+
+Each thread has an owner (its `resourceId`) that is set when the thread is created and cannot be changed. When you query a thread, you must use the correct owner's resource ID. Attempting to query a thread with a different resource ID will result in an error:
+
+```text
+Thread with id <thread_id> is for resource with id <resource_a>
+but resource <resource_b> was queried
+```
+
+Note that while each thread has one owner, messages within that thread can have different `resourceId` values. This is used for message attribution and filtering (e.g., distinguishing between different agents in a multi-agent system, or filtering messages for analytics).
+
+**Security:** Memory is a storage layer, not an authorization layer. Your application must implement access control before calling memory APIs. The `resourceId` parameter controls both validation and filtering - provide it to validate ownership and filter messages, or omit it for server-side access without validation.
+
+To avoid accidentally reusing thread IDs across different owners, use UUIDs: `crypto.randomUUID()`
+
 ### Thread title generation
 
 Mastra can automatically generate descriptive thread titles based on the user's first message.

package/dist/docs/memory/06-reference.md

@@ -127,7 +127,7 @@ export const agent = new Agent({
 - [createThread](https://mastra.ai/reference/v1/memory/createThread)
 - [recall](https://mastra.ai/reference/v1/memory/recall)
 - [getThreadById](https://mastra.ai/reference/v1/memory/getThreadById)
-- [listThreadsByResourceId](https://mastra.ai/reference/v1/memory/listThreadsByResourceId)
+- [listThreads](https://mastra.ai/reference/v1/memory/listThreads)
 - [deleteMessages](https://mastra.ai/reference/v1/memory/deleteMessages)
 - [cloneThread](https://mastra.ai/reference/v1/memory/cloneThread)
 - [Clone Utility Methods](https://mastra.ai/reference/v1/memory/clone-utilities)

package/dist/index.cjs

@@ -2647,33 +2647,76 @@ var MemoryLibSQL = class extends storage.MemoryStorage {
       );
     }
   }
-  async listThreadsByResourceId(args) {
-    const { resourceId, page = 0, perPage: perPageInput, orderBy } = args;
-    if (page < 0) {
+  async listThreads(args) {
+    const { page = 0, perPage: perPageInput, orderBy, filter } = args;
+    try {
+      this.validatePaginationInput(page, perPageInput ?? 100);
+    } catch (error$1) {
       throw new error.MastraError(
         {
-          id: storage.createStorageErrorId("LIBSQL", "LIST_THREADS_BY_RESOURCE_ID", "INVALID_PAGE"),
+          id: storage.createStorageErrorId("LIBSQL", "LIST_THREADS", "INVALID_PAGE"),
           domain: error.ErrorDomain.STORAGE,
           category: error.ErrorCategory.USER,
-          details: { page }
+          details: { page, ...perPageInput !== void 0 && { perPage: perPageInput } }
         },
-        new Error("page must be >= 0")
+        error$1 instanceof Error ? error$1 : new Error("Invalid pagination parameters")
       );
     }
     const perPage = storage.normalizePerPage(perPageInput, 100);
+    try {
+      this.validateMetadataKeys(filter?.metadata);
+    } catch (error$1) {
+      throw new error.MastraError(
+        {
+          id: storage.createStorageErrorId("LIBSQL", "LIST_THREADS", "INVALID_METADATA_KEY"),
+          domain: error.ErrorDomain.STORAGE,
+          category: error.ErrorCategory.USER,
+          details: { metadataKeys: filter?.metadata ? Object.keys(filter.metadata).join(", ") : "" }
+        },
+        error$1 instanceof Error ? error$1 : new Error("Invalid metadata key")
+      );
+    }
     const { offset, perPage: perPageForResponse } = storage.calculatePagination(page, perPageInput, perPage);
     const { field, direction } = this.parseOrderBy(orderBy);
     try {
-      const baseQuery = `FROM ${storage.TABLE_THREADS} WHERE resourceId = ?`;
-      const queryParams = [resourceId];
+      const whereClauses = [];
+      const queryParams = [];
+      if (filter?.resourceId) {
+        whereClauses.push("resourceId = ?");
+        queryParams.push(filter.resourceId);
+      }
+      if (filter?.metadata && Object.keys(filter.metadata).length > 0) {
+        for (const [key, value] of Object.entries(filter.metadata)) {
+          if (value === null) {
+            whereClauses.push(`json_extract(metadata, '$.${key}') IS NULL`);
+          } else if (typeof value === "boolean") {
+            whereClauses.push(`json_extract(metadata, '$.${key}') = ?`);
+            queryParams.push(value ? 1 : 0);
+          } else if (typeof value === "number") {
+            whereClauses.push(`json_extract(metadata, '$.${key}') = ?`);
+            queryParams.push(value);
+          } else if (typeof value === "string") {
+            whereClauses.push(`json_extract(metadata, '$.${key}') = ?`);
+            queryParams.push(value);
+          } else {
+            throw new error.MastraError({
+              id: storage.createStorageErrorId("LIBSQL", "LIST_THREADS", "INVALID_METADATA_VALUE"),
+              domain: error.ErrorDomain.STORAGE,
+              category: error.ErrorCategory.USER,
+              text: `Metadata filter value for key "${key}" must be a scalar type (string, number, boolean, or null), got ${typeof value}`,
+              details: { key, valueType: typeof value }
+            });
+          }
+        }
+      }
+      const whereClause = whereClauses.length > 0 ? `WHERE ${whereClauses.join(" AND ")}` : "";
+      const baseQuery = `FROM ${storage.TABLE_THREADS} ${whereClause}`;
       const mapRowToStorageThreadType = (row) => ({
         id: row.id,
         resourceId: row.resourceId,
         title: row.title,
         createdAt: new Date(row.createdAt),
-        // Convert string to Date
         updatedAt: new Date(row.updatedAt),
-        // Convert string to Date
         metadata: typeof row.metadata === "string" ? JSON.parse(row.metadata) : row.metadata
       });
       const countResult = await this.#client.execute({
@@ -2704,12 +2747,18 @@ var MemoryLibSQL = class extends storage.MemoryStorage {
         hasMore: perPageInput === false ? false : offset + perPage < total
       };
     } catch (error$1) {
+      if (error$1 instanceof error.MastraError && error$1.category === error.ErrorCategory.USER) {
+        throw error$1;
+      }
       const mastraError = new error.MastraError(
         {
-          id: storage.createStorageErrorId("LIBSQL", "LIST_THREADS_BY_RESOURCE_ID", "FAILED"),
+          id: storage.createStorageErrorId("LIBSQL", "LIST_THREADS", "FAILED"),
           domain: error.ErrorDomain.STORAGE,
           category: error.ErrorCategory.THIRD_PARTY,
-          details: { resourceId }
+          details: {
+            ...filter?.resourceId && { resourceId: filter.resourceId },
+            hasMetadataFilter: !!filter?.metadata
+          }
         },
         error$1
       );