@mastra/server 1.0.4 → 1.1.0-alpha.0

package/dist/{chunk-NUO7HPOV.cjs → chunk-AN42MFD5.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var chunk5W4RPVTK_cjs = require('./chunk-5W4RPVTK.cjs');
+var chunkZKMVCV4G_cjs = require('./chunk-ZKMVCV4G.cjs');
 var chunkMCYD5LW7_cjs = require('./chunk-MCYD5LW7.cjs');
-var chunkAVRO3FIN_cjs = require('./chunk-AVRO3FIN.cjs');
 var chunkSUKFO7UM_cjs = require('./chunk-SUKFO7UM.cjs');
+var chunk4LVJBXI2_cjs = require('./chunk-4LVJBXI2.cjs');
 var chunk64ITUOXI_cjs = require('./chunk-64ITUOXI.cjs');
 var chunkO7I5CWRX_cjs = require('./chunk-O7I5CWRX.cjs');
 var utils = require('@mastra/core/utils');
@@ -160,7 +160,9 @@ var listThreadsQuerySchema = chunkMCYD5LW7_cjs.createPagePaginationSchema(100).e
   ),
   orderBy: storageOrderBySchema
 });
-var getThreadByIdQuerySchema = optionalAgentIdQuerySchema;
+var getThreadByIdQuerySchema = optionalAgentIdQuerySchema.extend({
+  resourceId: z__default.default.string().optional()
+});
 var listMessagesQuerySchema = chunkMCYD5LW7_cjs.createPagePaginationSchema(40).extend({
   agentId: z__default.default.string().optional(),
   resourceId: z__default.default.string().optional(),
@@ -173,6 +175,12 @@ var getWorkingMemoryQuerySchema = z__default.default.object({
   resourceId: z__default.default.string().optional(),
   memoryConfig: memoryConfigSchema
 });
+var deleteThreadQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z__default.default.string().optional()
+});
+var deleteMessagesQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z__default.default.string().optional()
+});
 var getMemoryStatusNetworkQuerySchema = agentIdQuerySchema;
 var listThreadsNetworkQuerySchema = chunkMCYD5LW7_cjs.createPagePaginationSchema(100).extend({
   agentId: z__default.default.string().optional(),
@@ -192,7 +200,9 @@ var listThreadsNetworkQuerySchema = chunkMCYD5LW7_cjs.createPagePaginationSchema
   ),
   orderBy: storageOrderBySchema
 });
-var getThreadByIdNetworkQuerySchema = optionalAgentIdQuerySchema;
+var getThreadByIdNetworkQuerySchema = optionalAgentIdQuerySchema.extend({
+  resourceId: z__default.default.string().optional()
+});
 var listMessagesNetworkQuerySchema = chunkMCYD5LW7_cjs.createPagePaginationSchema(40).extend({
   agentId: z__default.default.string().optional(),
   resourceId: z__default.default.string().optional(),
@@ -203,8 +213,12 @@ var listMessagesNetworkQuerySchema = chunkMCYD5LW7_cjs.createPagePaginationSchem
 var saveMessagesNetworkQuerySchema = agentIdQuerySchema;
 var createThreadNetworkQuerySchema = agentIdQuerySchema;
 var updateThreadNetworkQuerySchema = agentIdQuerySchema;
-var deleteThreadNetworkQuerySchema = agentIdQuerySchema;
-var deleteMessagesNetworkQuerySchema = agentIdQuerySchema;
+var deleteThreadNetworkQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z__default.default.string().optional()
+});
+var deleteMessagesNetworkQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z__default.default.string().optional()
+});
 var memoryStatusResponseSchema = z__default.default.object({
   result: z__default.default.boolean()
 });
@@ -329,14 +343,25 @@ async function getMemoryFromContext({
     }
   }
   if (agentId && !agent) {
-    logger.debug("Agent not found, searching agents for agent", { agentId });
+    logger.debug("Agent not found in registered agents, trying stored agents", { agentId });
+    try {
+      const storedAgent = await mastra.getStoredAgentById(agentId);
+      if (storedAgent) {
+        agent = storedAgent;
+      }
+    } catch (error) {
+      logger.debug("Error getting stored agent", error);
+    }
+  }
+  if (agentId && !agent) {
+    logger.debug("Stored agent not found, searching sub-agents", { agentId });
     const agents = mastra.listAgents();
     if (Object.keys(agents || {}).length) {
       for (const [_, ag] of Object.entries(agents)) {
         try {
-          const agents2 = await ag.listAgents();
-          if (agents2[agentId]) {
-            agent = agents2[agentId];
+          const subAgents = await ag.listAgents({ requestContext });
+          if (subAgents[agentId]) {
+            agent = subAgents[agentId];
             break;
           }
         } catch (error) {
@@ -357,15 +382,16 @@ async function getMemoryFromContext({
 function getStorageFromContext({ mastra }) {
   return mastra.getStorage();
 }
-var GET_MEMORY_STATUS_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var GET_MEMORY_STATUS_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/status",
+  path: "/memory/status",
   responseType: "json",
   queryParamSchema: getMemoryStatusQuerySchema,
   responseSchema: memoryStatusResponseSchema,
   summary: "Get memory status",
   description: "Returns the current status of the memory system including configuration and health information",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, requestContext }) => {
     try {
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
@@ -384,15 +410,16 @@ var GET_MEMORY_STATUS_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var GET_MEMORY_CONFIG_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var GET_MEMORY_CONFIG_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/config",
+  path: "/memory/config",
   responseType: "json",
   queryParamSchema: getMemoryConfigQuerySchema,
   responseSchema: memoryConfigResponseSchema,
   summary: "Get memory configuration",
   description: "Returns the memory configuration for a specific agent or the system default",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, requestContext }) => {
     try {
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
@@ -406,20 +433,22 @@ var GET_MEMORY_CONFIG_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var LIST_THREADS_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var LIST_THREADS_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/threads",
+  path: "/memory/threads",
   responseType: "json",
   queryParamSchema: listThreadsQuerySchema,
   responseSchema: listThreadsResponseSchema,
   summary: "List memory threads",
   description: "Returns a paginated list of conversation threads with optional filtering by resource ID and/or metadata",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, resourceId, metadata, requestContext, page, perPage, orderBy }) => {
     try {
-      const filter = resourceId || metadata ? {} : void 0;
-      if (resourceId) {
-        filter.resourceId = resourceId;
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      const filter = effectiveResourceId || metadata ? {} : void 0;
+      if (effectiveResourceId) {
+        filter.resourceId = effectiveResourceId;
       }
       if (metadata) {
         filter.metadata = metadata;
@@ -455,9 +484,9 @@ var LIST_THREADS_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var GET_THREAD_BY_ID_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var GET_THREAD_BY_ID_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/threads/:threadId",
+  path: "/memory/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: getThreadByIdQuerySchema,
@@ -465,15 +494,19 @@ var GET_THREAD_BY_ID_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Get thread by ID",
   description: "Returns details for a specific conversation thread",
   tags: ["Memory"],
-  handler: async ({ mastra, agentId, threadId, requestContext }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, agentId, threadId, resourceId, requestContext }) => {
     try {
-      chunk5W4RPVTK_cjs.validateBody({ threadId });
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (memory) {
-        const thread = await memory.getThreadById({ threadId });
+        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
           throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
         }
+        await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
         return thread;
       }
       if (!agentId) {
@@ -481,10 +514,11 @@ var GET_THREAD_BY_ID_ROUTE = chunkAVRO3FIN_cjs.createRoute({
         if (storage) {
           const memoryStore = await storage.getStore("memory");
           if (memoryStore) {
-            const thread = await memoryStore.getThreadById({ threadId });
+            const thread = await memoryStore.getThreadById({ threadId: effectiveThreadId });
             if (!thread) {
               throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
             }
+            await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
             return thread;
           }
         }
@@ -495,9 +529,9 @@ var GET_THREAD_BY_ID_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var LIST_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var LIST_MESSAGES_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/threads/:threadId/messages",
+  path: "/memory/threads/:threadId/messages",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: listMessagesQuerySchema,
@@ -505,6 +539,7 @@ var LIST_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "List thread messages",
   description: "Returns a paginated list of messages in a conversation thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({
     mastra,
     agentId,
@@ -518,19 +553,22 @@ var LIST_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     requestContext
   }) => {
     try {
-      chunk5W4RPVTK_cjs.validateBody({ threadId });
-      if (!threadId) {
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId });
+      if (!effectiveThreadId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "No threadId found" });
       }
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (memory) {
-        const thread = await memory.getThreadById({ threadId });
+        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
           throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
         }
+        await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
         const result = await memory.recall({
-          threadId,
-          resourceId,
+          threadId: effectiveThreadId,
+          resourceId: effectiveResourceId,
           perPage,
           page,
           orderBy,
@@ -544,13 +582,14 @@ var LIST_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
         if (storage) {
           const memoryStore = await storage.getStore("memory");
           if (memoryStore) {
-            const thread = await memoryStore.getThreadById({ threadId });
+            const thread = await memoryStore.getThreadById({ threadId: effectiveThreadId });
             if (!thread) {
               throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
             }
+            await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
             const result = await memoryStore.listMessages({
-              threadId,
-              resourceId,
+              threadId: effectiveThreadId,
+              resourceId: effectiveResourceId,
               perPage,
               page,
               orderBy,
@@ -567,9 +606,9 @@ var LIST_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var GET_WORKING_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var GET_WORKING_MEMORY_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/threads/:threadId/working-memory",
+  path: "/memory/threads/:threadId/working-memory",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: getWorkingMemoryQuerySchema,
@@ -577,29 +616,39 @@ var GET_WORKING_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Get working memory",
   description: "Returns the working memory state for a thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, resourceId, requestContext, memoryConfig }) => {
     try {
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
-      chunk5W4RPVTK_cjs.validateBody({ threadId });
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
+      if (thread) {
+        await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
+      }
       const threadExists = !!thread;
       const template = await memory.getWorkingMemoryTemplate({ memoryConfig });
       const workingMemoryTemplate = template?.format === "json" ? { ...template, content: JSON.stringify(utils.generateEmptyFromSchema(template.content)) } : template;
-      const workingMemory = await memory.getWorkingMemory({ threadId, resourceId, memoryConfig });
+      const workingMemory = await memory.getWorkingMemory({
+        threadId: effectiveThreadId,
+        resourceId: effectiveResourceId,
+        memoryConfig
+      });
       const config = memory.getMergedThreadConfig(memoryConfig || {});
-      const source = config.workingMemory?.scope !== "thread" && resourceId ? "resource" : "thread";
+      const source = config.workingMemory?.scope !== "thread" && effectiveResourceId ? "resource" : "thread";
       return { workingMemory, source, workingMemoryTemplate, threadExists };
     } catch (error) {
       return chunkSUKFO7UM_cjs.handleError(error, "Error getting working memory");
     }
   }
 });
-var SAVE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var SAVE_MESSAGES_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/save-messages",
+  path: "/memory/save-messages",
   responseType: "json",
   queryParamSchema: agentIdQuerySchema,
   bodySchema: saveMessagesBodySchema,
@@ -607,8 +656,10 @@ var SAVE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Save messages",
   description: "Saves new messages to memory",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, messages, requestContext }) => {
     try {
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, void 0);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
@@ -625,6 +676,19 @@ var SAVE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
           message: `All messages must have threadId and resourceId fields. Found ${invalidMessages.length} invalid message(s).`
         });
       }
+      if (effectiveResourceId) {
+        const unauthorizedMessages = messages.filter((message) => message.resourceId !== effectiveResourceId);
+        if (unauthorizedMessages.length > 0) {
+          throw new chunk64ITUOXI_cjs.HTTPException(403, {
+            message: "Access denied: cannot save messages for a different resource"
+          });
+        }
+        const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
+        for (const threadId of threadIds) {
+          const thread = await memory.getThreadById({ threadId });
+          await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
+        }
+      }
       const processedMessages = messages.map((message) => ({
         ...message,
         id: message.id || memory.generateId(),
@@ -637,9 +701,9 @@ var SAVE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var CREATE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var CREATE_THREAD_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/threads",
+  path: "/memory/threads",
   responseType: "json",
   queryParamSchema: agentIdQuerySchema,
   bodySchema: createThreadBodySchema,
@@ -647,15 +711,17 @@ var CREATE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Create thread",
   description: "Creates a new conversation thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, resourceId, title, metadata, threadId, requestContext }) => {
     try {
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
       }
-      chunk5W4RPVTK_cjs.validateBody({ resourceId });
+      chunkZKMVCV4G_cjs.validateBody({ resourceId: effectiveResourceId });
       const result = await memory.createThread({
-        resourceId,
+        resourceId: effectiveResourceId,
         title,
         metadata,
         threadId
@@ -666,9 +732,9 @@ var CREATE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var UPDATE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var UPDATE_THREAD_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "PATCH",
-  path: "/api/memory/threads/:threadId",
+  path: "/memory/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: agentIdQuerySchema,
@@ -677,23 +743,28 @@ var UPDATE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Update thread",
   description: "Updates a conversation thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, title, metadata, resourceId, requestContext }) => {
     try {
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       const updatedAt = /* @__PURE__ */ new Date();
-      chunk5W4RPVTK_cjs.validateBody({ threadId });
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
       if (!thread) {
         throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
       }
+      await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
       const updatedThread = {
         ...thread,
         title: title || thread.title,
         metadata: metadata || thread.metadata,
-        resourceId: resourceId || thread.resourceId,
+        // Don't allow changing resourceId if effectiveResourceId is set (prevents reassigning threads)
+        resourceId: effectiveResourceId || resourceId || thread.resourceId,
         createdAt: thread.createdAt,
         updatedAt
       };
@@ -707,37 +778,41 @@ var UPDATE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var DELETE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var DELETE_THREAD_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "DELETE",
-  path: "/api/memory/threads/:threadId",
+  path: "/memory/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
-  queryParamSchema: agentIdQuerySchema,
+  queryParamSchema: deleteThreadQuerySchema,
   responseSchema: deleteThreadResponseSchema,
   summary: "Delete thread",
   description: "Deletes a conversation thread",
   tags: ["Memory"],
-  handler: async ({ mastra, agentId, threadId, requestContext }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, agentId, threadId, resourceId, requestContext }) => {
     try {
-      chunk5W4RPVTK_cjs.validateBody({ threadId });
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
       if (!thread) {
         throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
       }
-      await memory.deleteThread(threadId);
+      await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
+      await memory.deleteThread(effectiveThreadId);
       return { result: "Thread deleted" };
     } catch (error) {
       return chunkSUKFO7UM_cjs.handleError(error, "Error deleting thread");
     }
   }
 });
-var CLONE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var CLONE_THREAD_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/threads/:threadId/clone",
+  path: "/memory/threads/:threadId/clone",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: agentIdQuerySchema,
@@ -746,17 +821,26 @@ var CLONE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Clone thread",
   description: "Creates a copy of a conversation thread with all its messages",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, newThreadId, resourceId, title, metadata, options, requestContext }) => {
     try {
-      chunk5W4RPVTK_cjs.validateBody({ threadId });
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
       }
+      const sourceThread = await memory.getThreadById({ threadId: effectiveThreadId });
+      if (!sourceThread) {
+        throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Source thread not found" });
+      }
+      await chunkZKMVCV4G_cjs.validateThreadOwnership(sourceThread, effectiveResourceId);
       const result = await memory.cloneThread({
-        sourceThreadId: threadId,
+        sourceThreadId: effectiveThreadId,
         newThreadId,
-        resourceId,
+        // Use effective resourceId for the cloned thread
+        resourceId: effectiveResourceId,
         title,
         metadata,
         options
@@ -767,9 +851,9 @@ var CLONE_THREAD_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var UPDATE_WORKING_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var UPDATE_WORKING_MEMORY_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/threads/:threadId/working-memory",
+  path: "/memory/threads/:threadId/working-memory",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: agentIdQuerySchema,
@@ -778,36 +862,47 @@ var UPDATE_WORKING_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Update working memory",
   description: "Updates the working memory state for a thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, resourceId, memoryConfig, workingMemory, requestContext }) => {
     try {
-      chunk5W4RPVTK_cjs.validateBody({ threadId, workingMemory });
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      chunkZKMVCV4G_cjs.validateBody({ threadId: effectiveThreadId, workingMemory });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
       if (!thread) {
         throw new chunk64ITUOXI_cjs.HTTPException(404, { message: "Thread not found" });
       }
-      await memory.updateWorkingMemory({ threadId, resourceId, workingMemory, memoryConfig });
+      await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
+      await memory.updateWorkingMemory({
+        threadId: effectiveThreadId,
+        resourceId: effectiveResourceId,
+        workingMemory,
+        memoryConfig
+      });
       return { success: true };
     } catch (error) {
       return chunkSUKFO7UM_cjs.handleError(error, "Error updating working memory");
     }
   }
 });
-var DELETE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var DELETE_MESSAGES_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/messages/delete",
+  path: "/memory/messages/delete",
   responseType: "json",
-  queryParamSchema: agentIdQuerySchema,
+  queryParamSchema: deleteMessagesQuerySchema,
   bodySchema: deleteMessagesBodySchema,
   responseSchema: deleteMessagesResponseSchema,
   summary: "Delete messages",
   description: "Deletes specific messages from memory",
   tags: ["Memory"],
-  handler: async ({ mastra, agentId, messageIds, requestContext }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, agentId, resourceId, messageIds, requestContext }) => {
     try {
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
       if (messageIds === void 0 || messageIds === null) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "messageIds is required" });
       }
@@ -819,7 +914,28 @@ var DELETE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
       } else {
         normalizedIds = [messageIds];
       }
+      const stringIds = normalizedIds.map((id) => typeof id === "string" ? id : id.id);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
+      if (effectiveResourceId && stringIds.length > 0) {
+        const storage = memory?.storage || getStorageFromContext({ mastra });
+        if (!storage) {
+          throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: unable to verify message ownership" });
+        }
+        const memoryStore = await storage.getStore("memory");
+        if (!memoryStore) {
+          throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
+        }
+        const { messages } = await memoryStore.listMessagesById({ messageIds: stringIds });
+        const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
+        for (const threadId of threadIds) {
+          const thread = await memoryStore.getThreadById({ threadId });
+          if (thread && thread.resourceId && thread.resourceId !== effectiveResourceId) {
+            throw new chunk64ITUOXI_cjs.HTTPException(403, {
+              message: "Access denied: message belongs to a thread owned by a different resource"
+            });
+          }
+        }
+      }
       if (memory) {
         await memory.deleteMessages(normalizedIds);
       } else if (!agentId) {
@@ -827,7 +943,6 @@ var DELETE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
         if (storage) {
           const memoryStore = await storage.getStore("memory");
           if (memoryStore) {
-            const stringIds = normalizedIds.map((id) => typeof id === "string" ? id : id.id);
             await memoryStore.deleteMessages(stringIds);
           } else {
             throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
@@ -845,18 +960,21 @@ var DELETE_MESSAGES_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var SEARCH_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var SEARCH_MEMORY_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/search",
+  path: "/memory/search",
   responseType: "json",
   queryParamSchema: searchMemoryQuerySchema,
   responseSchema: searchMemoryResponseSchema,
   summary: "Search memory",
   description: "Searches across memory using semantic or text search",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, searchQuery, resourceId, threadId, limit = 20, requestContext, memoryConfig }) => {
     try {
-      chunk5W4RPVTK_cjs.validateBody({ searchQuery, resourceId });
+      const effectiveResourceId = chunkZKMVCV4G_cjs.getEffectiveResourceId(requestContext, resourceId);
+      const effectiveThreadId = chunkZKMVCV4G_cjs.getEffectiveThreadId(requestContext, threadId);
+      chunkZKMVCV4G_cjs.validateBody({ searchQuery, resourceId: effectiveResourceId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Memory is not initialized" });
@@ -865,8 +983,8 @@ var SEARCH_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
       const hasSemanticRecall = !!config?.semanticRecall;
       const resourceScope = typeof config?.semanticRecall === "object" ? config?.semanticRecall?.scope !== "thread" : true;
       const searchResults = [];
-      if (threadId && !resourceScope) {
-        const thread = await memory.getThreadById({ threadId });
+      if (effectiveThreadId && !resourceScope) {
+        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
           return {
             results: [],
@@ -876,13 +994,12 @@ var SEARCH_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
             searchType: hasSemanticRecall ? "semantic" : "text"
           };
         }
-        if (thread.resourceId !== resourceId) {
-          throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Thread does not belong to the specified resource" });
-        }
+        await chunkZKMVCV4G_cjs.validateThreadOwnership(thread, effectiveResourceId);
       }
-      if (!threadId) {
+      let searchThreadId = effectiveThreadId;
+      if (!searchThreadId) {
         const { threads } = await memory.listThreads({
-          filter: { resourceId },
+          filter: { resourceId: effectiveResourceId },
           page: 0,
           perPage: 1,
           orderBy: { field: "updatedAt", direction: "DESC" }
@@ -896,7 +1013,7 @@ var SEARCH_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
             searchType: hasSemanticRecall ? "semantic" : "text"
           };
         }
-        threadId = threads[0].id;
+        searchThreadId = threads[0].id;
       }
       const beforeRange = typeof config.semanticRecall === `boolean` ? 2 : typeof config.semanticRecall?.messageRange === `number` ? config.semanticRecall.messageRange : config.semanticRecall?.messageRange.before || 2;
       const afterRange = typeof config.semanticRecall === `boolean` ? 2 : typeof config.semanticRecall?.messageRange === `number` ? config.semanticRecall.messageRange : config.semanticRecall?.messageRange.after || 2;
@@ -912,20 +1029,20 @@ var SEARCH_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
         return { results: [], count: 0, query: searchQuery };
       }
       const result = await memory.recall({
-        threadId,
-        resourceId,
+        threadId: searchThreadId,
+        resourceId: effectiveResourceId,
         perPage: threadConfig.lastMessages,
         threadConfig: config,
         vectorSearchString: threadConfig.semanticRecall && searchQuery ? searchQuery : void 0
       });
       const threadIds = Array.from(
-        new Set(result.messages.map((m) => m.threadId || threadId).filter(Boolean))
+        new Set(result.messages.map((m) => m.threadId || searchThreadId).filter(Boolean))
       );
       const fetched = await Promise.all(threadIds.map((id) => memory.getThreadById({ threadId: id })));
       const threadMap = new Map(fetched.filter(Boolean).map((t) => [t.id, t]));
       for (const msg of result.messages) {
         const content = getTextContent(msg);
-        const msgThreadId = msg.threadId || threadId;
+        const msgThreadId = msg.threadId || searchThreadId;
         const thread = threadMap.get(msgThreadId);
         const threadMessages = (await memory.recall({ threadId: msgThreadId })).messages;
         const messageIndex = threadMessages.findIndex((m) => m.id === msg.id);
@@ -968,31 +1085,33 @@ var SEARCH_MEMORY_ROUTE = chunkAVRO3FIN_cjs.createRoute({
     }
   }
 });
-var GET_MEMORY_STATUS_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var GET_MEMORY_STATUS_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/network/status",
+  path: "/memory/network/status",
   responseType: "json",
   queryParamSchema: getMemoryStatusNetworkQuerySchema,
   responseSchema: memoryStatusResponseSchema,
   summary: "Get memory status (network)",
   description: "Returns the current status of the memory system (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: GET_MEMORY_STATUS_ROUTE.handler
 });
-var LIST_THREADS_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var LIST_THREADS_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/network/threads",
+  path: "/memory/network/threads",
   responseType: "json",
   queryParamSchema: listThreadsNetworkQuerySchema,
   responseSchema: listThreadsResponseSchema,
   summary: "List memory threads (network)",
   description: "Returns a paginated list of conversation threads (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: LIST_THREADS_ROUTE.handler
 });
-var GET_THREAD_BY_ID_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var GET_THREAD_BY_ID_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/network/threads/:threadId",
+  path: "/memory/network/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: getThreadByIdNetworkQuerySchema,
@@ -1000,11 +1119,12 @@ var GET_THREAD_BY_ID_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Get thread by ID (network)",
   description: "Returns details for a specific conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: GET_THREAD_BY_ID_ROUTE.handler
 });
-var LIST_MESSAGES_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var LIST_MESSAGES_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "GET",
-  path: "/api/memory/network/threads/:threadId/messages",
+  path: "/memory/network/threads/:threadId/messages",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: listMessagesNetworkQuerySchema,
@@ -1012,11 +1132,12 @@ var LIST_MESSAGES_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "List thread messages (network)",
   description: "Returns a paginated list of messages in a conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: LIST_MESSAGES_ROUTE.handler
 });
-var SAVE_MESSAGES_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var SAVE_MESSAGES_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/network/save-messages",
+  path: "/memory/network/save-messages",
   responseType: "json",
   queryParamSchema: saveMessagesNetworkQuerySchema,
   bodySchema: saveMessagesBodySchema,
@@ -1024,11 +1145,12 @@ var SAVE_MESSAGES_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Save messages (network)",
   description: "Saves new messages to memory (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: SAVE_MESSAGES_ROUTE.handler
 });
-var CREATE_THREAD_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var CREATE_THREAD_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/network/threads",
+  path: "/memory/network/threads",
   responseType: "json",
   queryParamSchema: createThreadNetworkQuerySchema,
   bodySchema: createThreadBodySchema,
@@ -1036,11 +1158,12 @@ var CREATE_THREAD_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Create thread (network)",
   description: "Creates a new conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: CREATE_THREAD_ROUTE.handler
 });
-var UPDATE_THREAD_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var UPDATE_THREAD_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "PATCH",
-  path: "/api/memory/network/threads/:threadId",
+  path: "/memory/network/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: updateThreadNetworkQuerySchema,
@@ -1049,11 +1172,12 @@ var UPDATE_THREAD_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Update thread (network)",
   description: "Updates a conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: UPDATE_THREAD_ROUTE.handler
 });
-var DELETE_THREAD_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var DELETE_THREAD_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "DELETE",
-  path: "/api/memory/network/threads/:threadId",
+  path: "/memory/network/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: deleteThreadNetworkQuerySchema,
@@ -1061,11 +1185,12 @@ var DELETE_THREAD_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Delete thread (network)",
   description: "Deletes a conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: DELETE_THREAD_ROUTE.handler
 });
-var DELETE_MESSAGES_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
+var DELETE_MESSAGES_NETWORK_ROUTE = chunk4LVJBXI2_cjs.createRoute({
   method: "POST",
-  path: "/api/memory/network/messages/delete",
+  path: "/memory/network/messages/delete",
   responseType: "json",
   queryParamSchema: deleteMessagesNetworkQuerySchema,
   bodySchema: deleteMessagesBodySchema,
@@ -1073,6 +1198,7 @@ var DELETE_MESSAGES_NETWORK_ROUTE = chunkAVRO3FIN_cjs.createRoute({
   summary: "Delete messages (network)",
   description: "Deletes specific messages from memory (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: DELETE_MESSAGES_ROUTE.handler
 });
 
@@ -1101,5 +1227,5 @@ exports.UPDATE_THREAD_ROUTE = UPDATE_THREAD_ROUTE;
 exports.UPDATE_WORKING_MEMORY_ROUTE = UPDATE_WORKING_MEMORY_ROUTE;
 exports.getTextContent = getTextContent;
 exports.memory_exports = memory_exports;
-//# sourceMappingURL=chunk-NUO7HPOV.cjs.map
-//# sourceMappingURL=chunk-NUO7HPOV.cjs.map
+//# sourceMappingURL=chunk-AN42MFD5.cjs.map
+//# sourceMappingURL=chunk-AN42MFD5.cjs.map