@mastra/server 1.0.4 → 1.1.0-alpha.0

package/dist/{chunk-2CYGIE3E.js → chunk-4JAEBN6N.js}

@@ -1,7 +1,7 @@
-import { validateBody } from './chunk-XWGAT2DA.js';
+import { getEffectiveResourceId, getEffectiveThreadId, validateBody, validateThreadOwnership } from './chunk-USR6JK77.js';
 import { createPagePaginationSchema, paginationInfoSchema, successResponseSchema } from './chunk-HT4LP3BO.js';
-import { createRoute } from './chunk-7S7ALPCY.js';
 import { handleError } from './chunk-ONN5EA7E.js';
+import { createRoute } from './chunk-D5VCL56B.js';
 import { HTTPException } from './chunk-6QWQZI4Q.js';
 import { __export } from './chunk-PR4QN5HX.js';
 import { generateEmptyFromSchema } from '@mastra/core/utils';
@@ -154,7 +154,9 @@ var listThreadsQuerySchema = createPagePaginationSchema(100).extend({
   ),
   orderBy: storageOrderBySchema
 });
-var getThreadByIdQuerySchema = optionalAgentIdQuerySchema;
+var getThreadByIdQuerySchema = optionalAgentIdQuerySchema.extend({
+  resourceId: z.string().optional()
+});
 var listMessagesQuerySchema = createPagePaginationSchema(40).extend({
   agentId: z.string().optional(),
   resourceId: z.string().optional(),
@@ -167,6 +169,12 @@ var getWorkingMemoryQuerySchema = z.object({
   resourceId: z.string().optional(),
   memoryConfig: memoryConfigSchema
 });
+var deleteThreadQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z.string().optional()
+});
+var deleteMessagesQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z.string().optional()
+});
 var getMemoryStatusNetworkQuerySchema = agentIdQuerySchema;
 var listThreadsNetworkQuerySchema = createPagePaginationSchema(100).extend({
   agentId: z.string().optional(),
@@ -186,7 +194,9 @@ var listThreadsNetworkQuerySchema = createPagePaginationSchema(100).extend({
   ),
   orderBy: storageOrderBySchema
 });
-var getThreadByIdNetworkQuerySchema = optionalAgentIdQuerySchema;
+var getThreadByIdNetworkQuerySchema = optionalAgentIdQuerySchema.extend({
+  resourceId: z.string().optional()
+});
 var listMessagesNetworkQuerySchema = createPagePaginationSchema(40).extend({
   agentId: z.string().optional(),
   resourceId: z.string().optional(),
@@ -197,8 +207,12 @@ var listMessagesNetworkQuerySchema = createPagePaginationSchema(40).extend({
 var saveMessagesNetworkQuerySchema = agentIdQuerySchema;
 var createThreadNetworkQuerySchema = agentIdQuerySchema;
 var updateThreadNetworkQuerySchema = agentIdQuerySchema;
-var deleteThreadNetworkQuerySchema = agentIdQuerySchema;
-var deleteMessagesNetworkQuerySchema = agentIdQuerySchema;
+var deleteThreadNetworkQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z.string().optional()
+});
+var deleteMessagesNetworkQuerySchema = agentIdQuerySchema.extend({
+  resourceId: z.string().optional()
+});
 var memoryStatusResponseSchema = z.object({
   result: z.boolean()
 });
@@ -323,14 +337,25 @@ async function getMemoryFromContext({
     }
   }
   if (agentId && !agent) {
-    logger.debug("Agent not found, searching agents for agent", { agentId });
+    logger.debug("Agent not found in registered agents, trying stored agents", { agentId });
+    try {
+      const storedAgent = await mastra.getStoredAgentById(agentId);
+      if (storedAgent) {
+        agent = storedAgent;
+      }
+    } catch (error) {
+      logger.debug("Error getting stored agent", error);
+    }
+  }
+  if (agentId && !agent) {
+    logger.debug("Stored agent not found, searching sub-agents", { agentId });
     const agents = mastra.listAgents();
     if (Object.keys(agents || {}).length) {
       for (const [_, ag] of Object.entries(agents)) {
         try {
-          const agents2 = await ag.listAgents();
-          if (agents2[agentId]) {
-            agent = agents2[agentId];
+          const subAgents = await ag.listAgents({ requestContext });
+          if (subAgents[agentId]) {
+            agent = subAgents[agentId];
             break;
           }
         } catch (error) {
@@ -353,13 +378,14 @@ function getStorageFromContext({ mastra }) {
 }
 var GET_MEMORY_STATUS_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/status",
+  path: "/memory/status",
   responseType: "json",
   queryParamSchema: getMemoryStatusQuerySchema,
   responseSchema: memoryStatusResponseSchema,
   summary: "Get memory status",
   description: "Returns the current status of the memory system including configuration and health information",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, requestContext }) => {
     try {
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
@@ -380,13 +406,14 @@ var GET_MEMORY_STATUS_ROUTE = createRoute({
 });
 var GET_MEMORY_CONFIG_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/config",
+  path: "/memory/config",
   responseType: "json",
   queryParamSchema: getMemoryConfigQuerySchema,
   responseSchema: memoryConfigResponseSchema,
   summary: "Get memory configuration",
   description: "Returns the memory configuration for a specific agent or the system default",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, requestContext }) => {
     try {
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
@@ -402,18 +429,20 @@ var GET_MEMORY_CONFIG_ROUTE = createRoute({
 });
 var LIST_THREADS_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/threads",
+  path: "/memory/threads",
   responseType: "json",
   queryParamSchema: listThreadsQuerySchema,
   responseSchema: listThreadsResponseSchema,
   summary: "List memory threads",
   description: "Returns a paginated list of conversation threads with optional filtering by resource ID and/or metadata",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, resourceId, metadata, requestContext, page, perPage, orderBy }) => {
     try {
-      const filter = resourceId || metadata ? {} : void 0;
-      if (resourceId) {
-        filter.resourceId = resourceId;
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      const filter = effectiveResourceId || metadata ? {} : void 0;
+      if (effectiveResourceId) {
+        filter.resourceId = effectiveResourceId;
       }
       if (metadata) {
         filter.metadata = metadata;
@@ -451,7 +480,7 @@ var LIST_THREADS_ROUTE = createRoute({
 });
 var GET_THREAD_BY_ID_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/threads/:threadId",
+  path: "/memory/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: getThreadByIdQuerySchema,
@@ -459,15 +488,19 @@ var GET_THREAD_BY_ID_ROUTE = createRoute({
   summary: "Get thread by ID",
   description: "Returns details for a specific conversation thread",
   tags: ["Memory"],
-  handler: async ({ mastra, agentId, threadId, requestContext }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, agentId, threadId, resourceId, requestContext }) => {
     try {
-      validateBody({ threadId });
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (memory) {
-        const thread = await memory.getThreadById({ threadId });
+        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
           throw new HTTPException(404, { message: "Thread not found" });
         }
+        await validateThreadOwnership(thread, effectiveResourceId);
         return thread;
       }
       if (!agentId) {
@@ -475,10 +508,11 @@ var GET_THREAD_BY_ID_ROUTE = createRoute({
         if (storage) {
           const memoryStore = await storage.getStore("memory");
           if (memoryStore) {
-            const thread = await memoryStore.getThreadById({ threadId });
+            const thread = await memoryStore.getThreadById({ threadId: effectiveThreadId });
             if (!thread) {
               throw new HTTPException(404, { message: "Thread not found" });
             }
+            await validateThreadOwnership(thread, effectiveResourceId);
             return thread;
           }
         }
@@ -491,7 +525,7 @@ var GET_THREAD_BY_ID_ROUTE = createRoute({
 });
 var LIST_MESSAGES_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/threads/:threadId/messages",
+  path: "/memory/threads/:threadId/messages",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: listMessagesQuerySchema,
@@ -499,6 +533,7 @@ var LIST_MESSAGES_ROUTE = createRoute({
   summary: "List thread messages",
   description: "Returns a paginated list of messages in a conversation thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({
     mastra,
     agentId,
@@ -512,19 +547,22 @@ var LIST_MESSAGES_ROUTE = createRoute({
     requestContext
   }) => {
     try {
-      validateBody({ threadId });
-      if (!threadId) {
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      validateBody({ threadId: effectiveThreadId });
+      if (!effectiveThreadId) {
         throw new HTTPException(400, { message: "No threadId found" });
       }
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (memory) {
-        const thread = await memory.getThreadById({ threadId });
+        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
           throw new HTTPException(404, { message: "Thread not found" });
         }
+        await validateThreadOwnership(thread, effectiveResourceId);
         const result = await memory.recall({
-          threadId,
-          resourceId,
+          threadId: effectiveThreadId,
+          resourceId: effectiveResourceId,
           perPage,
           page,
           orderBy,
@@ -538,13 +576,14 @@ var LIST_MESSAGES_ROUTE = createRoute({
         if (storage) {
           const memoryStore = await storage.getStore("memory");
           if (memoryStore) {
-            const thread = await memoryStore.getThreadById({ threadId });
+            const thread = await memoryStore.getThreadById({ threadId: effectiveThreadId });
             if (!thread) {
               throw new HTTPException(404, { message: "Thread not found" });
             }
+            await validateThreadOwnership(thread, effectiveResourceId);
             const result = await memoryStore.listMessages({
-              threadId,
-              resourceId,
+              threadId: effectiveThreadId,
+              resourceId: effectiveResourceId,
               perPage,
               page,
               orderBy,
@@ -563,7 +602,7 @@ var LIST_MESSAGES_ROUTE = createRoute({
 });
 var GET_WORKING_MEMORY_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/threads/:threadId/working-memory",
+  path: "/memory/threads/:threadId/working-memory",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: getWorkingMemoryQuerySchema,
@@ -571,20 +610,30 @@ var GET_WORKING_MEMORY_ROUTE = createRoute({
   summary: "Get working memory",
   description: "Returns the working memory state for a thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, resourceId, requestContext, memoryConfig }) => {
     try {
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
-      validateBody({ threadId });
+      validateBody({ threadId: effectiveThreadId });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
+      if (thread) {
+        await validateThreadOwnership(thread, effectiveResourceId);
+      }
       const threadExists = !!thread;
       const template = await memory.getWorkingMemoryTemplate({ memoryConfig });
       const workingMemoryTemplate = template?.format === "json" ? { ...template, content: JSON.stringify(generateEmptyFromSchema(template.content)) } : template;
-      const workingMemory = await memory.getWorkingMemory({ threadId, resourceId, memoryConfig });
+      const workingMemory = await memory.getWorkingMemory({
+        threadId: effectiveThreadId,
+        resourceId: effectiveResourceId,
+        memoryConfig
+      });
       const config = memory.getMergedThreadConfig(memoryConfig || {});
-      const source = config.workingMemory?.scope !== "thread" && resourceId ? "resource" : "thread";
+      const source = config.workingMemory?.scope !== "thread" && effectiveResourceId ? "resource" : "thread";
       return { workingMemory, source, workingMemoryTemplate, threadExists };
     } catch (error) {
       return handleError(error, "Error getting working memory");
@@ -593,7 +642,7 @@ var GET_WORKING_MEMORY_ROUTE = createRoute({
 });
 var SAVE_MESSAGES_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/save-messages",
+  path: "/memory/save-messages",
   responseType: "json",
   queryParamSchema: agentIdQuerySchema,
   bodySchema: saveMessagesBodySchema,
@@ -601,8 +650,10 @@ var SAVE_MESSAGES_ROUTE = createRoute({
   summary: "Save messages",
   description: "Saves new messages to memory",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, messages, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
@@ -619,6 +670,19 @@ var SAVE_MESSAGES_ROUTE = createRoute({
           message: `All messages must have threadId and resourceId fields. Found ${invalidMessages.length} invalid message(s).`
         });
       }
+      if (effectiveResourceId) {
+        const unauthorizedMessages = messages.filter((message) => message.resourceId !== effectiveResourceId);
+        if (unauthorizedMessages.length > 0) {
+          throw new HTTPException(403, {
+            message: "Access denied: cannot save messages for a different resource"
+          });
+        }
+        const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
+        for (const threadId of threadIds) {
+          const thread = await memory.getThreadById({ threadId });
+          await validateThreadOwnership(thread, effectiveResourceId);
+        }
+      }
       const processedMessages = messages.map((message) => ({
         ...message,
         id: message.id || memory.generateId(),
@@ -633,7 +697,7 @@ var SAVE_MESSAGES_ROUTE = createRoute({
 });
 var CREATE_THREAD_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/threads",
+  path: "/memory/threads",
   responseType: "json",
   queryParamSchema: agentIdQuerySchema,
   bodySchema: createThreadBodySchema,
@@ -641,15 +705,17 @@ var CREATE_THREAD_ROUTE = createRoute({
   summary: "Create thread",
   description: "Creates a new conversation thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, resourceId, title, metadata, threadId, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
-      validateBody({ resourceId });
+      validateBody({ resourceId: effectiveResourceId });
       const result = await memory.createThread({
-        resourceId,
+        resourceId: effectiveResourceId,
         title,
         metadata,
         threadId
@@ -662,7 +728,7 @@ var CREATE_THREAD_ROUTE = createRoute({
 });
 var UPDATE_THREAD_ROUTE = createRoute({
   method: "PATCH",
-  path: "/api/memory/threads/:threadId",
+  path: "/memory/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: agentIdQuerySchema,
@@ -671,23 +737,28 @@ var UPDATE_THREAD_ROUTE = createRoute({
   summary: "Update thread",
   description: "Updates a conversation thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, title, metadata, resourceId, requestContext }) => {
     try {
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       const updatedAt = /* @__PURE__ */ new Date();
-      validateBody({ threadId });
+      validateBody({ threadId: effectiveThreadId });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
       if (!thread) {
         throw new HTTPException(404, { message: "Thread not found" });
       }
+      await validateThreadOwnership(thread, effectiveResourceId);
       const updatedThread = {
         ...thread,
         title: title || thread.title,
         metadata: metadata || thread.metadata,
-        resourceId: resourceId || thread.resourceId,
+        // Don't allow changing resourceId if effectiveResourceId is set (prevents reassigning threads)
+        resourceId: effectiveResourceId || resourceId || thread.resourceId,
         createdAt: thread.createdAt,
         updatedAt
       };
@@ -703,26 +774,30 @@ var UPDATE_THREAD_ROUTE = createRoute({
 });
 var DELETE_THREAD_ROUTE = createRoute({
   method: "DELETE",
-  path: "/api/memory/threads/:threadId",
+  path: "/memory/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
-  queryParamSchema: agentIdQuerySchema,
+  queryParamSchema: deleteThreadQuerySchema,
   responseSchema: deleteThreadResponseSchema,
   summary: "Delete thread",
   description: "Deletes a conversation thread",
   tags: ["Memory"],
-  handler: async ({ mastra, agentId, threadId, requestContext }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, agentId, threadId, resourceId, requestContext }) => {
     try {
-      validateBody({ threadId });
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
       if (!thread) {
         throw new HTTPException(404, { message: "Thread not found" });
       }
-      await memory.deleteThread(threadId);
+      await validateThreadOwnership(thread, effectiveResourceId);
+      await memory.deleteThread(effectiveThreadId);
       return { result: "Thread deleted" };
     } catch (error) {
       return handleError(error, "Error deleting thread");
@@ -731,7 +806,7 @@ var DELETE_THREAD_ROUTE = createRoute({
 });
 var CLONE_THREAD_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/threads/:threadId/clone",
+  path: "/memory/threads/:threadId/clone",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: agentIdQuerySchema,
@@ -740,17 +815,26 @@ var CLONE_THREAD_ROUTE = createRoute({
   summary: "Clone thread",
   description: "Creates a copy of a conversation thread with all its messages",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, newThreadId, resourceId, title, metadata, options, requestContext }) => {
     try {
-      validateBody({ threadId });
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
+      const sourceThread = await memory.getThreadById({ threadId: effectiveThreadId });
+      if (!sourceThread) {
+        throw new HTTPException(404, { message: "Source thread not found" });
+      }
+      await validateThreadOwnership(sourceThread, effectiveResourceId);
       const result = await memory.cloneThread({
-        sourceThreadId: threadId,
+        sourceThreadId: effectiveThreadId,
         newThreadId,
-        resourceId,
+        // Use effective resourceId for the cloned thread
+        resourceId: effectiveResourceId,
         title,
         metadata,
         options
@@ -763,7 +847,7 @@ var CLONE_THREAD_ROUTE = createRoute({
 });
 var UPDATE_WORKING_MEMORY_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/threads/:threadId/working-memory",
+  path: "/memory/threads/:threadId/working-memory",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: agentIdQuerySchema,
@@ -772,18 +856,27 @@ var UPDATE_WORKING_MEMORY_ROUTE = createRoute({
   summary: "Update working memory",
   description: "Updates the working memory state for a thread",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, threadId, resourceId, memoryConfig, workingMemory, requestContext }) => {
     try {
-      validateBody({ threadId, workingMemory });
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      validateBody({ threadId: effectiveThreadId, workingMemory });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
-      const thread = await memory.getThreadById({ threadId });
+      const thread = await memory.getThreadById({ threadId: effectiveThreadId });
       if (!thread) {
         throw new HTTPException(404, { message: "Thread not found" });
       }
-      await memory.updateWorkingMemory({ threadId, resourceId, workingMemory, memoryConfig });
+      await validateThreadOwnership(thread, effectiveResourceId);
+      await memory.updateWorkingMemory({
+        threadId: effectiveThreadId,
+        resourceId: effectiveResourceId,
+        workingMemory,
+        memoryConfig
+      });
       return { success: true };
     } catch (error) {
       return handleError(error, "Error updating working memory");
@@ -792,16 +885,18 @@ var UPDATE_WORKING_MEMORY_ROUTE = createRoute({
 });
 var DELETE_MESSAGES_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/messages/delete",
+  path: "/memory/messages/delete",
   responseType: "json",
-  queryParamSchema: agentIdQuerySchema,
+  queryParamSchema: deleteMessagesQuerySchema,
   bodySchema: deleteMessagesBodySchema,
   responseSchema: deleteMessagesResponseSchema,
   summary: "Delete messages",
   description: "Deletes specific messages from memory",
   tags: ["Memory"],
-  handler: async ({ mastra, agentId, messageIds, requestContext }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, agentId, resourceId, messageIds, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       if (messageIds === void 0 || messageIds === null) {
         throw new HTTPException(400, { message: "messageIds is required" });
       }
@@ -813,7 +908,28 @@ var DELETE_MESSAGES_ROUTE = createRoute({
       } else {
         normalizedIds = [messageIds];
       }
+      const stringIds = normalizedIds.map((id) => typeof id === "string" ? id : id.id);
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
+      if (effectiveResourceId && stringIds.length > 0) {
+        const storage = memory?.storage || getStorageFromContext({ mastra });
+        if (!storage) {
+          throw new HTTPException(403, { message: "Access denied: unable to verify message ownership" });
+        }
+        const memoryStore = await storage.getStore("memory");
+        if (!memoryStore) {
+          throw new HTTPException(400, { message: "Memory is not initialized" });
+        }
+        const { messages } = await memoryStore.listMessagesById({ messageIds: stringIds });
+        const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
+        for (const threadId of threadIds) {
+          const thread = await memoryStore.getThreadById({ threadId });
+          if (thread && thread.resourceId && thread.resourceId !== effectiveResourceId) {
+            throw new HTTPException(403, {
+              message: "Access denied: message belongs to a thread owned by a different resource"
+            });
+          }
+        }
+      }
       if (memory) {
         await memory.deleteMessages(normalizedIds);
       } else if (!agentId) {
@@ -821,7 +937,6 @@ var DELETE_MESSAGES_ROUTE = createRoute({
         if (storage) {
           const memoryStore = await storage.getStore("memory");
           if (memoryStore) {
-            const stringIds = normalizedIds.map((id) => typeof id === "string" ? id : id.id);
             await memoryStore.deleteMessages(stringIds);
           } else {
             throw new HTTPException(400, { message: "Memory is not initialized" });
@@ -841,16 +956,19 @@ var DELETE_MESSAGES_ROUTE = createRoute({
 });
 var SEARCH_MEMORY_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/search",
+  path: "/memory/search",
   responseType: "json",
   queryParamSchema: searchMemoryQuerySchema,
   responseSchema: searchMemoryResponseSchema,
   summary: "Search memory",
   description: "Searches across memory using semantic or text search",
   tags: ["Memory"],
+  requiresAuth: true,
   handler: async ({ mastra, agentId, searchQuery, resourceId, threadId, limit = 20, requestContext, memoryConfig }) => {
     try {
-      validateBody({ searchQuery, resourceId });
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
+      validateBody({ searchQuery, resourceId: effectiveResourceId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
@@ -859,8 +977,8 @@ var SEARCH_MEMORY_ROUTE = createRoute({
       const hasSemanticRecall = !!config?.semanticRecall;
       const resourceScope = typeof config?.semanticRecall === "object" ? config?.semanticRecall?.scope !== "thread" : true;
       const searchResults = [];
-      if (threadId && !resourceScope) {
-        const thread = await memory.getThreadById({ threadId });
+      if (effectiveThreadId && !resourceScope) {
+        const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
           return {
             results: [],
@@ -870,13 +988,12 @@ var SEARCH_MEMORY_ROUTE = createRoute({
             searchType: hasSemanticRecall ? "semantic" : "text"
           };
         }
-        if (thread.resourceId !== resourceId) {
-          throw new HTTPException(403, { message: "Thread does not belong to the specified resource" });
-        }
+        await validateThreadOwnership(thread, effectiveResourceId);
       }
-      if (!threadId) {
+      let searchThreadId = effectiveThreadId;
+      if (!searchThreadId) {
         const { threads } = await memory.listThreads({
-          filter: { resourceId },
+          filter: { resourceId: effectiveResourceId },
           page: 0,
           perPage: 1,
           orderBy: { field: "updatedAt", direction: "DESC" }
@@ -890,7 +1007,7 @@ var SEARCH_MEMORY_ROUTE = createRoute({
             searchType: hasSemanticRecall ? "semantic" : "text"
           };
         }
-        threadId = threads[0].id;
+        searchThreadId = threads[0].id;
       }
       const beforeRange = typeof config.semanticRecall === `boolean` ? 2 : typeof config.semanticRecall?.messageRange === `number` ? config.semanticRecall.messageRange : config.semanticRecall?.messageRange.before || 2;
       const afterRange = typeof config.semanticRecall === `boolean` ? 2 : typeof config.semanticRecall?.messageRange === `number` ? config.semanticRecall.messageRange : config.semanticRecall?.messageRange.after || 2;
@@ -906,20 +1023,20 @@ var SEARCH_MEMORY_ROUTE = createRoute({
         return { results: [], count: 0, query: searchQuery };
       }
       const result = await memory.recall({
-        threadId,
-        resourceId,
+        threadId: searchThreadId,
+        resourceId: effectiveResourceId,
         perPage: threadConfig.lastMessages,
         threadConfig: config,
         vectorSearchString: threadConfig.semanticRecall && searchQuery ? searchQuery : void 0
       });
       const threadIds = Array.from(
-        new Set(result.messages.map((m) => m.threadId || threadId).filter(Boolean))
+        new Set(result.messages.map((m) => m.threadId || searchThreadId).filter(Boolean))
       );
       const fetched = await Promise.all(threadIds.map((id) => memory.getThreadById({ threadId: id })));
       const threadMap = new Map(fetched.filter(Boolean).map((t) => [t.id, t]));
       for (const msg of result.messages) {
         const content = getTextContent(msg);
-        const msgThreadId = msg.threadId || threadId;
+        const msgThreadId = msg.threadId || searchThreadId;
         const thread = threadMap.get(msgThreadId);
         const threadMessages = (await memory.recall({ threadId: msgThreadId })).messages;
         const messageIndex = threadMessages.findIndex((m) => m.id === msg.id);
@@ -964,29 +1081,31 @@ var SEARCH_MEMORY_ROUTE = createRoute({
 });
 var GET_MEMORY_STATUS_NETWORK_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/network/status",
+  path: "/memory/network/status",
   responseType: "json",
   queryParamSchema: getMemoryStatusNetworkQuerySchema,
   responseSchema: memoryStatusResponseSchema,
   summary: "Get memory status (network)",
   description: "Returns the current status of the memory system (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: GET_MEMORY_STATUS_ROUTE.handler
 });
 var LIST_THREADS_NETWORK_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/network/threads",
+  path: "/memory/network/threads",
   responseType: "json",
   queryParamSchema: listThreadsNetworkQuerySchema,
   responseSchema: listThreadsResponseSchema,
   summary: "List memory threads (network)",
   description: "Returns a paginated list of conversation threads (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: LIST_THREADS_ROUTE.handler
 });
 var GET_THREAD_BY_ID_NETWORK_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/network/threads/:threadId",
+  path: "/memory/network/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: getThreadByIdNetworkQuerySchema,
@@ -994,11 +1113,12 @@ var GET_THREAD_BY_ID_NETWORK_ROUTE = createRoute({
   summary: "Get thread by ID (network)",
   description: "Returns details for a specific conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: GET_THREAD_BY_ID_ROUTE.handler
 });
 var LIST_MESSAGES_NETWORK_ROUTE = createRoute({
   method: "GET",
-  path: "/api/memory/network/threads/:threadId/messages",
+  path: "/memory/network/threads/:threadId/messages",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: listMessagesNetworkQuerySchema,
@@ -1006,11 +1126,12 @@ var LIST_MESSAGES_NETWORK_ROUTE = createRoute({
   summary: "List thread messages (network)",
   description: "Returns a paginated list of messages in a conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: LIST_MESSAGES_ROUTE.handler
 });
 var SAVE_MESSAGES_NETWORK_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/network/save-messages",
+  path: "/memory/network/save-messages",
   responseType: "json",
   queryParamSchema: saveMessagesNetworkQuerySchema,
   bodySchema: saveMessagesBodySchema,
@@ -1018,11 +1139,12 @@ var SAVE_MESSAGES_NETWORK_ROUTE = createRoute({
   summary: "Save messages (network)",
   description: "Saves new messages to memory (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: SAVE_MESSAGES_ROUTE.handler
 });
 var CREATE_THREAD_NETWORK_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/network/threads",
+  path: "/memory/network/threads",
   responseType: "json",
   queryParamSchema: createThreadNetworkQuerySchema,
   bodySchema: createThreadBodySchema,
@@ -1030,11 +1152,12 @@ var CREATE_THREAD_NETWORK_ROUTE = createRoute({
   summary: "Create thread (network)",
   description: "Creates a new conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: CREATE_THREAD_ROUTE.handler
 });
 var UPDATE_THREAD_NETWORK_ROUTE = createRoute({
   method: "PATCH",
-  path: "/api/memory/network/threads/:threadId",
+  path: "/memory/network/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: updateThreadNetworkQuerySchema,
@@ -1043,11 +1166,12 @@ var UPDATE_THREAD_NETWORK_ROUTE = createRoute({
   summary: "Update thread (network)",
   description: "Updates a conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: UPDATE_THREAD_ROUTE.handler
 });
 var DELETE_THREAD_NETWORK_ROUTE = createRoute({
   method: "DELETE",
-  path: "/api/memory/network/threads/:threadId",
+  path: "/memory/network/threads/:threadId",
   responseType: "json",
   pathParamSchema: threadIdPathParams,
   queryParamSchema: deleteThreadNetworkQuerySchema,
@@ -1055,11 +1179,12 @@ var DELETE_THREAD_NETWORK_ROUTE = createRoute({
   summary: "Delete thread (network)",
   description: "Deletes a conversation thread (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: DELETE_THREAD_ROUTE.handler
 });
 var DELETE_MESSAGES_NETWORK_ROUTE = createRoute({
   method: "POST",
-  path: "/api/memory/network/messages/delete",
+  path: "/memory/network/messages/delete",
   responseType: "json",
   queryParamSchema: deleteMessagesNetworkQuerySchema,
   bodySchema: deleteMessagesBodySchema,
@@ -1067,9 +1192,10 @@ var DELETE_MESSAGES_NETWORK_ROUTE = createRoute({
   summary: "Delete messages (network)",
   description: "Deletes specific messages from memory (network route)",
   tags: ["Memory - Network"],
+  requiresAuth: true,
   handler: DELETE_MESSAGES_ROUTE.handler
 });
 
 export { CLONE_THREAD_ROUTE, CREATE_THREAD_NETWORK_ROUTE, CREATE_THREAD_ROUTE, DELETE_MESSAGES_NETWORK_ROUTE, DELETE_MESSAGES_ROUTE, DELETE_THREAD_NETWORK_ROUTE, DELETE_THREAD_ROUTE, GET_MEMORY_CONFIG_ROUTE, GET_MEMORY_STATUS_NETWORK_ROUTE, GET_MEMORY_STATUS_ROUTE, GET_THREAD_BY_ID_NETWORK_ROUTE, GET_THREAD_BY_ID_ROUTE, GET_WORKING_MEMORY_ROUTE, LIST_MESSAGES_NETWORK_ROUTE, LIST_MESSAGES_ROUTE, LIST_THREADS_NETWORK_ROUTE, LIST_THREADS_ROUTE, SAVE_MESSAGES_NETWORK_ROUTE, SAVE_MESSAGES_ROUTE, SEARCH_MEMORY_ROUTE, UPDATE_THREAD_NETWORK_ROUTE, UPDATE_THREAD_ROUTE, UPDATE_WORKING_MEMORY_ROUTE, getTextContent, memory_exports };
-//# sourceMappingURL=chunk-2CYGIE3E.js.map
-//# sourceMappingURL=chunk-2CYGIE3E.js.map
+//# sourceMappingURL=chunk-4JAEBN6N.js.map
+//# sourceMappingURL=chunk-4JAEBN6N.js.map