@mastra/server 1.0.4 → 1.1.0-alpha.1

package/dist/{chunk-4R2Z655M.js → chunk-F2WTCJ5C.js}

@@ -1,8 +1,9 @@
-import { getWorkflowInfo, WorkflowRegistry } from './chunk-GNCALVLC.js';
-import { streamResponseSchema } from './chunk-WLGJVDH4.js';
+import { getWorkflowInfo, WorkflowRegistry } from './chunk-ED6NQBHF.js';
+import { streamResponseSchema } from './chunk-LFNP3ACE.js';
+import { getEffectiveResourceId, validateRunOwnership } from './chunk-USR6JK77.js';
 import { createCombinedPaginationSchema, tracingOptionsSchema, messageResponseSchema, optionalRunIdSchema, runIdSchema } from './chunk-HT4LP3BO.js';
-import { createRoute } from './chunk-7S7ALPCY.js';
 import { handleError } from './chunk-ONN5EA7E.js';
+import { createRoute } from './chunk-D5VCL56B.js';
 import { HTTPException } from './chunk-6QWQZI4Q.js';
 import { __export } from './chunk-PR4QN5HX.js';
 import { TransformStream, ReadableStream } from 'stream/web';
@@ -225,7 +226,6 @@ async function listWorkflowsFromSystem({ mastra, workflowId }) {
             workflow = workflows[workflowId];
             break;
           }
-          break;
         } catch (error) {
           logger.debug("Error getting workflow from agent", error);
         }
@@ -239,7 +239,7 @@ async function listWorkflowsFromSystem({ mastra, workflowId }) {
 }
 var LIST_WORKFLOWS_ROUTE = createRoute({
   method: "GET",
-  path: "/api/workflows",
+  path: "/workflows",
   responseType: "json",
   queryParamSchema: z$1.object({
     partial: z$1.string().optional()
@@ -248,6 +248,7 @@ var LIST_WORKFLOWS_ROUTE = createRoute({
   summary: "List all workflows",
   description: "Returns a list of all available workflows in the system",
   tags: ["Workflows"],
+  requiresAuth: true,
   handler: async ({ mastra, partial }) => {
     try {
       const workflows = mastra.listWorkflows({ serialized: false });
@@ -264,13 +265,14 @@ var LIST_WORKFLOWS_ROUTE = createRoute({
 });
 var GET_WORKFLOW_BY_ID_ROUTE = createRoute({
   method: "GET",
-  path: "/api/workflows/:workflowId",
+  path: "/workflows/:workflowId",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   responseSchema: workflowInfoSchema,
   summary: "Get workflow by ID",
   description: "Returns details for a specific workflow",
   tags: ["Workflows"],
+  requiresAuth: true,
   handler: async ({ mastra, workflowId }) => {
     try {
       if (!workflowId) {
@@ -285,7 +287,7 @@ var GET_WORKFLOW_BY_ID_ROUTE = createRoute({
 });
 var LIST_WORKFLOW_RUNS_ROUTE = createRoute({
   method: "GET",
-  path: "/api/workflows/:workflowId/runs",
+  path: "/workflows/:workflowId/runs",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: listWorkflowRunsQuerySchema,
@@ -293,8 +295,22 @@ var LIST_WORKFLOW_RUNS_ROUTE = createRoute({
   summary: "List workflow runs",
   description: "Returns a paginated list of execution runs for the specified workflow",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, fromDate, toDate, page, perPage, limit, offset, resourceId, status }) => {
+  requiresAuth: true,
+  handler: async ({
+    mastra,
+    workflowId,
+    fromDate,
+    toDate,
+    page,
+    perPage,
+    limit,
+    offset,
+    resourceId,
+    status,
+    requestContext
+  }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -321,7 +337,7 @@ var LIST_WORKFLOW_RUNS_ROUTE = createRoute({
         toDate: toDate ? typeof toDate === "string" ? new Date(toDate) : toDate : void 0,
         perPage: finalPerPage,
         page: finalPage,
-        resourceId,
+        resourceId: effectiveResourceId,
         status
       }) || {
         runs: [],
@@ -335,7 +351,7 @@ var LIST_WORKFLOW_RUNS_ROUTE = createRoute({
 });
 var GET_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
   method: "GET",
-  path: "/api/workflows/:workflowId/runs/:runId",
+  path: "/workflows/:workflowId/runs/:runId",
   responseType: "json",
   pathParamSchema: workflowRunPathParams,
   queryParamSchema: workflowRunResultQuerySchema,
@@ -343,8 +359,10 @@ var GET_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
   summary: "Get workflow run by ID",
   description: "Returns a workflow run with metadata and processed execution state. Use the fields query parameter to reduce payload size by requesting only specific fields (e.g., ?fields=status,result,metadata)",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, fields, withNestedWorkflows }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, fields, withNestedWorkflows, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -364,6 +382,7 @@ var GET_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       return run;
     } catch (error) {
       return handleError(error, "Error getting workflow run");
@@ -372,15 +391,17 @@ var GET_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
 });
 var DELETE_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
   method: "DELETE",
-  path: "/api/workflows/:workflowId/runs/:runId",
+  path: "/workflows/:workflowId/runs/:runId",
   responseType: "json",
   pathParamSchema: workflowRunPathParams,
   responseSchema: workflowControlResponseSchema,
   summary: "Delete workflow run by ID",
   description: "Deletes a specific workflow run by ID",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -391,6 +412,11 @@ var DELETE_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
       if (!workflow) {
         throw new HTTPException(404, { message: "Workflow not found" });
       }
+      const run = await workflow.getWorkflowRunById(runId);
+      if (!run) {
+        throw new HTTPException(404, { message: "Workflow run not found" });
+      }
+      await validateRunOwnership(run, effectiveResourceId);
       await workflow.deleteWorkflowRunById(runId);
       return { message: "Workflow run deleted" };
     } catch (error) {
@@ -400,7 +426,7 @@ var DELETE_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
 });
 var CREATE_WORKFLOW_RUN_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/create-run",
+  path: "/workflows/:workflowId/create-run",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: optionalRunIdSchema,
@@ -409,8 +435,10 @@ var CREATE_WORKFLOW_RUN_ROUTE = createRoute({
   summary: "Create workflow run",
   description: "Creates a new workflow execution instance with an optional custom run ID",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, resourceId, disableScorers }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, resourceId, disableScorers, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -418,7 +446,7 @@ var CREATE_WORKFLOW_RUN_ROUTE = createRoute({
       if (!workflow) {
         throw new HTTPException(404, { message: "Workflow not found" });
       }
-      const run = await workflow.createRun({ runId, resourceId, disableScorers });
+      const run = await workflow.createRun({ runId, resourceId: effectiveResourceId, disableScorers });
       return { runId: run.runId };
     } catch (error) {
       return handleError(error, "Error creating workflow run");
@@ -427,7 +455,7 @@ var CREATE_WORKFLOW_RUN_ROUTE = createRoute({
 });
 var STREAM_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/stream",
+  path: "/workflows/:workflowId/stream",
   responseType: "stream",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -435,8 +463,10 @@ var STREAM_WORKFLOW_ROUTE = createRoute({
   summary: "Stream workflow execution",
   description: "Executes a workflow and streams the results in real-time",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, resourceId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, resourceId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -448,8 +478,8 @@ var STREAM_WORKFLOW_ROUTE = createRoute({
         throw new HTTPException(404, { message: "Workflow not found" });
       }
       const serverCache = mastra.getServerCache();
-      const run = await workflow.createRun({ runId, resourceId });
-      const result = run.stream(params);
+      const run = await workflow.createRun({ runId, resourceId: effectiveResourceId });
+      const result = run.stream({ ...params, requestContext });
       return result.fullStream.pipeThrough(
         new TransformStream({
           transform(chunk, controller) {
@@ -469,7 +499,7 @@ var STREAM_WORKFLOW_ROUTE = createRoute({
 });
 var RESUME_STREAM_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/resume-stream",
+  path: "/workflows/:workflowId/resume-stream",
   responseType: "stream",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -478,8 +508,10 @@ var RESUME_STREAM_WORKFLOW_ROUTE = createRoute({
   summary: "Resume workflow stream",
   description: "Resumes a suspended workflow execution and continues streaming results",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -494,9 +526,10 @@ var RESUME_STREAM_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
       const serverCache = mastra.getServerCache();
-      const stream = _run.resumeStream(params).fullStream.pipeThrough(
+      const stream = _run.resumeStream({ ...params, requestContext }).fullStream.pipeThrough(
         new TransformStream({
           transform(chunk, controller) {
             if (serverCache) {
@@ -516,7 +549,7 @@ var RESUME_STREAM_WORKFLOW_ROUTE = createRoute({
 });
 var START_ASYNC_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/start-async",
+  path: "/workflows/:workflowId/start-async",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: optionalRunIdSchema,
@@ -525,8 +558,10 @@ var START_ASYNC_WORKFLOW_ROUTE = createRoute({
   summary: "Start workflow asynchronously",
   description: "Starts a workflow execution asynchronously without streaming results",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, resourceId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -534,8 +569,8 @@ var START_ASYNC_WORKFLOW_ROUTE = createRoute({
       if (!workflow) {
         throw new HTTPException(404, { message: "Workflow not found" });
       }
-      const _run = await workflow.createRun({ runId });
-      const result = await _run.start(params);
+      const _run = await workflow.createRun({ runId, resourceId: effectiveResourceId });
+      const result = await _run.start({ ...params, requestContext });
       return result;
     } catch (error) {
       return handleError(error, "Error starting async workflow");
@@ -544,7 +579,7 @@ var START_ASYNC_WORKFLOW_ROUTE = createRoute({
 });
 var START_WORKFLOW_RUN_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/start",
+  path: "/workflows/:workflowId/start",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -553,8 +588,10 @@ var START_WORKFLOW_RUN_ROUTE = createRoute({
   summary: "Start specific workflow run",
   description: "Starts execution of a specific workflow run by ID",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -569,9 +606,11 @@ var START_WORKFLOW_RUN_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
       void _run.start({
-        ...params
+        ...params,
+        requestContext
       });
       return { message: "Workflow run started" };
     } catch (e) {
@@ -581,7 +620,7 @@ var START_WORKFLOW_RUN_ROUTE = createRoute({
 });
 var OBSERVE_STREAM_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/observe",
+  path: "/workflows/:workflowId/observe",
   responseType: "stream",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -589,8 +628,10 @@ var OBSERVE_STREAM_WORKFLOW_ROUTE = createRoute({
   summary: "Observe workflow stream",
   description: "Observes and streams updates from an already running workflow execution",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -605,6 +646,7 @@ var OBSERVE_STREAM_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
       const serverCache = mastra.getServerCache();
       if (!serverCache) {
@@ -651,7 +693,7 @@ var OBSERVE_STREAM_WORKFLOW_ROUTE = createRoute({
 });
 var RESUME_ASYNC_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/resume-async",
+  path: "/workflows/:workflowId/resume-async",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -660,8 +702,10 @@ var RESUME_ASYNC_WORKFLOW_ROUTE = createRoute({
   summary: "Resume workflow asynchronously",
   description: "Resumes a suspended workflow execution asynchronously without streaming",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -676,8 +720,9 @@ var RESUME_ASYNC_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
-      const result = await _run.resume(params);
+      const result = await _run.resume({ ...params, requestContext });
       return result;
     } catch (error) {
       return handleError(error, "Error resuming workflow step");
@@ -686,7 +731,7 @@ var RESUME_ASYNC_WORKFLOW_ROUTE = createRoute({
 });
 var RESUME_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/resume",
+  path: "/workflows/:workflowId/resume",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -695,8 +740,10 @@ var RESUME_WORKFLOW_ROUTE = createRoute({
   summary: "Resume workflow",
   description: "Resumes a suspended workflow execution from a specific step",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -711,8 +758,9 @@ var RESUME_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
-      void _run.resume(params);
+      void _run.resume({ ...params, requestContext });
       return { message: "Workflow run resumed" };
     } catch (error) {
       return handleError(error, "Error resuming workflow");
@@ -721,7 +769,7 @@ var RESUME_WORKFLOW_ROUTE = createRoute({
 });
 var RESTART_ASYNC_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/restart-async",
+  path: "/workflows/:workflowId/restart-async",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -730,8 +778,10 @@ var RESTART_ASYNC_WORKFLOW_ROUTE = createRoute({
   summary: "Restart workflow asynchronously",
   description: "Restarts an active workflow execution asynchronously",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -746,8 +796,9 @@ var RESTART_ASYNC_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
-      const result = await _run.restart(params);
+      const result = await _run.restart({ ...params, requestContext });
       return result;
     } catch (error) {
       return handleError(error, "Error restarting workflow");
@@ -756,7 +807,7 @@ var RESTART_ASYNC_WORKFLOW_ROUTE = createRoute({
 });
 var RESTART_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/restart",
+  path: "/workflows/:workflowId/restart",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -765,8 +816,10 @@ var RESTART_WORKFLOW_ROUTE = createRoute({
   summary: "Restart workflow",
   description: "Restarts an active workflow execution",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -781,8 +834,9 @@ var RESTART_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
-      void _run.restart(params);
+      void _run.restart({ ...params, requestContext });
       return { message: "Workflow run restarted" };
     } catch (error) {
       return handleError(error, "Error restarting workflow");
@@ -791,13 +845,14 @@ var RESTART_WORKFLOW_ROUTE = createRoute({
 });
 var RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/restart-all-active-workflow-runs-async",
+  path: "/workflows/:workflowId/restart-all-active-workflow-runs-async",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   responseSchema: workflowControlResponseSchema,
   summary: "Restart all active workflow runs asynchronously",
   description: "Restarts all active workflow runs asynchronously",
   tags: ["Workflows"],
+  requiresAuth: true,
   handler: async ({ mastra, workflowId }) => {
     try {
       if (!workflowId) {
@@ -816,13 +871,14 @@ var RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE = createRoute({
 });
 var RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/restart-all-active-workflow-runs",
+  path: "/workflows/:workflowId/restart-all-active-workflow-runs",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   responseSchema: workflowControlResponseSchema,
   summary: "Restart all active workflow runs",
   description: "Restarts all active workflow runs",
   tags: ["Workflows"],
+  requiresAuth: true,
   handler: async ({ mastra, workflowId }) => {
     try {
       if (!workflowId) {
@@ -841,7 +897,7 @@ var RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE = createRoute({
 });
 var TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/time-travel-async",
+  path: "/workflows/:workflowId/time-travel-async",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -850,8 +906,10 @@ var TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE = createRoute({
   summary: "Time travel workflow asynchronously",
   description: "Time travels a workflow run asynchronously without streaming",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -866,8 +924,9 @@ var TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
-      const result = await _run.timeTravel(params);
+      const result = await _run.timeTravel({ ...params, requestContext });
       return result;
     } catch (error) {
       return handleError(error, "Error time traveling workflow");
@@ -876,7 +935,7 @@ var TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE = createRoute({
 });
 var TIME_TRAVEL_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/time-travel",
+  path: "/workflows/:workflowId/time-travel",
   responseType: "json",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -885,8 +944,10 @@ var TIME_TRAVEL_WORKFLOW_ROUTE = createRoute({
   summary: "Time travel workflow",
   description: "Time travels a workflow run, starting from a specific step",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -901,8 +962,9 @@ var TIME_TRAVEL_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
-      void _run.timeTravel(params);
+      void _run.timeTravel({ ...params, requestContext });
       return { message: "Workflow run time travel started" };
     } catch (error) {
       return handleError(error, "Error time traveling workflow");
@@ -911,7 +973,7 @@ var TIME_TRAVEL_WORKFLOW_ROUTE = createRoute({
 });
 var TIME_TRAVEL_STREAM_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/time-travel-stream",
+  path: "/workflows/:workflowId/time-travel-stream",
   responseType: "stream",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
@@ -919,8 +981,10 @@ var TIME_TRAVEL_STREAM_WORKFLOW_ROUTE = createRoute({
   summary: "Time travel workflow stream",
   description: "Time travels a workflow run, starting from a specific step, and streams the results in real-time",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -931,9 +995,14 @@ var TIME_TRAVEL_STREAM_WORKFLOW_ROUTE = createRoute({
       if (!workflow) {
         throw new HTTPException(404, { message: "Workflow not found" });
       }
+      const existingRun = await workflow.getWorkflowRunById(runId);
+      if (!existingRun) {
+        throw new HTTPException(404, { message: "Workflow run not found" });
+      }
+      await validateRunOwnership(existingRun, effectiveResourceId);
       const serverCache = mastra.getServerCache();
-      const run = await workflow.createRun({ runId });
-      const result = run.timeTravelStream(params);
+      const run = await workflow.createRun({ runId, resourceId: existingRun.resourceId });
+      const result = run.timeTravelStream({ ...params, requestContext });
       return result.fullStream.pipeThrough(
         new TransformStream({
           transform(chunk, controller) {
@@ -953,15 +1022,17 @@ var TIME_TRAVEL_STREAM_WORKFLOW_ROUTE = createRoute({
 });
 var CANCEL_WORKFLOW_RUN_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/runs/:runId/cancel",
+  path: "/workflows/:workflowId/runs/:runId/cancel",
   responseType: "json",
   pathParamSchema: workflowRunPathParams,
   responseSchema: workflowControlResponseSchema,
   summary: "Cancel workflow run",
   description: "Cancels an in-progress workflow execution",
   tags: ["Workflows"],
-  handler: async ({ mastra, workflowId, runId }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -976,6 +1047,7 @@ var CANCEL_WORKFLOW_RUN_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
       await _run.cancel();
       return { message: "Workflow run cancelled" };
@@ -986,17 +1058,19 @@ var CANCEL_WORKFLOW_RUN_ROUTE = createRoute({
 });
 var STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/stream-legacy",
+  path: "/workflows/:workflowId/stream-legacy",
   responseType: "stream",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
   bodySchema: streamWorkflowBodySchema,
   responseSchema: streamResponseSchema,
   summary: "[DEPRECATED] Stream workflow with legacy format",
-  description: "Legacy endpoint for streaming workflow execution. Use /api/workflows/:workflowId/stream instead.",
+  description: "Legacy endpoint for streaming workflow execution. Use /workflows/:workflowId/stream instead.",
   tags: ["Workflows", "Legacy"],
-  handler: async ({ mastra, workflowId, runId, ...params }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, resourceId, requestContext, ...params }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -1008,9 +1082,10 @@ var STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
         throw new HTTPException(404, { message: "Workflow not found" });
       }
       const serverCache = mastra.getServerCache();
-      const run = await workflow.createRun({ runId });
+      const run = await workflow.createRun({ runId, resourceId: effectiveResourceId });
       const result = run.streamLegacy({
         ...params,
+        requestContext,
         onChunk: async (chunk) => {
           if (serverCache) {
             const cacheKey = runId;
@@ -1026,16 +1101,18 @@ var STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
 });
 var OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
   method: "POST",
-  path: "/api/workflows/:workflowId/observe-stream-legacy",
+  path: "/workflows/:workflowId/observe-stream-legacy",
   responseType: "stream",
   pathParamSchema: workflowIdPathParams,
   queryParamSchema: runIdSchema,
   responseSchema: streamResponseSchema,
   summary: "[DEPRECATED] Observe workflow stream with legacy format",
-  description: "Legacy endpoint for observing workflow stream. Use /api/workflows/:workflowId/observe instead.",
+  description: "Legacy endpoint for observing workflow stream. Use /workflows/:workflowId/observe instead.",
   tags: ["Workflows", "Legacy"],
-  handler: async ({ mastra, workflowId, runId }) => {
+  requiresAuth: true,
+  handler: async ({ mastra, workflowId, runId, requestContext }) => {
     try {
+      const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
       if (!workflowId) {
         throw new HTTPException(400, { message: "Workflow ID is required" });
       }
@@ -1050,6 +1127,7 @@ var OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
       if (!run) {
         throw new HTTPException(404, { message: "Workflow run not found" });
       }
+      await validateRunOwnership(run, effectiveResourceId);
       const _run = await workflow.createRun({ runId, resourceId: run.resourceId });
       const serverCache = mastra.getServerCache();
       if (!serverCache) {
@@ -1071,5 +1149,5 @@ var OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
 });
 
 export { CANCEL_WORKFLOW_RUN_ROUTE, CREATE_WORKFLOW_RUN_ROUTE, DELETE_WORKFLOW_RUN_BY_ID_ROUTE, GET_WORKFLOW_BY_ID_ROUTE, GET_WORKFLOW_RUN_BY_ID_ROUTE, LIST_WORKFLOWS_ROUTE, LIST_WORKFLOW_RUNS_ROUTE, OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE, OBSERVE_STREAM_WORKFLOW_ROUTE, RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE, RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE, RESTART_ASYNC_WORKFLOW_ROUTE, RESTART_WORKFLOW_ROUTE, RESUME_ASYNC_WORKFLOW_ROUTE, RESUME_STREAM_WORKFLOW_ROUTE, RESUME_WORKFLOW_ROUTE, START_ASYNC_WORKFLOW_ROUTE, START_WORKFLOW_RUN_ROUTE, STREAM_LEGACY_WORKFLOW_ROUTE, STREAM_WORKFLOW_ROUTE, TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE, TIME_TRAVEL_STREAM_WORKFLOW_ROUTE, TIME_TRAVEL_WORKFLOW_ROUTE, createWorkflowRunResponseSchema, listWorkflowRunsQuerySchema, listWorkflowsResponseSchema, resumeBodySchema, startAsyncWorkflowBodySchema, streamLegacyWorkflowBodySchema, streamWorkflowBodySchema, workflowControlResponseSchema, workflowExecutionResultSchema, workflowInfoSchema, workflowRunResultQuerySchema, workflowRunResultSchema, workflowRunsResponseSchema, workflows_exports };
-//# sourceMappingURL=chunk-4R2Z655M.js.map
-//# sourceMappingURL=chunk-4R2Z655M.js.map
+//# sourceMappingURL=chunk-F2WTCJ5C.js.map
+//# sourceMappingURL=chunk-F2WTCJ5C.js.map