@mastra/server 1.29.2-alpha.0 → 1.30.0-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,125 @@
 # @mastra/server
 
+## 1.30.0-alpha.1
+
+### Minor Changes
+
+- Update peer dependencies to match core package version bump (1.0.5) ([#12557](https://github.com/mastra-ai/mastra/pull/12557))
+
+### Patch Changes
+
+- Fixed a regression in 1.29.0 where configuring an agent with channel adapters (e.g. `channels.adapters.slack`) caused server startup to crash with a "Custom API route ... must not start with /api" error. The custom-route prefix validation now skips framework-generated webhook routes. ([#15952](https://github.com/mastra-ai/mastra/pull/15952))
+
+- Fix MCP client support in the agent editor: ([#15945](https://github.com/mastra-ai/mastra/pull/15945))
+  - MCP client form dirty state: Save button now enables after adding/removing MCP clients
+  - MCP tool name matching: Both bare and namespaced tool names are matched correctly
+  - Auth token forwarding: Token from cookie or header is forwarded to auth-protected MCP servers
+  - String interpolation: Request context variables in system prompts now resolve correctly
+
+- Add durable agents with resumable streams ([#12557](https://github.com/mastra-ai/mastra/pull/12557))
+
+  Durable agents make agent execution resilient to disconnections, crashes, and long-running operations.
+
+  ### The Problem
+
+  Standard agent streaming has two fragility points:
+  1. **Connection drops** - If a client disconnects mid-stream (network blip, browser refresh, mobile app backgrounded), all subsequent events are lost. The client has no way to "catch up" on what they missed.
+  2. **Long-running operations** - Agent loops with tool calls can take minutes. Holding an HTTP connection open that long is unreliable. If the server restarts or the connection times out, the work is lost.
+
+  ### The Solution
+
+  **Resumable streams** solve connection drops. Every event is cached with a sequential index. If a client disconnects at event 5, they can reconnect and request events starting from index 6. They receive cached events immediately, then continue with live events as they arrive.
+
+  **Durable execution** solves long-running operations. Instead of executing the agent loop directly in the HTTP request, execution happens in a workflow engine (built-in evented engine or Inngest). The HTTP request just subscribes to events. If the connection drops, execution continues. The client can reconnect anytime to observe progress.
+
+  ### Usage
+
+  Wrap any existing `Agent` with durability using factory functions:
+
+  ```typescript
+  import { Agent } from '@mastra/core/agent';
+  import { createDurableAgent } from '@mastra/core/agent/durable';
+
+  const agent = new Agent({
+    id: 'my-agent',
+    model: openai('gpt-4'),
+    instructions: 'You are helpful',
+  });
+
+  const durableAgent = createDurableAgent({ agent });
+  ```
+
+  **Factory functions for different execution strategies:**
+
+  | Factory                                  | Execution                           | Use Case                        |
+  | ---------------------------------------- | ----------------------------------- | ------------------------------- |
+  | `createDurableAgent({ agent })`          | Local, synchronous                  | Development, simple deployments |
+  | `createEventedAgent({ agent })`          | Fire-and-forget via workflow engine | Long-running operations         |
+  | `createInngestAgent({ agent, inngest })` | Inngest-powered                     | Production, distributed systems |
+
+  ### Resumable Streams
+
+  ```typescript
+  // Start streaming
+  const { runId, output } = await durableAgent.stream('Analyze this data...');
+
+  // Client disconnects at event 5...
+
+  // Reconnect and resume from where we left off
+  const { output: resumed } = await durableAgent.observe(runId, { offset: 6 });
+  // Receives events 6, 7, 8... from cache, then continues with live events
+  ```
+
+  ### PubSub and Cache
+
+  Durable agents use two infrastructure components:
+
+  | Component  | Purpose                                   | Default               |
+  | ---------- | ----------------------------------------- | --------------------- |
+  | **PubSub** | Real-time event delivery during streaming | `EventEmitterPubSub`  |
+  | **Cache**  | Stores events for replay on reconnection  | `InMemoryServerCache` |
+
+  When `stream()` is called, events flow through pubsub in real-time. The cache stores each event with a sequential index. When `observe()` is called, missed events replay from cache before continuing with live events.
+
+  **Configure via Mastra instance (recommended):**
+
+  ```typescript
+  const mastra = new Mastra({
+    cache: new RedisServerCache({ url: 'redis://...' }),
+    pubsub: new RedisPubSub({ url: 'redis://...' }),
+    agents: {
+      // Inherits cache and pubsub from Mastra
+      myAgent: createDurableAgent({ agent }),
+    },
+  });
+  ```
+
+  **Configure per-agent (overrides Mastra):**
+
+  ```typescript
+  const durableAgent = createDurableAgent({
+    agent,
+    cache: new RedisServerCache({ url: 'redis://...' }),
+    pubsub: new RedisPubSub({ url: 'redis://...' }),
+  });
+  ```
+
+  **Disable caching (streams won't be resumable):**
+
+  ```typescript
+  const durableAgent = createDurableAgent({ agent, cache: false });
+  ```
+
+  For single-instance deployments, the defaults work fine. For multi-instance deployments (load balancer, horizontal scaling), use Redis-backed implementations so any instance can serve reconnection requests.
+
+  ### Class Hierarchy
+  - `DurableAgent` extends `Agent` - base class with resumable streams
+  - `EventedAgent` extends `DurableAgent` - fire-and-forget execution
+  - `InngestAgent` extends `DurableAgent` - Inngest-powered execution
+
+- Updated dependencies [[`920c757`](https://github.com/mastra-ai/mastra/commit/920c75799c6bd71787d86deaf654a35af4c839ca), [`1fe2533`](https://github.com/mastra-ai/mastra/commit/1fe2533c4382ca6858aac7c4b63e888c2eac6541), [`f8694b6`](https://github.com/mastra-ai/mastra/commit/f8694b6fa0b7a5cde71d794c3bbef4957c55bcb8)]:
+  - @mastra/core@1.30.0-alpha.1
+
 ## 1.29.2-alpha.0
 
 ### Patch Changes

package/dist/{chunk-LWK57QIA.cjs → chunk-2CFH32YO.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkI3BHHWHT_cjs = require('./chunk-I3BHHWHT.cjs');
+var chunkEFW6MWXU_cjs = require('./chunk-EFW6MWXU.cjs');
 var chunk64ITUOXI_cjs = require('./chunk-64ITUOXI.cjs');
 
 // src/server/handlers/utils.ts
@@ -42,11 +42,11 @@ function parseFilters(filters) {
   );
 }
 function getEffectiveResourceId(requestContext, clientResourceId) {
-  const contextResourceId = requestContext?.get(chunkI3BHHWHT_cjs.MASTRA_RESOURCE_ID_KEY);
+  const contextResourceId = requestContext?.get(chunkEFW6MWXU_cjs.MASTRA_RESOURCE_ID_KEY);
   return contextResourceId || clientResourceId;
 }
 function getEffectiveThreadId(requestContext, clientThreadId) {
-  const contextThreadId = requestContext?.get(chunkI3BHHWHT_cjs.MASTRA_THREAD_ID_KEY);
+  const contextThreadId = requestContext?.get(chunkEFW6MWXU_cjs.MASTRA_THREAD_ID_KEY);
   return contextThreadId || clientThreadId;
 }
 async function validateThreadOwnership(thread, effectiveResourceId) {
@@ -68,5 +68,5 @@ exports.sanitizeBody = sanitizeBody;
 exports.validateBody = validateBody;
 exports.validateRunOwnership = validateRunOwnership;
 exports.validateThreadOwnership = validateThreadOwnership;
-//# sourceMappingURL=chunk-LWK57QIA.cjs.map
-//# sourceMappingURL=chunk-LWK57QIA.cjs.map
+//# sourceMappingURL=chunk-2CFH32YO.cjs.map
+//# sourceMappingURL=chunk-2CFH32YO.cjs.map

package/dist/{chunk-LWK57QIA.cjs.map → chunk-2CFH32YO.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/handlers/utils.ts"],"names":["HTTPException","MASTRA_RESOURCE_ID_KEY","MASTRA_THREAD_ID_KEY"],"mappings":";;;;;;AAKO,SAAS,aAAa,IAAA,EAA+B;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA,CAA+B,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/F,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,GAAG,CAAA,aAAA,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAIA,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,CAAE,CAAC,CAAA,EAAG,CAAA;AAAA,EAC3E;AACF;AAOO,SAAS,YAAA,CAAa,MAA+B,cAAA,EAA0B;AACpF,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAA,CACd,KAAA,EACA,YAAA,GAAuB,GAAA,EACvB,MAAc,GAAA,EACE;AAChB,EAAA,MAAM,UAAA,GAAA,CAAc,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAEpD,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,MAAA,CAAO,YAAY,GAAG,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,YAAA;AAC1B,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,OAAA,EAA4E;AACvG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAAA,CACX,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,CAAC,OAAO,CAAA,EAAG,GAAA,CAAI,CAAC,IAAA,KAAiB;AACnE,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,OAAO,CAAC,KAAK,KAAK,CAAA;AAAA,IACpB,CAAC;AAAA,GACH;AACF;AAUO,SAAS,sBAAA,CACd,gBACA,gBAAA,EACoB;AACpB,EAAA,MAAM,iBAAA,GAAoB,cAAA,EAAgB,GAAA,CAAIC,wCAAsB,CAAA;AACpE,EAAA,OAAO,iBAAA,IAAqB,gBAAA;AAC9B;AAMO,SAAS,oBAAA,CACd,gBACA,cAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,cAAA,EAAgB,GAAA,CAAIC,sCAAoB,CAAA;AAChE,EAAA,OAAO,eAAA,IAAmB,cAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,QACA,mBAAA,EACe;AACf,EAAA,IAAI,UAAU,mBAAA,IAAuB,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,eAAe,mBAAA,EAAqB;AACnG,IAAA,MAAM,IAAIF,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,yDAAyD,CAAA;AAAA,EACnG;AACF;AAMA,eAAsB,oBAAA,CACpB,KACA,mBAAA,EACe;AACf,EAAA,IAAI,OAAO,mBAAA,IAAuB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,eAAe,mBAAA,EAAqB;AAC1F,IAAA,MAAM,IAAIA,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,+DAA+D,CAAA;AAAA,EACzG;AACF","file":"chunk-LWK57QIA.cjs","sourcesContent":["import type { RequestContext } from '@mastra/core/di';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from '../constants';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"]}
+{"version":3,"sources":["../src/server/handlers/utils.ts"],"names":["HTTPException","MASTRA_RESOURCE_ID_KEY","MASTRA_THREAD_ID_KEY"],"mappings":";;;;;;AAKO,SAAS,aAAa,IAAA,EAA+B;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA,CAA+B,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/F,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,GAAG,CAAA,aAAA,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAIA,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,CAAE,CAAC,CAAA,EAAG,CAAA;AAAA,EAC3E;AACF;AAOO,SAAS,YAAA,CAAa,MAA+B,cAAA,EAA0B;AACpF,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAA,CACd,KAAA,EACA,YAAA,GAAuB,GAAA,EACvB,MAAc,GAAA,EACE;AAChB,EAAA,MAAM,UAAA,GAAA,CAAc,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAEpD,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,MAAA,CAAO,YAAY,GAAG,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,YAAA;AAC1B,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,OAAA,EAA4E;AACvG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAAA,CACX,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,CAAC,OAAO,CAAA,EAAG,GAAA,CAAI,CAAC,IAAA,KAAiB;AACnE,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,OAAO,CAAC,KAAK,KAAK,CAAA;AAAA,IACpB,CAAC;AAAA,GACH;AACF;AAUO,SAAS,sBAAA,CACd,gBACA,gBAAA,EACoB;AACpB,EAAA,MAAM,iBAAA,GAAoB,cAAA,EAAgB,GAAA,CAAIC,wCAAsB,CAAA;AACpE,EAAA,OAAO,iBAAA,IAAqB,gBAAA;AAC9B;AAMO,SAAS,oBAAA,CACd,gBACA,cAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,cAAA,EAAgB,GAAA,CAAIC,sCAAoB,CAAA;AAChE,EAAA,OAAO,eAAA,IAAmB,cAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,QACA,mBAAA,EACe;AACf,EAAA,IAAI,UAAU,mBAAA,IAAuB,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,eAAe,mBAAA,EAAqB;AACnG,IAAA,MAAM,IAAIF,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,yDAAyD,CAAA;AAAA,EACnG;AACF;AAMA,eAAsB,oBAAA,CACpB,KACA,mBAAA,EACe;AACf,EAAA,IAAI,OAAO,mBAAA,IAAuB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,eAAe,mBAAA,EAAqB;AAC1F,IAAA,MAAM,IAAIA,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,+DAA+D,CAAA;AAAA,EACzG;AACF","file":"chunk-2CFH32YO.cjs","sourcesContent":["import type { RequestContext } from '@mastra/core/di';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from '../constants';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"]}

package/dist/{chunk-BR6MQNNL.js → chunk-2HVAN7FF.js}

@@ -1040,7 +1040,7 @@ function imageSize(input) {
   throw new TypeError(`unsupported file type: ${type}`);
 }
 
-// ../memory/dist/chunk-XLJGXHP5.js
+// ../memory/dist/chunk-4C4ERX6N.js
 var OM_DEBUG_LOG = process.env.OM_DEBUG ? join(process.cwd(), "om-debug.log") : null;
 function omDebug(msg) {
   if (!OM_DEBUG_LOG) return;
@@ -10157,6 +10157,15 @@ var ObservationalMemoryProcessor = class {
       if (readOnly) {
         return messageList;
       }
+      const activeTurn = state.__omTurn ?? this.turn;
+      if (activeTurn && activeTurn.messageList !== messageList) {
+        await activeTurn.end().catch(() => {
+        });
+        if (this.turn === activeTurn) {
+          this.turn = void 0;
+        }
+        state.__omTurn = void 0;
+      }
       if (!this.turn || !state.__omTurn) {
         if (this.turn && !state.__omTurn) {
           await this.turn.end().catch(() => {
@@ -10319,5 +10328,5 @@ function getObservationsAsOf(activeObservations, asOf) {
 }
 
 export { ModelByInputTokens, OBSERVER_SYSTEM_PROMPT, ObservationalMemory, ObservationalMemoryProcessor, TokenCounter, buildObserverPrompt, buildObserverSystemPrompt, combineObservationGroupRanges, deriveObservationGroupProvenance, e, estimateTokenCount, extractCurrentTask, formatMessagesForObserver, formatToolResultForObserver, getObservationsAsOf, hasCurrentTaskSection, injectAnchorIds, optimizeObservationsForContext, parseAnchorId, parseObservationGroups, parseObserverOutput, reconcileObservationGroupsFromReflection, renderObservationGroupsForReflection, resolveToolResultValue, stripEphemeralAnchorIds, stripObservationGroups, truncateStringByTokens, wrapInObservationGroup };
-//# sourceMappingURL=chunk-BR6MQNNL.js.map
-//# sourceMappingURL=chunk-BR6MQNNL.js.map
+//# sourceMappingURL=chunk-2HVAN7FF.js.map
+//# sourceMappingURL=chunk-2HVAN7FF.js.map