@mastra/server 1.29.2-alpha.0 → 1.30.0

package/dist/{chunk-VLNRGJEM.js → chunk-JZNOIGOQ.js}

@@ -1,4 +1,4 @@
-import { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from './chunk-JVQ5EXNJ.js';
+import { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from './chunk-OJRAH5VV.js';
 import { HTTPException } from './chunk-6QWQZI4Q.js';
 
 // src/server/handlers/utils.ts
@@ -59,5 +59,5 @@ async function validateRunOwnership(run, effectiveResourceId) {
 }
 
 export { getEffectiveResourceId, getEffectiveThreadId, parseFilters, parsePerPage, sanitizeBody, validateBody, validateRunOwnership, validateThreadOwnership };
-//# sourceMappingURL=chunk-VLNRGJEM.js.map
-//# sourceMappingURL=chunk-VLNRGJEM.js.map
+//# sourceMappingURL=chunk-JZNOIGOQ.js.map
+//# sourceMappingURL=chunk-JZNOIGOQ.js.map

package/dist/{chunk-VLNRGJEM.js.map → chunk-JZNOIGOQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/handlers/utils.ts"],"names":[],"mappings":";;;;AAKO,SAAS,aAAa,IAAA,EAA+B;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA,CAA+B,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/F,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,GAAG,CAAA,aAAA,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,CAAE,CAAC,CAAA,EAAG,CAAA;AAAA,EAC3E;AACF;AAOO,SAAS,YAAA,CAAa,MAA+B,cAAA,EAA0B;AACpF,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAA,CACd,KAAA,EACA,YAAA,GAAuB,GAAA,EACvB,MAAc,GAAA,EACE;AAChB,EAAA,MAAM,UAAA,GAAA,CAAc,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAEpD,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,MAAA,CAAO,YAAY,GAAG,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,YAAA;AAC1B,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,OAAA,EAA4E;AACvG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAAA,CACX,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,CAAC,OAAO,CAAA,EAAG,GAAA,CAAI,CAAC,IAAA,KAAiB;AACnE,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,OAAO,CAAC,KAAK,KAAK,CAAA;AAAA,IACpB,CAAC;AAAA,GACH;AACF;AAUO,SAAS,sBAAA,CACd,gBACA,gBAAA,EACoB;AACpB,EAAA,MAAM,iBAAA,GAAoB,cAAA,EAAgB,GAAA,CAAI,sBAAsB,CAAA;AACpE,EAAA,OAAO,iBAAA,IAAqB,gBAAA;AAC9B;AAMO,SAAS,oBAAA,CACd,gBACA,cAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,cAAA,EAAgB,GAAA,CAAI,oBAAoB,CAAA;AAChE,EAAA,OAAO,eAAA,IAAmB,cAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,QACA,mBAAA,EACe;AACf,EAAA,IAAI,UAAU,mBAAA,IAAuB,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,eAAe,mBAAA,EAAqB;AACnG,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,yDAAyD,CAAA;AAAA,EACnG;AACF;AAMA,eAAsB,oBAAA,CACpB,KACA,mBAAA,EACe;AACf,EAAA,IAAI,OAAO,mBAAA,IAAuB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,eAAe,mBAAA,EAAqB;AAC1F,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,+DAA+D,CAAA;AAAA,EACzG;AACF","file":"chunk-VLNRGJEM.js","sourcesContent":["import type { RequestContext } from '@mastra/core/di';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from '../constants';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"]}
+{"version":3,"sources":["../src/server/handlers/utils.ts"],"names":[],"mappings":";;;;AAKO,SAAS,aAAa,IAAA,EAA+B;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA,CAA+B,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/F,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,GAAG,CAAA,aAAA,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,CAAE,CAAC,CAAA,EAAG,CAAA;AAAA,EAC3E;AACF;AAOO,SAAS,YAAA,CAAa,MAA+B,cAAA,EAA0B;AACpF,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAA,CACd,KAAA,EACA,YAAA,GAAuB,GAAA,EACvB,MAAc,GAAA,EACE;AAChB,EAAA,MAAM,UAAA,GAAA,CAAc,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAEpD,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,MAAA,CAAO,YAAY,GAAG,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,YAAA;AAC1B,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,OAAA,EAA4E;AACvG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAAA,CACX,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,CAAC,OAAO,CAAA,EAAG,GAAA,CAAI,CAAC,IAAA,KAAiB;AACnE,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,OAAO,CAAC,KAAK,KAAK,CAAA;AAAA,IACpB,CAAC;AAAA,GACH;AACF;AAUO,SAAS,sBAAA,CACd,gBACA,gBAAA,EACoB;AACpB,EAAA,MAAM,iBAAA,GAAoB,cAAA,EAAgB,GAAA,CAAI,sBAAsB,CAAA;AACpE,EAAA,OAAO,iBAAA,IAAqB,gBAAA;AAC9B;AAMO,SAAS,oBAAA,CACd,gBACA,cAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,cAAA,EAAgB,GAAA,CAAI,oBAAoB,CAAA;AAChE,EAAA,OAAO,eAAA,IAAmB,cAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,QACA,mBAAA,EACe;AACf,EAAA,IAAI,UAAU,mBAAA,IAAuB,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,eAAe,mBAAA,EAAqB;AACnG,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,yDAAyD,CAAA;AAAA,EACnG;AACF;AAMA,eAAsB,oBAAA,CACpB,KACA,mBAAA,EACe;AACf,EAAA,IAAI,OAAO,mBAAA,IAAuB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,eAAe,mBAAA,EAAqB;AAC1F,IAAA,MAAM,IAAI,aAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,+DAA+D,CAAA;AAAA,EACzG;AACF","file":"chunk-JZNOIGOQ.js","sourcesContent":["import type { RequestContext } from '@mastra/core/di';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from '../constants';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"]}