@mastra/server 1.31.1-alpha.0 → 1.32.0-alpha.2

package/dist/{chunk-JQUNK754.js → chunk-OJ7SK6PH.js}

@@ -1,10 +1,11 @@
-import { memoryStatusResponseSchema, getMemoryStatusQuerySchema, memoryConfigResponseSchema, getMemoryConfigQuerySchema, getObservationalMemoryResponseSchema, getObservationalMemoryQuerySchema, awaitBufferStatusResponseSchema, awaitBufferStatusBodySchema, listThreadsResponseSchema, listThreadsQuerySchema, getThreadByIdResponseSchema, getThreadByIdQuerySchema, threadIdPathParams, listMessagesResponseSchema, listMessagesQuerySchema, getWorkingMemoryResponseSchema, getWorkingMemoryQuerySchema, saveMessagesResponseSchema, saveMessagesBodySchema, agentIdQuerySchema, createThreadBodySchema, updateThreadBodySchema, deleteThreadResponseSchema, deleteThreadQuerySchema, cloneThreadResponseSchema, cloneThreadBodySchema, updateWorkingMemoryResponseSchema, updateWorkingMemoryBodySchema, deleteMessagesResponseSchema, deleteMessagesBodySchema, deleteMessagesQuerySchema, searchMemoryResponseSchema, searchMemoryQuerySchema, getMemoryStatusNetworkQuerySchema, listThreadsNetworkQuerySchema, getThreadByIdNetworkQuerySchema, listMessagesNetworkQuerySchema, saveMessagesNetworkQuerySchema, createThreadNetworkQuerySchema, updateThreadNetworkQuerySchema, deleteThreadNetworkQuerySchema, deleteMessagesNetworkQuerySchema } from './chunk-CJFSLVFA.js';
 import { isGatewayAgentAsync, getGatewayClient, toLocalOMRecord, toLocalThread, toLocalMessage } from './chunk-UTRP4B2Q.js';
-import { getEffectiveResourceId, getEffectiveThreadId, validateBody, validateThreadOwnership } from './chunk-JZNOIGOQ.js';
-import { createRoute } from './chunk-PA2BYLKF.js';
+import { memoryStatusResponseSchema, getMemoryStatusQuerySchema, memoryConfigResponseSchema, getMemoryConfigQuerySchema, getObservationalMemoryResponseSchema, getObservationalMemoryQuerySchema, awaitBufferStatusResponseSchema, awaitBufferStatusBodySchema, listThreadsResponseSchema, listThreadsQuerySchema, getThreadByIdResponseSchema, getThreadByIdQuerySchema, threadIdPathParams, listMessagesResponseSchema, listMessagesQuerySchema, getWorkingMemoryResponseSchema, getWorkingMemoryQuerySchema, saveMessagesResponseSchema, saveMessagesBodySchema, agentIdQuerySchema, createThreadBodySchema, updateThreadBodySchema, deleteThreadResponseSchema, deleteThreadQuerySchema, cloneThreadResponseSchema, cloneThreadBodySchema, updateWorkingMemoryResponseSchema, updateWorkingMemoryBodySchema, deleteMessagesResponseSchema, deleteMessagesBodySchema, deleteMessagesQuerySchema, searchMemoryResponseSchema, searchMemoryQuerySchema, getMemoryStatusNetworkQuerySchema, listThreadsNetworkQuerySchema, getThreadByIdNetworkQuerySchema, listMessagesNetworkQuerySchema, saveMessagesNetworkQuerySchema, createThreadNetworkQuerySchema, updateThreadNetworkQuerySchema, deleteThreadNetworkQuerySchema, deleteMessagesNetworkQuerySchema } from './chunk-CJFSLVFA.js';
+import { getEffectiveResourceId, getEffectiveThreadId, validateBody, enforceThreadAccess } from './chunk-K2KWDOYR.js';
 import { handleError } from './chunk-P23KBWKB.js';
+import { createRoute } from './chunk-KDUX3YN3.js';
 import { HTTPException } from './chunk-6QWQZI4Q.js';
 import { __export } from './chunk-PR4QN5HX.js';
+import { MastraFGAPermissions } from '@mastra/core/auth/ee';
 import { generateEmptyFromSchema } from '@mastra/core/utils';
 
 // src/server/handlers/memory.ts
@@ -37,6 +38,82 @@ __export(memory_exports, {
   UPDATE_WORKING_MEMORY_ROUTE: () => UPDATE_WORKING_MEMORY_ROUTE,
   getTextContent: () => getTextContent
 });
+function hasFGAUser(requestContext) {
+  const user = requestContext?.get("user");
+  return !!user && typeof user === "object";
+}
+function shouldFilterThreadsWithFGA(mastra, requestContext) {
+  return !!mastra.getServer?.()?.fga && hasFGAUser(requestContext);
+}
+async function filterAccessibleThreads({
+  mastra,
+  requestContext,
+  threads
+}) {
+  const fgaProvider = mastra.getServer?.()?.fga;
+  if (!fgaProvider || !hasFGAUser(requestContext) || threads.length === 0) {
+    return threads;
+  }
+  return fgaProvider.filterAccessible(
+    requestContext.get("user"),
+    threads,
+    "thread",
+    MastraFGAPermissions.MEMORY_READ
+  );
+}
+function paginateThreads({
+  threads,
+  page,
+  perPage
+}) {
+  const effectivePage = page ?? 0;
+  const effectivePerPage = perPage ?? 100;
+  if (effectivePerPage === false) {
+    return {
+      threads,
+      page: effectivePage,
+      perPage: false,
+      total: threads.length,
+      hasMore: false
+    };
+  }
+  const start = effectivePage * effectivePerPage;
+  const pagedThreads = threads.slice(start, start + effectivePerPage);
+  return {
+    threads: pagedThreads,
+    page: effectivePage,
+    perPage: effectivePerPage,
+    total: threads.length,
+    hasMore: start + pagedThreads.length < threads.length
+  };
+}
+async function enforceDeleteMessagesThreadAccess({
+  mastra,
+  requestContext,
+  memoryStore,
+  messageIds,
+  effectiveResourceId
+}) {
+  const { messages } = await memoryStore.listMessagesById({ messageIds });
+  const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
+  if (messages.some((message) => !message.threadId)) {
+    throw new HTTPException(403, { message: "Access denied: unable to verify message thread access" });
+  }
+  for (const threadId of threadIds) {
+    const thread = await memoryStore.getThreadById({ threadId });
+    if (!thread) {
+      throw new HTTPException(403, { message: "Access denied: unable to verify message thread access" });
+    }
+    await enforceThreadAccess({
+      mastra,
+      requestContext,
+      threadId,
+      thread,
+      effectiveResourceId,
+      permission: MastraFGAPermissions.MEMORY_DELETE
+    });
+  }
+}
 function getTextContent(message) {
   if (typeof message.content === "string") {
     return message.content;
@@ -497,6 +574,28 @@ var LIST_THREADS_ROUTE = createRoute({
       if (agent && isGateway) {
         const gwClient = getGatewayClient();
         if (gwClient) {
+          if (shouldFilterThreadsWithFGA(mastra, requestContext)) {
+            const initialResult = await gwClient.listThreads({
+              resourceId: effectiveResourceId,
+              limit: 1,
+              offset: 0
+            });
+            const allThreads = initialResult.total > 0 ? (await gwClient.listThreads({
+              resourceId: effectiveResourceId,
+              limit: initialResult.total,
+              offset: 0
+            })).threads.map(toLocalThread) : [];
+            const accessibleThreads = await filterAccessibleThreads({
+              mastra,
+              requestContext,
+              threads: allThreads
+            });
+            return paginateThreads({
+              threads: accessibleThreads,
+              page,
+              perPage
+            });
+          }
           const effectivePage = page ?? 0;
           const effectivePerPage = perPage ?? 100;
           const offset = effectivePage * effectivePerPage;
@@ -523,25 +622,61 @@ var LIST_THREADS_ROUTE = createRoute({
       }
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext, allowMissingAgent: true });
       if (memory) {
-        const result = await memory.listThreads({
-          filter,
+        const result = await memory.listThreads(
+          shouldFilterThreadsWithFGA(mastra, requestContext) ? {
+            filter,
+            perPage: false,
+            orderBy
+          } : {
+            filter,
+            page,
+            perPage,
+            orderBy
+          }
+        );
+        if (!shouldFilterThreadsWithFGA(mastra, requestContext)) {
+          return result;
+        }
+        const accessibleThreads = await filterAccessibleThreads({
+          mastra,
+          requestContext,
+          threads: result.threads
+        });
+        return paginateThreads({
+          threads: accessibleThreads,
           page,
-          perPage,
-          orderBy
+          perPage
         });
-        return result;
       }
       const storage = getStorageFromContext({ mastra });
       if (storage) {
         const memoryStore = await storage.getStore("memory");
         if (memoryStore) {
-          const result = await memoryStore.listThreads({
-            filter,
+          const result = await memoryStore.listThreads(
+            shouldFilterThreadsWithFGA(mastra, requestContext) ? {
+              filter,
+              perPage: false,
+              orderBy
+            } : {
+              filter,
+              page,
+              perPage,
+              orderBy
+            }
+          );
+          if (!shouldFilterThreadsWithFGA(mastra, requestContext)) {
+            return result;
+          }
+          const accessibleThreads = await filterAccessibleThreads({
+            mastra,
+            requestContext,
+            threads: result.threads
+          });
+          return paginateThreads({
+            threads: accessibleThreads,
             page,
-            perPage,
-            orderBy
+            perPage
           });
-          return result;
         }
       }
       throw new HTTPException(400, { message: "Memory is not initialized" });
@@ -583,7 +718,13 @@ var GET_THREAD_BY_ID_ROUTE = createRoute({
             };
           }
           const thread = toLocalThread(result.thread);
-          await validateThreadOwnership(thread, effectiveResourceId);
+          await enforceThreadAccess({
+            mastra,
+            requestContext,
+            threadId: effectiveThreadId,
+            thread,
+            effectiveResourceId
+          });
           return thread;
         }
       }
@@ -593,7 +734,13 @@ var GET_THREAD_BY_ID_ROUTE = createRoute({
         if (!thread) {
           throw new HTTPException(404, { message: "Thread not found" });
         }
-        await validateThreadOwnership(thread, effectiveResourceId);
+        await enforceThreadAccess({
+          mastra,
+          requestContext,
+          threadId: effectiveThreadId,
+          thread,
+          effectiveResourceId
+        });
         return thread;
       }
       const storage = getStorageFromContext({ mastra });
@@ -604,7 +751,13 @@ var GET_THREAD_BY_ID_ROUTE = createRoute({
           if (!thread) {
             throw new HTTPException(404, { message: "Thread not found" });
           }
-          await validateThreadOwnership(thread, effectiveResourceId);
+          await enforceThreadAccess({
+            mastra,
+            requestContext,
+            threadId: effectiveThreadId,
+            thread,
+            effectiveResourceId
+          });
           return thread;
         }
       }
@@ -651,7 +804,13 @@ var LIST_MESSAGES_ROUTE = createRoute({
         if (gwClient) {
           const threadResult = await gwClient.getThread(effectiveThreadId);
           if (threadResult) {
-            await validateThreadOwnership(toLocalThread(threadResult.thread), effectiveResourceId);
+            await enforceThreadAccess({
+              mastra,
+              requestContext,
+              threadId: effectiveThreadId,
+              thread: toLocalThread(threadResult.thread),
+              effectiveResourceId
+            });
           }
           const effectivePage = page ?? 0;
           const effectivePerPage = perPage ?? 100;
@@ -676,7 +835,13 @@ var LIST_MESSAGES_ROUTE = createRoute({
         if (!thread) {
           throw new HTTPException(404, { message: "Thread not found" });
         }
-        await validateThreadOwnership(thread, effectiveResourceId);
+        await enforceThreadAccess({
+          mastra,
+          requestContext,
+          threadId: effectiveThreadId,
+          thread,
+          effectiveResourceId
+        });
         const result = await memory.recall({
           threadId: effectiveThreadId,
           resourceId: effectiveResourceId,
@@ -697,7 +862,13 @@ var LIST_MESSAGES_ROUTE = createRoute({
           if (!thread) {
             throw new HTTPException(404, { message: "Thread not found" });
           }
-          await validateThreadOwnership(thread, effectiveResourceId);
+          await enforceThreadAccess({
+            mastra,
+            requestContext,
+            threadId: effectiveThreadId,
+            thread,
+            effectiveResourceId
+          });
           const result = await memoryStore.listMessages({
             threadId: effectiveThreadId,
             resourceId: effectiveResourceId,
@@ -741,8 +912,16 @@ var GET_WORKING_MEMORY_ROUTE = createRoute({
         return { workingMemory: null, source: "thread", workingMemoryTemplate: null, threadExists: false };
       }
       const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-      if (thread) {
-        await validateThreadOwnership(thread, effectiveResourceId);
+      const config = memory.getMergedThreadConfig(memoryConfig || {});
+      const source = config.workingMemory?.scope !== "thread" && effectiveResourceId ? "resource" : "thread";
+      if (thread || source === "resource") {
+        await enforceThreadAccess({
+          mastra,
+          requestContext,
+          threadId: effectiveThreadId,
+          thread,
+          effectiveResourceId
+        });
       }
       const threadExists = !!thread;
       const template = await memory.getWorkingMemoryTemplate({ memoryConfig });
@@ -752,8 +931,6 @@ var GET_WORKING_MEMORY_ROUTE = createRoute({
         resourceId: effectiveResourceId,
         memoryConfig
       });
-      const config = memory.getMergedThreadConfig(memoryConfig || {});
-      const source = config.workingMemory?.scope !== "thread" && effectiveResourceId ? "resource" : "thread";
       return { workingMemory, source, workingMemoryTemplate, threadExists };
     } catch (error) {
       return handleError(error, "Error getting working memory");
@@ -784,6 +961,20 @@ var SAVE_MESSAGES_ROUTE = createRoute({
       if (!Array.isArray(messages)) {
         throw new HTTPException(400, { message: "Messages should be an array" });
       }
+      const resourceIdByThread = /* @__PURE__ */ new Map();
+      for (const message of messages) {
+        if (!message.threadId || !message.resourceId) {
+          continue;
+        }
+        const existingResourceId = resourceIdByThread.get(message.threadId);
+        if (!existingResourceId) {
+          resourceIdByThread.set(message.threadId, message.resourceId);
+        } else if (existingResourceId !== message.resourceId) {
+          throw new HTTPException(400, {
+            message: "All messages for the same threadId must use the same resourceId."
+          });
+        }
+      }
       const invalidMessages = messages.filter((message) => !message.threadId || !message.resourceId);
       if (invalidMessages.length > 0) {
         throw new HTTPException(400, {
@@ -800,7 +991,27 @@ var SAVE_MESSAGES_ROUTE = createRoute({
         const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
         for (const threadId of threadIds) {
           const thread = await memory.getThreadById({ threadId });
-          await validateThreadOwnership(thread, effectiveResourceId);
+          await enforceThreadAccess({
+            mastra,
+            requestContext,
+            threadId,
+            thread,
+            effectiveResourceId,
+            permission: MastraFGAPermissions.MEMORY_WRITE
+          });
+        }
+      } else {
+        const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
+        for (const threadId of threadIds) {
+          const thread = await memory.getThreadById({ threadId });
+          await enforceThreadAccess({
+            mastra,
+            requestContext,
+            threadId,
+            thread,
+            effectiveResourceId: resourceIdByThread.get(threadId),
+            permission: MastraFGAPermissions.MEMORY_WRITE
+          });
         }
       }
       const processedMessages = messages.map((message) => ({
@@ -829,13 +1040,21 @@ var CREATE_THREAD_ROUTE = createRoute({
   handler: async ({ mastra, agentId, resourceId, title, metadata, threadId, requestContext }) => {
     try {
       const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      const effectiveThreadId = threadId ?? mastra.generateId();
+      validateBody({ resourceId: effectiveResourceId });
+      await enforceThreadAccess({
+        mastra,
+        requestContext,
+        threadId: effectiveThreadId,
+        effectiveResourceId,
+        permission: MastraFGAPermissions.MEMORY_WRITE
+      });
       const agent = await getAgentFromContext({ mastra, agentId, requestContext });
       if (agent && await isGatewayAgentAsync(agent)) {
         const gwClient = getGatewayClient();
         if (gwClient) {
-          validateBody({ resourceId: effectiveResourceId });
           const result2 = await gwClient.createThread({
-            id: threadId,
+            id: effectiveThreadId,
             resourceId: effectiveResourceId,
             title,
             metadata
@@ -847,12 +1066,11 @@ var CREATE_THREAD_ROUTE = createRoute({
       if (!memory) {
         throw new HTTPException(400, { message: "Memory is not initialized" });
       }
-      validateBody({ resourceId: effectiveResourceId });
       const result = await memory.createThread({
         resourceId: effectiveResourceId,
         title,
         metadata,
-        threadId
+        threadId: effectiveThreadId
       });
       return result;
     } catch (error) {
@@ -883,7 +1101,14 @@ var UPDATE_THREAD_ROUTE = createRoute({
         if (gwClient) {
           const existing = await gwClient.getThread(effectiveThreadId);
           if (existing) {
-            await validateThreadOwnership(toLocalThread(existing.thread), effectiveResourceId);
+            await enforceThreadAccess({
+              mastra,
+              requestContext,
+              threadId: effectiveThreadId,
+              thread: toLocalThread(existing.thread),
+              effectiveResourceId,
+              permission: MastraFGAPermissions.MEMORY_WRITE
+            });
           }
           const result2 = await gwClient.updateThread(effectiveThreadId, { title, metadata });
           if (!result2) {
@@ -901,7 +1126,14 @@ var UPDATE_THREAD_ROUTE = createRoute({
       if (!thread) {
         throw new HTTPException(404, { message: "Thread not found" });
       }
-      await validateThreadOwnership(thread, effectiveResourceId);
+      await enforceThreadAccess({
+        mastra,
+        requestContext,
+        threadId: effectiveThreadId,
+        thread,
+        effectiveResourceId,
+        permission: MastraFGAPermissions.MEMORY_WRITE
+      });
       const updatedThread = {
         ...thread,
         title: title || thread.title,
@@ -943,7 +1175,14 @@ var DELETE_THREAD_ROUTE = createRoute({
         if (gwClient) {
           const existing = await gwClient.getThread(effectiveThreadId);
           if (existing) {
-            await validateThreadOwnership(toLocalThread(existing.thread), effectiveResourceId);
+            await enforceThreadAccess({
+              mastra,
+              requestContext,
+              threadId: effectiveThreadId,
+              thread: toLocalThread(existing.thread),
+              effectiveResourceId,
+              permission: MastraFGAPermissions.MEMORY_DELETE
+            });
           }
           const deleteResult = await gwClient.deleteThread(effectiveThreadId);
           if (!deleteResult.ok) {
@@ -960,7 +1199,14 @@ var DELETE_THREAD_ROUTE = createRoute({
       if (!thread) {
         throw new HTTPException(404, { message: "Thread not found" });
       }
-      await validateThreadOwnership(thread, effectiveResourceId);
+      await enforceThreadAccess({
+        mastra,
+        requestContext,
+        threadId: effectiveThreadId,
+        thread,
+        effectiveResourceId,
+        permission: MastraFGAPermissions.MEMORY_DELETE
+      });
       await memory.deleteThread(effectiveThreadId);
       return { result: "Thread deleted" };
     } catch (error) {
@@ -984,6 +1230,7 @@ var CLONE_THREAD_ROUTE = createRoute({
     try {
       const effectiveThreadId = getEffectiveThreadId(requestContext, threadId);
       const effectiveResourceId = getEffectiveResourceId(requestContext, resourceId);
+      const effectiveNewThreadId = newThreadId ?? mastra.generateId();
       validateBody({ threadId: effectiveThreadId });
       const memory = await getMemoryFromContext({ mastra, agentId, requestContext });
       if (!memory) {
@@ -993,12 +1240,25 @@ var CLONE_THREAD_ROUTE = createRoute({
       if (!sourceThread) {
         throw new HTTPException(404, { message: "Source thread not found" });
       }
-      await validateThreadOwnership(sourceThread, effectiveResourceId);
+      const cloneResourceId = effectiveResourceId ?? sourceThread.resourceId ?? void 0;
+      await enforceThreadAccess({
+        mastra,
+        requestContext,
+        threadId: effectiveThreadId,
+        thread: sourceThread,
+        effectiveResourceId
+      });
+      await enforceThreadAccess({
+        mastra,
+        requestContext,
+        threadId: effectiveNewThreadId,
+        effectiveResourceId: cloneResourceId,
+        permission: MastraFGAPermissions.MEMORY_WRITE
+      });
       const result = await memory.cloneThread({
         sourceThreadId: effectiveThreadId,
-        newThreadId,
-        // Use effective resourceId for the cloned thread
-        resourceId: effectiveResourceId,
+        newThreadId: effectiveNewThreadId,
+        resourceId: cloneResourceId,
         title,
         metadata,
         options
@@ -1038,7 +1298,14 @@ var UPDATE_WORKING_MEMORY_ROUTE = createRoute({
       if (!thread) {
         throw new HTTPException(404, { message: "Thread not found" });
       }
-      await validateThreadOwnership(thread, effectiveResourceId);
+      await enforceThreadAccess({
+        mastra,
+        requestContext,
+        threadId: effectiveThreadId,
+        thread,
+        effectiveResourceId,
+        permission: MastraFGAPermissions.MEMORY_WRITE
+      });
       await memory.updateWorkingMemory({
         threadId: effectiveThreadId,
         resourceId: effectiveResourceId,
@@ -1087,16 +1354,28 @@ var DELETE_MESSAGES_ROUTE = createRoute({
         if (!memoryStore) {
           throw new HTTPException(400, { message: "Memory is not initialized" });
         }
-        const { messages } = await memoryStore.listMessagesById({ messageIds: stringIds });
-        const threadIds = [...new Set(messages.map((m) => m.threadId).filter(Boolean))];
-        for (const threadId of threadIds) {
-          const thread = await memoryStore.getThreadById({ threadId });
-          if (thread && thread.resourceId && thread.resourceId !== effectiveResourceId) {
-            throw new HTTPException(403, {
-              message: "Access denied: message belongs to a thread owned by a different resource"
-            });
-          }
+        await enforceDeleteMessagesThreadAccess({
+          mastra,
+          requestContext,
+          memoryStore,
+          messageIds: stringIds,
+          effectiveResourceId
+        });
+      } else if (stringIds.length > 0) {
+        const storage = memory?.storage || getStorageFromContext({ mastra });
+        if (!storage) {
+          throw new HTTPException(400, { message: "Memory is not initialized" });
+        }
+        const memoryStore = await storage.getStore("memory");
+        if (!memoryStore) {
+          throw new HTTPException(400, { message: "Memory is not initialized" });
         }
+        await enforceDeleteMessagesThreadAccess({
+          mastra,
+          requestContext,
+          memoryStore,
+          messageIds: stringIds
+        });
       }
       if (memory) {
         await memory.deleteMessages(normalizedIds);
@@ -1153,6 +1432,30 @@ var SEARCH_MEMORY_ROUTE = createRoute({
       const hasSemanticRecall = !!config?.semanticRecall;
       const resourceScope = typeof config?.semanticRecall === "object" ? config?.semanticRecall?.scope !== "thread" : true;
       const searchResults = [];
+      let accessibleThreadsForResource;
+      let accessibleThreadIds;
+      if (resourceScope && effectiveResourceId && shouldFilterThreadsWithFGA(mastra, requestContext)) {
+        const { threads } = await memory.listThreads({
+          filter: { resourceId: effectiveResourceId },
+          perPage: false,
+          orderBy: { field: "updatedAt", direction: "DESC" }
+        });
+        accessibleThreadsForResource = await filterAccessibleThreads({
+          mastra,
+          requestContext,
+          threads
+        });
+        accessibleThreadIds = new Set(accessibleThreadsForResource.map((thread) => thread.id));
+        if (accessibleThreadsForResource.length === 0) {
+          return {
+            results: [],
+            count: 0,
+            query: searchQuery,
+            searchScope: resourceScope ? "resource" : "thread",
+            searchType: hasSemanticRecall ? "semantic" : "text"
+          };
+        }
+      }
       if (effectiveThreadId && !resourceScope) {
         const thread = await memory.getThreadById({ threadId: effectiveThreadId });
         if (!thread) {
@@ -1164,16 +1467,22 @@ var SEARCH_MEMORY_ROUTE = createRoute({
             searchType: hasSemanticRecall ? "semantic" : "text"
           };
         }
-        await validateThreadOwnership(thread, effectiveResourceId);
+        await enforceThreadAccess({
+          mastra,
+          requestContext,
+          threadId: effectiveThreadId,
+          thread,
+          effectiveResourceId
+        });
       }
       let searchThreadId = effectiveThreadId;
       if (!searchThreadId) {
-        const { threads } = await memory.listThreads({
+        const threads = accessibleThreadsForResource ?? (await memory.listThreads({
           filter: { resourceId: effectiveResourceId },
           page: 0,
           perPage: 1,
           orderBy: { field: "updatedAt", direction: "DESC" }
-        });
+        })).threads;
         if (threads.length === 0) {
           return {
             results: [],
@@ -1205,12 +1514,24 @@ var SEARCH_MEMORY_ROUTE = createRoute({
         threadConfig: config,
         vectorSearchString: threadConfig.semanticRecall && searchQuery ? searchQuery : void 0
       });
+      const accessibleMessages = accessibleThreadIds ? result.messages.filter(
+        (message) => accessibleThreadIds.has(message.threadId || searchThreadId)
+      ) : result.messages;
+      if (accessibleMessages.length === 0) {
+        return {
+          results: [],
+          count: 0,
+          query: searchQuery,
+          searchScope: resourceScope ? "resource" : "thread",
+          searchType: hasSemanticRecall ? "semantic" : "text"
+        };
+      }
       const threadIds = Array.from(
-        new Set(result.messages.map((m) => m.threadId || searchThreadId).filter(Boolean))
+        new Set(accessibleMessages.map((m) => m.threadId || searchThreadId).filter(Boolean))
       );
       const fetched = await Promise.all(threadIds.map((id) => memory.getThreadById({ threadId: id })));
       const threadMap = new Map(fetched.filter(Boolean).map((t) => [t.id, t]));
-      for (const msg of result.messages) {
+      for (const msg of accessibleMessages) {
         const content = getTextContent(msg);
         const msgThreadId = msg.threadId || searchThreadId;
         const thread = threadMap.get(msgThreadId);
@@ -1373,5 +1694,5 @@ var DELETE_MESSAGES_NETWORK_ROUTE = createRoute({
 });
 
 export { AWAIT_BUFFER_STATUS_ROUTE, CLONE_THREAD_ROUTE, CREATE_THREAD_NETWORK_ROUTE, CREATE_THREAD_ROUTE, DELETE_MESSAGES_NETWORK_ROUTE, DELETE_MESSAGES_ROUTE, DELETE_THREAD_NETWORK_ROUTE, DELETE_THREAD_ROUTE, GET_MEMORY_CONFIG_ROUTE, GET_MEMORY_STATUS_NETWORK_ROUTE, GET_MEMORY_STATUS_ROUTE, GET_OBSERVATIONAL_MEMORY_ROUTE, GET_THREAD_BY_ID_NETWORK_ROUTE, GET_THREAD_BY_ID_ROUTE, GET_WORKING_MEMORY_ROUTE, LIST_MESSAGES_NETWORK_ROUTE, LIST_MESSAGES_ROUTE, LIST_THREADS_NETWORK_ROUTE, LIST_THREADS_ROUTE, SAVE_MESSAGES_NETWORK_ROUTE, SAVE_MESSAGES_ROUTE, SEARCH_MEMORY_ROUTE, UPDATE_THREAD_NETWORK_ROUTE, UPDATE_THREAD_ROUTE, UPDATE_WORKING_MEMORY_ROUTE, getTextContent, memory_exports };
-//# sourceMappingURL=chunk-JQUNK754.js.map
-//# sourceMappingURL=chunk-JQUNK754.js.map
+//# sourceMappingURL=chunk-OJ7SK6PH.js.map
+//# sourceMappingURL=chunk-OJ7SK6PH.js.map