@mastra/server 1.32.0-alpha.1 → 1.32.0-alpha.2

package/dist/{chunk-O6YA7VM3.cjs → chunk-RL34ZMLF.cjs}

@@ -1,21 +1,21 @@
 'use strict';
 
-var chunkHXICAUTW_cjs = require('./chunk-HXICAUTW.cjs');
-var chunkWYLVJSGR_cjs = require('./chunk-WYLVJSGR.cjs');
-var chunkGUWIV3ZN_cjs = require('./chunk-GUWIV3ZN.cjs');
-var chunkYJQYJ5WD_cjs = require('./chunk-YJQYJ5WD.cjs');
-var chunk3S5WOAYR_cjs = require('./chunk-3S5WOAYR.cjs');
-var chunk5UKYK7YK_cjs = require('./chunk-5UKYK7YK.cjs');
+var chunkK7IVZQKI_cjs = require('./chunk-K7IVZQKI.cjs');
+var chunkXEERRXWL_cjs = require('./chunk-XEERRXWL.cjs');
 var chunkB34S64RC_cjs = require('./chunk-B34S64RC.cjs');
+var chunk7LAFXMXB_cjs = require('./chunk-7LAFXMXB.cjs');
 var chunk64ITUOXI_cjs = require('./chunk-64ITUOXI.cjs');
 var chunkEFW6MWXU_cjs = require('./chunk-EFW6MWXU.cjs');
+var chunkHXICAUTW_cjs = require('./chunk-HXICAUTW.cjs');
+var chunkGUWIV3ZN_cjs = require('./chunk-GUWIV3ZN.cjs');
+var chunkWYLVJSGR_cjs = require('./chunk-WYLVJSGR.cjs');
 var chunkO7I5CWRX_cjs = require('./chunk-O7I5CWRX.cjs');
 var agent = require('@mastra/core/agent');
 var durable = require('@mastra/core/agent/durable');
+var ee = require('@mastra/core/auth/ee');
 var di = require('@mastra/core/di');
 var error = require('@mastra/core/error');
 var llm = require('@mastra/core/llm');
-var requestContext = require('@mastra/core/request-context');
 var zodToJson = require('@mastra/core/utils/zod-to-json');
 var v4 = require('zod/v4');
 
@@ -62,11 +62,11 @@ chunkO7I5CWRX_cjs.__export(agents_exports, {
 });
 function stashVersionOverrides(ctx, versions) {
   if (!versions) return;
-  const existingRaw = ctx.get(requestContext.MASTRA_VERSIONS_KEY);
+  const existingRaw = ctx.get(di.MASTRA_VERSIONS_KEY);
   const existing = existingRaw && typeof existingRaw === "object" && !Array.isArray(existingRaw) ? existingRaw : void 0;
   const merged = di.mergeVersionOverrides(existing, versions);
   if (merged) {
-    ctx.set(requestContext.MASTRA_VERSIONS_KEY, merged);
+    ctx.set(di.MASTRA_VERSIONS_KEY, merged);
   }
 }
 function isProviderConnected(providerId, customProviders) {
@@ -108,7 +108,7 @@ function schemaToJsonSchema(schema) {
   if (!schema) {
     return void 0;
   }
-  return chunk5UKYK7YK_cjs.standardSchemaToJSONSchema(chunk5UKYK7YK_cjs.toStandardSchema5(schema), { target: "draft-2020-12" });
+  return chunk7LAFXMXB_cjs.standardSchemaToJSONSchema(chunk7LAFXMXB_cjs.toStandardSchema5(schema), { target: "draft-2020-12" });
 }
 async function getSerializedAgentTools(tools, partial = false) {
   return Object.entries(tools || {}).reduce((acc, [key, tool]) => {
@@ -122,19 +122,19 @@ async function getSerializedAgentTools(tools, partial = false) {
           resolveLazySchema(tool.inputSchema)
         );
         if (inputSchema !== void 0) {
-          inputSchemaForReturn = chunkYJQYJ5WD_cjs.stringify(inputSchema);
+          inputSchemaForReturn = chunkK7IVZQKI_cjs.stringify(inputSchema);
         }
         const outputSchema = schemaToJsonSchema(
           resolveLazySchema(tool.outputSchema)
         );
         if (outputSchema !== void 0) {
-          outputSchemaForReturn = chunkYJQYJ5WD_cjs.stringify(outputSchema);
+          outputSchemaForReturn = chunkK7IVZQKI_cjs.stringify(outputSchema);
         }
         const requestContextSchema = schemaToJsonSchema(
           resolveLazySchema(tool.requestContextSchema)
         );
         if (requestContextSchema !== void 0) {
-          requestContextSchemaForReturn = chunkYJQYJ5WD_cjs.stringify(requestContextSchema);
+          requestContextSchemaForReturn = chunkK7IVZQKI_cjs.stringify(requestContextSchema);
         }
       } catch (error) {
         console.error(`Error getting serialized tool`, {
@@ -387,7 +387,7 @@ async function formatAgentList({
   let serializedRequestContextSchema;
   if (agent.requestContextSchema) {
     try {
-      serializedRequestContextSchema = chunkYJQYJ5WD_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
+      serializedRequestContextSchema = chunkK7IVZQKI_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
     } catch (error) {
       logger.error("Error serializing requestContextSchema for agent", { agentName: agent.name, error });
     }
@@ -571,7 +571,7 @@ async function formatAgent({
   let serializedRequestContextSchema;
   if (agent.requestContextSchema) {
     try {
-      serializedRequestContextSchema = chunkYJQYJ5WD_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
+      serializedRequestContextSchema = chunkK7IVZQKI_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
     } catch (error) {
       mastra.getLogger().error("Error serializing requestContextSchema for agent", { agentName: agent.name, error });
     }
@@ -601,7 +601,7 @@ async function formatAgent({
     ...agent.toRawConfig()?.status ? { status: agent.toRawConfig().status } : {}
   };
 }
-var LIST_AGENTS_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var LIST_AGENTS_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "GET",
   path: "/agents",
   responseType: "json",
@@ -613,7 +613,7 @@ var LIST_AGENTS_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   description: "Returns a list of all available agents in the system (both code-defined and stored)",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: "agents:read",
+  requiresPermission: ee.MastraFGAPermissions.AGENTS_READ,
   handler: async ({ mastra, requestContext, partial }) => {
     try {
       const codeAgents = mastra.listAgents();
@@ -677,13 +677,30 @@ var LIST_AGENTS_ROUTE = chunk5UKYK7YK_cjs.createRoute({
         const logger2 = mastra.getLogger();
         logger2.debug("Could not fetch stored agents", { error: storageError });
       }
+      const fgaProvider = mastra.getServer?.()?.fga;
+      const user = requestContext?.get("user");
+      if (fgaProvider && user) {
+        const agentList = Object.values(serializedAgents);
+        const accessible = await fgaProvider.filterAccessible(
+          user,
+          agentList,
+          "agent",
+          ee.MastraFGAPermissions.AGENTS_READ
+        );
+        const accessibleSet = new Set(accessible.map((a) => a.id));
+        for (const id of Object.keys(serializedAgents)) {
+          if (!accessibleSet.has(id)) {
+            delete serializedAgents[id];
+          }
+        }
+      }
       return serializedAgents;
     } catch (error) {
       return chunkB34S64RC_cjs.handleError(error, "Error getting agents");
     }
   }
 });
-var GET_AGENT_BY_ID_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var GET_AGENT_BY_ID_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "GET",
   path: "/agents/:agentId",
   responseType: "json",
@@ -694,7 +711,8 @@ var GET_AGENT_BY_ID_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   description: "Returns details for a specific agent including configuration, tools, and memory settings. Use query params to control which stored config version is used for overrides: ?status=published (active version, default), ?status=draft (latest draft), or ?versionId=<id> (specific version). Use either status or versionId, not both.",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: "agents:read",
+  requiresPermission: ee.MastraFGAPermissions.AGENTS_READ,
+  fga: { resourceType: "agent", resourceIdParam: "agentId", permission: ee.MastraFGAPermissions.AGENTS_READ },
   handler: async ({ agentId, mastra, requestContext, status, versionId }) => {
     try {
       const versionOptions = versionId ? { versionId } : status ? { status } : void 0;
@@ -712,7 +730,7 @@ var GET_AGENT_BY_ID_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var CLONE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var CLONE_AGENT_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/clone",
   responseType: "json",
@@ -739,7 +757,7 @@ var CLONE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
         agentId,
         versionOptions: extractVersionOptions(requestContext)
       });
-      const cloneId = chunkYJQYJ5WD_cjs.toSlug(newId || `${agentId}-clone`);
+      const cloneId = chunkK7IVZQKI_cjs.toSlug(newId || `${agentId}-clone`);
       const result = await editor.agent.clone(agent, {
         newId: cloneId,
         newName,
@@ -753,7 +771,7 @@ var CLONE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var GENERATE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var GENERATE_AGENT_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/generate",
   responseType: "json",
@@ -764,12 +782,12 @@ var GENERATE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   description: "Executes an agent with the provided messages and returns the complete response",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: "agents:execute",
+  requiresPermission: ee.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ agentId, mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
-      chunk3S5WOAYR_cjs.validateBody({ messages });
+      chunkXEERRXWL_cjs.validateBody({ messages });
       const agent = await getAgentFromSystem({
         mastra,
         agentId,
@@ -790,13 +808,22 @@ var GENERATE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       let authorizedMemoryOption = memoryOption;
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
-        const effectiveResourceId = chunk3S5WOAYR_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
-        const effectiveThreadId = chunk3S5WOAYR_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
-        if (effectiveThreadId && effectiveResourceId) {
+        const effectiveResourceId = chunkXEERRXWL_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        const effectiveThreadId = chunkXEERRXWL_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+        if (effectiveThreadId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
           if (memoryInstance) {
             const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
-            await chunk3S5WOAYR_cjs.validateThreadOwnership(thread, effectiveResourceId);
+            if (thread) {
+              await chunkXEERRXWL_cjs.enforceThreadAccess({
+                mastra,
+                requestContext: serverRequestContext,
+                threadId: effectiveThreadId,
+                thread,
+                effectiveResourceId,
+                permission: ee.MastraFGAPermissions.MEMORY_WRITE
+              });
+            }
           }
         }
         authorizedMemoryOption = {
@@ -819,7 +846,7 @@ var GENERATE_AGENT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var GENERATE_LEGACY_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var GENERATE_LEGACY_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/generate-legacy",
   responseType: "json",
@@ -838,20 +865,29 @@ var GENERATE_LEGACY_ROUTE = chunk5UKYK7YK_cjs.createRoute({
         versionOptions: extractVersionOptions(requestContext),
         requestContext
       });
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const { messages, resourceId, resourceid, threadId, ...rest } = params;
       const clientResourceId = resourceId ?? resourceid;
-      const effectiveResourceId = chunk3S5WOAYR_cjs.getEffectiveResourceId(requestContext, clientResourceId);
-      const effectiveThreadId = chunk3S5WOAYR_cjs.getEffectiveThreadId(requestContext, threadId);
-      chunk3S5WOAYR_cjs.validateBody({ messages });
+      const effectiveResourceId = chunkXEERRXWL_cjs.getEffectiveResourceId(requestContext, clientResourceId);
+      const effectiveThreadId = chunkXEERRXWL_cjs.getEffectiveThreadId(requestContext, threadId);
+      chunkXEERRXWL_cjs.validateBody({ messages });
       if (effectiveThreadId && !effectiveResourceId || !effectiveThreadId && effectiveResourceId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Both threadId or resourceId must be provided" });
       }
-      if (effectiveThreadId && effectiveResourceId) {
+      if (effectiveThreadId) {
         const memory = await agent.getMemory({ requestContext });
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-          await chunk3S5WOAYR_cjs.validateThreadOwnership(thread, effectiveResourceId);
+          if (thread) {
+            await chunkXEERRXWL_cjs.enforceThreadAccess({
+              mastra,
+              requestContext,
+              threadId: effectiveThreadId,
+              thread,
+              effectiveResourceId,
+              permission: ee.MastraFGAPermissions.MEMORY_WRITE
+            });
+          }
         }
       }
       const result = await agent.generateLegacy(messages, {
@@ -866,7 +902,7 @@ var GENERATE_LEGACY_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var STREAM_GENERATE_LEGACY_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_GENERATE_LEGACY_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream-legacy",
   responseType: "datastream-response",
@@ -885,20 +921,29 @@ var STREAM_GENERATE_LEGACY_ROUTE = chunk5UKYK7YK_cjs.createRoute({
         versionOptions: extractVersionOptions(requestContext),
         requestContext
       });
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const { messages, resourceId, resourceid, threadId, ...rest } = params;
       const clientResourceId = resourceId ?? resourceid;
-      const effectiveResourceId = chunk3S5WOAYR_cjs.getEffectiveResourceId(requestContext, clientResourceId);
-      const effectiveThreadId = chunk3S5WOAYR_cjs.getEffectiveThreadId(requestContext, threadId);
-      chunk3S5WOAYR_cjs.validateBody({ messages });
+      const effectiveResourceId = chunkXEERRXWL_cjs.getEffectiveResourceId(requestContext, clientResourceId);
+      const effectiveThreadId = chunkXEERRXWL_cjs.getEffectiveThreadId(requestContext, threadId);
+      chunkXEERRXWL_cjs.validateBody({ messages });
       if (effectiveThreadId && !effectiveResourceId || !effectiveThreadId && effectiveResourceId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Both threadId or resourceId must be provided" });
       }
-      if (effectiveThreadId && effectiveResourceId) {
+      if (effectiveThreadId) {
         const memory = await agent.getMemory({ requestContext });
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-          await chunk3S5WOAYR_cjs.validateThreadOwnership(thread, effectiveResourceId);
+          if (thread) {
+            await chunkXEERRXWL_cjs.enforceThreadAccess({
+              mastra,
+              requestContext,
+              threadId: effectiveThreadId,
+              thread,
+              effectiveResourceId,
+              permission: ee.MastraFGAPermissions.MEMORY_WRITE
+            });
+          }
         }
       }
       const streamResult = await agent.streamLegacy(messages, {
@@ -920,7 +965,7 @@ var STREAM_GENERATE_LEGACY_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var GET_PROVIDERS_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var GET_PROVIDERS_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "GET",
   path: "/agents/providers",
   responseType: "json",
@@ -970,7 +1015,7 @@ var GET_PROVIDERS_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var GENERATE_AGENT_VNEXT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var GENERATE_AGENT_VNEXT_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/generate/vnext",
   responseType: "json",
@@ -983,7 +1028,7 @@ var GENERATE_AGENT_VNEXT_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   requiresAuth: true,
   handler: GENERATE_AGENT_ROUTE.handler
 });
-var STREAM_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_GENERATE_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream",
   responseType: "stream",
@@ -995,12 +1040,12 @@ var STREAM_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   description: "Executes an agent with the provided messages and streams the response in real-time",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: "agents:execute",
+  requiresPermission: ee.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
-      chunk3S5WOAYR_cjs.validateBody({ messages });
+      chunkXEERRXWL_cjs.validateBody({ messages });
       const agent = await getAgentFromSystem({
         mastra,
         agentId,
@@ -1021,13 +1066,22 @@ var STREAM_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       let authorizedMemoryOption = memoryOption;
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
-        const effectiveResourceId = chunk3S5WOAYR_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
-        const effectiveThreadId = chunk3S5WOAYR_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
-        if (effectiveThreadId && effectiveResourceId) {
+        const effectiveResourceId = chunkXEERRXWL_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        const effectiveThreadId = chunkXEERRXWL_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+        if (effectiveThreadId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
           if (memoryInstance) {
             const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
-            await chunk3S5WOAYR_cjs.validateThreadOwnership(thread, effectiveResourceId);
+            if (thread) {
+              await chunkXEERRXWL_cjs.enforceThreadAccess({
+                mastra,
+                requestContext: serverRequestContext,
+                threadId: effectiveThreadId,
+                thread,
+                effectiveResourceId,
+                permission: ee.MastraFGAPermissions.MEMORY_WRITE
+              });
+            }
           }
         }
         authorizedMemoryOption = {
@@ -1050,7 +1104,7 @@ var STREAM_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream-until-idle",
   responseType: "stream",
@@ -1062,12 +1116,12 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   description: "Executes an agent with the provided messages and streams the response in real-time, also listens for background task completions and streams them in real-time",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: "agents:execute",
+  requiresPermission: ee.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;
-      chunk3S5WOAYR_cjs.validateBody({ messages });
+      chunkXEERRXWL_cjs.validateBody({ messages });
       const agent = await getAgentFromSystem({
         mastra,
         agentId,
@@ -1087,13 +1141,13 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       let authorizedMemoryOption = memoryOption;
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
-        const effectiveResourceId = chunk3S5WOAYR_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
-        const effectiveThreadId = chunk3S5WOAYR_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+        const effectiveResourceId = chunkXEERRXWL_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        const effectiveThreadId = chunkXEERRXWL_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId && effectiveResourceId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
           if (memoryInstance) {
             const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
-            await chunk3S5WOAYR_cjs.validateThreadOwnership(thread, effectiveResourceId);
+            await chunkXEERRXWL_cjs.validateThreadOwnership(thread, effectiveResourceId);
           }
         }
         authorizedMemoryOption = {
@@ -1116,7 +1170,7 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream/vnext",
   responseType: "stream",
@@ -1130,7 +1184,7 @@ var STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   deprecated: true,
   handler: STREAM_GENERATE_ROUTE.handler
 });
-var OBSERVE_AGENT_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var OBSERVE_AGENT_STREAM_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/observe",
   responseType: "stream",
@@ -1217,7 +1271,7 @@ var OBSERVE_AGENT_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var APPROVE_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var APPROVE_TOOL_CALL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/approve-tool-call",
   responseType: "stream",
@@ -1242,7 +1296,7 @@ var APPROVE_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const streamResult = await agent.approveToolCall({
         ...params,
         requestContext,
@@ -1254,7 +1308,7 @@ var APPROVE_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var DECLINE_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var DECLINE_TOOL_CALL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/decline-tool-call",
   responseType: "stream",
@@ -1279,7 +1333,7 @@ var DECLINE_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const streamResult = await agent.declineToolCall({
         ...params,
         requestContext,
@@ -1291,7 +1345,7 @@ var DECLINE_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var RESUME_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var RESUME_STREAM_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/resume-stream",
   responseType: "stream",
@@ -1303,13 +1357,13 @@ var RESUME_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   description: "Resumes a suspended agent stream with custom resume data",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: "agents:execute",
+  requiresPermission: ee.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const {
         resumeData,
         runId,
@@ -1337,13 +1391,22 @@ var RESUME_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       stashVersionOverrides(serverRequestContext, versions);
       let authorizedMemoryOption = memoryOption;
       const clientThreadId = typeof memoryOption?.thread === "string" ? memoryOption.thread : memoryOption?.thread?.id;
-      const effectiveResourceId = chunk3S5WOAYR_cjs.getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
-      const effectiveThreadId = chunk3S5WOAYR_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
-      if (effectiveThreadId && effectiveResourceId) {
+      const effectiveResourceId = chunkXEERRXWL_cjs.getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
+      const effectiveThreadId = chunkXEERRXWL_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+      if (effectiveThreadId) {
         const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
         if (memoryInstance) {
           const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
-          await chunk3S5WOAYR_cjs.validateThreadOwnership(thread, effectiveResourceId);
+          if (thread) {
+            await chunkXEERRXWL_cjs.enforceThreadAccess({
+              mastra,
+              requestContext: serverRequestContext,
+              threadId: effectiveThreadId,
+              thread,
+              effectiveResourceId,
+              permission: ee.MastraFGAPermissions.MEMORY_WRITE
+            });
+          }
         }
       }
       if (memoryOption || effectiveResourceId || effectiveThreadId) {
@@ -1355,7 +1418,7 @@ var RESUME_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       }
       const workflowsStore = await mastra.getStorage()?.getStore("workflows");
       const workflowRun = await workflowsStore?.getWorkflowRunById({ workflowName: "agentic-loop", runId });
-      await chunk3S5WOAYR_cjs.validateRunOwnership(workflowRun, chunk3S5WOAYR_cjs.getEffectiveResourceId(serverRequestContext, void 0));
+      await chunkXEERRXWL_cjs.validateRunOwnership(workflowRun, chunkXEERRXWL_cjs.getEffectiveResourceId(serverRequestContext, void 0));
       const { structuredOutput, ...restOptions } = rest;
       const options = {
         runId,
@@ -1372,7 +1435,7 @@ var RESUME_STREAM_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var APPROVE_TOOL_CALL_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var APPROVE_TOOL_CALL_GENERATE_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/approve-tool-call-generate",
   responseType: "json",
@@ -1396,7 +1459,7 @@ var APPROVE_TOOL_CALL_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const result = await agent.approveToolCallGenerate({
         ...params,
         requestContext,
@@ -1408,7 +1471,7 @@ var APPROVE_TOOL_CALL_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var DECLINE_TOOL_CALL_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var DECLINE_TOOL_CALL_GENERATE_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/decline-tool-call-generate",
   responseType: "json",
@@ -1432,7 +1495,7 @@ var DECLINE_TOOL_CALL_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const result = await agent.declineToolCallGenerate({
         ...params,
         requestContext,
@@ -1444,7 +1507,7 @@ var DECLINE_TOOL_CALL_GENERATE_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var STREAM_NETWORK_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_NETWORK_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/network",
   responseType: "stream",
@@ -1463,8 +1526,8 @@ var STREAM_NETWORK_ROUTE = chunk5UKYK7YK_cjs.createRoute({
         agentId,
         versionOptions: extractVersionOptions(requestContext)
       });
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
-      chunk3S5WOAYR_cjs.validateBody({ messages });
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.validateBody({ messages });
       const streamResult = await agent.network(messages, {
         ...params
       });
@@ -1474,7 +1537,7 @@ var STREAM_NETWORK_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var APPROVE_NETWORK_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var APPROVE_NETWORK_TOOL_CALL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/approve-network-tool-call",
   responseType: "stream",
@@ -1496,7 +1559,7 @@ var APPROVE_NETWORK_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const streamResult = await agent.approveNetworkToolCall({
         ...params
       });
@@ -1506,7 +1569,7 @@ var APPROVE_NETWORK_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var DECLINE_NETWORK_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var DECLINE_NETWORK_TOOL_CALL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/decline-network-tool-call",
   responseType: "stream",
@@ -1528,7 +1591,7 @@ var DECLINE_NETWORK_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk3S5WOAYR_cjs.sanitizeBody(params, ["tools"]);
+      chunkXEERRXWL_cjs.sanitizeBody(params, ["tools"]);
       const streamResult = await agent.declineNetworkToolCall({
         ...params
       });
@@ -1538,7 +1601,7 @@ var DECLINE_NETWORK_TOOL_CALL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var UPDATE_AGENT_MODEL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var UPDATE_AGENT_MODEL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/model",
   responseType: "json",
@@ -1560,7 +1623,7 @@ var UPDATE_AGENT_MODEL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var RESET_AGENT_MODEL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var RESET_AGENT_MODEL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/model/reset",
   responseType: "json",
@@ -1580,7 +1643,7 @@ var RESET_AGENT_MODEL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var REORDER_AGENT_MODEL_LIST_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var REORDER_AGENT_MODEL_LIST_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/models/reorder",
   responseType: "json",
@@ -1605,7 +1668,7 @@ var REORDER_AGENT_MODEL_LIST_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/models/:modelConfigId",
   responseType: "json",
@@ -1708,7 +1771,7 @@ async function findConnectedModel(agent) {
   }
   return null;
 }
-var ENHANCE_INSTRUCTIONS_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var ENHANCE_INSTRUCTIONS_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/instructions/enhance",
   responseType: "json",
@@ -1750,7 +1813,7 @@ ${comment ? `User feedback: ${comment}` : ""}`,
     }
   }
 });
-var STREAM_VNEXT_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_VNEXT_DEPRECATED_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/streamVNext",
   responseType: "stream",
@@ -1766,7 +1829,7 @@ var STREAM_VNEXT_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     throw new chunk64ITUOXI_cjs.HTTPException(410, { message: "This endpoint is deprecated. Please use /stream instead." });
   }
 });
-var STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream/vnext/ui",
   responseType: "stream",
@@ -1791,7 +1854,7 @@ var STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
     }
   }
 });
-var STREAM_UI_MESSAGE_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var STREAM_UI_MESSAGE_DEPRECATED_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream/ui",
   responseType: "stream",
@@ -1805,7 +1868,7 @@ var STREAM_UI_MESSAGE_DEPRECATED_ROUTE = chunk5UKYK7YK_cjs.createRoute({
   deprecated: true,
   handler: STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE.handler
 });
-var GET_AGENT_SKILL_ROUTE = chunk5UKYK7YK_cjs.createRoute({
+var GET_AGENT_SKILL_ROUTE = chunk7LAFXMXB_cjs.createRoute({
   method: "GET",
   path: "/agents/:agentId/skills/:skillName",
   responseType: "json",
@@ -1887,5 +1950,5 @@ exports.getSerializedProcessors = getSerializedProcessors;
 exports.getSerializedSkillsFromAgent = getSerializedSkillsFromAgent;
 exports.getWorkspaceToolsFromAgent = getWorkspaceToolsFromAgent;
 exports.isProviderConnected = isProviderConnected;
-//# sourceMappingURL=chunk-O6YA7VM3.cjs.map
-//# sourceMappingURL=chunk-O6YA7VM3.cjs.map
+//# sourceMappingURL=chunk-RL34ZMLF.cjs.map
+//# sourceMappingURL=chunk-RL34ZMLF.cjs.map