@mastra/server 1.35.0 → 1.36.0-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @mastra/server
 
+## 1.36.0-alpha.1
+
+### Patch Changes
+
+- Updated dependencies [[`8cdb86c`](https://github.com/mastra-ai/mastra/commit/8cdb86ceed1137bc2768e147dce85a0692b9fb26), [`eda90c5`](https://github.com/mastra-ai/mastra/commit/eda90c5bfd7de11805ecc9f4552716c895fbaf78), [`afc004f`](https://github.com/mastra-ai/mastra/commit/afc004f5cc7e30697809e7021820b9f5881e6719), [`408be73`](https://github.com/mastra-ai/mastra/commit/408be73449dfab92b51eab8c6623b6c443debc25)]:
+  - @mastra/core@1.36.0-alpha.1
+
+## 1.36.0-alpha.0
+
+### Minor Changes
+
+- Narrowed `AgentSignalContents` from `BaseMessageListInput` to `string | (TextPart | FilePart)[]`. ([#16622](https://github.com/mastra-ai/mastra/pull/16622))
+
+  Fixed two signal-content bugs:
+  - `user-message` signal attributes now reach the LLM
+  - multimodal non-`user-message` signals no longer lose file parts
+
+  Callers that previously passed wrapped message shapes to `agent.sendSignal` should now pass a bare string or a bare parts array.
+
+  Before:
+  `{ type: 'user-message', contents: [{ role: 'user', content: [{ type: 'text', text: 'hi' }] }] }`
+
+  After:
+  `{ type: 'user-message', contents: [{ type: 'text', text: 'hi' }] }`
+
+  Added an optional `providerOptions` field to `agent.sendSignal` that flows through to the resulting prompt turn (as `providerOptions` on the LLM message) and is persisted on the stored signal message (as `content.providerMetadata`).
+
+### Patch Changes
+
+- Fixed CompositeAuth incorrectly advertising SSO, session, and user provider capabilities when no inner provider supports them. Studio would show an SSO login button even when no provider had SSO configured, leading to 401 errors on login attempts. The duck-typing check now verifies that interface methods are actual functions rather than just present on the prototype chain. ([#16664](https://github.com/mastra-ai/mastra/pull/16664))
+
+- Updated dependencies [[`452036a`](https://github.com/mastra-ai/mastra/commit/452036a0d965b4f4c1efd93606e4f03b50b807a5), [`1a9cc60`](https://github.com/mastra-ai/mastra/commit/1a9cc6069f9910fc3d59e4953ac8cd95d89ad6f5), [`64c1e0b`](https://github.com/mastra-ai/mastra/commit/64c1e0b35165c96b659818bd0177aa18794ef11f), [`40d83a9`](https://github.com/mastra-ai/mastra/commit/40d83a90d9be31a1b83e04649edb703eb7753e33)]:
+  - @mastra/core@1.36.0-alpha.0
+
 ## 1.35.0
 
 ### Minor Changes

package/dist/{api-schema-manifest-HTSK7CWD.js → api-schema-manifest-EJXNYOFH.js}

@@ -1,4 +1,4 @@
-import { SERVER_ROUTES } from './chunk-H5FPSS2N.js';
+import { SERVER_ROUTES } from './chunk-XZT7USLH.js';
 import { schemaToJsonSchema } from './chunk-E53AJNZB.js';
 
 // src/server/server-adapter/api-schema-manifest.ts
@@ -52,5 +52,5 @@ function buildApiSchemaManifest(routes = SERVER_ROUTES) {
 }
 
 export { buildApiSchemaManifest };
-//# sourceMappingURL=api-schema-manifest-HTSK7CWD.js.map
-//# sourceMappingURL=api-schema-manifest-HTSK7CWD.js.map
+//# sourceMappingURL=api-schema-manifest-EJXNYOFH.js.map
+//# sourceMappingURL=api-schema-manifest-EJXNYOFH.js.map

package/dist/{api-schema-manifest-HTSK7CWD.js.map → api-schema-manifest-EJXNYOFH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"names":[],"mappings":";;;;AA2BA,SAAS,cAAc,MAAA,EAA4D;AACjF,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,MAAM,CAAA,GAAI,MAAA;AAC/C;AAEA,SAAS,aAAa,KAAA,EAAyC;AAC7D,EAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAK,KAAA,GAAwB,MAAA;AAChG;AAEA,SAAS,WAAW,MAAA,EAAkE;AACpF,EAAA,MAAM,OAAO,MAAA,EAAQ,IAAA;AACrB,EAAA,OAAO,MAAM,OAAA,CAAQ,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AACpD;AAEA,SAAS,mBAAmB,cAAA,EAAiE;AAC3F,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,EAAE,MAAM,SAAA,EAAU;AAE9C,EAAA,MAAM,IAAA,GAAO,WAAW,cAAc,CAAA;AACtC,EAAA,IAAI,IAAA,KAAS,OAAA,EAAS,OAAO,EAAE,MAAM,OAAA,EAAQ;AAC7C,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAO,EAAE,MAAM,QAAA,EAAS;AAE/C,EAAA,MAAM,UAAA,GACJ,cAAA,CAAe,UAAA,IAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,cAAA,CAAe,UAAU,CAAA,GAAI,cAAA,CAAe,UAAA,GAAa,EAAC;AACxG,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AAC5C,EAAA,MAAM,qBAAqB,MAAA,IAAU,UAAA,GAAa,MAAA,GAAS,YAAA,IAAgB,aAAa,YAAA,GAAe,MAAA;AACvG,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAAE,IAAA;AAAA,IAC9C,CAAC,GAAG,QAAQ,MAAM,UAAA,CAAW,YAAA,CAAa,QAAQ,CAAC,CAAA,KAAM;AAAA,MACvD,CAAC,CAAA;AAEL,EAAA,IAAI,YAAA,KAAiB,kBAAA,IAAsB,aAAA,CAAc,MAAA,IAAU,CAAA,CAAA,EAAI;AACrE,IAAA,OAAO,EAAE,IAAA,EAAM,iBAAA,EAAmB,YAAA,EAAc,kBAAA,EAAmB;AAAA,EACrE;AACA,EAAA,IAAI,cAAA,CAAe,wBAAwB,aAAA,CAAc,MAAA,KAAW,GAAG,OAAO,EAAE,MAAM,QAAA,EAAS;AAC/F,EAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAC1B;AAEA,SAAS,gBAAgB,KAAA,EAA6B;AACpD,EAAA,OAAO,KAAA,CAAM,YAAA,KAAiB,MAAA,IAAU,CAAC,KAAA,CAAM,UAAA;AACjD;AAEO,SAAS,sBAAA,CAAuB,SAAiC,aAAA,EAAkC;AACxG,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAA;AAAA,IACT,QAAQ,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,CAAE,IAAI,CAAA,KAAA,KAAS;AAClD,MAAA,MAAM,cAAA,GAAiB,aAAA,CAAc,KAAA,CAAM,cAAc,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,cAAc,KAAA,CAAM,YAAA;AAAA,QACpB,eAAA,EAAiB,aAAA,CAAc,KAAA,CAAM,eAAe,CAAA;AAAA,QACpD,gBAAA,EAAkB,aAAA,CAAc,KAAA,CAAM,gBAAgB,CAAA;AAAA,QACtD,UAAA,EAAY,aAAA,CAAc,KAAA,CAAM,UAAU,CAAA;AAAA,QAC1C,cAAA;AAAA,QACA,aAAA,EAAe,mBAAmB,cAAc;AAAA,OAClD;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"api-schema-manifest-HTSK7CWD.js","sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"]}
+{"version":3,"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"names":[],"mappings":";;;;AA2BA,SAAS,cAAc,MAAA,EAA4D;AACjF,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,MAAM,CAAA,GAAI,MAAA;AAC/C;AAEA,SAAS,aAAa,KAAA,EAAyC;AAC7D,EAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAK,KAAA,GAAwB,MAAA;AAChG;AAEA,SAAS,WAAW,MAAA,EAAkE;AACpF,EAAA,MAAM,OAAO,MAAA,EAAQ,IAAA;AACrB,EAAA,OAAO,MAAM,OAAA,CAAQ,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AACpD;AAEA,SAAS,mBAAmB,cAAA,EAAiE;AAC3F,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,EAAE,MAAM,SAAA,EAAU;AAE9C,EAAA,MAAM,IAAA,GAAO,WAAW,cAAc,CAAA;AACtC,EAAA,IAAI,IAAA,KAAS,OAAA,EAAS,OAAO,EAAE,MAAM,OAAA,EAAQ;AAC7C,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAO,EAAE,MAAM,QAAA,EAAS;AAE/C,EAAA,MAAM,UAAA,GACJ,cAAA,CAAe,UAAA,IAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,cAAA,CAAe,UAAU,CAAA,GAAI,cAAA,CAAe,UAAA,GAAa,EAAC;AACxG,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AAC5C,EAAA,MAAM,qBAAqB,MAAA,IAAU,UAAA,GAAa,MAAA,GAAS,YAAA,IAAgB,aAAa,YAAA,GAAe,MAAA;AACvG,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAAE,IAAA;AAAA,IAC9C,CAAC,GAAG,QAAQ,MAAM,UAAA,CAAW,YAAA,CAAa,QAAQ,CAAC,CAAA,KAAM;AAAA,MACvD,CAAC,CAAA;AAEL,EAAA,IAAI,YAAA,KAAiB,kBAAA,IAAsB,aAAA,CAAc,MAAA,IAAU,CAAA,CAAA,EAAI;AACrE,IAAA,OAAO,EAAE,IAAA,EAAM,iBAAA,EAAmB,YAAA,EAAc,kBAAA,EAAmB;AAAA,EACrE;AACA,EAAA,IAAI,cAAA,CAAe,wBAAwB,aAAA,CAAc,MAAA,KAAW,GAAG,OAAO,EAAE,MAAM,QAAA,EAAS;AAC/F,EAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAC1B;AAEA,SAAS,gBAAgB,KAAA,EAA6B;AACpD,EAAA,OAAO,KAAA,CAAM,YAAA,KAAiB,MAAA,IAAU,CAAC,KAAA,CAAM,UAAA;AACjD;AAEO,SAAS,sBAAA,CAAuB,SAAiC,aAAA,EAAkC;AACxG,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAA;AAAA,IACT,QAAQ,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,CAAE,IAAI,CAAA,KAAA,KAAS;AAClD,MAAA,MAAM,cAAA,GAAiB,aAAA,CAAc,KAAA,CAAM,cAAc,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,cAAc,KAAA,CAAM,YAAA;AAAA,QACpB,eAAA,EAAiB,aAAA,CAAc,KAAA,CAAM,eAAe,CAAA;AAAA,QACpD,gBAAA,EAAkB,aAAA,CAAc,KAAA,CAAM,gBAAgB,CAAA;AAAA,QACtD,UAAA,EAAY,aAAA,CAAc,KAAA,CAAM,UAAU,CAAA;AAAA,QAC1C,cAAA;AAAA,QACA,aAAA,EAAe,mBAAmB,cAAc;AAAA,OAClD;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"api-schema-manifest-EJXNYOFH.js","sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"]}

package/dist/{api-schema-manifest-WVM7QABS.cjs → api-schema-manifest-EMKHNXSD.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk7BDWHV3B_cjs = require('./chunk-7BDWHV3B.cjs');
+var chunkWNIL6DVE_cjs = require('./chunk-WNIL6DVE.cjs');
 var chunkAZORAK4H_cjs = require('./chunk-AZORAK4H.cjs');
 
 // src/server/server-adapter/api-schema-manifest.ts
@@ -34,7 +34,7 @@ function inferResponseShape(responseSchema) {
 function isManifestRoute(route) {
   return route.responseType === "json" && !route.deprecated;
 }
-function buildApiSchemaManifest(routes = chunk7BDWHV3B_cjs.SERVER_ROUTES) {
+function buildApiSchemaManifest(routes = chunkWNIL6DVE_cjs.SERVER_ROUTES) {
   return {
     version: 1,
     routes: routes.filter(isManifestRoute).map((route) => {
@@ -54,5 +54,5 @@ function buildApiSchemaManifest(routes = chunk7BDWHV3B_cjs.SERVER_ROUTES) {
 }
 
 exports.buildApiSchemaManifest = buildApiSchemaManifest;
-//# sourceMappingURL=api-schema-manifest-WVM7QABS.cjs.map
-//# sourceMappingURL=api-schema-manifest-WVM7QABS.cjs.map
+//# sourceMappingURL=api-schema-manifest-EMKHNXSD.cjs.map
+//# sourceMappingURL=api-schema-manifest-EMKHNXSD.cjs.map

package/dist/{api-schema-manifest-WVM7QABS.cjs.map → api-schema-manifest-EMKHNXSD.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"names":["schemaToJsonSchema","SERVER_ROUTES"],"mappings":";;;;;;AA2BA,SAAS,cAAc,MAAA,EAA4D;AACjF,EAAA,OAAO,MAAA,GAASA,oCAAA,CAAmB,MAAM,CAAA,GAAI,MAAA;AAC/C;AAEA,SAAS,aAAa,KAAA,EAAyC;AAC7D,EAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAK,KAAA,GAAwB,MAAA;AAChG;AAEA,SAAS,WAAW,MAAA,EAAkE;AACpF,EAAA,MAAM,OAAO,MAAA,EAAQ,IAAA;AACrB,EAAA,OAAO,MAAM,OAAA,CAAQ,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AACpD;AAEA,SAAS,mBAAmB,cAAA,EAAiE;AAC3F,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,EAAE,MAAM,SAAA,EAAU;AAE9C,EAAA,MAAM,IAAA,GAAO,WAAW,cAAc,CAAA;AACtC,EAAA,IAAI,IAAA,KAAS,OAAA,EAAS,OAAO,EAAE,MAAM,OAAA,EAAQ;AAC7C,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAO,EAAE,MAAM,QAAA,EAAS;AAE/C,EAAA,MAAM,UAAA,GACJ,cAAA,CAAe,UAAA,IAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,cAAA,CAAe,UAAU,CAAA,GAAI,cAAA,CAAe,UAAA,GAAa,EAAC;AACxG,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AAC5C,EAAA,MAAM,qBAAqB,MAAA,IAAU,UAAA,GAAa,MAAA,GAAS,YAAA,IAAgB,aAAa,YAAA,GAAe,MAAA;AACvG,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAAE,IAAA;AAAA,IAC9C,CAAC,GAAG,QAAQ,MAAM,UAAA,CAAW,YAAA,CAAa,QAAQ,CAAC,CAAA,KAAM;AAAA,MACvD,CAAC,CAAA;AAEL,EAAA,IAAI,YAAA,KAAiB,kBAAA,IAAsB,aAAA,CAAc,MAAA,IAAU,CAAA,CAAA,EAAI;AACrE,IAAA,OAAO,EAAE,IAAA,EAAM,iBAAA,EAAmB,YAAA,EAAc,kBAAA,EAAmB;AAAA,EACrE;AACA,EAAA,IAAI,cAAA,CAAe,wBAAwB,aAAA,CAAc,MAAA,KAAW,GAAG,OAAO,EAAE,MAAM,QAAA,EAAS;AAC/F,EAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAC1B;AAEA,SAAS,gBAAgB,KAAA,EAA6B;AACpD,EAAA,OAAO,KAAA,CAAM,YAAA,KAAiB,MAAA,IAAU,CAAC,KAAA,CAAM,UAAA;AACjD;AAEO,SAAS,sBAAA,CAAuB,SAAiCC,+BAAA,EAAkC;AACxG,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAA;AAAA,IACT,QAAQ,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,CAAE,IAAI,CAAA,KAAA,KAAS;AAClD,MAAA,MAAM,cAAA,GAAiB,aAAA,CAAc,KAAA,CAAM,cAAc,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,cAAc,KAAA,CAAM,YAAA;AAAA,QACpB,eAAA,EAAiB,aAAA,CAAc,KAAA,CAAM,eAAe,CAAA;AAAA,QACpD,gBAAA,EAAkB,aAAA,CAAc,KAAA,CAAM,gBAAgB,CAAA;AAAA,QACtD,UAAA,EAAY,aAAA,CAAc,KAAA,CAAM,UAAU,CAAA;AAAA,QAC1C,cAAA;AAAA,QACA,aAAA,EAAe,mBAAmB,cAAc;AAAA,OAClD;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"api-schema-manifest-WVM7QABS.cjs","sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"]}
+{"version":3,"sources":["../src/server/server-adapter/api-schema-manifest.ts"],"names":["schemaToJsonSchema","SERVER_ROUTES"],"mappings":";;;;;;AA2BA,SAAS,cAAc,MAAA,EAA4D;AACjF,EAAA,OAAO,MAAA,GAASA,oCAAA,CAAmB,MAAM,CAAA,GAAI,MAAA;AAC/C;AAEA,SAAS,aAAa,KAAA,EAAyC;AAC7D,EAAA,OAAO,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAK,KAAA,GAAwB,MAAA;AAChG;AAEA,SAAS,WAAW,MAAA,EAAkE;AACpF,EAAA,MAAM,OAAO,MAAA,EAAQ,IAAA;AACrB,EAAA,OAAO,MAAM,OAAA,CAAQ,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,GAAI,IAAA;AACpD;AAEA,SAAS,mBAAmB,cAAA,EAAiE;AAC3F,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,EAAE,MAAM,SAAA,EAAU;AAE9C,EAAA,MAAM,IAAA,GAAO,WAAW,cAAc,CAAA;AACtC,EAAA,IAAI,IAAA,KAAS,OAAA,EAAS,OAAO,EAAE,MAAM,OAAA,EAAQ;AAC7C,EAAA,IAAI,IAAA,KAAS,QAAA,EAAU,OAAO,EAAE,MAAM,QAAA,EAAS;AAE/C,EAAA,MAAM,UAAA,GACJ,cAAA,CAAe,UAAA,IAAc,CAAC,KAAA,CAAM,OAAA,CAAQ,cAAA,CAAe,UAAU,CAAA,GAAI,cAAA,CAAe,UAAA,GAAa,EAAC;AACxG,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AAC5C,EAAA,MAAM,qBAAqB,MAAA,IAAU,UAAA,GAAa,MAAA,GAAS,YAAA,IAAgB,aAAa,YAAA,GAAe,MAAA;AACvG,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAAE,IAAA;AAAA,IAC9C,CAAC,GAAG,QAAQ,MAAM,UAAA,CAAW,YAAA,CAAa,QAAQ,CAAC,CAAA,KAAM;AAAA,MACvD,CAAC,CAAA;AAEL,EAAA,IAAI,YAAA,KAAiB,kBAAA,IAAsB,aAAA,CAAc,MAAA,IAAU,CAAA,CAAA,EAAI;AACrE,IAAA,OAAO,EAAE,IAAA,EAAM,iBAAA,EAAmB,YAAA,EAAc,kBAAA,EAAmB;AAAA,EACrE;AACA,EAAA,IAAI,cAAA,CAAe,wBAAwB,aAAA,CAAc,MAAA,KAAW,GAAG,OAAO,EAAE,MAAM,QAAA,EAAS;AAC/F,EAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAC1B;AAEA,SAAS,gBAAgB,KAAA,EAA6B;AACpD,EAAA,OAAO,KAAA,CAAM,YAAA,KAAiB,MAAA,IAAU,CAAC,KAAA,CAAM,UAAA;AACjD;AAEO,SAAS,sBAAA,CAAuB,SAAiCC,+BAAA,EAAkC;AACxG,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,CAAA;AAAA,IACT,QAAQ,MAAA,CAAO,MAAA,CAAO,eAAe,CAAA,CAAE,IAAI,CAAA,KAAA,KAAS;AAClD,MAAA,MAAM,cAAA,GAAiB,aAAA,CAAc,KAAA,CAAM,cAAc,CAAA;AACzD,MAAA,OAAO;AAAA,QACL,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,cAAc,KAAA,CAAM,YAAA;AAAA,QACpB,eAAA,EAAiB,aAAA,CAAc,KAAA,CAAM,eAAe,CAAA;AAAA,QACpD,gBAAA,EAAkB,aAAA,CAAc,KAAA,CAAM,gBAAgB,CAAA;AAAA,QACtD,UAAA,EAAY,aAAA,CAAc,KAAA,CAAM,UAAU,CAAA;AAAA,QAC1C,cAAA;AAAA,QACA,aAAA,EAAe,mBAAmB,cAAc;AAAA,OAClD;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"api-schema-manifest-EMKHNXSD.cjs","sourcesContent":["import type { JSONSchema7 } from '@mastra/schema-compat';\nimport { schemaToJsonSchema } from './openapi-utils';\nimport { SERVER_ROUTES } from './routes/index';\nimport type { ServerRoute } from './routes/index';\n\nexport interface ApiSchemaResponseShape {\n  kind: 'array' | 'record' | 'object-property' | 'single' | 'unknown';\n  listProperty?: string;\n  paginationProperty?: string;\n}\n\nexport interface ApiSchemaManifestRoute {\n  method: string;\n  path: string;\n  responseType: string;\n  pathParamSchema?: JSONSchema7;\n  queryParamSchema?: JSONSchema7;\n  bodySchema?: JSONSchema7;\n  responseSchema?: JSONSchema7;\n  responseShape: ApiSchemaResponseShape;\n}\n\nexport interface ApiSchemaManifest {\n  version: 1;\n  routes: ApiSchemaManifestRoute[];\n}\n\nfunction convertSchema(schema: ServerRoute['bodySchema']): JSONSchema7 | undefined {\n  return schema ? schemaToJsonSchema(schema) : undefined;\n}\n\nfunction asJsonSchema(value: unknown): JSONSchema7 | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as JSONSchema7) : undefined;\n}\n\nfunction schemaType(schema: JSONSchema7 | undefined): JSONSchema7['type'] | undefined {\n  const type = schema?.type;\n  return Array.isArray(type) ? type.find(Boolean) : type;\n}\n\nfunction inferResponseShape(responseSchema: JSONSchema7 | undefined): ApiSchemaResponseShape {\n  if (!responseSchema) return { kind: 'unknown' };\n\n  const type = schemaType(responseSchema);\n  if (type === 'array') return { kind: 'array' };\n  if (type !== 'object') return { kind: 'single' };\n\n  const properties =\n    responseSchema.properties && !Array.isArray(responseSchema.properties) ? responseSchema.properties : {};\n  const propertyNames = Object.keys(properties);\n  const paginationProperty = 'page' in properties ? 'page' : 'pagination' in properties ? 'pagination' : undefined;\n  const listProperty = Object.entries(properties).find(\n    ([, property]) => schemaType(asJsonSchema(property)) === 'array',\n  )?.[0];\n\n  if (listProperty && (paginationProperty || propertyNames.length <= 2)) {\n    return { kind: 'object-property', listProperty, paginationProperty };\n  }\n  if (responseSchema.additionalProperties && propertyNames.length === 0) return { kind: 'record' };\n  return { kind: 'single' };\n}\n\nfunction isManifestRoute(route: ServerRoute): boolean {\n  return route.responseType === 'json' && !route.deprecated;\n}\n\nexport function buildApiSchemaManifest(routes: readonly ServerRoute[] = SERVER_ROUTES): ApiSchemaManifest {\n  return {\n    version: 1,\n    routes: routes.filter(isManifestRoute).map(route => {\n      const responseSchema = convertSchema(route.responseSchema);\n      return {\n        method: route.method,\n        path: route.path,\n        responseType: route.responseType,\n        pathParamSchema: convertSchema(route.pathParamSchema),\n        queryParamSchema: convertSchema(route.queryParamSchema),\n        bodySchema: convertSchema(route.bodySchema),\n        responseSchema,\n        responseShape: inferResponseShape(responseSchema),\n      };\n    }),\n  };\n}\n"]}

package/dist/{chunk-RUKCZLXN.cjs → chunk-3NA22RQ5.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunk5XW4MKE6_cjs = require('./chunk-5XW4MKE6.cjs');
 var chunk64ITUOXI_cjs = require('./chunk-64ITUOXI.cjs');
+var chunk5XW4MKE6_cjs = require('./chunk-5XW4MKE6.cjs');
 var memory = require('@mastra/core/memory');
 var authEE = require('@mastra/core/auth/ee');
 
@@ -134,5 +134,5 @@ exports.sanitizeBody = sanitizeBody;
 exports.validateBody = validateBody;
 exports.validateRunOwnership = validateRunOwnership;
 exports.validateThreadOwnership = validateThreadOwnership;
-//# sourceMappingURL=chunk-RUKCZLXN.cjs.map
-//# sourceMappingURL=chunk-RUKCZLXN.cjs.map
+//# sourceMappingURL=chunk-3NA22RQ5.cjs.map
+//# sourceMappingURL=chunk-3NA22RQ5.cjs.map

package/dist/{chunk-RUKCZLXN.cjs.map → chunk-3NA22RQ5.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"names":["authEE","MastraFGAPermissions","HTTPException","MASTRA_RESOURCE_ID_KEY","MASTRA_THREAD_ID_KEY","MastraMemory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,oBAAA,GAAuB;AAAA,EAC3B,aAAA,EAAe,eAAA;AAAA,EACf,aAAA,EAAe,eAAA;AAAA,EACf,cAAA,EAAgB,gBAAA;AAAA,EAChB,WAAA,EAAa,aAAA;AAAA,EACb,aAAA,EAAe,eAAA;AAAA,EACf,WAAA,EAAa,aAAA;AAAA,EACb,YAAA,EAAc,cAAA;AAAA,EACd,aAAA,EAAe,eAAA;AAAA,EACf,UAAA,EAAY,YAAA;AAAA,EACZ,iBAAA,EAAmB,mBAAA;AAAA,EACnB,cAAA,EAAgB;AAClB,CAAA;AAEA,IAAM,eAAA,GAAkCA,iBAAA,CAAA,oBAAA;AAQjC,IAAMC,qBAAAA,GACX,mBAAmB,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAAE,MAAA,GAAS,IAAI,eAAA,GAAkB;;;ACnD1E,SAAS,aAAa,IAAA,EAA+B;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA,CAA+B,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/F,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,GAAG,CAAA,aAAA,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAIC,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,CAAE,CAAC,CAAA,EAAG,CAAA;AAAA,EAC3E;AACF;AAOO,SAAS,YAAA,CAAa,MAA+B,cAAA,EAA0B;AACpF,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAA,CACd,KAAA,EACA,YAAA,GAAuB,GAAA,EACvB,MAAc,GAAA,EACE;AAChB,EAAA,MAAM,UAAA,GAAA,CAAc,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAEpD,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,MAAA,CAAO,YAAY,GAAG,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,YAAA;AAC1B,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,OAAA,EAA4E;AACvG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAAA,CACX,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,CAAC,OAAO,CAAA,EAAG,GAAA,CAAI,CAAC,IAAA,KAAiB;AACnE,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,OAAO,CAAC,KAAK,KAAK,CAAA;AAAA,IACpB,CAAC;AAAA,GACH;AACF;AAUO,SAAS,sBAAA,CACd,gBACA,gBAAA,EACoB;AACpB,EAAA,MAAM,iBAAA,GAAoB,cAAA,EAAgB,GAAA,CAAIC,wCAAsB,CAAA;AACpE,EAAA,OAAO,iBAAA,IAAqB,gBAAA;AAC9B;AAMO,SAAS,oBAAA,CACd,gBACA,cAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,cAAA,EAAgB,GAAA,CAAIC,sCAAoB,CAAA;AAChE,EAAA,OAAO,eAAA,IAAmB,cAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,QACA,mBAAA,EACe;AACf,EAAA,IAAI,UAAU,mBAAA,IAAuB,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,eAAe,mBAAA,EAAqB;AACnG,IAAA,MAAM,IAAIF,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,yDAAyD,CAAA;AAAA,EACnG;AACF;AAMA,eAAsB,mBAAA,CAAoB;AAAA,EACxC,MAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,mBAAA;AAAA,EACA,aAAaD,qBAAAA,CAAqB;AACpC,CAAA,EAOkB;AAChB,EAAA,MAAM,uBAAA,CAAwB,QAAQ,mBAAmB,CAAA;AAEzD,EAAA,MAAM,WAAA,GAAc,MAAA,EAAQ,SAAA,IAAY,EAAG,GAAA;AAC3C,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,cAAA,EAAgB,GAAA,CAAI,MAAM,CAAA;AACvC,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACrC,IAAA,MAAM,IAAIC,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,4DAA4D,CAAA;AAAA,EACtG;AAEA,EAAA,MAAMG,oBAAa,cAAA,CAAe;AAAA,IAChC,MAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA,EAAY,QAAQ,UAAA,IAAc,mBAAA;AAAA,IAClC,cAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAMA,eAAsB,oBAAA,CACpB,KACA,mBAAA,EACe;AACf,EAAA,IAAI,OAAO,mBAAA,IAAuB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,eAAe,mBAAA,EAAqB;AAC1F,IAAA,MAAM,IAAIH,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,+DAA+D,CAAA;AAAA,EACzG;AACF","file":"chunk-RUKCZLXN.cjs","sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;\n","import type { MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when either auth user or FGA provider is absent.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = mastra?.getServer?.()?.fga;\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n  });\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"]}
+{"version":3,"sources":["../src/server/fga-permissions.ts","../src/server/handlers/utils.ts"],"names":["authEE","MastraFGAPermissions","HTTPException","MASTRA_RESOURCE_ID_KEY","MASTRA_THREAD_ID_KEY","MastraMemory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAM,oBAAA,GAAuB;AAAA,EAC3B,aAAA,EAAe,eAAA;AAAA,EACf,aAAA,EAAe,eAAA;AAAA,EACf,cAAA,EAAgB,gBAAA;AAAA,EAChB,WAAA,EAAa,aAAA;AAAA,EACb,aAAA,EAAe,eAAA;AAAA,EACf,WAAA,EAAa,aAAA;AAAA,EACb,YAAA,EAAc,cAAA;AAAA,EACd,aAAA,EAAe,eAAA;AAAA,EACf,UAAA,EAAY,YAAA;AAAA,EACZ,iBAAA,EAAmB,mBAAA;AAAA,EACnB,cAAA,EAAgB;AAClB,CAAA;AAEA,IAAM,eAAA,GAAkCA,iBAAA,CAAA,oBAAA;AAQjC,IAAMC,qBAAAA,GACX,mBAAmB,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA,CAAE,MAAA,GAAS,IAAI,eAAA,GAAkB;;;ACnD1E,SAAS,aAAa,IAAA,EAA+B;AAC1D,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA,CAA+B,CAAC,GAAA,EAAK,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/F,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA,UAAA,EAAa,GAAG,CAAA,aAAA,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAIC,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,aAAa,CAAA,CAAE,CAAC,CAAA,EAAG,CAAA;AAAA,EAC3E;AACF;AAOO,SAAS,YAAA,CAAa,MAA+B,cAAA,EAA0B;AACpF,EAAA,KAAA,MAAW,OAAO,cAAA,EAAgB;AAChC,IAAA,IAAI,OAAO,IAAA,EAAM;AACf,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,YAAA,CACd,KAAA,EACA,YAAA,GAAuB,GAAA,EACvB,MAAc,GAAA,EACE;AAChB,EAAA,MAAM,UAAA,GAAA,CAAc,KAAA,IAAS,EAAA,EAAI,IAAA,GAAO,WAAA,EAAY;AAEpD,EAAA,IAAI,eAAe,OAAA,EAAS;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAS,QAAA,CAAS,KAAA,IAAS,MAAA,CAAO,YAAY,GAAG,EAAE,CAAA;AACzD,EAAA,IAAI,KAAA,CAAM,MAAM,CAAA,EAAG,OAAO,YAAA;AAC1B,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,OAAA,EAA4E;AACvG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IAAA,CACX,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,GAAU,CAAC,OAAO,CAAA,EAAG,GAAA,CAAI,CAAC,IAAA,KAAiB;AACnE,MAAA,MAAM,CAAC,GAAA,EAAK,GAAG,UAAU,CAAA,GAAI,IAAA,CAAK,MAAM,GAAG,CAAA;AAC3C,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,GAAG,CAAA;AACjC,MAAA,OAAO,CAAC,KAAK,KAAK,CAAA;AAAA,IACpB,CAAC;AAAA,GACH;AACF;AAUO,SAAS,sBAAA,CACd,gBACA,gBAAA,EACoB;AACpB,EAAA,MAAM,iBAAA,GAAoB,cAAA,EAAgB,GAAA,CAAIC,wCAAsB,CAAA;AACpE,EAAA,OAAO,iBAAA,IAAqB,gBAAA;AAC9B;AAMO,SAAS,oBAAA,CACd,gBACA,cAAA,EACoB;AACpB,EAAA,MAAM,eAAA,GAAkB,cAAA,EAAgB,GAAA,CAAIC,sCAAoB,CAAA;AAChE,EAAA,OAAO,eAAA,IAAmB,cAAA;AAC5B;AAOA,eAAsB,uBAAA,CACpB,QACA,mBAAA,EACe;AACf,EAAA,IAAI,UAAU,mBAAA,IAAuB,MAAA,CAAO,UAAA,IAAc,MAAA,CAAO,eAAe,mBAAA,EAAqB;AACnG,IAAA,MAAM,IAAIF,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,yDAAyD,CAAA;AAAA,EACnG;AACF;AAMA,eAAsB,mBAAA,CAAoB;AAAA,EACxC,MAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,mBAAA;AAAA,EACA,aAAaD,qBAAAA,CAAqB;AACpC,CAAA,EAOkB;AAChB,EAAA,MAAM,uBAAA,CAAwB,QAAQ,mBAAmB,CAAA;AAEzD,EAAA,MAAM,WAAA,GAAc,MAAA,EAAQ,SAAA,IAAY,EAAG,GAAA;AAC3C,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,cAAA,EAAgB,GAAA,CAAI,MAAM,CAAA;AACvC,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACrC,IAAA,MAAM,IAAIC,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,4DAA4D,CAAA;AAAA,EACtG;AAEA,EAAA,MAAMG,oBAAa,cAAA,CAAe;AAAA,IAChC,MAAA;AAAA,IACA,IAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA,EAAY,QAAQ,UAAA,IAAc,mBAAA;AAAA,IAClC,cAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAMA,eAAsB,oBAAA,CACpB,KACA,mBAAA,EACe;AACf,EAAA,IAAI,OAAO,mBAAA,IAAuB,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,eAAe,mBAAA,EAAqB;AAC1F,IAAA,MAAM,IAAIH,+BAAA,CAAc,GAAA,EAAK,EAAE,OAAA,EAAS,+DAA+D,CAAA;AAAA,EACzG;AACF","file":"chunk-3NA22RQ5.cjs","sourcesContent":["/**\n * Safe re-export of `MastraFGAPermissions` from `@mastra/core/auth/ee`.\n *\n * Why this shim exists:\n * `MastraFGAPermissions` was introduced in `@mastra/core@1.32.0`. Earlier\n * versions of `@mastra/core` ship `@mastra/core/auth/ee` but do not export\n * this constant. A direct named import (`import { MastraFGAPermissions }\n * from '@mastra/core/auth/ee'`) fails at ESM link time when this version\n * of `@mastra/server` is paired with `@mastra/core < 1.32.0`, taking the\n * entire user bundle down before any code runs.\n *\n * A namespace import tolerates missing names — `ns.MissingExport` is just\n * `undefined`, no link-time error. We then expose the permission map.\n *\n * Fallback values:\n * If the consuming `@mastra/core` does not export `MastraFGAPermissions`,\n * we substitute a hardcoded map of the canonical permission strings used\n * by routes in `@mastra/server`. This preserves the explicit RBAC\n * permission overrides those routes already had as string literals in\n * `@mastra/server@1.31.0` (e.g. `requiresPermission: \"agents:execute\"`\n * on `/v1/responses`). Without this fallback, `requiresPermission` would\n * be `undefined` on old core and the auth layer would derive the wrong\n * permission from the route path (e.g. `v1:write` instead of\n * `agents:execute`), breaking RBAC users who upgrade `@mastra/server`\n * but stay on `@mastra/core@1.31.0`.\n *\n * Once the consuming `@mastra/core` is on `1.32.0+` the values are real\n * and behaviour is identical to a direct named import.\n */\n\nimport * as authEE from '@mastra/core/auth/ee';\n\n// Canonical strings for the FGA permission keys actually referenced by\n// `@mastra/server` source. Mirrors `MastraFGAPermissions` in\n// `@mastra/core@1.32.0+` for these specific keys, and matches the string\n// literals previously hardcoded on the same routes in `@mastra/server@1.31.0`.\nconst FALLBACK_PERMISSIONS = {\n  AGENTS_CREATE: 'agents:create',\n  AGENTS_DELETE: 'agents:delete',\n  AGENTS_EXECUTE: 'agents:execute',\n  AGENTS_READ: 'agents:read',\n  MEMORY_DELETE: 'memory:delete',\n  MEMORY_READ: 'memory:read',\n  MEMORY_WRITE: 'memory:write',\n  TOOLS_EXECUTE: 'tools:execute',\n  TOOLS_READ: 'tools:read',\n  WORKFLOWS_EXECUTE: 'workflows:execute',\n  WORKFLOWS_READ: 'workflows:read',\n} as const;\n\nconst realPermissions = (authEE as any).MastraFGAPermissions;\n\n// Typed as `any` on purpose: consumers of `@mastra/server` may run their\n// typecheck against a `@mastra/core` that doesn't export `MastraFGAPermissions`\n// (anything < 1.32.0). Pinning to the real type would push that name into the\n// emitted `.d.ts` and break downstream typecheck. `any` lets the property\n// accesses (`MastraFGAPermissions.AGENTS_READ`) flow through cleanly on every\n// supported core.\nexport const MastraFGAPermissions: any =\n  realPermissions && Object.keys(realPermissions).length > 0 ? realPermissions : FALLBACK_PERMISSIONS;\n","import type { MastraFGAPermissionInput } from '@mastra/core/auth/ee';\nimport type { RequestContext } from '@mastra/core/di';\nimport { MastraMemory } from '@mastra/core/memory';\nimport { MASTRA_RESOURCE_ID_KEY, MASTRA_THREAD_ID_KEY } from '../constants';\nimport { MastraFGAPermissions } from '../fga-permissions';\nimport { HTTPException } from '../http-exception';\n\n// Validation helper\nexport function validateBody(body: Record<string, unknown>) {\n  const errorResponse = Object.entries(body).reduce<Record<string, string>>((acc, [key, value]) => {\n    if (!value) {\n      acc[key] = `Argument \"${key}\" is required`;\n    }\n    return acc;\n  }, {});\n\n  if (Object.keys(errorResponse).length > 0) {\n    throw new HTTPException(400, { message: Object.values(errorResponse)[0] });\n  }\n}\n\n/**\n * sanitizes the body by removing disallowed keys.\n * @param body body to sanitize\n * @param disallowedKeys keys to remove from the body\n */\nexport function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]) {\n  for (const key of disallowedKeys) {\n    if (key in body) {\n      delete body[key];\n    }\n  }\n}\n\nexport function parsePerPage(\n  value: string | undefined,\n  defaultValue: number = 100,\n  max: number = 1000,\n): number | false {\n  const normalized = (value || '').trim().toLowerCase();\n  // Handle explicit false to bypass pagination\n  if (normalized === 'false') {\n    return false;\n  }\n  const parsed = parseInt(value || String(defaultValue), 10);\n  if (isNaN(parsed)) return defaultValue;\n  return Math.min(max, Math.max(1, parsed));\n}\n\n/**\n * Parses filter query parameters into a key-value object.\n */\nexport function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined {\n  if (!filters) return undefined;\n\n  return Object.fromEntries(\n    (Array.isArray(filters) ? filters : [filters]).map((attr: string) => {\n      const [key, ...valueParts] = attr.split(':');\n      const value = valueParts.join(':'); // ✅ Handles colons in values\n      return [key, value];\n    }),\n  );\n}\n\n// ============================================================================\n// Authorization Utilities\n// ============================================================================\n\n/**\n * Gets the effective resourceId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveResourceId(\n  requestContext: RequestContext | undefined,\n  clientResourceId: string | undefined,\n): string | undefined {\n  const contextResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY) as string | undefined;\n  return contextResourceId || clientResourceId;\n}\n\n/**\n * Gets the effective threadId, preferring the reserved key from requestContext\n * over client-provided values for security.\n */\nexport function getEffectiveThreadId(\n  requestContext: RequestContext | undefined,\n  clientThreadId: string | undefined,\n): string | undefined {\n  const contextThreadId = requestContext?.get(MASTRA_THREAD_ID_KEY) as string | undefined;\n  return contextThreadId || clientThreadId;\n}\n\n/**\n * Validates that a thread belongs to the specified resourceId.\n * Throws 403 if the thread exists but belongs to a different resource.\n * Threads with no resourceId are accessible to all (shared threads).\n */\nexport async function validateThreadOwnership(\n  thread: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (thread && effectiveResourceId && thread.resourceId && thread.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: thread belongs to a different resource' });\n  }\n}\n\n/**\n * Validates both coarse resource ownership and fine-grained thread access.\n * FGA enforcement is a no-op when either auth user or FGA provider is absent.\n */\nexport async function enforceThreadAccess({\n  mastra,\n  requestContext,\n  threadId,\n  thread,\n  effectiveResourceId,\n  permission = MastraFGAPermissions.MEMORY_READ,\n}: {\n  mastra: any;\n  requestContext?: RequestContext;\n  threadId: string;\n  thread?: { resourceId?: string | null } | null;\n  effectiveResourceId?: string;\n  permission?: MastraFGAPermissionInput;\n}): Promise<void> {\n  await validateThreadOwnership(thread, effectiveResourceId);\n\n  const fgaProvider = mastra?.getServer?.()?.fga;\n  if (!fgaProvider) {\n    return;\n  }\n\n  const user = requestContext?.get('user');\n  if (!user || typeof user !== 'object') {\n    throw new HTTPException(403, { message: 'FGA authorization denied: authenticated user is required' });\n  }\n\n  await MastraMemory.checkThreadFGA({\n    mastra,\n    user: user as { id: string; [key: string]: unknown },\n    threadId,\n    resourceId: thread?.resourceId ?? effectiveResourceId,\n    requestContext,\n    permission,\n  });\n}\n\n/**\n * Validates that a workflow run belongs to the specified resourceId.\n * Throws 403 if the run exists but belongs to a different resource.\n */\nexport async function validateRunOwnership(\n  run: { resourceId?: string | null } | null | undefined,\n  effectiveResourceId: string | undefined,\n): Promise<void> {\n  if (run && effectiveResourceId && run.resourceId && run.resourceId !== effectiveResourceId) {\n    throw new HTTPException(403, { message: 'Access denied: workflow run belongs to a different resource' });\n  }\n}\n"]}