@mastra/server 1.51.1-alpha.0 → 1.52.0-alpha.11

package/dist/{chunk-7NBIALK4.js → chunk-VE4HJNJQ.js}

@@ -1,9 +1,9 @@
-import { createStoredAgentResponseSchema } from './chunk-MPFUINWR.js';
+import { createStoredAgentResponseSchema } from './chunk-5HBR27TT.js';
 import { getAgentSkillResponseSchema, skillDisambiguationQuerySchema } from './chunk-ZHULRNJG.js';
-import { listAgentsResponseSchema, serializedAgentSchema, agentVersionQuerySchema, agentIdPathParams, generateResponseSchema, agentExecutionBodySchema, agentExecutionLegacyBodySchema, streamResponseSchema, providersResponseSchema, sendAgentSignalBodySchema, sendAgentMessageBodySchema, queueAgentMessageBodySchema, abortAgentThreadResponseSchema, abortAgentThreadBodySchema, subscribeAgentThreadBodySchema, streamUntilIdleBodySchema, observeAgentResponseSchema, observeAgentBodySchema, toolCallResponseSchema, approveToolCallBodySchema, sendToolApprovalResponseSchema, sendToolApprovalBodySchema, listSuspendedRunsResponseSchema, listSuspendedRunsQuerySchema, declineToolCallBodySchema, resumeStreamBodySchema, recoverBodySchema, resumeStreamUntilIdleBodySchema, approveNetworkToolCallBodySchema, declineNetworkToolCallBodySchema, modelManagementResponseSchema, updateAgentModelBodySchema, reorderAgentModelListBodySchema, updateAgentModelInModelListBodySchema, modelConfigIdPathParams, enhanceInstructionsResponseSchema, enhanceInstructionsBodySchema, agentSkillPathParams } from './chunk-256OPP7S.js';
-import { MastraFGAPermissions, sanitizeBody, validateBody, getEffectiveResourceId, getEffectiveThreadId, enforceThreadAccess, validateThreadOwnership, validateRunOwnership } from './chunk-JBSUT5XF.js';
-import { stringify, toSlug } from './chunk-NBI73TS5.js';
-import { WORKSPACE_TOOLS, resolveToolConfig, MASTRA_IS_STUDIO_KEY, isReservedRequestContextKey } from './chunk-5FOSK5R3.js';
+import { listAgentsResponseSchema, serializedAgentSchema, agentVersionQuerySchema, agentIdPathParams, generateResponseSchema, agentExecutionBodySchema, agentExecutionLegacyBodySchema, streamResponseSchema, providersResponseSchema, sendAgentSignalBodySchema, sendAgentMessageBodySchema, queueAgentMessageBodySchema, abortAgentThreadResponseSchema, abortAgentThreadBodySchema, subscribeAgentThreadBodySchema, streamUntilIdleBodySchema, observeAgentResponseSchema, observeAgentBodySchema, toolCallResponseSchema, approveToolCallBodySchema, sendToolApprovalResponseSchema, sendToolApprovalBodySchema, listSuspendedRunsResponseSchema, listSuspendedRunsQuerySchema, declineToolCallBodySchema, resumeStreamBodySchema, recoverBodySchema, resumeStreamUntilIdleBodySchema, approveNetworkToolCallBodySchema, declineNetworkToolCallBodySchema, modelManagementResponseSchema, updateAgentModelBodySchema, reorderAgentModelListBodySchema, updateAgentModelInModelListBodySchema, modelConfigIdPathParams, enhanceInstructionsResponseSchema, enhanceInstructionsBodySchema, agentSkillPathParams } from './chunk-QGKHU5OX.js';
+import { MastraFGAPermissions, sanitizeBody, validateBody, getEffectiveResourceId, requireEffectiveResourceId, getEffectiveThreadId, enforceThreadAccess, validateThreadOwnership, validateRunOwnership } from './chunk-A7APTIYJ.js';
+import { stringify, toSlug } from './chunk-TB2LLLRU.js';
+import { WORKSPACE_TOOLS, resolveToolConfig, MASTRA_IS_STUDIO_KEY, isReservedRequestContextKey, MASTRA_RESOURCE_ID_KEY } from './chunk-L4WPXN4O.js';
 import { handleError } from './chunk-7ZWJX3AN.js';
 import { createRoute } from './chunk-OMNQYWK3.js';
 import { standardSchemaToJSONSchema, toStandardSchema5 } from './chunk-7IJHXTUO.js';
@@ -98,6 +98,72 @@ function mergeBodyRequestContext(serverRequestContext, bodyRequestContext) {
     }
   }
 }
+function normalizePublicExecutionOptions(options, serverRequestContext) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) return void 0;
+  const { actor: _actor, requestContext, ...normalized } = options;
+  mergeBodyRequestContext(serverRequestContext, requestContext);
+  return { ...normalized, requestContext: serverRequestContext };
+}
+function hasSuspendedToolCall(snapshot, toolCallId) {
+  const resumeTarget = snapshot.resumeLabels?.[toolCallId];
+  const resumeStep = resumeTarget?.stepId ? snapshot.context?.[resumeTarget.stepId] : void 0;
+  if (resumeStep?.status === "suspended" && (resumeStep.suspendPayload?.requireToolApproval || resumeStep.suspendPayload?.toolCallSuspended || resumeStep.suspendPayload?.toolCallId)) {
+    return true;
+  }
+  const visit = (value) => {
+    if (!value || typeof value !== "object") return false;
+    if (Array.isArray(value)) return value.some(visit);
+    const record = value;
+    const payload = record.suspendPayload;
+    if (record.status === "suspended" && (payload?.requireToolApproval?.toolCallId === toolCallId || payload?.toolCallId === toolCallId)) {
+      return true;
+    }
+    return Object.values(record).some(visit);
+  };
+  return visit(snapshot.context);
+}
+async function validateDurableToolCallAccess({
+  mastra,
+  agent,
+  runId,
+  toolCallId,
+  requestContext
+}) {
+  if (!isDurableAgentLike(agent)) return;
+  const workflowsStore = await mastra.getStorage()?.getStore("workflows");
+  const workflowRun = await workflowsStore?.getWorkflowRunById({
+    workflowName: DurableStepIds.AGENTIC_LOOP,
+    runId
+  });
+  if (!workflowRun) {
+    throw new HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
+  }
+  let snapshot = workflowRun.snapshot;
+  if (typeof snapshot === "string") {
+    try {
+      snapshot = JSON.parse(snapshot);
+    } catch {
+      snapshot = void 0;
+    }
+  }
+  const input = snapshot?.context?.input;
+  const persistedResourceIds = new Set(
+    [
+      workflowRun.resourceId,
+      input?.state?.resourceId,
+      input?.messageListState?.memoryInfo?.resourceId,
+      input?.requestContextEntries?.[MASTRA_RESOURCE_ID_KEY]
+    ].filter((resourceId) => typeof resourceId === "string" && resourceId.length > 0)
+  );
+  const effectiveResourceId = getEffectiveResourceId(requestContext, void 0);
+  const [persistedResourceId] = persistedResourceIds;
+  if (persistedResourceIds.size > 1 || persistedResourceId && persistedResourceId !== effectiveResourceId) {
+    throw new HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
+  }
+  if (!snapshot || snapshot.status !== "suspended" || input?.agentId !== agent.id || !hasSuspendedToolCall(snapshot, toolCallId)) {
+    throw new HTTPException(403, { message: "Access denied: tool call is not suspended on this durable run" });
+  }
+}
 function isProviderConnected(providerId, customProviders) {
   const cleanId = providerId.includes(".") ? providerId.split(".")[0] : providerId;
   let provider = PROVIDER_REGISTRY[cleanId];
@@ -846,7 +912,7 @@ var GENERATE_AGENT_ROUTE = createRoute({
   requiresPermission: MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ agentId, mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
       validateBody({ messages });
       const versionOptions = extractVersionOptions(
@@ -866,6 +932,7 @@ var GENERATE_AGENT_ROUTE = createRoute({
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
         const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        requireEffectiveResourceId(effectiveResourceId);
         const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
@@ -892,6 +959,8 @@ var GENERATE_AGENT_ROUTE = createRoute({
       const { structuredOutput, ...restOptions } = rest;
       const options = {
         ...restOptions,
+        // Schema validates context permissively; runtime values are ModelMessages.
+        context: restOptions.context,
         requestContext: serverRequestContext,
         memory: authorizedMemoryOption,
         abortSignal
@@ -922,7 +991,7 @@ var GENERATE_LEGACY_ROUTE = createRoute({
         versionOptions: extractVersionOptions(requestContext),
         requestContext
       });
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const { messages, resourceId, resourceid, threadId, ...rest } = params;
       const clientResourceId = resourceId ?? resourceid;
       const effectiveResourceId = getEffectiveResourceId(requestContext, clientResourceId);
@@ -978,7 +1047,7 @@ var STREAM_GENERATE_LEGACY_ROUTE = createRoute({
         versionOptions: extractVersionOptions(requestContext),
         requestContext
       });
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const { messages, resourceId, resourceid, threadId, ...rest } = params;
       const clientResourceId = resourceId ?? resourceid;
       const effectiveResourceId = getEffectiveResourceId(requestContext, clientResourceId);
@@ -1009,17 +1078,22 @@ var STREAM_GENERATE_LEGACY_ROUTE = createRoute({
         resourceId: effectiveResourceId ?? "",
         threadId: effectiveThreadId ?? ""
       });
-      const streamResponse = rest.output ? streamResult.toTextStreamResponse() : streamResult.toDataStreamResponse({
-        sendUsage: true,
-        sendReasoning: true,
-        getErrorMessage: (error) => {
-          if (error instanceof Error) {
-            const safeMessage = error.message.replace(/([A-Za-z]:)?[\/][^\s,)]+/g, "<path>").replace(/\s+at\s+[^\n]*/g, "").replace(/Response body:.*/s, "").trim();
-            return `An error occurred while processing your request. ${safeMessage || "Unknown error"}`;
+      const streamResponse = rest.output ? streamResult.toTextStreamResponse() : (
+        // Without `output`, streamLegacy returns a StreamTextResult which has
+        // toDataStreamResponse; TS resolves the object-stream overload because
+        // `output` is optionally typed on the body schema.
+        streamResult.toDataStreamResponse({
+          sendUsage: true,
+          sendReasoning: true,
+          getErrorMessage: (error) => {
+            if (error instanceof Error) {
+              const safeMessage = error.message.replace(/([A-Za-z]:)?[\/][^\s,)]+/g, "<path>").replace(/\s+at\s+[^\n]*/g, "").replace(/Response body:.*/s, "").trim();
+              return `An error occurred while processing your request. ${safeMessage || "Unknown error"}`;
+            }
+            return "An error occurred while processing your request.";
           }
-          return "An error occurred while processing your request.";
-        }
-      });
+        })
+      );
       return streamResponse;
     } catch (error) {
       return handleError(error, "error streaming agent response");
@@ -1115,7 +1189,7 @@ var STREAM_GENERATE_ROUTE = createRoute({
   requiresPermission: MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
       validateBody({ messages });
       const versionOptions = extractVersionOptions(
@@ -1135,6 +1209,7 @@ var STREAM_GENERATE_ROUTE = createRoute({
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
         const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        requireEffectiveResourceId(effectiveResourceId);
         const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
@@ -1178,7 +1253,7 @@ var STREAM_GENERATE_ROUTE = createRoute({
 var sendAgentSignalResponseSchema = z.object({
   accepted: z.literal(true),
   runId: z.string(),
-  signal: z.any().optional()
+  signal: z.unknown().optional()
 });
 function handleSignalRoutingError(error, defaultMessage) {
   if (error instanceof MastraError && error.category === ErrorCategory.USER && !error.status && !error.details?.status) {
@@ -1213,7 +1288,7 @@ var SEND_AGENT_SIGNAL_ROUTE = createRoute({
     try {
       const idleStreamOptions = ifIdle?.streamOptions;
       const bodyRequestContext = idleStreamOptions?.requestContext;
-      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
+      const normalizedIdleStreamOptions = normalizePublicExecutionOptions(idleStreamOptions, serverRequestContext);
       const versionOptions = extractVersionOptions(serverRequestContext, bodyRequestContext);
       const agent = await getAgentFromSystem({
         mastra,
@@ -1221,14 +1296,17 @@ var SEND_AGENT_SIGNAL_ROUTE = createRoute({
         versionOptions,
         requestContext: serverRequestContext
       });
-      stashVersionOverrides(serverRequestContext, idleStreamOptions?.versions);
+      stashVersionOverrides(
+        serverRequestContext,
+        normalizedIdleStreamOptions?.versions
+      );
       ensureDefaultVersionStatus(serverRequestContext, versionOptions);
       const effectiveResourceId = getEffectiveResourceId(serverRequestContext, resourceId);
       const effectiveThreadId = getEffectiveThreadId(serverRequestContext, threadId);
       const ifIdleWithContext = {
         ifIdle: {
           ...ifIdle ?? {},
-          streamOptions: { ...idleStreamOptions ?? {}, requestContext: serverRequestContext }
+          streamOptions: { ...normalizedIdleStreamOptions ?? {}, requestContext: serverRequestContext }
         }
       };
       if (effectiveThreadId && effectiveResourceId) {
@@ -1284,7 +1362,7 @@ async function handleAgentMessageRoute({
 }) {
   const idleStreamOptions = ifIdle?.streamOptions;
   const bodyRequestContext = idleStreamOptions?.requestContext;
-  mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
+  const normalizedIdleStreamOptions = normalizePublicExecutionOptions(idleStreamOptions, serverRequestContext);
   const versionOptions = extractVersionOptions(serverRequestContext, bodyRequestContext);
   const agent = await getAgentFromSystem({
     mastra,
@@ -1292,14 +1370,14 @@ async function handleAgentMessageRoute({
     versionOptions,
     requestContext: serverRequestContext
   });
-  stashVersionOverrides(serverRequestContext, idleStreamOptions?.versions);
+  stashVersionOverrides(serverRequestContext, normalizedIdleStreamOptions?.versions);
   ensureDefaultVersionStatus(serverRequestContext, versionOptions);
   const effectiveResourceId = getEffectiveResourceId(serverRequestContext, resourceId);
   const effectiveThreadId = getEffectiveThreadId(serverRequestContext, threadId);
   const ifIdleWithContext = {
     ifIdle: {
       ...ifIdle ?? {},
-      streamOptions: { ...idleStreamOptions ?? {}, requestContext: serverRequestContext }
+      streamOptions: { ...normalizedIdleStreamOptions ?? {}, requestContext: serverRequestContext }
     }
   };
   if (effectiveThreadId && effectiveResourceId) {
@@ -1531,7 +1609,7 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = createRoute({
   requiresPermission: MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;
       validateBody({ messages });
       const agent = await getAgentFromSystem({
@@ -1548,6 +1626,7 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = createRoute({
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
         const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        requireEffectiveResourceId(effectiveResourceId);
         const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId && effectiveResourceId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
@@ -1565,6 +1644,8 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = createRoute({
       const { structuredOutput, ...restOptions } = rest;
       const options = {
         ...restOptions,
+        // Schema validates context permissively; runtime values are ModelMessages.
+        context: restOptions.context,
         requestContext: serverRequestContext,
         memory: authorizedMemoryOption,
         abortSignal
@@ -1702,7 +1783,14 @@ var APPROVE_TOOL_CALL_ROUTE = createRoute({
       if (!params.toolCallId) {
         throw new HTTPException(400, { message: "Tool call id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const streamResult = await agent.approveToolCall({
         ...params,
         requestContext,
@@ -1760,7 +1848,11 @@ var SEND_TOOL_APPROVAL_ROUTE = createRoute({
         throw new HTTPException(400, { message: "Tool call id is required" });
       }
       mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
+      const normalizedStreamOptions = normalizePublicExecutionOptions(
+        params.streamOptions,
+        serverRequestContext
+      );
       const { effectiveResourceId, effectiveThreadId } = await validateSubscriptionToolCallThreadAccess({
         agent,
         requestContext: serverRequestContext,
@@ -1769,6 +1861,7 @@ var SEND_TOOL_APPROVAL_ROUTE = createRoute({
       });
       return await agent.sendToolApproval({
         ...params,
+        ...normalizedStreamOptions ? { streamOptions: normalizedStreamOptions } : {},
         resourceId: effectiveResourceId,
         threadId: effectiveThreadId,
         requestContext: serverRequestContext,
@@ -1856,7 +1949,14 @@ var DECLINE_TOOL_CALL_ROUTE = createRoute({
       if (!params.toolCallId) {
         throw new HTTPException(400, { message: "Tool call id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const streamResult = await agent.declineToolCall({
         ...params,
         requestContext,
@@ -1886,7 +1986,7 @@ var RESUME_STREAM_ROUTE = createRoute({
       if (!params.runId) {
         throw new HTTPException(400, { message: "Run id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const {
         resumeData,
         runId,
@@ -1911,6 +2011,9 @@ var RESUME_STREAM_ROUTE = createRoute({
       let authorizedMemoryOption = memoryOption;
       const clientThreadId = typeof memoryOption?.thread === "string" ? memoryOption.thread : memoryOption?.thread?.id;
       const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
+      if (memoryOption) {
+        requireEffectiveResourceId(effectiveResourceId);
+      }
       const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);
       if (effectiveThreadId) {
         const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
@@ -1989,7 +2092,7 @@ var RECOVER_ROUTE = createRoute({
         agentId,
         versionOptions
       });
-      if (typeof agent.recover !== "function") {
+      if (!isDurableAgentLike(agent)) {
         throw new HTTPException(400, {
           message: "Agent does not support recover. Only durable agents (createDurableAgent) can recover runs."
         });
@@ -2027,7 +2130,7 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = createRoute({
       if (!params.runId) {
         throw new HTTPException(400, { message: "Run id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const {
         resumeData,
         runId,
@@ -2046,18 +2149,15 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = createRoute({
         agentId,
         versionOptions
       });
-      if (bodyRequestContext && typeof bodyRequestContext === "object") {
-        for (const [key, value] of Object.entries(bodyRequestContext)) {
-          if (serverRequestContext.get(key) === void 0) {
-            serverRequestContext.set(key, value);
-          }
-        }
-      }
+      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
       stashVersionOverrides(serverRequestContext, versions);
       ensureDefaultVersionStatus(serverRequestContext, versionOptions);
       let authorizedMemoryOption = memoryOption;
       const clientThreadId = typeof memoryOption?.thread === "string" ? memoryOption.thread : memoryOption?.thread?.id;
       const effectiveResourceId = getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
+      if (memoryOption) {
+        requireEffectiveResourceId(effectiveResourceId);
+      }
       const effectiveThreadId = getEffectiveThreadId(serverRequestContext, clientThreadId);
       if (effectiveThreadId) {
         const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
@@ -2090,6 +2190,8 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = createRoute({
         runId,
         toolCallId,
         ...restOptions,
+        // Schema validates context permissively; runtime values are ModelMessages.
+        context: restOptions.context,
         requestContext: serverRequestContext,
         memory: authorizedMemoryOption,
         abortSignal
@@ -2125,7 +2227,14 @@ var APPROVE_TOOL_CALL_GENERATE_ROUTE = createRoute({
       if (!params.toolCallId) {
         throw new HTTPException(400, { message: "Tool call id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const result = await agent.approveToolCallGenerate({
         ...params,
         requestContext,
@@ -2161,7 +2270,14 @@ var DECLINE_TOOL_CALL_GENERATE_ROUTE = createRoute({
       if (!params.toolCallId) {
         throw new HTTPException(400, { message: "Tool call id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const result = await agent.declineToolCallGenerate({
         ...params,
         requestContext,
@@ -2192,10 +2308,17 @@ var STREAM_NETWORK_ROUTE = createRoute({
         agentId,
         versionOptions: extractVersionOptions(requestContext)
       });
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       validateBody({ messages });
+      let authorizedMemoryOption = params.memory;
+      if (params.memory) {
+        const effectiveResourceId = getEffectiveResourceId(requestContext, params.memory.resource);
+        requireEffectiveResourceId(effectiveResourceId);
+        authorizedMemoryOption = { ...params.memory, resource: effectiveResourceId };
+      }
       const streamResult = await agent.network(messages, {
-        ...params
+        ...params,
+        memory: authorizedMemoryOption
       });
       return streamResult;
     } catch (error) {
@@ -2225,7 +2348,7 @@ var APPROVE_NETWORK_TOOL_CALL_ROUTE = createRoute({
       if (!params.runId) {
         throw new HTTPException(400, { message: "Run id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const streamResult = await agent.approveNetworkToolCall({
         ...params
       });
@@ -2257,7 +2380,7 @@ var DECLINE_NETWORK_TOOL_CALL_ROUTE = createRoute({
       if (!params.runId) {
         throw new HTTPException(400, { message: "Run id is required" });
       }
-      sanitizeBody(params, ["tools"]);
+      sanitizeBody(params, ["tools", "actor"]);
       const streamResult = await agent.declineNetworkToolCall({
         ...params
       });
@@ -2575,5 +2698,5 @@ var GET_AGENT_SKILL_ROUTE = createRoute({
 });
 
 export { ABORT_AGENT_THREAD_ROUTE, APPROVE_NETWORK_TOOL_CALL_ROUTE, APPROVE_TOOL_CALL_GENERATE_ROUTE, APPROVE_TOOL_CALL_ROUTE, CLONE_AGENT_ROUTE, DECLINE_NETWORK_TOOL_CALL_ROUTE, DECLINE_TOOL_CALL_GENERATE_ROUTE, DECLINE_TOOL_CALL_ROUTE, ENHANCE_INSTRUCTIONS_ROUTE, GENERATE_AGENT_ROUTE, GENERATE_AGENT_VNEXT_ROUTE, GENERATE_LEGACY_ROUTE, GET_AGENT_BY_ID_ROUTE, GET_AGENT_SKILL_ROUTE, GET_PROVIDERS_ROUTE, LIST_AGENTS_ROUTE, LIST_SUSPENDED_RUNS_ROUTE, OBSERVE_AGENT_STREAM_ROUTE, QUEUE_AGENT_MESSAGE_ROUTE, RECOVER_ROUTE, REORDER_AGENT_MODEL_LIST_ROUTE, RESET_AGENT_MODEL_ROUTE, RESUME_STREAM_ROUTE, RESUME_STREAM_UNTIL_IDLE_ROUTE, SEND_AGENT_MESSAGE_ROUTE, SEND_AGENT_SIGNAL_ROUTE, SEND_TOOL_APPROVAL_ROUTE, STREAM_GENERATE_LEGACY_ROUTE, STREAM_GENERATE_ROUTE, STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE, STREAM_NETWORK_ROUTE, STREAM_UI_MESSAGE_DEPRECATED_ROUTE, STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE, STREAM_UNTIL_IDLE_GENERATE_ROUTE, STREAM_VNEXT_DEPRECATED_ROUTE, SUBSCRIBE_AGENT_THREAD_ROUTE, UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE, UPDATE_AGENT_MODEL_ROUTE, agents_exports, buildProvidersList, extractVersionOptions, getAgentFromSystem, getBrowserToolsFromAgent, getSerializedAgentTools, getSerializedProcessors, getSerializedSkillsFromAgent, getWorkspaceToolsFromAgent, isProviderConnected };
-//# sourceMappingURL=chunk-7NBIALK4.js.map
-//# sourceMappingURL=chunk-7NBIALK4.js.map
+//# sourceMappingURL=chunk-VE4HJNJQ.js.map
+//# sourceMappingURL=chunk-VE4HJNJQ.js.map