@mastra/server 1.51.1-alpha.0 → 1.52.0-alpha.11

package/dist/{chunk-ZG6ZAG5V.cjs → chunk-WQVA7QMU.cjs}

@@ -1,11 +1,11 @@
 'use strict';
 
-var chunkW36PYFFL_cjs = require('./chunk-W36PYFFL.cjs');
+var chunkNIMP2XEL_cjs = require('./chunk-NIMP2XEL.cjs');
 var chunkHXICAUTW_cjs = require('./chunk-HXICAUTW.cjs');
-var chunkILPFFVYC_cjs = require('./chunk-ILPFFVYC.cjs');
-var chunk42M6Y2OD_cjs = require('./chunk-42M6Y2OD.cjs');
-var chunkHW2VSBCG_cjs = require('./chunk-HW2VSBCG.cjs');
-var chunkSXKQ7CSX_cjs = require('./chunk-SXKQ7CSX.cjs');
+var chunkYBLFY24F_cjs = require('./chunk-YBLFY24F.cjs');
+var chunkQQJHGSB2_cjs = require('./chunk-QQJHGSB2.cjs');
+var chunkUCDJCHJA_cjs = require('./chunk-UCDJCHJA.cjs');
+var chunkVK4EOZXR_cjs = require('./chunk-VK4EOZXR.cjs');
 var chunkZ7LCIYK7_cjs = require('./chunk-Z7LCIYK7.cjs');
 var chunkSX2AJUSP_cjs = require('./chunk-SX2AJUSP.cjs');
 var chunkWOQFR6J7_cjs = require('./chunk-WOQFR6J7.cjs');
@@ -87,19 +87,85 @@ function ensureDefaultVersionStatus(ctx, versionOptions) {
   ctx.set(di.MASTRA_VERSIONS_KEY, updated);
 }
 function getIsStudioFromContext(requestContext) {
-  return requestContext.get(chunkSXKQ7CSX_cjs.MASTRA_IS_STUDIO_KEY) === true;
+  return requestContext.get(chunkVK4EOZXR_cjs.MASTRA_IS_STUDIO_KEY) === true;
 }
 function mergeBodyRequestContext(serverRequestContext, bodyRequestContext) {
   if (!bodyRequestContext || typeof bodyRequestContext !== "object") {
     return;
   }
   for (const [key, value] of Object.entries(bodyRequestContext)) {
-    if (chunkSXKQ7CSX_cjs.isReservedRequestContextKey(key)) continue;
+    if (chunkVK4EOZXR_cjs.isReservedRequestContextKey(key)) continue;
     if (serverRequestContext.get(key) === void 0) {
       serverRequestContext.set(key, value);
     }
   }
 }
+function normalizePublicExecutionOptions(options, serverRequestContext) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) return void 0;
+  const { actor: _actor, requestContext, ...normalized } = options;
+  mergeBodyRequestContext(serverRequestContext, requestContext);
+  return { ...normalized, requestContext: serverRequestContext };
+}
+function hasSuspendedToolCall(snapshot, toolCallId) {
+  const resumeTarget = snapshot.resumeLabels?.[toolCallId];
+  const resumeStep = resumeTarget?.stepId ? snapshot.context?.[resumeTarget.stepId] : void 0;
+  if (resumeStep?.status === "suspended" && (resumeStep.suspendPayload?.requireToolApproval || resumeStep.suspendPayload?.toolCallSuspended || resumeStep.suspendPayload?.toolCallId)) {
+    return true;
+  }
+  const visit = (value) => {
+    if (!value || typeof value !== "object") return false;
+    if (Array.isArray(value)) return value.some(visit);
+    const record = value;
+    const payload = record.suspendPayload;
+    if (record.status === "suspended" && (payload?.requireToolApproval?.toolCallId === toolCallId || payload?.toolCallId === toolCallId)) {
+      return true;
+    }
+    return Object.values(record).some(visit);
+  };
+  return visit(snapshot.context);
+}
+async function validateDurableToolCallAccess({
+  mastra,
+  agent: agent$1,
+  runId,
+  toolCallId,
+  requestContext
+}) {
+  if (!agent.isDurableAgentLike(agent$1)) return;
+  const workflowsStore = await mastra.getStorage()?.getStore("workflows");
+  const workflowRun = await workflowsStore?.getWorkflowRunById({
+    workflowName: durable.DurableStepIds.AGENTIC_LOOP,
+    runId
+  });
+  if (!workflowRun) {
+    throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
+  }
+  let snapshot = workflowRun.snapshot;
+  if (typeof snapshot === "string") {
+    try {
+      snapshot = JSON.parse(snapshot);
+    } catch {
+      snapshot = void 0;
+    }
+  }
+  const input = snapshot?.context?.input;
+  const persistedResourceIds = new Set(
+    [
+      workflowRun.resourceId,
+      input?.state?.resourceId,
+      input?.messageListState?.memoryInfo?.resourceId,
+      input?.requestContextEntries?.[chunkVK4EOZXR_cjs.MASTRA_RESOURCE_ID_KEY]
+    ].filter((resourceId) => typeof resourceId === "string" && resourceId.length > 0)
+  );
+  const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(requestContext, void 0);
+  const [persistedResourceId] = persistedResourceIds;
+  if (persistedResourceIds.size > 1 || persistedResourceId && persistedResourceId !== effectiveResourceId) {
+    throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
+  }
+  if (!snapshot || snapshot.status !== "suspended" || input?.agentId !== agent$1.id || !hasSuspendedToolCall(snapshot, toolCallId)) {
+    throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: tool call is not suspended on this durable run" });
+  }
+}
 function isProviderConnected(providerId, customProviders) {
   const cleanId = providerId.includes(".") ? providerId.split(".")[0] : providerId;
   let provider = llm.PROVIDER_REGISTRY[cleanId];
@@ -153,19 +219,19 @@ async function getSerializedAgentTools(tools, partial = false) {
           resolveLazySchema(tool.inputSchema)
         );
         if (inputSchema !== void 0) {
-          inputSchemaForReturn = chunkHW2VSBCG_cjs.stringify(inputSchema);
+          inputSchemaForReturn = chunkUCDJCHJA_cjs.stringify(inputSchema);
         }
         const outputSchema = schemaToJsonSchema(
           resolveLazySchema(tool.outputSchema)
         );
         if (outputSchema !== void 0) {
-          outputSchemaForReturn = chunkHW2VSBCG_cjs.stringify(outputSchema);
+          outputSchemaForReturn = chunkUCDJCHJA_cjs.stringify(outputSchema);
         }
         const requestContextSchema = schemaToJsonSchema(
           resolveLazySchema(tool.requestContextSchema)
         );
         if (requestContextSchema !== void 0) {
-          requestContextSchemaForReturn = chunkHW2VSBCG_cjs.stringify(requestContextSchema);
+          requestContextSchemaForReturn = chunkUCDJCHJA_cjs.stringify(requestContextSchema);
         }
       } catch (error) {
         console.error(`Error getting serialized tool`, {
@@ -226,47 +292,47 @@ async function getWorkspaceToolsFromAgent(agent, requestContext) {
       requestContext: requestContext ? Object.fromEntries(requestContext.entries()) : {}
     };
     const isEnabled = async (toolName) => {
-      return (await chunkSXKQ7CSX_cjs.resolveToolConfig(toolsConfig, toolName, configContext)).enabled;
+      return (await chunkVK4EOZXR_cjs.resolveToolConfig(toolsConfig, toolName, configContext)).enabled;
     };
     if (workspace.filesystem) {
-      if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.READ_FILE)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.READ_FILE);
+      if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.READ_FILE)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.READ_FILE);
       }
-      if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES);
+      if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES);
       }
-      if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT);
+      if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT);
       }
       if (!isReadOnly) {
-        if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE)) {
-          tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE);
+        if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE)) {
+          tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE);
         }
-        if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE)) {
-          tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE);
+        if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE)) {
+          tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE);
         }
-        if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.DELETE)) {
-          tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.DELETE);
+        if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.DELETE)) {
+          tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.DELETE);
         }
-        if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.MKDIR)) {
-          tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.MKDIR);
+        if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.MKDIR)) {
+          tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.MKDIR);
         }
       }
-      if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.GREP)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.FILESYSTEM.GREP);
+      if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.GREP)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.FILESYSTEM.GREP);
       }
     }
     if (workspace.canBM25 || workspace.canVector) {
-      if (await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.SEARCH.SEARCH)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.SEARCH.SEARCH);
+      if (await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.SEARCH.SEARCH)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.SEARCH.SEARCH);
       }
-      if (!isReadOnly && await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.SEARCH.INDEX)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.SEARCH.INDEX);
+      if (!isReadOnly && await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.SEARCH.INDEX)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.SEARCH.INDEX);
       }
     }
     if (workspace.sandbox) {
-      if (workspace.sandbox.executeCommand && await isEnabled(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND)) {
-        tools.push(chunkSXKQ7CSX_cjs.WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND);
+      if (workspace.sandbox.executeCommand && await isEnabled(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND)) {
+        tools.push(chunkVK4EOZXR_cjs.WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND);
       }
     }
     return tools;
@@ -420,7 +486,7 @@ async function formatAgentList({
   let serializedRequestContextSchema;
   if (agent.requestContextSchema) {
     try {
-      serializedRequestContextSchema = chunkHW2VSBCG_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
+      serializedRequestContextSchema = chunkUCDJCHJA_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
     } catch (error) {
       logger.error("Error serializing requestContextSchema for agent", { agentName: agent.name, error });
     }
@@ -626,7 +692,7 @@ async function formatAgent({
   let serializedRequestContextSchema;
   if (agent.requestContextSchema) {
     try {
-      serializedRequestContextSchema = chunkHW2VSBCG_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
+      serializedRequestContextSchema = chunkUCDJCHJA_cjs.stringify(zodToJson.zodToJsonSchema(agent.requestContextSchema));
     } catch (error) {
       mastra.getLogger().error("Error serializing requestContextSchema for agent", { agentName: agent.name, error });
     }
@@ -666,12 +732,12 @@ var LIST_AGENTS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   queryParamSchema: v4.z.object({
     partial: v4.z.string().optional()
   }),
-  responseSchema: chunkILPFFVYC_cjs.listAgentsResponseSchema,
+  responseSchema: chunkYBLFY24F_cjs.listAgentsResponseSchema,
   summary: "List all agents",
   description: "Returns a list of all available agents in the system (both code-defined and stored)",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_READ,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_READ,
   handler: async ({ mastra, requestContext, partial }) => {
     try {
       const codeAgents = mastra.listAgents();
@@ -749,7 +815,7 @@ var LIST_AGENTS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
           user,
           agentList,
           "agent",
-          chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_READ
+          chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_READ
         );
         const accessibleSet = new Set(accessible.map((a) => a.id));
         for (const id of Object.keys(serializedAgents)) {
@@ -768,14 +834,14 @@ var GET_AGENT_BY_ID_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "GET",
   path: "/agents/:agentId",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  queryParamSchema: chunkILPFFVYC_cjs.agentVersionQuerySchema,
-  responseSchema: chunkILPFFVYC_cjs.serializedAgentSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  queryParamSchema: chunkYBLFY24F_cjs.agentVersionQuerySchema,
+  responseSchema: chunkYBLFY24F_cjs.serializedAgentSchema,
   summary: "Get agent by ID",
   description: "Returns details for a specific agent including configuration, tools, and memory settings. Use query params to control which stored config version is used for overrides: ?status=published (active version, default), ?status=draft (latest draft), or ?versionId=<id> (specific version). Use either status or versionId, not both.",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_READ,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_READ,
   handler: async ({ agentId, mastra, requestContext, status, versionId }) => {
     try {
       const versionOptions = versionId ? { versionId } : status ? { status } : void 0;
@@ -797,14 +863,14 @@ var CLONE_AGENT_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/clone",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
   bodySchema: v4.z.object({
     newId: v4.z.string().optional().describe("ID for the cloned agent. If not provided, derived from agent ID."),
     newName: v4.z.string().optional().describe('Name for the cloned agent. Defaults to "{name} (Clone)".'),
     metadata: v4.z.record(v4.z.string(), v4.z.unknown()).optional(),
     authorId: v4.z.string().optional()
   }),
-  responseSchema: chunkW36PYFFL_cjs.createStoredAgentResponseSchema,
+  responseSchema: chunkNIMP2XEL_cjs.createStoredAgentResponseSchema,
   summary: "Clone agent",
   description: "Clones a code-defined or stored agent to a new stored agent in the database",
   tags: ["Agents"],
@@ -820,7 +886,7 @@ var CLONE_AGENT_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         agentId,
         versionOptions: extractVersionOptions(requestContext)
       });
-      const cloneId = chunkHW2VSBCG_cjs.toSlug(newId || `${agentId}-clone`);
+      const cloneId = chunkUCDJCHJA_cjs.toSlug(newId || `${agentId}-clone`);
       const result = await editor.agent.clone(agent, {
         newId: cloneId,
         newName,
@@ -838,19 +904,19 @@ var GENERATE_AGENT_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/generate",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.generateResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.generateResponseSchema,
   summary: "Generate agent response",
   description: "Executes an agent with the provided messages and returns the complete response",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ agentId, mastra, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
-      chunk42M6Y2OD_cjs.validateBody({ messages });
+      chunkQQJHGSB2_cjs.validateBody({ messages });
       const versionOptions = extractVersionOptions(
         serverRequestContext,
         bodyRequestContext
@@ -867,20 +933,21 @@ var GENERATE_AGENT_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       let authorizedMemoryOption = memoryOption;
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
-        const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
-        const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+        const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        chunkQQJHGSB2_cjs.requireEffectiveResourceId(effectiveResourceId);
+        const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
           if (memoryInstance) {
             const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
             if (thread) {
-              await chunk42M6Y2OD_cjs.enforceThreadAccess({
+              await chunkQQJHGSB2_cjs.enforceThreadAccess({
                 mastra,
                 requestContext: serverRequestContext,
                 threadId: effectiveThreadId,
                 thread,
                 effectiveResourceId,
-                permission: chunk42M6Y2OD_cjs.MastraFGAPermissions.MEMORY_WRITE
+                permission: chunkQQJHGSB2_cjs.MastraFGAPermissions.MEMORY_WRITE
               });
             }
           }
@@ -894,6 +961,8 @@ var GENERATE_AGENT_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       const { structuredOutput, ...restOptions } = rest;
       const options = {
         ...restOptions,
+        // Schema validates context permissively; runtime values are ModelMessages.
+        context: restOptions.context,
         requestContext: serverRequestContext,
         memory: authorizedMemoryOption,
         abortSignal
@@ -909,9 +978,9 @@ var GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/generate-legacy",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionLegacyBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.generateResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionLegacyBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.generateResponseSchema,
   summary: "[DEPRECATED] Generate with legacy format",
   description: "Legacy endpoint for generating agent responses. Use /agents/:agentId/generate instead.",
   tags: ["Agents", "Legacy"],
@@ -924,12 +993,12 @@ var GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         versionOptions: extractVersionOptions(requestContext),
         requestContext
       });
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const { messages, resourceId, resourceid, threadId, ...rest } = params;
       const clientResourceId = resourceId ?? resourceid;
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(requestContext, clientResourceId);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(requestContext, threadId);
-      chunk42M6Y2OD_cjs.validateBody({ messages });
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(requestContext, clientResourceId);
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(requestContext, threadId);
+      chunkQQJHGSB2_cjs.validateBody({ messages });
       if (effectiveThreadId && !effectiveResourceId || !effectiveThreadId && effectiveResourceId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Both threadId or resourceId must be provided" });
       }
@@ -938,13 +1007,13 @@ var GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
           if (thread) {
-            await chunk42M6Y2OD_cjs.enforceThreadAccess({
+            await chunkQQJHGSB2_cjs.enforceThreadAccess({
               mastra,
               requestContext,
               threadId: effectiveThreadId,
               thread,
               effectiveResourceId,
-              permission: chunk42M6Y2OD_cjs.MastraFGAPermissions.MEMORY_WRITE
+              permission: chunkQQJHGSB2_cjs.MastraFGAPermissions.MEMORY_WRITE
             });
           }
         }
@@ -965,9 +1034,9 @@ var STREAM_GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream-legacy",
   responseType: "datastream-response",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionLegacyBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionLegacyBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "[DEPRECATED] Stream with legacy format",
   description: "Legacy endpoint for streaming agent responses. Use /agents/:agentId/stream instead.",
   tags: ["Agents", "Legacy"],
@@ -980,12 +1049,12 @@ var STREAM_GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         versionOptions: extractVersionOptions(requestContext),
         requestContext
       });
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const { messages, resourceId, resourceid, threadId, ...rest } = params;
       const clientResourceId = resourceId ?? resourceid;
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(requestContext, clientResourceId);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(requestContext, threadId);
-      chunk42M6Y2OD_cjs.validateBody({ messages });
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(requestContext, clientResourceId);
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(requestContext, threadId);
+      chunkQQJHGSB2_cjs.validateBody({ messages });
       if (effectiveThreadId && !effectiveResourceId || !effectiveThreadId && effectiveResourceId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Both threadId or resourceId must be provided" });
       }
@@ -994,13 +1063,13 @@ var STREAM_GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
           if (thread) {
-            await chunk42M6Y2OD_cjs.enforceThreadAccess({
+            await chunkQQJHGSB2_cjs.enforceThreadAccess({
               mastra,
               requestContext,
               threadId: effectiveThreadId,
               thread,
               effectiveResourceId,
-              permission: chunk42M6Y2OD_cjs.MastraFGAPermissions.MEMORY_WRITE
+              permission: chunkQQJHGSB2_cjs.MastraFGAPermissions.MEMORY_WRITE
             });
           }
         }
@@ -1011,17 +1080,22 @@ var STREAM_GENERATE_LEGACY_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         resourceId: effectiveResourceId ?? "",
         threadId: effectiveThreadId ?? ""
       });
-      const streamResponse = rest.output ? streamResult.toTextStreamResponse() : streamResult.toDataStreamResponse({
-        sendUsage: true,
-        sendReasoning: true,
-        getErrorMessage: (error) => {
-          if (error instanceof Error) {
-            const safeMessage = error.message.replace(/([A-Za-z]:)?[\/][^\s,)]+/g, "<path>").replace(/\s+at\s+[^\n]*/g, "").replace(/Response body:.*/s, "").trim();
-            return `An error occurred while processing your request. ${safeMessage || "Unknown error"}`;
+      const streamResponse = rest.output ? streamResult.toTextStreamResponse() : (
+        // Without `output`, streamLegacy returns a StreamTextResult which has
+        // toDataStreamResponse; TS resolves the object-stream overload because
+        // `output` is optionally typed on the body schema.
+        streamResult.toDataStreamResponse({
+          sendUsage: true,
+          sendReasoning: true,
+          getErrorMessage: (error) => {
+            if (error instanceof Error) {
+              const safeMessage = error.message.replace(/([A-Za-z]:)?[\/][^\s,)]+/g, "<path>").replace(/\s+at\s+[^\n]*/g, "").replace(/Response body:.*/s, "").trim();
+              return `An error occurred while processing your request. ${safeMessage || "Unknown error"}`;
+            }
+            return "An error occurred while processing your request.";
           }
-          return "An error occurred while processing your request.";
-        }
-      });
+        })
+      );
       return streamResponse;
     } catch (error) {
       return chunkZ7LCIYK7_cjs.handleError(error, "error streaming agent response");
@@ -1074,7 +1148,7 @@ var GET_PROVIDERS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "GET",
   path: "/agents/providers",
   responseType: "json",
-  responseSchema: chunkILPFFVYC_cjs.providersResponseSchema,
+  responseSchema: chunkYBLFY24F_cjs.providersResponseSchema,
   summary: "List AI providers",
   description: "Returns a list of all configured AI model providers",
   tags: ["Agents"],
@@ -1093,9 +1167,9 @@ var GENERATE_AGENT_VNEXT_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/generate/vnext",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.generateResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.generateResponseSchema,
   summary: "Generate a response from an agent",
   description: "Generate a response from an agent",
   tags: ["Agents"],
@@ -1107,19 +1181,19 @@ var STREAM_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/stream",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream agent response",
   description: "Executes an agent with the provided messages and streams the response in real-time",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, versions, ...rest } = params;
-      chunk42M6Y2OD_cjs.validateBody({ messages });
+      chunkQQJHGSB2_cjs.validateBody({ messages });
       const versionOptions = extractVersionOptions(
         serverRequestContext,
         bodyRequestContext
@@ -1136,20 +1210,21 @@ var STREAM_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       let authorizedMemoryOption = memoryOption;
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
-        const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
-        const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+        const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        chunkQQJHGSB2_cjs.requireEffectiveResourceId(effectiveResourceId);
+        const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
           if (memoryInstance) {
             const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
             if (thread) {
-              await chunk42M6Y2OD_cjs.enforceThreadAccess({
+              await chunkQQJHGSB2_cjs.enforceThreadAccess({
                 mastra,
                 requestContext: serverRequestContext,
                 threadId: effectiveThreadId,
                 thread,
                 effectiveResourceId,
-                permission: chunk42M6Y2OD_cjs.MastraFGAPermissions.MEMORY_WRITE
+                permission: chunkQQJHGSB2_cjs.MastraFGAPermissions.MEMORY_WRITE
               });
             }
           }
@@ -1180,7 +1255,7 @@ var STREAM_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
 var sendAgentSignalResponseSchema = v4.z.object({
   accepted: v4.z.literal(true),
   runId: v4.z.string(),
-  signal: v4.z.any().optional()
+  signal: v4.z.unknown().optional()
 });
 function handleSignalRoutingError(error$1, defaultMessage) {
   if (error$1 instanceof error.MastraError && error$1.category === error.ErrorCategory.USER && !error$1.status && !error$1.details?.status) {
@@ -1193,8 +1268,8 @@ var SEND_AGENT_SIGNAL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/signals",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.sendAgentSignalBodySchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.sendAgentSignalBodySchema,
   responseSchema: sendAgentSignalResponseSchema,
   summary: "Send agent signal",
   description: "Sends a signal to an active agent run or starts a memory thread run when the thread is idle",
@@ -1215,7 +1290,7 @@ var SEND_AGENT_SIGNAL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
     try {
       const idleStreamOptions = ifIdle?.streamOptions;
       const bodyRequestContext = idleStreamOptions?.requestContext;
-      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
+      const normalizedIdleStreamOptions = normalizePublicExecutionOptions(idleStreamOptions, serverRequestContext);
       const versionOptions = extractVersionOptions(serverRequestContext, bodyRequestContext);
       const agent = await getAgentFromSystem({
         mastra,
@@ -1223,21 +1298,24 @@ var SEND_AGENT_SIGNAL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         versionOptions,
         requestContext: serverRequestContext
       });
-      stashVersionOverrides(serverRequestContext, idleStreamOptions?.versions);
+      stashVersionOverrides(
+        serverRequestContext,
+        normalizedIdleStreamOptions?.versions
+      );
       ensureDefaultVersionStatus(serverRequestContext, versionOptions);
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, threadId);
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, threadId);
       const ifIdleWithContext = {
         ifIdle: {
           ...ifIdle ?? {},
-          streamOptions: { ...idleStreamOptions ?? {}, requestContext: serverRequestContext }
+          streamOptions: { ...normalizedIdleStreamOptions ?? {}, requestContext: serverRequestContext }
         }
       };
       if (effectiveThreadId && effectiveResourceId) {
         const memory = await agent.getMemory({ requestContext: serverRequestContext });
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-          await chunk42M6Y2OD_cjs.validateThreadOwnership(thread, effectiveResourceId);
+          await chunkQQJHGSB2_cjs.validateThreadOwnership(thread, effectiveResourceId);
         }
       }
       if (typeof agent.sendSignal !== "function") {
@@ -1286,7 +1364,7 @@ async function handleAgentMessageRoute({
 }) {
   const idleStreamOptions = ifIdle?.streamOptions;
   const bodyRequestContext = idleStreamOptions?.requestContext;
-  mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
+  const normalizedIdleStreamOptions = normalizePublicExecutionOptions(idleStreamOptions, serverRequestContext);
   const versionOptions = extractVersionOptions(serverRequestContext, bodyRequestContext);
   const agent = await getAgentFromSystem({
     mastra,
@@ -1294,21 +1372,21 @@ async function handleAgentMessageRoute({
     versionOptions,
     requestContext: serverRequestContext
   });
-  stashVersionOverrides(serverRequestContext, idleStreamOptions?.versions);
+  stashVersionOverrides(serverRequestContext, normalizedIdleStreamOptions?.versions);
   ensureDefaultVersionStatus(serverRequestContext, versionOptions);
-  const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
-  const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, threadId);
+  const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
+  const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, threadId);
   const ifIdleWithContext = {
     ifIdle: {
       ...ifIdle ?? {},
-      streamOptions: { ...idleStreamOptions ?? {}, requestContext: serverRequestContext }
+      streamOptions: { ...normalizedIdleStreamOptions ?? {}, requestContext: serverRequestContext }
     }
   };
   if (effectiveThreadId && effectiveResourceId) {
     const memory = await agent.getMemory({ requestContext: serverRequestContext });
     if (memory) {
       const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-      await chunk42M6Y2OD_cjs.validateThreadOwnership(thread, effectiveResourceId);
+      await chunkQQJHGSB2_cjs.validateThreadOwnership(thread, effectiveResourceId);
     }
   }
   if (typeof agent[methodName] !== "function") {
@@ -1342,8 +1420,8 @@ var SEND_AGENT_MESSAGE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/send-message",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.sendAgentMessageBodySchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.sendAgentMessageBodySchema,
   responseSchema: sendAgentMessageResponseSchema,
   summary: "Send agent message",
   description: "Sends a user message to an active agent run or starts a memory thread run when the thread is idle",
@@ -1362,8 +1440,8 @@ var QUEUE_AGENT_MESSAGE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/queue-message",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.queueAgentMessageBodySchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.queueAgentMessageBodySchema,
   responseSchema: sendAgentMessageResponseSchema,
   summary: "Queue agent message",
   description: "Queues a user message to run after the active thread run completes, or starts a memory thread run when idle",
@@ -1382,9 +1460,9 @@ var ABORT_AGENT_THREAD_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/threads/abort",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.abortAgentThreadBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.abortAgentThreadResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.abortAgentThreadBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.abortAgentThreadResponseSchema,
   summary: "Abort active agent thread run",
   description: "Aborts the currently active stream run for a memory thread without changing thread subscriptions",
   tags: ["Agents", "Streaming"],
@@ -1398,8 +1476,8 @@ var ABORT_AGENT_THREAD_ROUTE = chunkSX2AJUSP_cjs.createRoute({
           message: "agent thread aborts are not supported by this Mastra core version"
         });
       }
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, threadId);
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, threadId);
       if (!effectiveThreadId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "threadId is required" });
       }
@@ -1407,7 +1485,7 @@ var ABORT_AGENT_THREAD_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         const memory = await agent.getMemory({ requestContext: serverRequestContext });
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-          await chunk42M6Y2OD_cjs.validateThreadOwnership(thread, effectiveResourceId);
+          await chunkQQJHGSB2_cjs.validateThreadOwnership(thread, effectiveResourceId);
         }
       }
       const aborted = await agent.abortThreadStream({ resourceId: effectiveResourceId, threadId: effectiveThreadId });
@@ -1423,9 +1501,9 @@ var SUBSCRIBE_AGENT_THREAD_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   responseType: "stream",
   streamFormat: "sse",
   sseFlushOnConnect: true,
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.subscribeAgentThreadBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.subscribeAgentThreadBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Subscribe to agent thread runs",
   description: "Subscribes to future and active stream runs for a memory thread",
   tags: ["Agents", "Streaming"],
@@ -1439,8 +1517,8 @@ var SUBSCRIBE_AGENT_THREAD_ROUTE = chunkSX2AJUSP_cjs.createRoute({
           message: "agent thread subscriptions are not supported by this Mastra core version"
         });
       }
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, threadId);
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, resourceId);
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, threadId);
       if (!effectiveThreadId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "threadId is required" });
       }
@@ -1448,7 +1526,7 @@ var SUBSCRIBE_AGENT_THREAD_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         const memory = await agent.getMemory({ requestContext: serverRequestContext });
         if (memory) {
           const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-          await chunk42M6Y2OD_cjs.validateThreadOwnership(thread, effectiveResourceId);
+          await chunkQQJHGSB2_cjs.validateThreadOwnership(thread, effectiveResourceId);
         }
       }
       const subscription = await agent.subscribeToThread({
@@ -1523,19 +1601,19 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/stream-until-idle",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.streamUntilIdleBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.streamUntilIdleBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream agent response until idle",
   description: "Executes an agent with the provided messages and streams the response in real-time, also listens for background task completions and streams them in real-time",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const { messages, memory: memoryOption, requestContext: bodyRequestContext, ...rest } = params;
-      chunk42M6Y2OD_cjs.validateBody({ messages });
+      chunkQQJHGSB2_cjs.validateBody({ messages });
       const agent = await getAgentFromSystem({
         mastra,
         agentId,
@@ -1549,13 +1627,14 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       let authorizedMemoryOption = memoryOption;
       if (memoryOption) {
         const clientThreadId = typeof memoryOption.thread === "string" ? memoryOption.thread : memoryOption.thread?.id;
-        const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
-        const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+        const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, memoryOption.resource);
+        chunkQQJHGSB2_cjs.requireEffectiveResourceId(effectiveResourceId);
+        const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
         if (effectiveThreadId && effectiveResourceId) {
           const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
           if (memoryInstance) {
             const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
-            await chunk42M6Y2OD_cjs.validateThreadOwnership(thread, effectiveResourceId);
+            await chunkQQJHGSB2_cjs.validateThreadOwnership(thread, effectiveResourceId);
           }
         }
         authorizedMemoryOption = {
@@ -1567,6 +1646,8 @@ var STREAM_UNTIL_IDLE_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       const { structuredOutput, ...restOptions } = rest;
       const options = {
         ...restOptions,
+        // Schema validates context permissively; runtime values are ModelMessages.
+        context: restOptions.context,
         requestContext: serverRequestContext,
         memory: authorizedMemoryOption,
         abortSignal
@@ -1582,9 +1663,9 @@ var STREAM_GENERATE_VNEXT_DEPRECATED_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream/vnext",
   responseType: "stream",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream a response from an agent",
   description: "[DEPRECATED] This endpoint is deprecated. Please use /stream instead.",
   tags: ["Agents"],
@@ -1597,9 +1678,9 @@ var OBSERVE_AGENT_STREAM_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/observe",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.observeAgentBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.observeAgentResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.observeAgentBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.observeAgentResponseSchema,
   summary: "Observe agent stream",
   description: "Reconnect to an existing agent stream to receive missed events. Supports position-based resume with offset for efficient reconnection.",
   tags: ["Agents", "Streaming"],
@@ -1684,9 +1765,9 @@ var APPROVE_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/approve-tool-call",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.approveToolCallBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.toolCallResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.approveToolCallBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.toolCallResponseSchema,
   summary: "Approve tool call",
   description: "Approves a pending tool call and continues agent execution",
   tags: ["Agents", "Tools"],
@@ -1704,7 +1785,14 @@ var APPROVE_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const streamResult = await agent.approveToolCall({
         ...params,
         requestContext,
@@ -1722,8 +1810,8 @@ async function validateSubscriptionToolCallThreadAccess({
   resourceId,
   threadId
 }) {
-  const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(requestContext, resourceId);
-  const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(requestContext, threadId);
+  const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(requestContext, resourceId);
+  const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(requestContext, threadId);
   if (!effectiveThreadId) {
     throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "threadId is required" });
   }
@@ -1731,7 +1819,7 @@ async function validateSubscriptionToolCallThreadAccess({
     const memory = await agent.getMemory({ requestContext });
     if (memory) {
       const thread = await memory.getThreadById({ threadId: effectiveThreadId });
-      await chunk42M6Y2OD_cjs.validateThreadOwnership(thread, effectiveResourceId);
+      await chunkQQJHGSB2_cjs.validateThreadOwnership(thread, effectiveResourceId);
     }
   }
   return { effectiveResourceId: effectiveResourceId ?? "", effectiveThreadId };
@@ -1740,9 +1828,9 @@ var SEND_TOOL_APPROVAL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/send-tool-approval",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.sendToolApprovalBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.sendToolApprovalResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.sendToolApprovalBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.sendToolApprovalResponseSchema,
   summary: "Send tool approval",
   description: "Approves or declines a pending tool call and publishes resumed chunks to thread subscribers",
   tags: ["Agents", "Tools"],
@@ -1762,7 +1850,11 @@ var SEND_TOOL_APPROVAL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
       mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
+      const normalizedStreamOptions = normalizePublicExecutionOptions(
+        params.streamOptions,
+        serverRequestContext
+      );
       const { effectiveResourceId, effectiveThreadId } = await validateSubscriptionToolCallThreadAccess({
         agent,
         requestContext: serverRequestContext,
@@ -1771,6 +1863,7 @@ var SEND_TOOL_APPROVAL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       });
       return await agent.sendToolApproval({
         ...params,
+        ...normalizedStreamOptions ? { streamOptions: normalizedStreamOptions } : {},
         resourceId: effectiveResourceId,
         threadId: effectiveThreadId,
         requestContext: serverRequestContext,
@@ -1785,9 +1878,9 @@ var LIST_SUSPENDED_RUNS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "GET",
   path: "/agents/:agentId/suspended-runs",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  queryParamSchema: chunkILPFFVYC_cjs.listSuspendedRunsQuerySchema,
-  responseSchema: chunkILPFFVYC_cjs.listSuspendedRunsResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  queryParamSchema: chunkYBLFY24F_cjs.listSuspendedRunsQuerySchema,
+  responseSchema: chunkYBLFY24F_cjs.listSuspendedRunsResponseSchema,
   summary: "List suspended runs",
   description: "Lists suspended agent runs from storage \u2014 runs waiting on a tool-call approval or on a tool that suspended. Works after a server restart and across instances.",
   tags: ["Agents", "Tools"],
@@ -1799,8 +1892,8 @@ var LIST_SUSPENDED_RUNS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         agentId,
         versionOptions: extractVersionOptions(requestContext)
       });
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(requestContext, query.resourceId);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(requestContext, query.threadId);
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(requestContext, query.resourceId);
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(requestContext, query.threadId);
       if (effectiveThreadId) {
         const memory = await agent.getMemory({ requestContext });
         if (!memory) {
@@ -1812,7 +1905,7 @@ var LIST_SUSPENDED_RUNS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         if (!thread) {
           throw new chunk64ITUOXI_cjs.HTTPException(403, { message: "Access denied: thread not found" });
         }
-        await chunk42M6Y2OD_cjs.enforceThreadAccess({
+        await chunkQQJHGSB2_cjs.enforceThreadAccess({
           mastra,
           requestContext,
           threadId: effectiveThreadId,
@@ -1838,9 +1931,9 @@ var DECLINE_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/decline-tool-call",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.declineToolCallBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.toolCallResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.declineToolCallBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.toolCallResponseSchema,
   summary: "Decline tool call",
   description: "Declines a pending tool call and continues agent execution without executing the tool",
   tags: ["Agents", "Tools"],
@@ -1858,7 +1951,14 @@ var DECLINE_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const streamResult = await agent.declineToolCall({
         ...params,
         requestContext,
@@ -1875,20 +1975,20 @@ var RESUME_STREAM_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/resume-stream",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.resumeStreamBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.resumeStreamBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Resume agent stream",
   description: "Resumes a suspended agent stream with custom resume data",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const {
         resumeData,
         runId,
@@ -1912,20 +2012,23 @@ var RESUME_STREAM_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       ensureDefaultVersionStatus(serverRequestContext, versionOptions);
       let authorizedMemoryOption = memoryOption;
       const clientThreadId = typeof memoryOption?.thread === "string" ? memoryOption.thread : memoryOption?.thread?.id;
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
+      if (memoryOption) {
+        chunkQQJHGSB2_cjs.requireEffectiveResourceId(effectiveResourceId);
+      }
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
       if (effectiveThreadId) {
         const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
         if (memoryInstance) {
           const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
           if (thread) {
-            await chunk42M6Y2OD_cjs.enforceThreadAccess({
+            await chunkQQJHGSB2_cjs.enforceThreadAccess({
               mastra,
               requestContext: serverRequestContext,
               threadId: effectiveThreadId,
               thread,
               effectiveResourceId,
-              permission: chunk42M6Y2OD_cjs.MastraFGAPermissions.MEMORY_WRITE
+              permission: chunkQQJHGSB2_cjs.MastraFGAPermissions.MEMORY_WRITE
             });
           }
         }
@@ -1939,7 +2042,7 @@ var RESUME_STREAM_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       }
       const workflowsStore = await mastra.getStorage()?.getStore("workflows");
       const workflowRun = await workflowsStore?.getWorkflowRunById({ workflowName: "agentic-loop", runId });
-      await chunk42M6Y2OD_cjs.validateRunOwnership(workflowRun, chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, void 0));
+      await chunkQQJHGSB2_cjs.validateRunOwnership(workflowRun, chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, void 0));
       const { structuredOutput, untilIdle, ...restOptions } = rest;
       const options = {
         runId,
@@ -1964,14 +2067,14 @@ var RECOVER_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/recover",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.recoverBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.recoverBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Recover an orphaned durable agent run",
   description: "Re-drives an orphaned RUNNING durable-agent run after a process restart. Only supported on durable agents (createDurableAgent). Returns a stream that replays past chunks and continues the loop to completion.",
   tags: ["Agents"],
   requiresAuth: true,
-  requiresPermission: chunk42M6Y2OD_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
+  requiresPermission: chunkQQJHGSB2_cjs.MastraFGAPermissions.AGENTS_EXECUTE,
   handler: async ({ mastra, agentId, abortSignal, requestContext: serverRequestContext, ...params }) => {
     try {
       if (!params.runId) {
@@ -1986,12 +2089,12 @@ var RECOVER_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
       stashVersionOverrides(serverRequestContext, versions);
       ensureDefaultVersionStatus(serverRequestContext, versionOptions);
-      const agent = await getAgentFromSystem({
+      const agent$1 = await getAgentFromSystem({
         mastra,
         agentId,
         versionOptions
       });
-      if (typeof agent.recover !== "function") {
+      if (!agent.isDurableAgentLike(agent$1)) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, {
           message: "Agent does not support recover. Only durable agents (createDurableAgent) can recover runs."
         });
@@ -2001,8 +2104,8 @@ var RECOVER_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         workflowName: durable.DurableStepIds.AGENTIC_LOOP,
         runId
       });
-      await chunk42M6Y2OD_cjs.validateRunOwnership(workflowRun, chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, void 0));
-      const streamResult = await agent.recover(runId, {
+      await chunkQQJHGSB2_cjs.validateRunOwnership(workflowRun, chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, void 0));
+      const streamResult = await agent$1.recover(runId, {
         abortSignal
       });
       return streamResult.fullStream;
@@ -2016,9 +2119,9 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/resume-stream-until-idle",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.resumeStreamUntilIdleBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.resumeStreamUntilIdleBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Resume agent stream until idle",
   description: "Resumes a suspended agent stream until idle with custom resume data, also listens for background task completions and streams them in real-time",
   tags: ["Agents"],
@@ -2029,7 +2132,7 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const {
         resumeData,
         runId,
@@ -2048,31 +2151,28 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         agentId,
         versionOptions
       });
-      if (bodyRequestContext && typeof bodyRequestContext === "object") {
-        for (const [key, value] of Object.entries(bodyRequestContext)) {
-          if (serverRequestContext.get(key) === void 0) {
-            serverRequestContext.set(key, value);
-          }
-        }
-      }
+      mergeBodyRequestContext(serverRequestContext, bodyRequestContext);
       stashVersionOverrides(serverRequestContext, versions);
       ensureDefaultVersionStatus(serverRequestContext, versionOptions);
       let authorizedMemoryOption = memoryOption;
       const clientThreadId = typeof memoryOption?.thread === "string" ? memoryOption.thread : memoryOption?.thread?.id;
-      const effectiveResourceId = chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
-      const effectiveThreadId = chunk42M6Y2OD_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
+      const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, memoryOption?.resource);
+      if (memoryOption) {
+        chunkQQJHGSB2_cjs.requireEffectiveResourceId(effectiveResourceId);
+      }
+      const effectiveThreadId = chunkQQJHGSB2_cjs.getEffectiveThreadId(serverRequestContext, clientThreadId);
       if (effectiveThreadId) {
         const memoryInstance = await agent.getMemory({ requestContext: serverRequestContext });
         if (memoryInstance) {
           const thread = await memoryInstance.getThreadById({ threadId: effectiveThreadId });
           if (thread) {
-            await chunk42M6Y2OD_cjs.enforceThreadAccess({
+            await chunkQQJHGSB2_cjs.enforceThreadAccess({
               mastra,
               requestContext: serverRequestContext,
               threadId: effectiveThreadId,
               thread,
               effectiveResourceId,
-              permission: chunk42M6Y2OD_cjs.MastraFGAPermissions.MEMORY_WRITE
+              permission: chunkQQJHGSB2_cjs.MastraFGAPermissions.MEMORY_WRITE
             });
           }
         }
@@ -2086,12 +2186,14 @@ var RESUME_STREAM_UNTIL_IDLE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       }
       const workflowsStore = await mastra.getStorage()?.getStore("workflows");
       const workflowRun = await workflowsStore?.getWorkflowRunById({ workflowName: "agentic-loop", runId });
-      await chunk42M6Y2OD_cjs.validateRunOwnership(workflowRun, chunk42M6Y2OD_cjs.getEffectiveResourceId(serverRequestContext, void 0));
+      await chunkQQJHGSB2_cjs.validateRunOwnership(workflowRun, chunkQQJHGSB2_cjs.getEffectiveResourceId(serverRequestContext, void 0));
       const { structuredOutput, ...restOptions } = rest;
       const options = {
         runId,
         toolCallId,
         ...restOptions,
+        // Schema validates context permissively; runtime values are ModelMessages.
+        context: restOptions.context,
         requestContext: serverRequestContext,
         memory: authorizedMemoryOption,
         abortSignal
@@ -2107,9 +2209,9 @@ var APPROVE_TOOL_CALL_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/approve-tool-call-generate",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.approveToolCallBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.generateResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.approveToolCallBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.generateResponseSchema,
   summary: "Approve tool call (non-streaming)",
   description: "Approves a pending tool call and returns the complete response",
   tags: ["Agents", "Tools"],
@@ -2127,7 +2229,14 @@ var APPROVE_TOOL_CALL_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const result = await agent.approveToolCallGenerate({
         ...params,
         requestContext,
@@ -2143,9 +2252,9 @@ var DECLINE_TOOL_CALL_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/decline-tool-call-generate",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.declineToolCallBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.generateResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.declineToolCallBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.generateResponseSchema,
   summary: "Decline tool call (non-streaming)",
   description: "Declines a pending tool call and returns the complete response",
   tags: ["Agents", "Tools"],
@@ -2163,7 +2272,14 @@ var DECLINE_TOOL_CALL_GENERATE_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.toolCallId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Tool call id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
+      await validateDurableToolCallAccess({
+        mastra,
+        agent,
+        runId: params.runId,
+        toolCallId: params.toolCallId,
+        requestContext
+      });
       const result = await agent.declineToolCallGenerate({
         ...params,
         requestContext,
@@ -2180,9 +2296,9 @@ var STREAM_NETWORK_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/network",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream agent network",
   description: "Executes an agent network with multiple agents and streams the response",
   tags: ["Agents"],
@@ -2194,10 +2310,17 @@ var STREAM_NETWORK_ROUTE = chunkSX2AJUSP_cjs.createRoute({
         agentId,
         versionOptions: extractVersionOptions(requestContext)
       });
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
-      chunk42M6Y2OD_cjs.validateBody({ messages });
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
+      chunkQQJHGSB2_cjs.validateBody({ messages });
+      let authorizedMemoryOption = params.memory;
+      if (params.memory) {
+        const effectiveResourceId = chunkQQJHGSB2_cjs.getEffectiveResourceId(requestContext, params.memory.resource);
+        chunkQQJHGSB2_cjs.requireEffectiveResourceId(effectiveResourceId);
+        authorizedMemoryOption = { ...params.memory, resource: effectiveResourceId };
+      }
       const streamResult = await agent.network(messages, {
-        ...params
+        ...params,
+        memory: authorizedMemoryOption
       });
       return streamResult;
     } catch (error) {
@@ -2210,9 +2333,9 @@ var APPROVE_NETWORK_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/approve-network-tool-call",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.approveNetworkToolCallBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.approveNetworkToolCallBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Approve network tool call",
   description: "Approves a pending network tool call and continues network agent execution",
   tags: ["Agents", "Tools"],
@@ -2227,7 +2350,7 @@ var APPROVE_NETWORK_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const streamResult = await agent.approveNetworkToolCall({
         ...params
       });
@@ -2242,9 +2365,9 @@ var DECLINE_NETWORK_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   path: "/agents/:agentId/decline-network-tool-call",
   responseType: "stream",
   streamFormat: "sse",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.declineNetworkToolCallBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.declineNetworkToolCallBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Decline network tool call",
   description: "Declines a pending network tool call and continues network agent execution without executing the tool",
   tags: ["Agents", "Tools"],
@@ -2259,7 +2382,7 @@ var DECLINE_NETWORK_TOOL_CALL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
       if (!params.runId) {
         throw new chunk64ITUOXI_cjs.HTTPException(400, { message: "Run id is required" });
       }
-      chunk42M6Y2OD_cjs.sanitizeBody(params, ["tools"]);
+      chunkQQJHGSB2_cjs.sanitizeBody(params, ["tools", "actor"]);
       const streamResult = await agent.declineNetworkToolCall({
         ...params
       });
@@ -2273,9 +2396,9 @@ var UPDATE_AGENT_MODEL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/model",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.updateAgentModelBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.modelManagementResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.updateAgentModelBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.modelManagementResponseSchema,
   summary: "Update agent model",
   description: "Updates the AI model used by the agent",
   tags: ["Agents", "Models"],
@@ -2295,8 +2418,8 @@ var RESET_AGENT_MODEL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/model/reset",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  responseSchema: chunkILPFFVYC_cjs.modelManagementResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  responseSchema: chunkYBLFY24F_cjs.modelManagementResponseSchema,
   summary: "Reset agent model",
   description: "Resets the agent model to its original configuration",
   tags: ["Agents", "Models"],
@@ -2315,9 +2438,9 @@ var REORDER_AGENT_MODEL_LIST_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/models/reorder",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.reorderAgentModelListBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.modelManagementResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.reorderAgentModelListBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.modelManagementResponseSchema,
   summary: "Reorder agent model list",
   description: "Reorders the model list for agents with multiple model configurations",
   tags: ["Agents", "Models"],
@@ -2340,9 +2463,9 @@ var UPDATE_AGENT_MODEL_IN_MODEL_LIST_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/models/:modelConfigId",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.modelConfigIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.updateAgentModelInModelListBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.modelManagementResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.modelConfigIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.updateAgentModelInModelListBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.modelManagementResponseSchema,
   summary: "Update model in model list",
   description: "Updates a specific model configuration in the agent model list",
   tags: ["Agents", "Models"],
@@ -2443,9 +2566,9 @@ var ENHANCE_INSTRUCTIONS_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/instructions/enhance",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.enhanceInstructionsBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.enhanceInstructionsResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.enhanceInstructionsBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.enhanceInstructionsResponseSchema,
   summary: "Enhance agent instructions",
   description: "Uses AI to enhance or modify agent instructions based on user feedback",
   tags: ["Agents"],
@@ -2471,7 +2594,7 @@ Current: ${instructions}
 ${comment ? `User feedback: ${comment}` : ""}`,
         {
           structuredOutput: {
-            schema: chunkILPFFVYC_cjs.enhanceInstructionsResponseSchema
+            schema: chunkYBLFY24F_cjs.enhanceInstructionsResponseSchema
           }
         }
       );
@@ -2485,9 +2608,9 @@ var STREAM_VNEXT_DEPRECATED_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/streamVNext",
   responseType: "stream",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream a response from an agent",
   description: "[DEPRECATED] This endpoint is deprecated. Please use /stream instead.",
   tags: ["Agents"],
@@ -2501,9 +2624,9 @@ var STREAM_UI_MESSAGE_VNEXT_DEPRECATED_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream/vnext/ui",
   responseType: "stream",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream UI messages from an agent",
   description: "[DEPRECATED] This endpoint is deprecated. Please use the @mastra/ai-sdk package for uiMessage transformations",
   tags: ["Agents"],
@@ -2526,9 +2649,9 @@ var STREAM_UI_MESSAGE_DEPRECATED_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "POST",
   path: "/agents/:agentId/stream/ui",
   responseType: "stream",
-  pathParamSchema: chunkILPFFVYC_cjs.agentIdPathParams,
-  bodySchema: chunkILPFFVYC_cjs.agentExecutionBodySchema,
-  responseSchema: chunkILPFFVYC_cjs.streamResponseSchema,
+  pathParamSchema: chunkYBLFY24F_cjs.agentIdPathParams,
+  bodySchema: chunkYBLFY24F_cjs.agentExecutionBodySchema,
+  responseSchema: chunkYBLFY24F_cjs.streamResponseSchema,
   summary: "Stream UI messages from an agent",
   description: "[DEPRECATED] This endpoint is deprecated. Please use the @mastra/ai-sdk package for uiMessage transformations",
   tags: ["Agents"],
@@ -2540,7 +2663,7 @@ var GET_AGENT_SKILL_ROUTE = chunkSX2AJUSP_cjs.createRoute({
   method: "GET",
   path: "/agents/:agentId/skills/:skillName",
   responseType: "json",
-  pathParamSchema: chunkILPFFVYC_cjs.agentSkillPathParams,
+  pathParamSchema: chunkYBLFY24F_cjs.agentSkillPathParams,
   queryParamSchema: chunkHXICAUTW_cjs.skillDisambiguationQuerySchema,
   responseSchema: chunkHXICAUTW_cjs.getAgentSkillResponseSchema,
   summary: "Get agent skill",
@@ -2624,5 +2747,5 @@ exports.getSerializedProcessors = getSerializedProcessors;
 exports.getSerializedSkillsFromAgent = getSerializedSkillsFromAgent;
 exports.getWorkspaceToolsFromAgent = getWorkspaceToolsFromAgent;
 exports.isProviderConnected = isProviderConnected;
-//# sourceMappingURL=chunk-ZG6ZAG5V.cjs.map
-//# sourceMappingURL=chunk-ZG6ZAG5V.cjs.map
+//# sourceMappingURL=chunk-WQVA7QMU.cjs.map
+//# sourceMappingURL=chunk-WQVA7QMU.cjs.map